Windows 10 devices can't connect to an 802.1X environment

PNW Weer — Mon, 05 Mar 2018 13:22:46 GMT

Windows 10 devices can't connect to an 802.1X environment (November Update)

https://support.microsoft.com/en-gb/help/3121002/windows-10-devices-can-t-connect-to-an-802-1x-environment

Please advise me the fix release on Cisco ISE to mitigate above issue.

I am intending to upgrade to version 2.0 from version 1.4, , according to Microsoft ISE version 2.0.0.306 patch 1 is effected,

thanks

Re: Windows 10 devices can't connect to an 802.1X environment

hslai — Mon, 05 Mar 2018 20:35:21 GMT

The Microsoft support help pages might be either giving confusing or incorrect info.

ISE 2.0 FCS without patches is impacted. ISE 2.0 Patch 1 is the one providing the fix for this issue.

See Resolved Issues in Cisco ISE Version 2.0.0.306—Cumulative Patch 1

Table 12 Cisco ISE Patch Version 2.0.0.306—Patch 1 Resolved Caveats

Caveat	Description
CSCuw88770	ISE 2.0 PEAP TLS 1.2 wireless authentication fails with Android 6 and Win 10. This issue occurred because in TLS 1.2, the mechanism of MPPE keys generation has been changed for EAP-TLS, PEAP, and EAP-TTLS. EAP-FAST is not affected. Symptom: Authentication reports from logs show that the authentication is successful; however, the state on the WLC of the client session is dot1x required. Wireless packet captures reveal that 4-way handshakes following EAP-success are not completing, either M1 and M2 or M1 only. Conditions: This issue occurs when a combination of the following conditions are true: If you have Cisco ISE, Release 2.0 FCS version with no patch installed. Wireless LAN with L2 security configured for WPA2 Enterprise. A device with Android 6 or Windows 10 version 1511 tries to authenticate. Protocols used are PEAP or TTLS or EAP-TLS Workaround: For Android, none. You cannot configure TLS version from Android client or Cisco ISE For Windows 10 clients, you may disable TLS 1.2 and enable TLS 1.0: – Create DWORD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13\TlsVersion and set the associate DWORD value to C0. – Restart EapHost service.

Caveat

Description

CSCuw88770

ISE 2.0 PEAP TLS 1.2 wireless authentication fails with Android 6 and Win 10.

This issue occurred because in TLS 1.2, the mechanism of MPPE keys generation has been changed for EAP-TLS, PEAP, and EAP-TTLS. EAP-FAST is not affected.

Symptom: Authentication reports from logs show that the authentication is successful; however, the state on the WLC of the client session is dot1x required. Wireless packet captures reveal that 4-way handshakes following EAP-success are not completing, either M1 and M2 or M1 only.

Conditions: This issue occurs when a combination of the following conditions are true:

If you have Cisco ISE, Release 2.0 FCS version with no patch installed.
Wireless LAN with L2 security configured for WPA2 Enterprise.
A device with Android 6 or Windows 10 version 1511 tries to authenticate.
Protocols used are PEAP or TTLS or EAP-TLS

Workaround:

For Android, none. You cannot configure TLS version from Android client or Cisco ISE
For Windows 10 clients, you may disable TLS 1.2 and enable TLS 1.0:

– Create DWORD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13\TlsVersion and set the associate DWORD value to C0.

– Restart EapHost service.

topic Re: Windows 10 devices can't connect to an 802.1X environment in Network Access Control

Windows 10 devices can't connect to an 802.1X environment

Windows 10 devices can't connect to an 802.1X environment (November Update)

Re: Windows 10 devices can't connect to an 802.1X environment