topic Re: ISE 2.3 randomly does not authenticate users in Network Access Control

ISE 2.3 randomly does not authenticate users

katerina.dardoufa — Thu, 11 Apr 2019 11:31:12 GMT

Hello all,

we are running ISE 2.3 with patch 6. I tried to add some new devices to authenticate via tacacs+, but ISE does not always authenticate the users. In the tacacs live logs, I do not see the username that was manually entered, but instead of that I see "username#random_number#", which was clearly not entered!

Any ideas?

Re: ISE 2.3 randomly does not authenticate users

Timothy Abbott — Thu, 11 Apr 2019 16:26:04 GMT

Hi,

I recommend you work with the TAC to investigate this issue further. It could be an issue with the network access device or ISE.

Regards,

-Tim

Re: ISE 2.3 randomly does not authenticate users

katerina.dardoufa — Fri, 19 Apr 2019 14:06:01 GMT

Hello Tim,

I was able to find what is causing the issue. The problem is with Nexus 7K with 7 VDCs. If the first attempt to authenticate to the device is unsuccessful (wrong password), then when trying for the second/third time, the tacacs logs show username followed by #vdc_number# for the second attempt, #vdc_number##vdc_number# for the third attempt and the device responds with "too many authentication failures". If I then login with the correct credentials everything is ok.

The question is why the devices adds #vdc_number# to the username, causing ISE to fail?

Thank you in advance,

Katerina