- Community Home
- >
- Networking
- >
- Legacy
- >
- Switches, Hubs, Modems
- >
- 802.1x Problem on Remote Site
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Forums
Discussions
Discussions
Discussions
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-01-2008 07:48 AM
11-01-2008 07:48 AM
802.1x Problem on Remote Site
I have a strange Problem at a Remote Site.
It's a Branch Office with only one 2610-48-PWR Switch.
The Win XP Clients (with SP3) and the Users are successfully authenticated at the Windows IAS Server and the IDM but the Network Port seems not be change into the right VLAN so that the Clients won't get an IP-Address via DHCP.
If I put static IP-Address to the Client and try to ping Ressources from the right VLAN the will be timed out. So the Client wille be in the wrong VLAN.
This behavior occured also on the AP530 Access Point at this site.
I tested the RADIUS Authentication and get all right informations for the User. So it might be something between the RADIUS Server and the Remote Site I think.
I hope you can help me. Thanx.
Alen
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-01-2008 08:39 AM
11-01-2008 08:39 AM
Re: 802.1x Problem on Remote Site
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-01-2008 08:40 AM
11-01-2008 08:40 AM
Re: 802.1x Problem on Remote Site
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-01-2008 09:04 AM
11-01-2008 09:04 AM
Re: 802.1x Problem on Remote Site
check
ip helper address command on switch
check
config)# sh vlans ports xxx
with command port vlan status
check
remote active directory rule (in radius service)for user or user group rule
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-02-2008 03:07 AM
11-02-2008 03:07 AM
Re: 802.1x Problem on Remote Site
I attached you the # sh run Output.
The IAS Server Log said, that the User was granted, so the authentication will be successfully.
The IP-Helper on the switch is not active because it's not a routing switch. I installed a DHCP Relay on the Firewall wich works fine for the Guests-VLAN.
# sh vlans ports xxx cannot check at the moment because I am back in the Headquarter.
I can check the same issue next week at a another Branch Office.
Alen
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-02-2008 10:18 PM
11-02-2008 10:18 PM
Re: 802.1x Problem on Remote Site
I think one radius server headquarter residing and one radius server residing branch office
where is residing dhcp server/servers
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-02-2008 10:33 PM
11-02-2008 10:33 PM
Re: 802.1x Problem on Remote Site
and all switch sh run print
I check all config for you
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-03-2008 12:21 AM
11-03-2008 12:21 AM
Re: 802.1x Problem on Remote Site
Here the Topology Layout
AP530 --> 2610-48-PWR --> Firewall Branch
Firewall Branch --> VPN --> Firewall HQ
Firwaöö HQ --> IAS1 / IAS2
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-03-2008 12:28 AM
11-03-2008 12:28 AM
Re: 802.1x Problem on Remote Site
if the microsoft policiy has been changed from the default settings, sometimes the wrong policy is used
see http://technet.microsoft.com/en-us/library/cc786978.aspx search for "third party"
reset the microsoft RRAS policy to the defaults (or maybe change policy order or even delete).
hope this helps
Pieter
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-03-2008 12:30 AM
11-03-2008 12:30 AM
Re: 802.1x Problem on Remote Site
no the RADIUS Server will work fine.
I tested it yesterday in the Headquarter.
The authentication is correct and the VLAN's on the switches in the HQ were also set correctly but not at the Branch Office Side :(
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-03-2008 02:19 AM
11-03-2008 02:19 AM
Re: 802.1x Problem on Remote Site
is a different vlan used at the HQ?
if so is this vlan assigned by the radius server?
see "VLAN Membership Priorities" P11-30 in
http://cdn.procurve.com/training/Manuals/2610-Security-Dec2007-59918642.pdf
suggestion : try test with local user.
password port-access user-name Jim secret3
aaa authentication port-access local
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-03-2008 05:09 AM
11-03-2008 05:09 AM
Re: 802.1x Problem on Remote Site
vlan 1 managemet
vlan 1008 voip vlan
vlan 1009 office vlan
vlan 1007 guest vlan
ı want dynamical assign vlan member each vlan with 802.1x
(only vlan 1008 for voip device static)
ip routing
vlan 1
name "DEFAULT_VLAN"
untagged 1-34,41,50
ip address 172.16.1.4 255.255.255.0
no untagged 35-40
ip igmp high-priority-forward
exit
vlan 1008
name "VoIP"
untagged 35-40
ip address 172.16.2.4 255.255.255.0
qos priority 6
voice
ip igmp high-priority-forward
exit
vlan 1009
name "Office"
ip address 172.16.3.4 255.255.255.0
ip helper address (dhcp server address)
exit
vlan 1007
name "Guests"
ip address 172.16.5.4 255.255.255.192
ip helper address (dhcp server address)
exit
ip routing 0.0.0.0 0.0.0.0 172.16.1.5 *********this address firewall lan ip
aaa authentication port-access eap-radius
aaa accounting network start-stop radius
radius-server host
radius-server host
aaa port-access authenticator 30
aaa port-access authenticator 30 reauth-period 300
aaa port-access authenticator 30 unauth-vid 1007
aaa port-access authenticator 30 client-limit 1
aaa port-access authenticator active
aaa port-access 30
interface 30 resiade vlan 1 untagged member
when to take radius authentication packet this port dynamically change vlan status
you have to create redius active directory rules in radius servis for all domain users
for vlan 1009 office users
important 3 attribute
tunnel medium type ---radius standart---802 includes all....
tunnel pvd group id---radius standart--1009 (this number very important because definition vlan)
tunnel type-----------radius standart--virtual lans (vlan)
each domain user connect any port(except int 35-40)assign to dynamically vlan 1009
other user (nondomain)want connect any port (except int 35-40)assign to dynamically vlan 1007
create for vlan 1009 and 1007 dhcp scobe on dhcp server
scobe 1
name forvlan1009
ip range 172.16.3.10.....50
subnet mask 255.255.255.0
default route 172.16.3.4
scobe 2
name forvlan1007
ip range 172.16.5.10.....50
subnet mask 255.255.255.0
default route 172.16.5.4
please watch this video
http://www.dosya.tc/802.1x_dynamicvlan.rar.html
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-04-2008 12:21 PM
11-04-2008 12:21 PM
Re: 802.1x Problem on Remote Site
On which VLAN will be the client did the 802.1x request ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-05-2008 11:59 AM
11-05-2008 11:59 AM
Re: 802.1x Problem on Remote Site
I found the solution for the problem.
The main problem was the Framed MTU Size. The Microsoft KB Article 883389 (http://support.microsoft.com/kb/883389/en-us) described how to reduced the EAP packet size.
I say thank to all which tries to help.
Alen