According to the log, username is not being validated at the server. Server is rejecting the username. You can try checking strip domain name from windows username located under the Auth Servers under authentication. Authentication -----> Auth Servers ----> <your Auth Server (AD in this case or LDAP)> Remove Domain from Windows user names? Check the box below. I also suggest you to check if CHAP alone works with out 802.1x Authentication. If your client is unable to authenticate using CHAP alone on the Server, you might me missing store passwords using reverse encryption in AD password policies. Siince, in the last post one poster reported that EAP-TTLS/EAP-JUAC works fine, I suspect this reverse passwod encryption setting to be off. It must be enabled to perform any authentication related to MSCHAP. Please post if this doesnt work. Let us know if it works as well Hope it helps. Regards, Parth ... View more

Hi, 1. As stated in earlier posts, OAC odyssey client has a 802.1x supplicant and so windows 802.1x is not required to be enabled for 802.1x authentication. 2. Regarding your second question, YOU DO NOT REQUIRE any machine authentication enabled to accomplish the task. OAC has a GINA module that uses the windows logon credentials to authenticate on the network with 802.1x. For more information on GINA please take a look at http://forums.juniper.net/t5/Identity-and-Policy-Control/How-GINA-works/m-p/79508/highlight/false#M996 With this module, the user does not require to enter logon credentials twice - once for network and once for domain. Hope this makes sense. Regards, Parth ... View more

Hello, OAC GINA is used in enabling network authentication to occur before the user is authenticated against the AD. This helps similar to the single sign on where the user is not required to enter login credentials twice. Generally when 802.1x is implemented for L2 authentication, the user is not allowed to send any traffic through the switch port before L2 authentication is performed. GINA captures the user credentials from windows logon dialog, delays the log on process on windows and uses the credentials to authenticate on the network. Once the Authentication is done, windows log on process occurs as usual. In this scenario, authentication is happening in two stages, 1- authenticating on the network 2 - authenticating to the domian. OAC GINA is a replacement of Windows GINA module, that helps Odyssey Client to perform network authentication using windows logon credentials. This requires the user to enter credentials only once while actually the authentication is happening 2 times. Hope this helps. Regards, Partha ... View more