ExtremeWireless 10.11.03.0004- 802.1x EAP-TLS auth failed

  • 2
  • 1
  • Problem
  • Updated 2 years ago
  • Solved
  • (Edited)
Greetings,
I have a customer running a PoC and now we have problems with the 802.1x EAP-TLS authentication since yesterday.

No workstation is able to authenticate on a 802.1x VNS, while the legacy Cisco solution still working fine. All workstations use EAP-TLS for authentication (certificate installed).

Maybe it's related to the new Microsoft Update (https://support.microsoft.com/en-us/kb/3199173) they deployed yesterday?

The customer is running EW 10.11.03.0004.

The NPS logs show information like this:
Logging Results:
Accounting information was written to the local log file.
Reason Code:  22
Reason:  The client could not be authenticated  because the Extensible Authentication Protocol (EAP) Type cannot be processed by the server.
Running some sniffing, we got something interesting:
  1. The user tries to connect to the network and the EW send an Access-Request to the NPS
  2. The NPS answer with a Access-Challenge. Inside the packet, there's an EAP-Message(79) indicating the type as "TLS EAP (EAP-TLS) (13)"
  3. The EW send another Access-Request with an EAP-Message (79) containing: "Type Legacy Nak (Response Only) (3)" and "Desired Auth Type: Protected EAP (EAP-PEAP) (25)".
  4. The NPS send an Access-Reject message with "Code: Failure (4)"
It seems that the EW wants to use EAP-PEAP instead of the EAP-TLS (expected by the NPS Server and was working until yesterday).

This makes sense? The customer is trying our solution to replace the existing Cisco infrastructure, but now we are in trouble.

We asked GTAC, but there's nothing reported until now.

Any ideas? Maybe something needs to be fixed on a new FW release?

Best regards,

-Leo
Photo of Leonardo Peixoto

Leonardo Peixoto

  • 2,620 Points 2k badge 2x thumb
  • anxious

Posted 2 years ago

  • 2
  • 1
Photo of Pala, Zdenek

Pala, Zdenek, Employee

  • 9,038 Points 5k badge 2x thumb
Hi Leo.

The controller/AP is only encapsulating/decapsulating the traffic from EAPoL to EAP in the radius protocol. If there is wrong eap type it is on the client or on the radius server.

I would focus to client/radius server troubleshooting.

You may check the wireshark capture what eap is being sent by the client...

Good luck!

Z.
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
Have you verified that the server and client certs are all valid.  Also, make sure the data / time is correct on the RADIUS server.  I have seen time drift cause this error before.  I suggest using a NTP server for everything (just making some suggestions).  

Also, check to make sure EAP-MSCHAPv2 is selected for your authentication methods ... 
Photo of Leonardo Peixoto

Leonardo Peixoto

  • 2,620 Points 2k badge 2x thumb
Greetings Pala and Jeremy,

Following up with the issue, the customer called me telling the Cisco solution suddenly stopped working too...

Some suspects have arisen about the MS KB3199173 and the customer decided to uninstall it and voialà... Everything come back to life!

Both Cisco and Extreme wireless solutions are operational without touching anything in the configs, just uninstalling the KB from the PC clients.

MS messed up with something in this update. The customer started a WSUS operation to mass-uninstall this KB from all PCs in the infrastructure.

Maybe someone from the Wireless Engineering/PM should take a look at it to avoid issues with other customers and maybe inform the GTAC team about our findings.

Thank you for your help!

Best regards,

-Leo
Photo of Leonardo Peixoto

Leonardo Peixoto

  • 2,620 Points 2k badge 2x thumb
Greetings,

We are running a further investigation...

Maybe the KB wasn't the only problem.

I'll keep you informed about our progress to try to really pinpoint the root cause.

Best regards,

-Leo
Photo of Joseph Burnsworth

Joseph Burnsworth

  • 2,328 Points 2k badge 2x thumb
Have we tried going to 10.11.04?
Photo of Jeremy

Jeremy, Embassador

  • 9,788 Points 5k badge 2x thumb
Keep us posted.
Photo of Leonardo Peixoto

Leonardo Peixoto

  • 2,620 Points 2k badge 2x thumb
Greetings guys,

After a further investigation with the customer we found the issue.

After the MS KB something changed in the Windows EAP process. Taking a closer look at the NPS the customer added the PEAP method to the rule and now it works.

Before the installation of the KB they only used the "Smartcard or certificate" method on the NPS rule.

Maybe in other scenarios the customers already had Cert + PEAP configured on the NPS and will not be affected, but in this case the config adjustments in NPS solved the problem.

It's cool to keep the community aware of this "new" issue and take a look at the NPS configs.

Thanks for your help!

Best regards,

-Leo
Photo of Drew C.

Drew C., Community Manager

  • 38,276 Points 20k badge 2x thumb
Hi Leo, it was great meeting you at the partner summit a few weeks ago.  Thanks for coming back to the community and helping everyone to be aware of this issue!
Photo of Leonardo Peixoto

Leonardo Peixoto

  • 2,620 Points 2k badge 2x thumb
It was very nice to meet you too! Thanks for your support! =)