topic Wired EAP-FAST User Machine authentication in Network Access Control

Wired EAP-FAST User Machine authentication

ansarjavaid54 — Sun, 31 Mar 2019 08:15:22 GMT

Dears,

I am trying to authenticate my domain PC's/users with ISE and am using Any-connect 4.2 with eap-fast user and machine authentication.

Everything was working with window 7 until I re-image two nodes from 1.4 to 2.2 and restore ISE configs. I have window 7 which is in process to upgrade to window 10.

ISSUE:
1. After signing out window 10 machine authentication is happening and getting right result but after signing in with domain user posture is not working after looping its saying no policy server found. For it to work i have to click on NAM profile once more to re authenticate and in that case its starting its posture check.

2. Some machines are not even authenticating even i did restart, sign out. No session is showing on switch-port.
3. Some machine on authentication getting IPV6 logo only because we are not using IPv6 in the environment.

Re: Wired EAP-FAST User Machine authentication

Mike.Cifelli — Mon, 01 Apr 2019 15:26:52 GMT

Try using NAM profile editor to change configuration.xml to enable port exceptions (allow data traffic before authentication). Are you performing VN or vlan changes during the authz process? For example, restricted access in one vlan until posture status is compliant.

Re: Wired EAP-FAST User Machine authentication

bassam — Tue, 02 Apr 2019 18:25:41 GMT

Hi Mike.

Thank you for the reply. Yes suggested option is already enabled and am using dACL to restrict instead of VLAN.

Re: Wired EAP-FAST User Machine authentication

ansarjavaid54 — Tue, 02 Apr 2019 18:32:09 GMT

"Ansar"