Procurve Macbased Authentication

[Scratch]

Hi there,

 

hopefulle somebody here can give me some hints

I have several 2600 and 5300 switches configured with 802.1x, which works fine.

Problem: MAC-based authentication. My switches just won't talk with my RADIUS (MS IAS) server...

 

This thread gave me some pointers but nothing worked so far:

http://www.edugeek.net/forums/networks/10463-mac-based-vlan-allocation-procurve-switches-11x.html

 

My setup:

 

2600 and 5300 Switches

Radius configured and working (802.1x with same RADIUS works)

IAS-Policy with correct group and NAS-type

EAP-Method MD5-Challenge, CHAP is enabled

aaa authentication port-access eap-radius is enabled

message authenticator is disabled

Tried different delimiter settings

Accounts for Clients have reversible encryption enabled and user/pw is mac-address

 

I expected to see activated ports with *show port-access mac-based clients* but the list is empty altough several ports are active.

 

Log only shows "Port blocked by AAA"...

Edited January 5, 2009 by Scratch
Additional Info

[Scratch]

nobody got a clue?

[localzuk]

This is the config on my HP 5406zl switch:

 

max-vlans 64 
module 1 type J8706A 
module 2 type J8705A 
module 3 type J8702A 
module 4 type J8702A 
ip default-gateway 10.5.143.254 
ip routing 
ip udp-bcast-forward 
vlan 1 
  name "Servers" 
  untagged A12-A24,B1-B11,B13-B19,B21-B24,C1-C21,C24,D2-D3,D5-D14,D16-D24 
  ip forward-protocol udp 10.5.140.127 5151 
  ip forward-protocol udp 10.5.140.255 5151 
  ip forward-protocol udp 10.5.141.63 5151 
  ip forward-protocol udp 10.5.141.127 5151 
  ip forward-protocol udp 10.5.141.191 5151 
  ip forward-protocol udp 10.5.141.255 5151 
  ip forward-protocol udp 10.5.142.127 5151 
  ip address 10.5.143.1 255.255.255.0 
  tagged A1-A11,C22 
  no untagged B12,B20,C23,D1,D4,D15 
  exit
aaa accounting update periodic 15 
aaa accounting network start-stop radius 
aaa accounting exec start-stop radius 
aaa accounting system start-stop radius 
radius-server dead-time 5 
radius-server key juniper12a 
radius-server host 10.5.143.14 
primary-vlan 666 
aaa port-access mac-based C1,C5,C9,C11-C20,D2,D5-D10,D12-D14,D16,D18-D24
aaa port-access mac-based C1 unauth-vid 666
aaa port-access mac-based C5 unauth-vid 666

 

Well, the pertinent bit anyway. The vlan part is repeated for the different VLANs and the aaa parts are repeated for different groups of ports.

[DMcCoy]

Have you altered the Framed-MTU option in the IAS policy? Newer Procurve firmware versions don't work with the default value anymore. I have set Framed-MTU in all of my policies to 1400

[Scratch]

Thank you for your replies.

 

@DmcCoy: Tested it, had no effekt.

 

RAS-Policy Settings are:

Framed-Protocol: PPP

Service-Type: Framed

[localzuk]

Just a quick question, did you have reversible encryption enabled before or after creating the password for clients?

[Scratch]

activated reversible encryption and then set the password.

[Scratch]

/bump