I have a customer running a PoC and now we have problems with the 802.1x EAP-TLS authentication since yesterday.
No workstation is able to authenticate on a 802.1x VNS, while the legacy Cisco solution still working fine. All workstations use EAP-TLS for authentication (certificate installed).
Maybe it's related to the new Microsoft Update (https://support.microsoft.com/en-us/kb/3199173) they deployed yesterday?
The customer is running EW 10.11.03.0004.
The NPS logs show information like this:
Logging Results:Running some sniffing, we got something interesting:
Accounting information was written to the local log file.
Reason Code: 22
Reason: The client could not be authenticated because the Extensible Authentication Protocol (EAP) Type cannot be processed by the server.
- The user tries to connect to the network and the EW send an Access-Request to the NPS
- The NPS answer with a Access-Challenge. Inside the packet, there's an EAP-Message(79) indicating the type as "TLS EAP (EAP-TLS) (13)"
- The EW send another Access-Request with an EAP-Message (79) containing: "Type Legacy Nak (Response Only) (3)" and "Desired Auth Type: Protected EAP (EAP-PEAP) (25)".
- The NPS send an Access-Reject message with "Code: Failure (4)"
This makes sense? The customer is trying our solution to replace the existing Cisco infrastructure, but now we are in trouble.
We asked GTAC, but there's nothing reported until now.
Any ideas? Maybe something needs to be fixed on a new FW release?