Em muốn hỏi về xác thực 802.1x

[CCnMS]

Hiện tại em đang triển khai 802.1x với mô hình:
Client XP-----SW 2960------IAS
Hiện tại là xác thực từ SW với IAS thì OK rồi ví dụ phía dưới:
--------------------
SW-CNTT04#test aaa group radius test1 123456a@ legacy
Attempting authentication test to server-group radius using radius
User was successfully authenticated.

SW-CNTT04#
015057: *Apr 24 18:10:54.376: AAA: parse name=<no string> idb type=-1 tty=-1
015058: *Apr 24 18:10:54.376: AAA/MEMORY: create_user (0x2BC897C) user='test1' ruser='NULL' ds0=0 port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 initial_task_id='0', vrf= (id=0)
015059: *Apr 24 18:10:54.376: RADIUS: Pick NAS IP for u=0x2BC897C tableid=0 cfg_addr=0.0.0.0
015060: *Apr 24 18:10:54.376: RADIUS: ustruct sharecount=1
015061: *Apr 24 18:10:54.376: Radius: radius_port_info() success=0 radius_nas_port=1
015062: *Apr 24 18:10:54.376: RADIUS/ENCODE: Best Local IP-Address 10.4.20.244 for Radius-Server 10.4.29.18
015063: *Apr 24 18:10:54.376: RADIUS(00000000): Send Access-Request to 10.4.29.18:1812 id 1645/71, len 57
015064: *Apr 24 18:10:54.376: RADIUS: authenticator F9 E5 1A 6C B3 41 6A 0E - EE 03 DF 33 BA 31 45 94
015065: *Apr 24 18:10:54.376: RADIUS: NAS-IP-Address [4] 6 10.4.20.244
015066: *Apr 24 18:10:54.384: RADIUS: NAS-Port-Type [61] 6 Async [0]
015067: *Apr 24 18:10:54.384: RADIUS: User-Name [1] 7 "test1"
015068: *Apr 24 18:10:54.384: RADIUS: User-Password [2] 18 *
015069: *Apr 24 18:10:54.384: RADIUS: Received from id 1645/71 10.4.29.18:1812, Access-Accept, len 74
015070: *Apr 24 18:10:54.384: RADIUS: authenticator D4 EF 15 40 36 AB 69 A2 - FC F8 0F 7B 24 14 4B D0
015071: *Apr 24 18:10:54.384: RADIUS: Service-Type [6] 6 Framed [2]
015072: *Apr 24 18:10:54.384: RADIUS: Tunnel-Medium-Type [65] 6 00:ALL_802 [6]
015073: *Apr 24 18:10:54.384: RADIUS: Tunnel-Private-Group[81] 4 "29"
015074: *Apr 24 18:10:54.384: RADIUS: Tunnel-Type [64] 6 00:VLAN [13]
015075: *Apr 24 18:10:54.384: RADIUS: Class [25] 32
015076: *Apr 24 18:10:54.384: RADIUS: 2B 43 03 59 00 00 01 37 00 01 0A 04 1D 12 01 C6 0F 77 08 A7 49 86 00 00 00 00 00 00 00 17 [ +CY7wI]
015077: *Apr 24 18:10:54.384: RADIUS: saved authorization data for user 2BC897C at 1F91900
015078: *Apr 24 18:10:54.384: AAA/MEMORY: free_user (0x2BC897C) user='test1' ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN priv=1 vrf= (id=0)
--------------------------------

Cấu hình SW của em đây ạ:
SW-CNTT04#show run
Building configuration...

