Windows 8 System Does Not get an IP Address After Removing the SNAC Client.

Products

• Endpoint Protection
• Network Access Control
• Network Access Control on Appliance

Issue/Introduction

If an 802.1x authentication that fails, and the "Wired AutoConfig" service is stopped, the network connection will remain frozen in an "unauthenticated" state.
 

This issue was reproduced on Windows 8 x_64 and has been reproduced without SNAC/EAP installed.

 

System unable to aquire and IP address.

Cause

Based lab research, Symantec does not believe this is issue is caused by the SNAC product.  On a client system two settings to control the 802.1x authentication:

•    "Wired AutoConfig" service status
•    "Enable IEEE 802.1x authentication" checkbox in the network properties

By default, the "Wired AutoConfig" service is not running, and the "Enable IEEE 802.1x authentication" is checked.  When the service is started in this configuration, the
properties page will show that it is enabled (checked).  If the SNAC agent is uninstalled, the "Wired AutoConfig" service is also stopped. Because the "Enable IEEE 802.1x authentication" is NOT changed by SNAC, the setting will not be updated.

In lab tests, when the "WireAutoConfig" is stopped, the adapter is left in an "unauthenticated" status. When you uncheck the "Enable IEEE 802.1x authentication" it informs the network adapter to exit the "unauthenticated" state, causing the NIC to be unable to get an IP address.

 

Resolution

Workarounds include:

Starting the "Wired AutoConfig" service + pass the 802.1x authentication

or

Start the "Wired AutoConfig" service
Uncheck the "Enable IEEE 802.1x authentication" in the network connection property page
Then stop the "Wired AutoConfig" service.

Please see the attached "802.1x.PNG" for detail.

 

Applies To

OS: Windows 8 x_64