Windows Modern Standby (S0) - 802.1x EAP-TLS - No Response to Request Idenity after sleep

Question

Windows Modern Standby (S0) - 802.1x EAP-TLS - No Response to Request Idenity after sleep

Stefan 0

Hi,

we have a problem with laptops that use the new S0 Modern Standby. We use EAP-TLS with computer certificate for network authentication. After the PC has been in power saving mode for some time, it no longer responds to EAP Request Identity packets from the switch. Even after the PC is woken up again, the network does not reconnect. The dot3svc is running and is set to automatic. In the debug log of the service I see the following error message:

Event ID: 21030

Details: There is no 1x port available. The received packet is ignored.

A recording with Wireshark proves that the EAP Request Idenity packet arrives at the PC, but it does not respond. EAPOL start packets are also not sent by the PC. The network is only connected after either the LAN cable is disconnected and reconnected or the network adapter is deactivated and reactivated.

Unfortunately, we cannot go back to the old S3 standby mode, as the SSD is then no longer recognized and Windows no longer boots.

If I deactivate connected standby via the registry, there are no problems. However, Wake On Lan then no longer works.

Why does Windows no longer respond to the switch's requests to authenticate itself? If the error is displayed on the Ethernet network adapter: "Authentication attempt"

The following details about our hardware:

PC model: Fujitsu E5511

Network card: Intel(R) Ethernet Connection (13) I219-LM

Network card driver: 12.9.2.55 (Latest)

Windows Version: Windows 10 Pro Version 22H2 (Build 19045.3803)

Windows Update: All updates have been installed

Network:

Switch: Extreme Networks X435-8P-4S

Authentication and dynamic VLAN assignment via RADIUS

Andy 0 Reputation points

2024-01-15T13:02:22.0766667+00:00

Might be a bit late, but try disabling wake on LAN in the bios as I have found it causes similar issues.
Also Windows should send an EAP start when it "awakens" which the switch should "see" and repond with an EAP challenge.
Windows 7 never used to send an EAP start when waking from S0/Sleep/Hibernation or even off but with wak on LAN enabled so caused all sorts of problems. Also note you mioght need an ethernet tap to caputure all EAP packets.

HTH
Stefan 0 Reputation points

2024-01-15T13:12:27.16+00:00

Hi Andy, Thanks for the comment. I would also expect windows to send an EAPOL start package after standby. But this is not the case. I will try that out. If that is the cause of the problem, that would be bad. We also need WoL to update the notebooks overnight.... Best regards Stefan
Andy 0 Reputation points

2024-01-15T14:02:46.12+00:00

Hi Stefan,
Sorry didnt see the bit where you said you need WOL.
Does your switch send an EAP challege when the PC starts sending packets into the port?
I have not worked with the Extreme switches, but the cisco ones send an EAP chanllenge as soon as a packet (ARP, DHCP, whatever) arrives at an unauthenticated port. Also I am pretty sure wireshark on the PC doesnt proccess some of the EAP/EAPOL packets so you only see them using an inline tap (i use an ETAP-2003). Also the cisco monitor session doesnt capture all the EAP packets so the Extremes might be the same. Maybe some of the EAP packets are done in hardware?

I dont know what your radius server is, but we used MAC auth, control directon, access lists and periodic reauth timers when Do1x is not avaiable while the (win7) PC is "sleeping" to allow temp access for WOL packet and while the PC is "waking up" Regards Andy
Gary Nebbett 6,206 Reputation points

2024-01-15T14:45:44.5733333+00:00

Hello Stefan,

Did you paraphrase the message "There is no 1x port available. The received packet is ignored." or perhaps translate it from a different language (perhaps the German "Es ist kein 1X-Port vorhanden. Das empfangene Paket wird ignoriert.")

I can only find a possibly relevant event with the text "No 1X port exists. Ignoring the packet received".

Would you be prepared to create and share some ETW traces demonstrating the problem (the traces would need to span the period from before entering the S0 state to after generation of the 21030 event. The trace command that I have in mind is netsh trace start scenario=Layer2,dot3_wpp report=disabled tracefile=why.etl but I would need to check whether there is anything else that could be usefully added to the trace.