Current configuration : 10063 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service sequence-numbers
!
hostname SW-CNTT04
!
boot-start-marker
boot-end-marker
!
enable password 7 02150C5903094C010D4F0D140C19
!
username anhnc privilege 2 password 7 104D000A0618
username shb-admin privilege 15 password 7 14041A09040B690B652937382B1D
username cisco privilege 2 password 7 030752180500
aaa new-model
!
!
aaa authentication login default local
aaa authentication dot1x default group radius
aaa authorization exec default local
aaa authorization network default group radius
!
!
!
aaa session-id common
system mtu routing 1500
ip subnet-zero
!
!
!
crypto pki trustpoint TP-self-signed-4276715776
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4276715776
revocation-check none
rsakeypair TP-self-signed-4276715776
!
!
crypto pki certificate chain TP-self-signed-4276715776
certificate self-signed 01
30820242 308201AB A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 34323736 37313537 3736301E 170D3933 30333031 30303030
35335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 32373637
31353737 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100C42F D1F3682C 7649FDD8 30364D6F B5AB4B82 80E9CFC1 75195E23 FC2F72F4
F1386C3C 63107A63 F97ECAE4 A37EFA53 050D9076 2EEB6660 0190A028 616A8E82
CB8DE052 429A943E 6ACF87F0 CD42ADCE 324BFAF8 953ED848 81392727 8FB03F00
43A7B0D1 B45105AD C0EDD026 64EE6769 12A445B9 DDCCA505 0D32DE9B F4F4F81D
3D0B0203 010001A3 6A306830 0F060355 1D130101 FF040530 030101FF 30150603
551D1104 0E300C82 0A53572D 434E5454 30342E30 1F060355 1D230418 30168014
A7828EC1 8213C249 919F6C41 AFBDF9F4 AB3BEFDB 301D0603 551D0E04 160414A7
828EC182 13C24991 9F6C41AF BDF9F4AB 3BEFDB30 0D06092A 864886F7 0D010104
05000381 8100A2EA 9B7BB98D 5C34BAFC D9A0E5AD 445F92A6 EC91F7A4 837F1BF4
43AD0E46 75247098 78B39916 AA97B68E CFD57C01 AC1008E1 ACBB487E BF364CF7
32ABB519 45E310A7 0BAFB352 5AA3EB2C 5AB47E25 19CFEAFE E9E2FF58 67FF4384
1AFD6924 8998D952 B2ABF958 F0DE70E3 D6594024 E8600186 D2C82361 2A9F6515
833A1A18 12E4
quit
!
!
dot1x system-auth-control
dot1x guest-vlan supplicant
!
!
!
errdisable recovery cause udld
errdisable recovery cause bpduguard
errdisable recovery cause security-violation
errdisable recovery cause channel-misconfig
errdisable recovery cause pagp-flap
errdisable recovery cause dtp-flap
errdisable recovery cause link-flap
errdisable recovery cause sfp-config-mismatch
errdisable recovery cause gbic-invalid
errdisable recovery cause psecure-violation
errdisable recovery cause port-mode-failure
errdisable recovery cause dhcp-rate-limit
errdisable recovery cause mac-limit
errdisable recovery cause vmps
errdisable recovery cause storm-control
errdisable recovery cause inline-power
errdisable recovery cause loopback
errdisable recovery cause small-frame
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0/1
description "***May tinh A Longdm***"
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/2
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/3
description "***Lap top cua Tuan Anh***"
switchport mode access
switchport port-security mac-address 0026.9e94.1dfa
spanning-tree portfast
!
interface FastEthernet0/4
description "***Destop cua Tuan ANh***"
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/5
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/6
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/7
description "***Ket noi may tinh cua Cong Anh tren tang 2***"
switchport mode access
switchport port-security mac-address 0019.bb43.f7ba
spanning-tree portfast
!
interface FastEthernet0/8
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/9
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/10
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/11
description ****Connect to Laptop Hoannv****
switchport mode access
switchport port-security
