"no sessions match supplied criteria" on a dot1x enabled interface

umahar — Mon, 18 Apr 2016 12:54:37 GMT

Hello,

We are seeing some strange behaviour on Catalyst 4K SUP 8 running 03.06.04.E

1. One configuring the below interface commands the machine is denied access as "no sessions match supplied criteria" message is displayed by issuing "show authentication session interface gi4/15 de" command.

2. The ISE logs show that the machine is trying to authenticate via MAB.

By removing dot1x configuration everything is working.

interface GigabitEthernet4/15

switchport access vlan 912

switchport mode access

switchport voice vlan 942

ip access-group Dot1x_Preauth_Restricted_IN in

logging event link-status

authentication event fail action next-method

authentication host-mode multi-auth

authentication open

authentication order dot1x mab

authentication priority dot1x mab

authentication port-control auto

authentication violation replace

mab

no snmp trap link-status

dot1x pae authenticator

dot1x timeout tx-period 10

dot1x max-reauth-req 1

storm-control broadcast include multicast

storm-control broadcast level 0.10

spanning-tree portfast

spanning-tree bpduguard enable

end

The endpoint is correctly configured with dot1x. After stopping wired autoconfig "no sessions match supplied criteria" is displayed again even though we should be expecting MAB.

It seems to be an issue with a particular machine as other machines are able to authenticate from the same port.

However shouldn't the switch still be able authenticate the machine via MAB if for some reason the supplicant is corrupted ?

Please let me know if anyone has encountered the same issue.

Thanks,

Utkarsh

Re: "no sessions match supplied criteria" on a dot1x enabled interface

howon — Wed, 20 Apr 2016 04:32:19 GMT

I suggest downgrading the IOS on the switch. Current recommended version for Cat 4500 Sup8 is 3.6.3 per Cisco Identity Services Engine Network Component Compatibility, Release 2.0 - Cisco

Re: "no sessions match supplied criteria" on a dot1x enabled interface

umahar — Thu, 12 May 2016 06:31:00 GMT

The issue was solved by Windows team by applying Windows patches.

Re: "no sessions match supplied criteria" on a dot1x enabled interface

kngitonga — Wed, 30 May 2018 16:45:17 GMT

Which windows OS was this? I might be having the same problem with windows 10 on Wired Dot1x

topic Re: "no sessions match supplied criteria" on a dot1x enabled interface in Network Access Control

"no sessions match supplied criteria" on a dot1x enabled interface

Re: "no sessions match supplied criteria" on a dot1x enabled interface

Re: "no sessions match supplied criteria" on a dot1x enabled interface

Re: "no sessions match supplied criteria" on a dot1x enabled interface