topic 802.1X NIC issue in Endpoint Security

802.1X NIC issue

AbelBurgos5029 — Sat, 16 May 2020 17:40:16 GMT

Hello everyone,

I am having some issues with my dot1x configuration and was hoping to get some ideas on what the issue might be.... End points are configured with windows supplicant software, Cisco 9300 working as authenticator and Cisco ISE as authentication server. All devices have been configured, but here is the issue:

Every time I log into a workstation, and go to the NIC properties, it will show "attempting to authenticate" and will not complete the authentication until I either reset the NIC or I click switch user and log back in with the same user. Once I do one of those two things, the "windows security login" pops up asking for the credentials once again. Once I re-enter the credentials thats when the authentication is completed and the log appears in the ISE Radius Log as successful.

Any ideas why the "windows security login" doesnt appear without having to mess with the computer NIC?

Re: 802.1X NIC issue

JELA — Sat, 16 May 2020 19:15:18 GMT

Hello,
Could you please help give us a better understanding:

Which windows version are you running?
What kind of authentication are you using (EAP-PEAP MSCHAPv2?)
Could you please provide the C9300 interface configuration where host is connected?
The output of the "show authentication session interface XXXX" (where XXX is the iface where the host is connectec) when you get the "windows security login" prompt

Thank you.

Re: 802.1X NIC issue

AbelBurgos5029 — Sun, 17 May 2020 16:20:00 GMT

Hello.

I am using windows 10.

Authentication is PEAP-MSCHAPV2

I will get you the interface configuration tomorrow once I go into the office. It is a classified network so I dont have remote access.

Thanks for the help!

Re: 802.1X NIC issue

AbelBurgos5029 — Tue, 19 May 2020 23:22:04 GMT

Hello,

Here is part of the configuration in the switch:

Switch# configure terminal

Switch(config)# dot1x system-auth-control

Switch(config)# aaa new-model

Switch(config)# aaa authentication dot1x default group radius

Switch(config-if)# switchport mode access

Switch(config-if)# dot1x pae authenticator

Switch(config-if)# dot1x port-control auto

Like I said, if I restart the NIC, it would go through and authenticate using 802.1x but not sure why it wont work without restarting the NIC everytime.

thanks