switchport port-security mac-address 7884.3ccd.7cfa
spanning-tree portfast
!
interface FastEthernet0/12
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/13
description ***connect to PC Cuongle****
switchport mode access
switchport port-security maximum 4
switchport port-security
spanning-tree portfast
!
interface FastEthernet0/14
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/15
description ***Connect to PC LoanTTT***
switchport mode access
switchport port-security maximum 4
switchport port-security
spanning-tree portfast
!
interface FastEthernet0/16
description ***Connect to PC HoaNH****
switchport mode access
switchport port-security maximum 4
switchport port-security
spanning-tree portfast
!
interface FastEthernet0/17
description ****Connect to PC AnhNN****
switchport mode access
switchport port-security maximum 10
switchport port-security
spanning-tree portfast
!
interface FastEthernet0/18
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/19
description ****connect to Laptop MAC_ Hungdq ****
switchport mode access
switchport port-security maximum 2
switchport port-security
switchport port-security mac-address 0025.4ba2.b374
switchport port-security mac-address 0800.27e5.f0e7
spanning-tree portfast
!
interface FastEthernet0/20
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/21
description ***connect to PC Hungdq***
switchport mode access
switchport port-security
switchport port-security mac-address 20cf.3064.bc94
spanning-tree portfast
!
interface FastEthernet0/22
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/23
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/24
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/25
description ***Connect to PC Vinhmv****
switchport mode access
switchport port-security mac-address 0024.81ca.b4a3
spanning-tree portfast
!
interface FastEthernet0/26
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x reauthentication
dot1x guest-vlan 41
dot1x auth-fail vlan 1
spanning-tree portfast
!
interface FastEthernet0/27
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/28
switchport access vlan 29
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/29
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/30
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/31
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/32
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/33
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/34
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/35
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/36
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/37
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/38
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/39
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/40
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/41
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/42
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/43
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/44
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/45
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/46
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/47
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/48
switchport access vlan 29
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet0/1
switchport mode trunk
!
interface GigabitEthernet0/2
switchport mode trunk
!
interface Vlan1
ip address 10.4.20.244 255.255.255.0
no ip route-cache
!
ip default-gateway 10.4.20.1
ip http server
ip http authentication local
ip http secure-server
radius-server host 10.4.29.18 auth-port 1812 acct-port 1813 key 123456789
!
control-plane
!
privilege exec level 2 show startup-config
!
line con 0
password 7 104D000A0618
line vty 0 4
exec-timeout 1000 0
password 7 104D000A0618
line vty 5 15
exec-timeout 1000 0
password 7 104D000A0618
!
end