Gary
Stefan 0 Reputation points

2024-01-16T08:48:58.0866667+00:00

Hi, the switch is periodically sending EAP Request Idenity packets to the PC . Somehow the Windows PC is ignoring that packages after it wakes up from sleep. I even found an debug event log in Windows where it Says "No 1X port exists. Ignoring the packet received" after the request idenity packet is arrived. the switch is also reacting to packets arriving on the edge port where the mac adress is not authenticated. It then sends an radius Access-Request packet on behalf of that pc to the radius server. Our Radius Server is configured too reject these mac auth's because we only want to authenticate via dot1x. But we need to have mac auth enabled on the port for clients that are not supporting dot1x. So for some client's we only allowing dot1x auth at the radius server and for some clients we allow mac auth. I have also captured the traffic with an etap-2003. I can clearly see the switch trying to authenticate the pc. I understand when windows is sleeping it can't do 802.1x authentication but i would expect the pc to at least to send an eapol start packet after it wakes up. For the WOL Packets we are using a tagged vlan on that edge port where we redirect the wol broadcast. That vlan is only doing egress traffic to the pc so no traffic can ingress in that vlan from the edge port. i also tried to change tls version to 1.0 because of this article
https://support.microsoft.com/en-us/topic/windows-10-devices-can-t-connect-to-an-802-1x-environment-179ef277-e6ef-8ea3-cb0e-11a6b80fa955 this does also not helped to solve the problem... @gary thanks for your comment as well. Yes you are right. Maybe that's the reason i have not found anything on google for my translated version of the error message. With the correct error message i can find an article in the cisco community. https://community.cisco.com/t5/network-access-control/ise-1-2-patch-7-quot-nak-requesting-to-use-peap-instead-quot/td-p/2459720 But in this forum the solution was that the dot3svc.dll was not up to date on a Windows 7 Client. I am using the latest Windows 10 22H2 Image. I have done the trace you mentioned. Should i just post it here or can I send it to you directly? Thanks so far for the help! Best regards Stefan
Gary Nebbett 6,206 Reputation points

2024-01-16T09:48:26.6266667+00:00

Hello Stefan,

You can either post a link to the trace here or send it to me directly (gary.nebbett at outlook.com). I wanted to do some more research to see whether any additional ETW providers could usefully be added to the trace but examining your existing trace would be the easiest way to start.

I have a PC that I use as a VPN server but also sometimes cause to enter a sleep mode. A VPN component registers at start-up, deregisters upon the power message announcing the sleep and does not even try to re-register when waking from sleep. This might be considered a bug, but it is unusual (perhaps near to making no sense) to place such a server in a sleep state.

What I am expecting from your trace is something similar. If there is evidence of this type of behaviour then there may be no simple fix but at least you will know what is happening and why.

The problem with the loosely translated text was identifying the ETW provider given just a 16-bit number and some text that did not match any embedded strings (it turned out to be Microsoft-Windows-Wired-AutoConfig).

The dot3_wpp scenario trace does not include Microsoft-Windows-Wired-AutoConfig nor Microsoft-Windows-OneX and perhaps other useful providers.

Gary
Sistemas Red 0 Reputation points

2024-08-06T11:46:00.2133333+00:00

Hi Stefan,

We have a similar problem with some Windows 10 PCs and switches Extreme. Sometimes, when these PCs turn-on (only sometimes) they don´t authenticate correctly. Reviewing switch log we find this message:

07/11/2024 09:19:13.21 <Noti:nl.Dot1xClientAuthFail> Slot-1: Authentication failed for Network Login 802.1x user Mac 6C:02:E0:9B:53:9F port 1:35 because either the supplicant does not support dot1X or the supplicant has not responded to the EAPOL PDUs.

We suspect about the Windows 802.1X supplicant. For any reason it doesn´t respond to EAPOL request. Then, the network assign the switch port to the guest VLAN, and the PC doesn´t get an IP address from the correct VLAN.

Did you get to resolve your problem? Could you share the solution? Perhaps it help us to resolve the ours one.

Thanks a lot in advance.
Stefan 0 Reputation points

2024-08-06T12:05:02.68+00:00

Hi Sistemas Red,

Unfortunately, we have not found a solution to this either. We have decided to deactivate all energy-saving modes via GPO. In our case, the error only occurred after the energy-saving mode. You might want to check whether you have also activated the energy-saving mode.

best regards

stefan
Sistemas Red 0 Reputation points

2024-08-07T07:47:49.1066667+00:00

Thanks a lot, Stefan.

