Hi @KKZ 

Thanks for posting in our business forum.

KKZ wrote

Hello, 

We are trying to implement 802.1x on wired LAN. 
We have Windows NPS server and TP-Link Switch. The authentication method is EAP-TLS. 
It is working fine in wireless the APs are managed by OC-300 but we haven't adopted the tp-link switch in OC-300. 

The authentication happens. 
I am receiving EAP-Success from Switch to Windows PC and Access-Accept from my Windows NPS server to Switch. 
But after every 20-25 packets we are getting packet drops and we can see in the packet capture that we are receiving EAP-Failure from switch to client and Switch is sending Access-Request to the NPS server. 
Why is switch reauthenticating the client again? Is there any way to solve this. 

 

How do you identify that is the switch sending the access request instead of the client? Then conclude it is the switch drops the packet and causes a reauthentication. Does any evidence or information indicate this?

Hi @KKZ 

Thanks for posting in our business forum.

KKZ wrote

  @Clive_A 




On checking the captures on wireshark, I can see that after success getting failure then again whole EAP process takes place and again success and then failure.
Also getting Access-Accept from RADIUS server but then switch gives access-request for the same client.

The whole diagram of your network. These IPs are internal IPs, there is no need to mosaic them.

Try to get a bigger picture of the whole interaction/conversation. MAC addresses should be mosaiced.

Have you double-checked if your settings are correct?

And to your description, you mean that it repeats success > failure > reinitiate > success > failure and it enters such a loop?

Hi @KKZ 

Thanks for posting in our business forum.

KKZ wrote

  @Clive_A 

Hello, 

Yes the process repeats itself and the authentication process starts again.
I want to know whether the switch is starting the authentication process again or the client?

You need to monitor this behavior from the Wireshark. I don't know.

If it enters this loop, you can use the Wireshark filter to find out more granular details about it.