Introduction
This document describes how to help connect old IoT wireless clients who do not support newer 802.1X versions.
Requirements
Components used
This is based on Wireless LAN Controller Catalyst 9800 running any Cisco IOS® XE 17.x version.
Context
The 802.1X protocol has up to 3 versions until now. 802.1X-2001 is version 1, 802.1X-2004 is version 2, 802.1X-2010 and all subsequent revisions use version 3 identifier.
The IEEE standard is very clear that each device must advertise their maximum supported version and then agree on a common version as all versions are backwards compatible.
The Catalyst 9800 WLC advertises 802.1X and eapol version 3.
In a lot of cases, the wireless client replies with 802.1X version 1 and authentication can continue using the version 1 implementation for example.
However, some specific older IoT clients expect to see a specific 802.1X version on the other end and do not tolerate seeing a newer version they do not understand. This is a violation of the standard. However, sometimes you cannot easily update your IoT device and must live with it. It is therefore possible to adjust the 802.1X version on the controller to make these clients.
There are no good reasons to modify this version unless you have proofs that you are facing this problem with a specific set of clients !
Verify that you are hitting this problem
Here is a sample of working radioactive trace where the controller advertises version 3 but the client rightfully replies with a lower version and authentication can continue:
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Posting RESTART on Client
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Entering init state
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Entering idle state
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Posting !AUTH_ABORT on Client
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Entering restart state
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Resetting the client 0xD8000002
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Override cfg - MAC <MAC> - profile (none)
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Override cfg - SuppTimeout 30s, ReAuthMax 2, MaxReq 2, TxPeriod 30s
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Sending create new context event to EAP for 0xD8000002 (7a9d.d7f6.710f)
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Posting !EAP_RESTART on Client
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Enter connecting state
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Restart connecting
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Posting RX_REQ on Client
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Authenticating state entered
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Connecting authenticating action
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Entering request state
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Setting EAPOL eth-type to 0x888e, destination mac to
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [0000.0000.0000:capwap_9000002c] Sending out EAPOL packet
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] Sent EAPOL packet - Version : 3,EAPOL Type : EAP, Payload Length : 5, EAP-Type = Identity
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] EAP Packet - REQUEST, ID : 0x1
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [0000.0000.0000:unknown] Pkt body: 01 01 00 05 01
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] EAPOL packet sent to client
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>] Received EAPOL packet - Version : 1,EAPOL Type : EAP, Payload Length : 12, EAP-Type = Identity
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [<MAC>:capwap_9000002c] EAP Packet - RESPONSE, ID : 0x1
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [0000.0000.0000:unknown] Pkt body: 02 01 00 0c 01 34 34 37 33 36 34 35
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [0000.0000.0000:capwap_9000002c] Queuing an EAPOL pkt on Authenticator Q
{wncd_x_R0-0}{1}: [dot1x] [25076]: (info): [0000.0000.0000:capwap_9000002c] Dequeued pkt: CODE = 2,TYPE = 1,LEN = 12
(...) RADIUS authentication follows
A non working output looks similar up until the EAP identity request message sent by the WLC/AP and then the client does not respond anything to it.
Changing Eapol/802.1X version
WLC#show dot1x all
Sysauthcontrol Disabled
Dot1x Protocol Version 3
WLC#config terminal
Enter configuration commands, one per line. End with CNTL/Z.
WLC(config)#service internal
WLC(config)#dot1x eapol version 2
WLC(config)#exit
WLC#show dot1x all
Sysauthcontrol Disabled
Dot1x Protocol Version 2
Feedback