We´re going to ask about a GPO for deactive energy-saving-mode to our colleagues. They are investigating about this problem too and they want to make a test before, retarding DHCP-client service starting.

Thanks again, regards.

3 answers

Your answer

Andy 0 Reputation points

2024-01-15T13:02:22.0766667+00:00

Might be a bit late, but try disabling wake on LAN in the bios as I have found it causes similar issues.
Also Windows should send an EAP start when it "awakens" which the switch should "see" and repond with an EAP challenge.
Windows 7 never used to send an EAP start when waking from S0/Sleep/Hibernation or even off but with wak on LAN enabled so caused all sorts of problems. Also note you mioght need an ethernet tap to caputure all EAP packets.

HTH
Stefan 0 Reputation points

2024-01-15T13:12:27.16+00:00

Hi Andy, Thanks for the comment. I would also expect windows to send an EAPOL start package after standby. But this is not the case. I will try that out. If that is the cause of the problem, that would be bad. We also need WoL to update the notebooks overnight.... Best regards Stefan
Andy 0 Reputation points

2024-01-15T14:02:46.12+00:00

Hi Stefan,
Sorry didnt see the bit where you said you need WOL.
Does your switch send an EAP challege when the PC starts sending packets into the port?
I have not worked with the Extreme switches, but the cisco ones send an EAP chanllenge as soon as a packet (ARP, DHCP, whatever) arrives at an unauthenticated port. Also I am pretty sure wireshark on the PC doesnt proccess some of the EAP/EAPOL packets so you only see them using an inline tap (i use an ETAP-2003). Also the cisco monitor session doesnt capture all the EAP packets so the Extremes might be the same. Maybe some of the EAP packets are done in hardware?

I dont know what your radius server is, but we used MAC auth, control directon, access lists and periodic reauth timers when Do1x is not avaiable while the (win7) PC is "sleeping" to allow temp access for WOL packet and while the PC is "waking up" Regards Andy
Gary Nebbett 6,206 Reputation points

2024-01-15T14:45:44.5733333+00:00

Hello Stefan,

Did you paraphrase the message "There is no 1x port available. The received packet is ignored." or perhaps translate it from a different language (perhaps the German "Es ist kein 1X-Port vorhanden. Das empfangene Paket wird ignoriert.")

I can only find a possibly relevant event with the text "No 1X port exists. Ignoring the packet received".

Would you be prepared to create and share some ETW traces demonstrating the problem (the traces would need to span the period from before entering the S0 state to after generation of the 21030 event. The trace command that I have in mind is netsh trace start scenario=Layer2,dot3_wpp report=disabled tracefile=why.etl but I would need to check whether there is anything else that could be usefully added to the trace.

Gary
Gary Nebbett 6,206 Reputation points

2024-01-16T09:48:26.6266667+00:00

Hello Stefan,

You can either post a link to the trace here or send it to me directly (gary.nebbett at outlook.com). I wanted to do some more research to see whether any additional ETW providers could usefully be added to the trace but examining your existing trace would be the easiest way to start.

I have a PC that I use as a VPN server but also sometimes cause to enter a sleep mode. A VPN component registers at start-up, deregisters upon the power message announcing the sleep and does not even try to re-register when waking from sleep. This might be considered a bug, but it is unusual (perhaps near to making no sense) to place such a server in a sleep state.

What I am expecting from your trace is something similar. If there is evidence of this type of behaviour then there may be no simple fix but at least you will know what is happening and why.

The problem with the loosely translated text was identifying the ETW provider given just a 16-bit number and some text that did not match any embedded strings (it turned out to be Microsoft-Windows-Wired-AutoConfig).

The dot3_wpp scenario trace does not include Microsoft-Windows-Wired-AutoConfig nor Microsoft-Windows-OneX and perhaps other useful providers.

