topic Thanks Jan, in Network Access Control

Authentication issues in ISE 2.0 deployment

kamlenegi — Mon, 11 Mar 2019 06:55:06 GMT

Hello All,

We have deployed ISE 2.0 for wired & wireless users. Now we are increasing users in LAN and facing more problems, can someone help us to fine tune ISE auth parameter. Issues are:

1. Sleep mode domain systems goes in mab authentication and stuck in preauth vlan which should be dot1x. After unplug & plug the lan cable then it works and dot1x success. Everyday users come in the morning and need to unplugged & plugged the lan cable which is not a solution.

2. IP address conflict message seems in may system after authentication success, can we do fine tune ISE for this.

3. Some systems wired auto config goes stop automatically and windows supplicant stop working.

Please help us to do the best practice configuration.

Thanks

Kamlesh

Hello Kamlesh, my comments

nspasov — Fri, 22 Jul 2016 16:26:51 GMT

Hello Kamlesh, my comments below:

1) What type of machines and what type of Operating System are running on them

2) Who is handling the IP address assignment in your network? This sounds like a DHCP configuration issue rather than ISE.

3) Are you turning the auto config client via GPO? If so, have you confirmed that there aren't conflicting policies that might be causing this? Event viewer should give you more info on why and who turned that service off.

I hope this helps!

Thank you for rating helpful posts!

IP address conflict is

jan.nielsen — Sun, 24 Jul 2016 10:42:20 GMT

IP address conflict is usually caused by a windows flaw, it can be solved with :

ip device tracking probe delay 10

http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/8021x/116529-problemsolution-product-00.html

Hi Neno,

kamlenegi — Sun, 24 Jul 2016 16:25:38 GMT

Hi Neno,

We are using Windows 7 & 10 machines, maximum are win7. IP address is assigning from Window DHCP server.

How I can check auto config client via GPO?

Thanks

Kamlesh

Thanks Jan,

kamlenegi — Sun, 24 Jul 2016 16:26:30 GMT

Thanks Jan,

Let me configure & observe.

Thanks

Kamlesh

Dear kamlesh,

lajan jaleel — Mon, 25 Jul 2016 11:41:50 GMT

Dear kamlesh,

Are you using anyconnect supplicant for authentication or you are using Windows native Authentication for Dot1x.

Also Could you please post the ISE policies for reference.

Thanks & Regards,

LAJAN JALEEL