HP Printers trying to do 802.1x but failing with timeouts
Hello, I have a working 802.1x setup on the wired network of our office and everything is fine for Linux stations, Apple notebooks and the few windows notebooks we have. The Linux stations and the apple notebooks are doing EAP-TLS. And my idea was to have the printers we use do the same. But with the printers I get a lot of timeouts during authentication and to me it looks like the printer is really having a big issue handling all the certificate things etc. Does anyone here have experience in setting this up? Would it be an idea to get a newer printserver into the printers? I'm looking at the JetDirect 635 (J7961G). Jan Hugo Prins
On 8 Mar 2015, at 18:11, jan hugo prins <jhp@jhprins.org> wrote:
Hello,
I have a working 802.1x setup on the wired network of our office and everything is fine for Linux stations, Apple notebooks and the few windows notebooks we have. The Linux stations and the apple notebooks are doing EAP-TLS. And my idea was to have the printers we use do the same. But with the printers I get a lot of timeouts during authentication and to me it looks like the printer is really having a big issue handling all the certificate things etc.
Does anyone here have experience in setting this up? Would it be an idea to get a newer printserver into the printers? I'm looking at the JetDirect 635 (J7961G).
Just to check, you're using the latest firmware? The HP supplicant used to implement PEAP incorrectly, they may have gotten something wrong in EAP-TLS too. Could you paste the debug output, and we'll be able to see if it's something obvious. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi, I updated the firmware of the printers last week. That was one of my first tests. I have some port statistics for EAP authentication on the switch: The port that holds the printers: tc03st01sw1(config-if)#show eapol auth-dia interface 15 Port: 15 EntersConnecting: 1411 EapLogoffsWhileConnecting: 3 EntersAuthenticating: 432 AuthSuccessWhileAuthenticating: 134 AuthTimeoutsWhileAuthenticating: 0 AuthFailWhileAuthenticating: 69 AuthReauthsWhileAuthenticating: 0 AuthEapStartsWhileAuthenticating: 205 AuthEapLogoffWhileAuthenticating: 0 AuthReauthsWhileAuthenticated: 6 AuthEapStartsWhileAuthenticated: 124 AuthEapLogoffWhileAuthenticated: 0 BackendResponses: 1826 BackendAccessChallenges: 1602 BackendOtherRequestsToSupplicant: 1641 BackendNonNakResponsesFromSupplicant: 1324 BackendAuthSuccesses: 134 BackendAuthFails: 69 A different port that holds a Apple workstation. tc03st01sw1(config-if)#show eapol auth-dia interface 21 Port: 21 EntersConnecting: 12638 EapLogoffsWhileConnecting: 0 EntersAuthenticating: 160 AuthSuccessWhileAuthenticating: 150 AuthTimeoutsWhileAuthenticating: 0 AuthFailWhileAuthenticating: 6 AuthReauthsWhileAuthenticating: 0 AuthEapStartsWhileAuthenticating: 4 AuthEapLogoffWhileAuthenticating: 0 AuthReauthsWhileAuthenticated: 1 AuthEapStartsWhileAuthenticated: 146 AuthEapLogoffWhileAuthenticated: 2 BackendResponses: 1689 BackendAccessChallenges: 1529 BackendOtherRequestsToSupplicant: 1529 BackendNonNakResponsesFromSupplicant: 1458 BackendAuthSuccesses: 150 BackendAuthFails: 6 I think it is very odd that the AuthEapStartsWhileAuthenticating is very high compared to the port with the Apple workstation. I have included a debugging log I have created tonight. Some sidenotes: - The linux workstations I have tested so far (Fedora 21 and Fedora 18) on the 802.1x ethernet authenticate using EAP-TLS just fine. - Apple laptop my co-worker uses can authenticate just fine using EAP-TLS as well, as long as he can import the certificate I have given him from a PKCS12 file. - The Radius certificate and the root certificate I have created about 3 years ago when I needed 802.1x authentication for the wireless network. - Windows clients authenticate using these certificates in combination with the Username / Password the user has in LDAP. - Linux clients and Apple clients do the same. The manual to configure it on a windows workstation is just 20 pages longer. - I see a lot of messages telling me something about Certificate Compatibility but that page has a lot of info about windows, and windows has been working for several years just fine. The only thing I have never tested is Windows workstations doing EAP-TLS. But in our environment we decided a long time ago that we don't want this. Some information about the certificates is included as well. For now I have set the authentication on PEAP only and this works just fine. Would like to have the certificates working though. Thanks in advance, Jan Hugo Prins On 03/08/2015 11:39 PM, Arran Cudbard-Bell wrote:
On 8 Mar 2015, at 18:11, jan hugo prins <jhp@jhprins.org> wrote:
Hello,
I have a working 802.1x setup on the wired network of our office and everything is fine for Linux stations, Apple notebooks and the few windows notebooks we have. The Linux stations and the apple notebooks are doing EAP-TLS. And my idea was to have the printers we use do the same. But with the printers I get a lot of timeouts during authentication and to me it looks like the printer is really having a big issue handling all the certificate things etc.
Does anyone here have experience in setting this up? Would it be an idea to get a newer printserver into the printers? I'm looking at the JetDirect 635 (J7961G). Just to check, you're using the latest firmware?
The HP supplicant used to implement PEAP incorrectly, they may have gotten something wrong in EAP-TLS too.