SW-CNTT04#
SW-CNTT04#
-----------------------------------------
Nhưng khi xác thực trên client toàn báo lỗi "Authentication fail"

[luancb]

Bạn tham khảo : http://www.cesnet.cz/doc/techzpravy/...uthentication/

Mình không biết bạn cấu hình Authen server đã đúng chưa ? Trong link là cách cấu hình Radius server sử dụng ACS, chứ ko dùng IAS .

[tudq]

đưa cái này lên cho học hỏi thêm nè...
authentication với XP sp3 trở lên nhé



!
Current configuration : 10130 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname BD-Floor1-Switch-3
!
boot-start-marker
boot-end-marker
!
enable password vvvvv
!******************************
aaa new-model
!
!
aaa authentication dot1x default group radius
aaa authorization network default group radius
!
!
!
aaa session-id common
system mtu routing 1500
vtp mode transparent
ip subnet-zero
!
!
!
crypto pki trustpoint TP-self-signed-2436013824
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2436013824
revocation-check none
rsakeypair TP-self-signed-2436013824
!
!
crypto pki certificate chain TP-self-signed-2436013824
certificate self-signed 01
3082024B 308201B4 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32343336 30313338 3234301E 170D3933 30333031 30303030
35375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 34333630
31333832 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100F495 07C577F0 B297F6A1 5C55F72F A76EE8B0 492D94F8 1337B3A7 B5A668A9
C3114C87 21C91E0F 51AC6E30 F3552920 712BC742 3C9AB23C A1A964A1 D8861909
1CE37609 C6C60413 29473D79 08AB74FA D5B0109E 435109D3 E5040CC9 AD4CB84C
FEBC0225 3500DEE0 CD445715 24F18B97 783B7CC1 B9D7D9C5 6BB47CCB 1937D495
BA2D0203 010001A3 73307130 0F060355 1D130101 FF040530 030101FF 301E0603
551D1104 17301582 1342442D 466C6F6F 72312D53 77697463 682D332E 301F0603
551D2304 18301680 146891DC 76214FCB F5667ECC CD269C4C BAF71070 B8301D06
03551D0E 04160414 6891DC76 214FCBF5 667ECCCD 269C4CBA F71070B8 300D0609
2A864886 F70D0101 04050003 818100C5 1BDA35A1 3EE541BF 6B982F03 F580A814
C8BCC194 41A2C496 FE81482D 637A4F1E 7F914AA9 F0AD2BED 86DBF6CA 39AD2AC0
DC830B96 D4FB877F B0E69D65 F5CA0167 9644B7BB C649AA1F 8A4B595E 1F184621
A0125248 F0F9B5DF 8F9B69F2 35D96545 B947FA1B 98ECBEA7 5F675AED C127F2DD
7DB4AA30 59BDD01A 5275FDA8 FD1C34
quit
!
!
dot1x system-auth-control
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 2
!
vlan 3
name test
!
vlan 4
name Non-Compliant
!
vlan 5
name Cachly
interface FastEthernet0/9
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/10
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/11
switchport access vlan 2
!
interface FastEthernet0/12
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/13
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/14
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/15
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/16
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/17
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/18
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/19
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/20
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/21
description "LE DOAN BINH win7 home"
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/22
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/23
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/24
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/25
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/26
switchport access vlan 2
switchport mode access
dot1x pae authenticator
dot1x port-control auto
dot1x violation-mode protect
dot1x timeout reauth-period 43200
dot1x reauthentication
spanning-tree portfast
!
interface FastEthernet0/27
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/28
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/29
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/30
switchport access vlan 2
!
interface FastEthernet0/31
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/32
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/33
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/34
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/35
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/36
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/37
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/38
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/39
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/40
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/41
switchport access vlan 2
!
interface FastEthernet0/42
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/43
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/44
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/45
switchport access vlan 2
switchport mode access
shutdown
spanning-tree portfast
!
interface FastEthernet0/46
switchport access vlan 4
!
interface FastEthernet0/47
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/48
switchport access vlan 2
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet0/1
switchport mode trunk
!
interface GigabitEthernet0/2
switchport mode trunk
!
interface Vlan1
ip address 192.168.48.21 255.255.255.0
no ip route-cache
!
ip http server
ip http secure-server
snmp-server community IT-PTSC-MC RO
snmp-server enable traps snmp linkdown linkup
snmp-server host 172.16.2.89 version 2c IT-PTSC-MC
radius-server host 192.168.48.2 auth-port 1812 acct-port 1813 keycccccccccc
!

[mystery1983]

Vậy cho mình hỏi là nếu khi user không có tài khoản trong database của ACS hoặc dùng domain để chứng thực khi connect vào hệ thống, thì khi đó mình có tự động gán vlan nào đó để cho user đi internet không ?

[CCnMS]

Trong mô hình của em ko có CA và AD nhé chỉ có radius server(IAS)thôi, và user là được tạo trên local của IAS. Mỗi lần cắm PC vào cổng nó hỏi user/pass rồi nhưng gõ vào là nó bảo "Authencation fail" luôn . Mà với acount em test trên Sw bằng câu lệnh "test" thì OK.
Giờ ko biết làm cách nào nữa:50::50::50::50::50::50::50::50::50::50::50::50 ::50::50::50::50::50::50::50:

[mystery1983]

IAS thì mình đã từng làm thử rồi, nhưng có 1 điều bất tiện của IAS trên 2k3 là nó chỉ có thể gán vlan cho user cùng với IAS server thôi.

[mystery1983]

Nếu như bạn dùng soft cisco ACS thì rất là ok.Có thể làm tất cả các thiết bị.

[mystery1983]

vậy bạn CCnMS dùng IOS gì cho con 2960 đấy ?

[CCnMS]

vậy bạn CCnMS dùng IOS gì cho con 2960 đấy ?

Cảm ơn bạn mình đang dùng Sw 2960(c2960-lanbasek9-mz.122-44.SE6).
bạn nói như trên là "Vlan user phải cùng vlan IAS" điều này mình thấy hơi bất tiện và vô lý. Trong thực tế user nằm ở các vlan khác nhau và khác với vlan server.
YM của mình là: phamduchanh83
Rất muốn hỏi thêm bạn về con IAS.

