Problem authenticating with Checkpoint Integrity.

[Alan DeKok]

Ian Walker wrote:
> I'm attempting 802.1x authentication with Checkpoint Integrity.  I have
> it working with peap no problems and usings mschapv2.  However, when I
> attempt with Integrity, I have to choose "Zone Labs Cooperative
> Enforcement" within the Windows 802.1x authentication options.  I've
> then chosen peap/mschapv2 here, but an additional setting is eap-type
> "44" of which I'm unable to change on the client.

  Which is proprietary to ZoneLabs, and which is otherwise unknown.

> The main bit of this being the EAP NAK and "NAK asked for bad type 44". 
> I'm unsure of how I'm supposed to configure freeradius to use this type,
> as in the IANA numbers, type 44 is shown as:
> 
> 44 ZoneLabs EAP (ZLXEAP)
> 
> Any ideas on what I can do to get this working?

  Ask Zone Labs for documentation on how it works, and on an
implementation that you can submit to FreeRADIUS.  Tell them that if
their EAP type is implemented in FreeRADIUS, then it will be available
in the most widely used RADIUS server on the planet. :)

  Alan DeKok.
--
  http://deployingradius.com       - The web site of the book
  http://deployingradius.com/blog/ - The blog