Aruba ClearPass Workshop (2021) - Wireless Access #7 TEAP Authentication (EAP Chaining)

[@prayerpoint7241]

I am an ISE engineer. Thank you for this video.

[@BernhardHustomo]

i tot customer wanted to use EAP-TLS when they mentioned about TEAP... then figured out they r not the same. thanks a lot for the demo ! -from accp 2015 ^_^

[@michalsrnicek4676]

@Herman Robers Hello Herman, I tried to configure TEAP method too. I have problems to get it work. Im still getting same error: eap-teap: Conflicting identities 'anonymous' and 'host/myPC.domain' in the request. ERROR RadiusServer.Radius - rlm_eap_teap: Client sent a valid identity 'anonymous' in outer request, and is sending another identity 'host/myPC.domain' in inner, rejecting the request. Since i cannot disable identity privacy in newer version of windows im stuck. It seems to be problem with identity privacy - getting the same error with peap aswel.

[@jonashammarback2617]

Does Microsoft support configuration of EAP-TEAP in GPO's now, or is it only possible to configure it manually? If it´s not possible to configure in a GPO it will be quite hard to roll out this authentication protocol in a Windows Active Directory managed environment... If it´s not supported yet I hope it will be so soon. It would solve some very common pains for customers.

[@hermanrobers]

Jonas, good question. As far as I know, there are no GPO templates (or how these are called) for TEAP, but you can deploy the TEAP configuration through XML to your clients through GPO, but also through Intune for computers that are not joined to the on-premise AD, but to Azure AD for example. If you search on the internet, you should be able to find how to do that with the XML.

[@ws_ed9970]

Windows Server 2019 does not support configuration of EAP-TEAP in GPOs, but Windows Server 2022 does support configuration of EAP-TEAP in GPOs.

[@giovanniaugusto2406]

Windows 2022 supports TEAP via GPO but I have found it working correctly only by using RSAT:GPO Manager via a Windows 10 workstation

[@johnbritto2668]

@Herman Robers I have configured everything like in your tutorial and in Access Tracker it still tells me Authentication method is EAP am I missing something? Thank you for your videos

[@hermanrobers]

TEAP is one of the possible methods of EAP, so what is it what you see exactly? Did you also change your client to perform TEAP authentication? Does authentication succeed? If it fails, it may be that you see limited information and just 'EAP'. In that case, 'the trick' is to make sure you have a successful authentication and you will see much more information to get further.

[@johnbritto2668]

@@hermanrobers We had to upgrade our controllers I believe the version we were on was passing the TEAP authentication to clearpass. But I do have a question, We have a machine-auth role for successful method-1 only and that role is set to lets say vlan 101 then when we get fully authenticated method-1 and method-2 succesful we apply the user role for vlan 102. Now sometimes after switching roles the windows device will not release the IP address of the vlan 101 until we disconnect and reconnect, then it will get vlan 102. Have you seen this issue before and how have you been able to overcome this issue? Thank you for all your help and videos much appreciated.

[@techevangelist8373]

Can eap-teap do user and machine authentication at the same time?

[@hermanrobers]

Yes: TEAP authentication can do User and Computer authentication in the same Authentication transaction (EAP Chaining). Check the video to see the TEAP-Method-1 and TEAP-Method-2 in the same authentication to be both Computer and User.

[@techevangelist8373]

@@hermanrobers Thanks Herman. I will go through.

[@user-xy9dn6oz7g]

Is windows 10 the only operating system that currently supports eap-teap?

[@hermanrobers]

As far as I know, yes. Also it is the only still supported version of Windows client, and it is hard to impossible to join other operating systems to a Windows domain.

[@user-xy9dn6oz7g]

@@hermanrobers yes, I have joined macs to a windows domain in the past. It is quite a pain. This is still really good info. It would've been very useful for a project I did recently that included CAC authentication. Your videos are the reason I was able to get it working. Thank you!

[@ulis1821]

Windows is the only OS that uses the Machine/User authentication concept, so in my opinion there is no reason to provide TEAP on other OSes. Thank you, Herman, great content as always!

[@jpadams23]

@@ulis1821 MacOS has the ability for the computer to Authenticate and flip to the user when they logon. The computer auth Is I’ll not be seen as [Machine Authenticated]. You can create logic around this though similar to what Herman created with the endpoint attribute.

[@ulis1821]

@@jpadams23 oh ok, didn’t know that. Thanks for the clarification. Have to investigate on that…