topic What is the exact model of in Network Access Control

Machine authenticatiion not working after upgrade to ISE 1.2

Cristian Popescu — Mon, 11 Mar 2019 05:39:17 GMT

After upgrading to ISE 1.2.0.899 patch 14 we have a problem running machine authentication for a few hosts (30 of about 3000).

Although we can see on the switch that the host presents the hostname, in ISE Operations all we get is the MAC address (for both the Identity and Endpoint ID fields).

On the switch:

show auth sessions int FastEthernet0/1
Interface: FastEthernet0/1
MAC Address: 3c97.0eed.afbc
IP Address: Unknown
User-Name: host/xxxxxxxxxx
Status: Running
Domain: UNKNOWN
Oper host mode: multi-auth
Oper control dir: both
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0AF19F16000138DC11B59C9D
Acct Session ID: 0x000292EA
Handle: 0x01000BCA

Runnable methods list:
Method State
mab Failed over
dot1x Running

In ISE we see the contents of the attached file.

The workaround we found was to move the host in a different switch, where it will authenticate, and then move it back on the initial switch where it will work now. I know it doesn't make sense but it worked...

Shut / no shut on the switch port or clearing the auth session doesn't work.

Does anybody have any idea about this problem?

Thanks in advance!

Update:

The issue seems to be related with how the policy servers cache the sessions/auth requests from the network devices. If we point the network device that hosts the problematic machines to another radius server the auth runs as expected. A number of machines have problems with a certain policy server (not always the same) while most machines authenticate correctly. The problem is that if, for whatever reason,a machine fails to auth, that policy server could "decide" to hang to that failed auth result for susequent tries.

What are the types (models)

Charlie Moreton — Mon, 20 Apr 2015 14:50:25 GMT

What are the types (models) of switches and the software versions running on them?

Catalyst 4500 version 03.04

Cristian Popescu — Mon, 20 Apr 2015 15:42:03 GMT

Catalyst 4500 version 03.04.03.SG

Cisco 2960 version 12.2(46r)SE2

On which switch does the

Charlie Moreton — Mon, 20 Apr 2015 20:28:06 GMT

On which switch does the reauthentication work?

Either way, it looks like you need to update the switch software:

This is from the ISE 1.2 Compatibility Matrix which can be found here:

https://supportforums.cisco.com/sites/default/files/attachments/discussion/4500.png

Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.

Charles Moreton

We also have a 2960 with the

Cristian Popescu — Tue, 21 Apr 2015 06:16:01 GMT

We also have a 2960 with the same problem running 15.0(2)SE1

The 4500 looks supported with Version 03.04.03.SG

We also have a 2960 with the

Cristian Popescu — Tue, 21 Apr 2015 06:33:51 GMT

We also have a 2960 with the same problem running 15.0(2)SE1

The 4500 looks supported with Version 03.04.03.SG

What is the exact model of

Charlie Moreton — Tue, 21 Apr 2015 15:17:16 GMT

What is the exact model of the 2960?