About Deimark_

Deimark_ · ‎10-20-2009

Yup, thats it. You beat me to it. I was looking for the details but you are obviously quicker. :D

Deimark_ · ‎10-20-2009

Indeed it was cisco switches but seimens phones, Similar MAC auth (using wildcards) and much wailings and gnashings of teeth to find out that the cisco needed to have the voice vlan attrib passed to it when we enabled dot1x (when it quite happily functioned fine without it when dot1x was disabled) All in all, a very interesting deployment but would have rather I been able to rely on example docs than through the school of harship hehe. M

Deimark_ · ‎10-20-2009

I am really sorry about the delay in this. We did manage to get it resolved using the means you mentioned and it did indeed require a call to JTAC to confirm the machine auth stuff. Like you, the JTAC guy was very knowledgeable too may be the same one hehe. We then hit other issues on this install, namely down to cisco switches, dot1x and return atrributes needed. Does seem that tehre is a lack of example docs for this particular product. The docs are good and do have indeed all the info we need, but its not obvious nor is it easy to find. I suspect that this will get corrected in time as the product gets used a lot more but it was rather disappointing and frustrating when we could not get decent detailed info on this. Still a great product tho. :P DM

Deimark_ · ‎09-23-2009

Hiya We are also in a positoon here where we want to use machine accounts on the OAC client to get some connectivity to the machine using dot1x before a user logs in and are having some issues getting this to work. We would be greatly interested to hear of anyone getting this to work and also what settings managed to acheive your required goal. So far we have not got the errors you see but its still early for us nd I suspect we will be posting morr info including logs shortly. Any light that can be shed on this would be greatly appreciated. TIA

Deimark_ · ‎08-27-2009

Excellent, thanks for that. I could not find any example config to sue on 2950s. I will give this a go and get back to you if Imamange to make a mes of it. :P Thanks again. DM

Deimark_ · ‎08-27-2009

Thanks for posting I forgot to metnion, in my test envirinment, I am using Cisco 2950s, running 12.1 (yes, I am aware that its old, but so are the boxes. :P) Some of the config you have listed for the switch, is not available to me which I suspect is due to the old version of IOS I have, however, the problem I see is that even after setting the Tunnel-Private-Group-ID as a specifi parameter (to make sure I definitely have the right info being sent) I still see no errors or recognistion on the switch. Ah well, i will keep at this and try to get a newer version of IOS in case its the version mismatch. :P Thanks

Deimark_ · ‎08-24-2009

Hi all Yup, I know cisco aint popular round here but I have a limitation on a customer site where Ciscos are the layer 2 devices. Am trying to get the 802.1x working through the IC and I am almost there. I have got the user auth working fine and the IC sends the VLAN tag down the wire but it does not seem to be accepted by the cisco. I have the followng configured: 1. Role map to map my test user to "test" role 2. Test role is assigned the VLAN=10 3. Cisco switch added as RADIUS client (set as cisco) In the logs, I see my test user authenitcate via RADIUS and get assigned the correct VLAN. I have also tried adding another attribute to the info for the RADIUS attributes of Tunnel-Private-Group-ID with teh VLAN name (as it seems the cisco wants the name sent, not the VLAN number) but to no avail. My cisco config for the relevant settings are: aaa new-model aaa authentication dot1x default group radius enable secret 5 $1$6FRK$vPQCfaxF0ZFIiifROUQ8h/ dot1x system-auth-control interface FastEthernet0/22 switchport mode access no ip address dot1x port-control auto spanning-tree portfast ! interface FastEthernet0/23 switchport mode access no ip address dot1x port-control auto spanning-tree portfast ! radius-server host 192.168.9.55 auth-port 1812 acct-port 1813 radius-server retransmit 3 radius-server key ******* Am I missing something from the cisco config to make it work with UAC? Any assistance here would be great. TIA DM

Re: OAC machine authentication without certs

Re: OAC machine authentication without certs

Re: OAC machine authentication without certs

Re: OAC machine authentication without certs

Re: UAC 4500 3.0 with Cisco Switches 802.1x and VL...

Re: UAC 4500 3.0 with Cisco Switches 802.1x and VL...

UAC 4500 3.0 with Cisco Switches 802.1x and VLANs