-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alan DeKok wrote:
A.L.M.Buxey@lboro.ac.uk wrote:
verily, we created userIDs for the printers in the Active Directory (same as normal users - and they happily use 802.1X for wifi and wired).
however, we have hit a problem - when configuring some HP printers to use PEAP, it 'just doesnt work(tm)' :-(
The printers are *claiming* that they're doing PEAPv0. However, the protocol they're running is actually PEAPv2.
the devices in question are M5035 and M6040 MFP devices, I've attached the output of the radiusd -X after the 'ready' line - as said, this all works for other devices.... anyway, the 'interesting' line as far as i'm concerned after seeing these debugs for many years is
[peap] Session established. Decoding tunneled attributes. [peap] Got something weird.
Yes. Arran ran into this, too. He sent me some more detailed packet traces.
The contents of the tunnel are wrong for PEAPv0. I believe he fired off a "polite" email to HP about this. :) It took me 30 minutes to explain the basic premise.
0: Them: Does the printer get an IP? 1: Me: Yes 2: Them: But it doesn't work on the network ? 3: Me: No, because the developers mis-implemented PEAPv0 and failed authentication 4: Them: But it gets an IP? 5: Me: Yes 6: Them: But it doesn't work on the network ? goto 3; I think it's at 'second level' tech support now.... I'm waiting for a response back. They even tried to transfer me to HP ProCurve at one point: ProCurve: But it's a printer? Me: They said it was a networking problem... ProCurve: But it's a printer? It looks like they actually implemented 802.1X-2004 version as opposed to the ProCurve switches, which appear to implement the earlier standard. That is the supplicant has both 'Controlled' and 'Uncontrolled' ports. Only the Uncontrolled port seems to allow DHCP traffic to pass as well as EAPOL packets... So once you enable authentication and the printer fails to authenticate, it won't let you Telnet into the jetdirect card or use the web interface until you do a cold restart (and clear all the 802.1X settings)... Brilliant ! You're welcome to open a case as well... Arran
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmS+y4ACgkQcaklux5oVKJceQCfbdG3FCDpZ4JuZ7RNx16uu6dT J5YAn2jd0dlpOGHMCrl0zUlmElIGFDVP =tff3 -----END PGP SIGNATURE-----