ISSUE: dot1x not working in some of the VC's

ISSUE DESCRIPTION: Windows 11 client connects to 802.1x enabled port for EAP-TLS (certificate), and never completes authentication.

Network PCAP shows the switch communicating with Authentication-Server (Clearpass), but Clearpass is not being presented the FULL certificate (just the initial part).

Dot1x on EX4400-48MP traceoption shows communication between client and the switch and Clearpass, but it seems to just keep cycling/retrying.

ISSUE IMPACT: Users connecting to non-working VC are unable to authenticate through 802.1x

ENVIRONMENT: Pre-production

DEVICE:

Model - EX4400-48MP VC

Code - 22.4R3-S2.12

TOPOLOGY:

Client/Windows 11  < --- > access leaf 1/2 < --- > spine 1/2 < --- > border leaf 1/2 < --- > Clearpass Radius server

TROUBLESHOOTING SUMMARY:

1. Customer is testing 802.1x in their 3 member EX440-48MP VC switches where client 802.1x authentication is failing for 3 of the EX440-48MP VC's and working for the other 3 EX440-48MP.

2. This is a new implementation and customer is testing this pre-production deployment.

3. During JTAC troubleshooting, 

+ JTAC enabled protocols dot1x no-mac-table-binding but it did not make any difference.

+ The ‘show dot1x interface’ output gets stuck in “authenticating” and it never authenticates.

+ The switch interface never learns the host/client (windows 11) mac-address.

+ From previous dot1x traceoptions it looks like the device with mac was failing dot1x authentication due to a timeout. It shows no response from the host.

+ Then the switch tries to authenticate again begins initializing the process.

+ There’s a possibility that the mac-age expires before the reauthentication timer, so it will remove the session of the authentication session, this could cause an early reauthentication.

Jul 2 11:59:55.727201 pnac_get_vlan_name_from_vlan_id:456 vlan (test) for vid (4444)

Jul 2 11:59:55.727217 pnac_l2ald_timeout_node No reponse from host for mac (aa:bb:cc:12:34:56). Declare auth fail

Jul 2 11:59:55.727231 pnac_pvlan_bd_lookup(PVLAN) primary bd 29 for ifl mge-0/0/30.0 NOT Present

Jul 2 11:59:55.727246 AuthSession node with Mac: aa:bb:cc:12:34:56 in port session AIP DB found !!!

+ There is a log message that repeats multiple times in the traceoptions:

 "pnac_process_l2ng_mac_learn_query: get_mac_status returned AUTH_PENDING"

 The error message "pnac_process_l2ng_mac_learn_query: get_mac_status returned AUTH_PENDING" indicates that there is an issue with the MAC learning process. The "AUTH_PENDING" status suggests that the MAC address is still pending authentication which we saw it's not clearly happening.

From the client side packet capture, capture is similar to the many other different machines used which was taken from the client side when connected to a non-working VC.

The eap “Failure” is always present in every client-side pcap. (quickly connecting the client to a working VC, everything works as expected).

A failure code of 4 indicates that the authenticator was unable to authenticate the peer. This could indicate a problem with the user's account 

Each time it appears the client sends TLS certificate to the switch from a non-working and working client pcap.

Same issue was not seen in JTAC lab when tried to replicate.

sers connecting to non-working VC are unable to authenticate through 802.1x

Client side configuration change by customer fixed the issue