I tried 802.1x via wired and it fell on its face. I have tried this on both Cisco and Extreme gear. What I found from hours of looking at packet captures is that the MS supplicant just doesn't work consistently.
It seemed that the switches and RADIUS servers were working properly and moving packets along as designed but the supplicant would just flake out. It wouldn't not respond part way through an 802.1x authentication or it would not prompt the end user for credentials when needed etc. I have seen this behavior all the way from Win XP through Win8. I tried updates and combing the forums and found that many other folks are having issues with wired 802.1x but was never able to resolve it partially due to the intermittent nature. I tried NIC driver updates, OS patches anything I could find. The weird thing is that wireless works well. I would think it would be one supplicant for both and the connection method would not matter. John From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Danny Eaton Sent: Wednesday, June 24, 2015 4:26 PM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU Subject: [BULK] Re: [WIRELESS-LAN] Network Authentication question Importance: Low Is anyone doing any of these for wired, using 802.1X? From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of John Kaftan Sent: Wednesday, June 24, 2015 3:22 PM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: Re: [WIRELESS-LAN] Network Authentication question I went with the Extreme Netsight product at my last shop and found it to be excellent. I could assign policy to an end user pretty much on any criteria I could think of. I was hard pressed to find something I could not do. The nice thing about Extreme is that it is a fully integrated system across wired and wireless and you can apply the exact same policy to a user no matter how or where they connect. Naturally it works best if you have Extreme for both wired and wireless but it is not necessary. John From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Barber, Matt Sent: Wednesday, June 24, 2015 1:46 PM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: [BULK] Re: [WIRELESS-LAN] Network Authentication question Importance: Low Hi Matthew, We are currently deploying a new Aruba network with ClearPass after evaluating both them and Extreme pretty heavily. ClearPass was one of the major deciding factors in us ending up with Aruba. As Frank and Russ mentioned, it is very full-featured. We are using the RADIUS functionality for our main WPA2-Enterprise network and using their guest and registration features for everything else. We are very impressed so far. I would be happy to talk specifics if you are interested. Take care, Matt Barber '06 Network and Systems Manager Morrisville State College 315-684-6053 From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Williams, Matthew Sent: Wednesday, June 24, 2015 10:44 AM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: [WIRELESS-LAN] Network Authentication question We're looking into a few RADIUS solutions and I was wondering if any of you had any experience with the following products and what your thoughts are on them: Cisco ISE Aruba ClearPass Extreme NetSight Cloudpath XPressConnect ES Any input would be appreciated. Thanks. Respectfully, Matthew Williams IT Manager, Wireless Kent State University Office: (330) 672-7246 Mobile: (330) 469-0445 ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. !DSPAM:911,558b11734371431181996! ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
