topic Re: Windows 8 and 10 authentication failed in Network Access Control

Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Fri, 21 Feb 2020 18:44:44 GMT

Hi,

I have authentication problem with windows 8 and 10 clients in ISE 2.2.

Windows 8 and windows 10 clients can not have access to the network at the first authentication. We must lockout and unlock to have access to the network. I used external identity store which is Active Directory.

I have made ISE 2.2 downgrade to ISE 2.1 and ISE 2.2 upgrade to ISE 2.3, but I am still have the same issue. I have contacted tac but they told me it is a windows issue but I am not sure about it because wiindows 8 and 10 clients works in other offices.

Please can you help me?

Best Regards,

Aristide AKAFFOU

Re: Windows 8 and 10 authentication failed

Mark Elsen — Thu, 01 Feb 2018 17:56:19 GMT

- what's in the live logs, then,for the first auth attempt from the particular windows server

- for ise2.2. upgrade to the latest patch level

- >TAC says it's a windows issue : well if they say that, then they must earn their money and and also explain to you what the windows issue is (nice to ask!)

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Thu, 01 Feb 2018 18:06:08 GMT

Hi marce1000,

In live logs, we have error 5411: supplicant stop responding.

Now I don't think it is an upgrade issue. We used all the version.

Tac don't say anymore to help to resolve the issue.

Best Regards

Re: Windows 8 and 10 authentication failed

Mark Elsen — Fri, 02 Feb 2018 08:00:06 GMT

- Then you need to look at possible issues concerning the supplicant; 1) which software-vendor is it ? 2) is it certfied to be compatible with cisco-ise+win8-10 ? 3) are there any patches for it , possibly helping to resove this issue? 4) Can you contact the supplicant software-vendor and report this issue ?

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Fri, 02 Feb 2018 09:44:09 GMT

Hi,

I have configured windows 10 and 8 clients for authentification and I used Cisco NAC agent and cisco anyconnect network access manager.

Can you please tell me more about windows supplicant?

Best Regards,

Aristide

Re: Windows 8 and 10 authentication failed

Mark Elsen — Fri, 02 Feb 2018 09:57:09 GMT

- I am only talking about the Cisco NAC Agent then; same reasoning applies; isthe version you are using compatible with win8 or win10 (check release notes, version info and or contact CISCO).

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Fri, 02 Feb 2018 10:56:33 GMT

Thanks for your reply.

In the release they use Cisco NAC agent version 4.9.5.8, 4.9.5.7, 4.9.5.6. But I used NAC agent version 4.9.5.10. Do you think this is a issue?

Best Regards,

Aristide

Re: Windows 8 and 10 authentication failed

Mark Elsen — Fri, 02 Feb 2018 12:25:44 GMT

- It think the only way to find out, is to remove the existing agent from a windows-test-host; install one of those working releases and check if it works (then).

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Mon, 05 Feb 2018 10:37:51 GMT

Hello,

Thanks marce, I made all of this changes about cisco nac agent version, and i have made also windows 10 update, but I encountered the same issue.

Best Regards,

Aristide AKAFFOU

Re: Windows 8 and 10 authentication failed

Mark Elsen — Mon, 05 Feb 2018 12:08:20 GMT

- Check your windows hosts's eventlog (app, system,...) ; look for errors (if any) concerning the supplicant (software) around the timeframe, that ISE says in the live-logs, that it is no longer responding

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Mon, 05 Feb 2018 14:48:06 GMT

Hi,

You can see in attached the windows live logs about the issue.

Best regards,

Aristide

Re: Windows 8 and 10 authentication failed

Mark Elsen — Mon, 05 Feb 2018 16:06:31 GMT

- I am worried about the NTP error ; time sync is crucial also for do1x and ise. Make sure the windows host has a valid and working/usable NTP source.

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Mon, 05 Feb 2018 16:16:11 GMT

Hi marce,

So I have to configure ntp server for the windows clients?

Re: Windows 8 and 10 authentication failed

Rob Ingram — Mon, 05 Feb 2018 17:37:12 GMT

Yes, it's important that a windows computer's time is in sync, for instance you'll be using certificates and if you time/date is incorrect on the windows client you won't be able to validate the certificate. You need to resolve those Windows errors before attempting 802.1x authentication.

Are you in dot1x closed mode? The error messages you provided indicated that the computer cannot communicate with the domain.

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Mon, 05 Feb 2018 17:54:20 GMT

Hi RJI,

Thanks for your reply. I am not in closed mode.

Best regards,

Aristide

Re: Windows 8 and 10 authentication failed

Mark Elsen — Mon, 05 Feb 2018 18:01:56 GMT

- Sure ! This is a must as RJI relies ; note also however that this also applies to the complete authenticationg infrastructure (from switch -> ise -> identity store).. They all must have a correct timezone and working NTP setup.

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Mon, 05 Feb 2018 18:14:52 GMT

thanks marce,

It's work very fine for windows 7 without this changes. Ok I understand i will do the modifications and I will back to you.

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Fri, 09 Feb 2018 10:38:14 GMT

Hi all,

I have resolved the issue

Firstly I have configured native supplicant profile on cisco ISE.

Secondly, I uncheck "Enable single sign-on for this network" in the supplicant windows configuration. Finally all is work fine now.

Best Regards,

Aristide AKAFFOU

Re: Windows 8 and 10 authentication failed

kamlenegi — Mon, 16 Jul 2018 16:26:46 GMT

Hello Aristide,

Have you fixed your issue?

I am facing same issue in client environment, we are not using certificate base auth, using dot1x auth from AD only.

Thanks

Kamlesh

Re: Windows 8 and 10 authentication failed

Akaffou Aristide Akaffou — Mon, 16 Jul 2018 16:52:23 GMT

Hello kamlenegi,

I have fixed this issue. I have just reconfigured windows supplicant for windows 10.

Just uncheck " Enable single sign on for this network" on the supplicant configuration.

You have to disable port security on the switch too, if it is enable.

Best Regards,

Aristide