A customer is experiencing authentication failures when clients connect to a new EAP-TLS SSID. Based on the logs and packet capture above, what is the cause of the failure?

Question

Exhibits

Options

• AThe client cannot validate the RADIUS server's certificate
• BThe MTU in the path between the AP and HPE Aruba Networking ClearPass is too small
• CHPE Aruba Networking ClearPass cannot validate the user's certificate
• DThe access point doesn't have the correct root CA certificate installed

• A
  28% (5)
• B
  56% (10)
• C
  11% (2)
• D
  6% (1)

Explanation

MTU fragmentation is the culprit because EAP-TLS requires transporting full X.509 certificates during the TLS handshake - these can exceed 1500 bytes. If the path MTU between the AP and ClearPass is too small, the RADIUS/EAP packets carrying certificate fragments are dropped or improperly reassembled, and the handshake never completes. This typically appears in packet captures as retransmissions or a sudden connection drop mid-handshake.

A is wrong because a client certificate validation failure would occur after packets successfully reach ClearPass - you'd see an Access-Reject with a certificate error, not a transport-layer dropout mid-handshake.

C is wrong for a similar reason: ClearPass failing to validate the user certificate is a PKI/trust issue that produces a specific reject log entry; it doesn't cause the fragmentation pattern visible in the capture.

D is wrong because the AP is purely a pass-through authenticator (802.1X supplicant traffic is tunneled to ClearPass via RADIUS); the AP never inspects or validates certificates itself, so its CA store is irrelevant.

Memory tip: "Big certs, small pipes break EAP-TLS." Whenever you see EAP-TLS failures with no obvious cert error in ClearPass logs, think MTU - certificates are large, and oversized RADIUS packets are a classic silent killer.

No community discussion yet for this question.