EAP-TLS Authentication failure over WiFi

[HThiam]

Hi All

I have been trying to deploy a wireless solution but been stuck with appears to be an authentication failure with the Radius Server ( ISE) . The set up consist of an Intune laptop attempting to connect  to a Meraki managed SSID .  I m using Meraki APs connected over a trunk to a Meraki switch that eventually traverses the Wan to the target radius server . All the required routing is in place to ensure the 802.1x messages can reach ISE , can also confirm  the device and CA root  certificates on the test device have been properly configured and that the correct policy is being hit on ISE.

EAP-TLS is being used as the  authentication method in this scenario 

However with every attempt to connect to the SSID  it s getting stuck on the following

No firewall is processing the traffic and as mentioned the requests are getting into ISE .

Could this be related to authentication timeouts or MTU mismatch  over the Wan ?

Any help will be greatly appreciated 

Thanks

Please find below the ISE logs for the failed authentication 

Steps

	11001	Received RADIUS Access-Request
	11017	RADIUS created a new session
	11117	Generated a new session ID
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15048	Queried PIP - Network Access.UserName
	15048	Queried PIP - Radius.Called-Station-ID
	11507	Extracted EAP-Response/Identity
	12500	Prepared EAP-Request proposing EAP-TLS with challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12502	Extracted EAP-Response containing EAP-TLS challenge-response and accepting EAP-TLS as negotiated
	12800	Extracted first TLS record; TLS handshake started
	12545	Client requested EAP-TLS session ticket
	12805	Extracted TLS ClientHello message
	12806	Prepared TLS ServerHello message
	12807	Prepared TLS Certificate message
	12808	Prepared TLS ServerKeyExchange message
	12809	Prepared TLS CertificateRequest message
	12810	Prepared TLS ServerDone message
	12505	Prepared EAP-Request with another EAP-TLS challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12504	Extracted EAP-Response containing EAP-TLS challenge-response
	12505	Prepared EAP-Request with another EAP-TLS challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request ( Step latency=2588 ms)
	11018	RADIUS is re-using an existing session
	12504	Extracted EAP-Response containing EAP-TLS challenge-response
	12505	Prepared EAP-Request with another EAP-TLS challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12504	Extracted EAP-Response containing EAP-TLS challenge-response
	12505	Prepared EAP-Request with another EAP-TLS challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12504	Extracted EAP-Response containing EAP-TLS challenge-response
	12505	Prepared EAP-Request with another EAP-TLS challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12504	Extracted EAP-Response containing EAP-TLS challenge-response
	12505	Prepared EAP-Request with another EAP-TLS challenge
	11006	Returned RADIUS Access-Challenge
	12935	Supplicant stopped responding to ISE during EAP-TLS certificate exchange ( Step latency=120000 ms)
	61025	Open secure connection with TLS peer
	5411	Supplicant stopped responding to ISE

[ConnorL]

9/10 times this is a MTU issue, especially if you see the constant challenge & requests. Take a packet capture upstream of the AP and see what packet size you see on the RADIUS requests. 

[HThiam]

Thanks for the reply , I will execute a packet capture on the  switch .

[PhilipDAth]

My bet - an issue on the Windows side.  Anything appearing in the event viewer in Windows?

In the Windows WiFi configuration - has the root CA been ticked under the trusted section?  It is the right hand most option in this screen shot.

[HThiam]

Thanks for the reply . That one is being ticked , all the devices are being configured through Intune . The ones used OnPrem are working fine , it s just the ones that need to traverse the Wan for ISE authentication .

[pjc]

I'm calling MTU on this problem too.

I had a similar issue where a couple of our WAN sites would not receive the accept response, and would appear as a Radius timeout error in the dashboard logs, but the request was being received by the radius server. 

We use SDWan where the WAN traffic is encrypted, add this to using EAP/TLS client certificate authentication, and the packets were too big for the MTU packet size at these sites, hence were being fragmented.

You can try pinging the sites (using the -f and -l and mtu size (1180 in this example) switches e.g 

ping 10.8.6.1 -f -l 1180

and check if the packet size needs to be lower at your affected sites before fragmentation (change the value (1180) up and down until you get a reply that is not fragmented), compared to your working sites

You made be able to change the MTU on your routers/switches etc at the remote site, or change the MTU size in the ISE radius config for these sites (radius connection/auth policies)

You could also try sending the requests via the Meraki cloud radius and then into your on-prem radius (put the affected AP's into a different network and change the radius destination to the Meraki cloud radius), these requests will then go out/back in unencrypted (lower packet size), which may prove if it is MTU related or not.

You can also try setting up a different authentication method, say MSCHAP, and try authenticating with client username/password only (no EAP/TLS certs), if this works then it's also most likely MTU/defragmentation

good luck

[alemabrahao]

You can add "IP MTU 1500" on the radius source SVI. This will cause the radius packets to be fragmented at the IP layer. This will resolve the issue.

[HThiam]

Thanks to both . Looks likely to be MTU related .I will try and let you know how it went 

[HThiam]

Hi All . 

Sorry for the delayed answer . I have lowered  the MTU onto the switch the APs are connected to but that hasn't made  a difference .However, I just noticed that   that the APs Radius requests are experiencing some packet drops as they hit our Onprem firewall ( yes there s a firewall indeed ),   any idea why ?  

The packet capture in attachment has been obtained from the firewall.

Thanks in advance for all you input 

Thanks

[peto]

same problem here. my setup is MX67W (17.10.2) -> MR33. Both of them are configured with 802.1x SSID. Clients use EAP-TLS. Everything works on MR33 but doesn't work on MX67W (it worked before). EAP-PEAP works on both of them. 

[alemabrahao]

I suggest you downgrade the MX to version 16.16.8.

[peto]

yes, I was thinking about it as well, but since it is not available anymore, I will have to ask the support to do that.

[Tony-JIa]

Hello,

You can try to enable "RADIUS Proxy" on the SSID, i think that might be helpful to solve the issue you are facing.

[HThiam]

Hi All

Just to let you know  the matter is now solved . Our on Prem Firewall had a Zone protection profile  with a setting instructing  the firewall to drop fragmented traffic .

Once  that setting was updated it worked .

Thanks all for your contributions