Could you paste the debug output, and we'll be able to see if it's something obvious.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Log file was missing. Does this work? Jan Hugo On 03/09/2015 11:17 PM, jan hugo prins wrote:
Hi,
I updated the firmware of the printers last week. That was one of my first tests.
I have some port statistics for EAP authentication on the switch:
The port that holds the printers: tc03st01sw1(config-if)#show eapol auth-dia interface 15 Port: 15 EntersConnecting: 1411 EapLogoffsWhileConnecting: 3 EntersAuthenticating: 432 AuthSuccessWhileAuthenticating: 134 AuthTimeoutsWhileAuthenticating: 0 AuthFailWhileAuthenticating: 69 AuthReauthsWhileAuthenticating: 0 AuthEapStartsWhileAuthenticating: 205 AuthEapLogoffWhileAuthenticating: 0 AuthReauthsWhileAuthenticated: 6 AuthEapStartsWhileAuthenticated: 124 AuthEapLogoffWhileAuthenticated: 0 BackendResponses: 1826 BackendAccessChallenges: 1602 BackendOtherRequestsToSupplicant: 1641 BackendNonNakResponsesFromSupplicant: 1324 BackendAuthSuccesses: 134 BackendAuthFails: 69
A different port that holds a Apple workstation. tc03st01sw1(config-if)#show eapol auth-dia interface 21 Port: 21 EntersConnecting: 12638 EapLogoffsWhileConnecting: 0 EntersAuthenticating: 160 AuthSuccessWhileAuthenticating: 150 AuthTimeoutsWhileAuthenticating: 0 AuthFailWhileAuthenticating: 6 AuthReauthsWhileAuthenticating: 0 AuthEapStartsWhileAuthenticating: 4 AuthEapLogoffWhileAuthenticating: 0 AuthReauthsWhileAuthenticated: 1 AuthEapStartsWhileAuthenticated: 146 AuthEapLogoffWhileAuthenticated: 2 BackendResponses: 1689 BackendAccessChallenges: 1529 BackendOtherRequestsToSupplicant: 1529 BackendNonNakResponsesFromSupplicant: 1458 BackendAuthSuccesses: 150 BackendAuthFails: 6
I think it is very odd that the AuthEapStartsWhileAuthenticating is very high compared to the port with the Apple workstation.
I have included a debugging log I have created tonight.
Some sidenotes: - The linux workstations I have tested so far (Fedora 21 and Fedora 18) on the 802.1x ethernet authenticate using EAP-TLS just fine. - Apple laptop my co-worker uses can authenticate just fine using EAP-TLS as well, as long as he can import the certificate I have given him from a PKCS12 file. - The Radius certificate and the root certificate I have created about 3 years ago when I needed 802.1x authentication for the wireless network. - Windows clients authenticate using these certificates in combination with the Username / Password the user has in LDAP. - Linux clients and Apple clients do the same. The manual to configure it on a windows workstation is just 20 pages longer. - I see a lot of messages telling me something about Certificate Compatibility but that page has a lot of info about windows, and windows has been working for several years just fine. The only thing I have never tested is Windows workstations doing EAP-TLS. But in our environment we decided a long time ago that we don't want this.
Some information about the certificates is included as well.
For now I have set the authentication on PEAP only and this works just fine. Would like to have the certificates working though.
Thanks in advance, Jan Hugo Prins
On 03/08/2015 11:39 PM, Arran Cudbard-Bell wrote:
On 8 Mar 2015, at 18:11, jan hugo prins <jhp@jhprins.org> wrote:
Hello,
I have a working 802.1x setup on the wired network of our office and everything is fine for Linux stations, Apple notebooks and the few windows notebooks we have. The Linux stations and the apple notebooks are doing EAP-TLS. And my idea was to have the printers we use do the same. But with the printers I get a lot of timeouts during authentication and to me it looks like the printer is really having a big issue handling all the certificate things etc.
Does anyone here have experience in setting this up? Would it be an idea to get a newer printserver into the printers? I'm looking at the JetDirect 635 (J7961G). Just to check, you're using the latest firmware?
The HP supplicant used to implement PEAP incorrectly, they may have gotten something wrong in EAP-TLS too.
Could you paste the debug output, and we'll be able to see if it's something obvious.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 9 Mar 2015, at 18:42, jan hugo prins <jhp@jhprins.org> wrote:
Log file was missing. Does this work?
Nope. What format did you attach it as? The mail server is prejudiced against Windows users... -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 9 Mar 2015, at 20:40, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 9 Mar 2015, at 18:42, jan hugo prins <jhp@jhprins.org> wrote:
Log file was missing. Does this work?
Nope. What format did you attach it as?
The mail server is prejudiced against Windows users...
But you're on Linux, hmm, i'll go and have a word with it. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi,
Does anyone here have experience in setting this up? Would it be an idea to get a newer printserver into the printers? I'm looking at the JetDirect 635 (J7961G).
Arran (who knows what he's talking about WRT HP and 802.1X in printers ;-) ) has already said - we need the debug alan
I need to create this debug output during a quiet window on the network. This will probebly be tonight. I keep you updated. Jan Hugo Prins On 03/09/2015 11:25 AM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Does anyone here have experience in setting this up? Would it be an idea to get a newer printserver into the printers? I'm looking at the JetDirect 635 (J7961G). Arran (who knows what he's talking about WRT HP and 802.1X in printers ;-) ) has already said - we need the debug
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Arran Cudbard-Bell -
jan hugo prins