Gary
Sistemas Red 0 Reputation points

2024-08-06T11:46:00.2133333+00:00

Hi Stefan,

We have a similar problem with some Windows 10 PCs and switches Extreme. Sometimes, when these PCs turn-on (only sometimes) they don´t authenticate correctly. Reviewing switch log we find this message:

07/11/2024 09:19:13.21 <Noti:nl.Dot1xClientAuthFail> Slot-1: Authentication failed for Network Login 802.1x user Mac 6C:02:E0:9B:53:9F port 1:35 because either the supplicant does not support dot1X or the supplicant has not responded to the EAPOL PDUs.

We suspect about the Windows 802.1X supplicant. For any reason it doesn´t respond to EAPOL request. Then, the network assign the switch port to the guest VLAN, and the PC doesn´t get an IP address from the correct VLAN.

Did you get to resolve your problem? Could you share the solution? Perhaps it help us to resolve the ours one.

Thanks a lot in advance.
Stefan 0 Reputation points

2024-08-06T12:05:02.68+00:00

Hi Sistemas Red,

Unfortunately, we have not found a solution to this either. We have decided to deactivate all energy-saving modes via GPO. In our case, the error only occurred after the energy-saving mode. You might want to check whether you have also activated the energy-saving mode.

best regards

stefan
Sistemas Red 0 Reputation points

2024-08-07T07:47:49.1066667+00:00

Thanks a lot, Stefan.

We´re going to ask about a GPO for deactive energy-saving-mode to our colleagues. They are investigating about this problem too and they want to make a test before, retarding DHCP-client service starting.

Thanks again, regards.

Answer 1

Hello,

Thank you for posting in Q&A forum.

According to your statement, the supplicant (laptop) didn't respond to EAP-TLS authentication traffic and even initiate the EAPOL Start request. I will recommend to start the troubleshooting from power setting and adaptor configuration.

You can check

Expand property of the adaptor -> "Configuration" -> "Power Management" -> Disable "Allow the computer to turn off this device to save power".
Check Windows Power Settings and make sure advanced power settings is configured well.

Please kindly try steps above and keep us informed of the result for further sync. Thanks a lot.

Answer 2

Stefan 0

Hi Jur Chen,

thank you for your suggestions.

The problem is not that the network wired adapter is shut down. the network link is still up when the pc is in energy safe mode. And this option you mentioned is only applicable in wifi cards or?. i think it has do something with the dot3svc stop working after some time in energy safe mode. but i can‘t figure out how to fix that problem.

best regards

stefan

Answer 3

Anonymous

Hi Stefan,

Thank you for your reply.

Actully this option applies to both of LAN/WLAN adapters.

Regarding dot3svc, you can also do basic check:

Open "service.msc" by pressing win+R to check whether the service status is "Automatic".

Also, you can capture process monitor trace and confirm if the service stops when machine turns into power saving mode.

By the way, what if you could have any backup snapshot/checkpoint restore PC as a solution?

Thank you.

Stefan 0 Reputation points

2024-01-07T20:47:03.62+00:00

Hi Jur chen,

okay but i see no options on my network adapter configuration.

the service is allready set to to "automtatic"

actually i don't think the service is stopped in the energy safe mode. But how can i track that?

the problem exist on a newly installed windows 10. and i have that problem with all laptops that only supports the new s0 modern standby.

do you have any information about the error code i postet?

Event ID: 21030

Details: There is no 1x port available. The received packet is ignored.

i can't find anything online about this event id...

best regards

stefan
Shujun Chen (Shanghai Wicresoft Co Ltd) 5 Reputation points Microsoft External Staff

2024-01-09T02:19:48.92+00:00
Hi Stefan,

First to answer your question, you can open task manager and record the service PID first, then when issue reproduced and trace captured, you can filter the event by PID in process monitor and check if there's any service stop activity.

From my point of view, this event ID means there's no available port available for 802.1x authentication traffic. We need to check if the traffic goes well from network adaptor to deep level.

To further investigate this issue, I will suggest you opening a support ticket to Windows Networking Support team for further help.

Provide history network trace captured for reference

History issue time

Windows Client IP address and NPS Server IP address

In the case support engineer will help you reproduce the issue and capture ETL trace for further analysis and dig the RCA.

Thanks for your understanding.

Best Regards,
Shujun

If the Answer is helpful, please click "Accept Answer" and upvote it.

Share via

Windows Modern Standby (S0) - 802.1x EAP-TLS - No Response to Request Idenity after sleep

3 answers

Your answer