Network Security Blog

#5411 EAP session timed out ->
this means the client did not respond to the ACS within certain timeout hence failed the authentication.

This usually happens when a client starts the authentication process,
however for some reason this never ends and ACS is still waiting for
information coming from the client machine,
but if there is not a response in the next 120 seconds then the ACS finish
the process and shows the error 5411 EAP session timed out

Workaround:
I assume that the WLC is the one sending the authentication request to the
ACS server, right? If so, go to the RADIUS server configuration in the WLC
and increase the time out value to 20 seconds.
Please give it a try and let me know the results.
If The error message that we are getting "
5411 EAP session time out" is more of cosmetic issue rather than
authentication related issue.


We can actually ignore the error message if all your users are able to
authenticate fine .

"This may be due to EAP mis-configuration on ACS or Network Device."

So you want to know if there is a problem with the ACS or network client
configuration that you need to take care here, please correct me if I am
wrong.

This is a very common request ___ and the message the ACS provides makes
anyone think that could be a problem with the EAP setting in your server,
most of the times when we receive similar cases the error message comes
along with this other alarm "5411 EAP session timed out", first of all ___
there is nothing to worry or change in the ACS server.

The new ACS 5.x now provides way more information about the authentication
requests (pass or fail), this is a generic message, and may be generated for
multiple reasons for example when there is no response for first EAP packet
from client, the client dis-associating from WLC, the end user didn't type
the username or password in the proper time, client closed the
authentication prompt without entering the credentials, etc.

When this occurs the ACS displays the error "EAP session timeout" or "This
may be due to EAP misconfiguration on ACS or Network Device" because its
expecting an EAP response from the client, but does not receive the response
in a timely manner.

This doesn't represent a problem in the authentication unit or similar is
just an informational message that the ACS provides in the reports.