Access Manager Configuration EAP-TLS

[thoffmann_ECKD]

Hi folks,

we want to use the Access Manager for a customer deployment for local 802.1X Authentication.

We have hybrid Win 11 notebooks with Microsoft Cloud PKI over intune. We deliver computer certificates to the clients. Now we want to authenticate with this certificate against the access Manager. 

We build a policy that says if in the cert ist XXX than allow access. We do not want to lookup to Entra ID, we only want to get access for client with certificate present in the first step.

If we deploy the config to the switch, we see in the log that the field with the computername is extracted from the local cert. But than the Access Manager throws an error:

Session Id

bf302f75-ee18-4c48-9731-6aa6ea894261

Time

Mar 21 06:57:38

Status

Failed

Failure/ Rejection info

Reason

There was an internal server error occured in authentication flow.

Suggested action

Please verify configurations and retry. We are taking a look. Please report if this issue is not fixed.

User

Username

host/XXX-19291600753

Has anyone the same issue?

Notice:

If we use MAB Auth the Access Manager works as well.

[thomasthomsen]

Not on topic, but I think a new Techincal forum should be created just for Access Manager.

[Mloraditch]

At the moment very few orgs have access to AM as it’s an early preview and not even rolled out fully to the Early Access page.

You may need to contact support to get an answer. If you do please share the resolution.

[thoffmann_ECKD]

Hi Guys,

after i started the conversation here, the log from the access manager changed. Now it seems that the authetication works for me. ihave also opened a ticket but there was no answer yet. Since i got a answer, i will post ist here.

Thanks

[PhilipDAth]

I don't have access to Access Manager yet ...

Try configuring the Windows 802.1x policy to only do user authentication (then it won't present computer certificates), and delivering user certificates to the users.