[CCnMS]

Em muốn nó xác thực được đã chứ chưa muốn đến phần gán VLAN, giờ dùng cứ type acount vào là báo "Authentication failed"

[luancb]

Chào bạn,

Bạn xem lại 2 phần :

Cấu hình trên Sw :
Cấu hình xác thực dot1x cho cổng f0/x trên Switch

- Bật AAA:
Switch(config)#aaa new-model

- Chỉ ra RADIUS Server được sử dụng để xác thực:
Switch(config)#radius-server host 192.168.1.254 auth-port 1812 key my_key

- Chọn kiểu xác thực AAA là dot1x với method list chỉ có một phương pháp là sử dụng RADIUS Server:
Switch(config)#aaa authentication dot1x default group radius

- Bật dot1x trên Switch và trên cổng đấu với Client:
Switch(config)#dot1x system-auth-control
Switch(config)#int f0/1
Switch(config-if)#dot1x port-control auto


Và xem cách cấu hình server authen đúng chưa ?

[CCnMS]

Chào bạn,

Bạn xem lại 2 phần :

Cấu hình trên Sw :
Cấu hình xác thực dot1x cho cổng f0/x trên Switch

- Bật AAA:
Switch(config)#aaa new-model

- Chỉ ra RADIUS Server được sử dụng để xác thực:
Switch(config)#radius-server host 192.168.1.254 auth-port 1812 key my_key

- Chọn kiểu xác thực AAA là dot1x với method list chỉ có một phương pháp là sử dụng RADIUS Server:
Switch(config)#aaa authentication dot1x default group radius

- Bật dot1x trên Switch và trên cổng đấu với Client:
Switch(config)#dot1x system-auth-control
Switch(config)#int f0/1
Switch(config-if)#dot1x port-control auto


Và xem cách cấu hình server authen đúng chưa ?

Thực sự là không biết sai ở đâu, cái lab của mình chỉ khác lab khuyến cáo là mình ko dùng user của AD mà dùng tạo user bằng tay trên con IAS thôi. Mình dùng câu lệnh "test" (được bôi đỏ phía trên) thì thấy "access-accept" thì mình nghĩ là phần radius server không có vấn đề gì.
Nhưng xác thực tại client cứ báo lỗi :50::50::50::50::50::50::50::50::50::50::50::50::5 0::50::50::50::50::50::50::50::50::50::50:

[CCnMS]

Chào bạn,

Bạn xem lại 2 phần :

Cấu hình trên Sw :
Cấu hình xác thực dot1x cho cổng f0/x trên Switch

- Bật AAA:
Switch(config)#aaa new-model

- Chỉ ra RADIUS Server được sử dụng để xác thực:
Switch(config)#radius-server host 192.168.1.254 auth-port 1812 key my_key

- Chọn kiểu xác thực AAA là dot1x với method list chỉ có một phương pháp là sử dụng RADIUS Server:
Switch(config)#aaa authentication dot1x default group radius

- Bật dot1x trên Switch và trên cổng đấu với Client:
Switch(config)#dot1x system-auth-control
Switch(config)#int f0/1
Switch(config-if)#dot1x port-control auto


Và xem cách cấu hình server authen đúng chưa ?

Thực sự là không biết sai ở đâu, cái lab của mình chỉ khác lab khuyến cáo là mình ko dùng user của AD mà dùng tạo user bằng tay trên con IAS thôi. Mình dùng câu lệnh "test" (được bôi đỏ phía trên) thì thấy "access-accept" thì mình nghĩ là phần radius server không có vấn đề gì.
Nhưng xác thực tại client cứ báo lỗi :50::50::50::50::50::50::50::50::50::50::50::50::5 0::50::50::50::50::50::50::50::50::50::50:

[CCnMS]

bác nào đáo qua topic thì giúp em với:50::50::50::50::50::50::50::50::50::50: