topic Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x in Network Access Control

Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Mon, 30 Mar 2020 13:56:46 GMT

hello everyone

I have a problem guys,

1 piece standalone cisco ise v2.4 I use it in the building

500 to 800 users are working

''now; map authentication side is actively working now ''

anyconnect is installed on all computers and config is ready,

and when I activate the ports on the switch, I see that there is authentication on it

so the system is working'

but

there is no authentication at all when I restart computers,

running system before restarting computers
does not work after restarting computers

authentication does not work when I restart computers

and non-authentication users

anyconnect software asks for username and password

Meanwhile, I upgraded the patch updates

I made switch firmware updates

and there are switches operating in different brands

juniper,alcatel,huawei

I request your support on this matter, friends

thanks,

I'm transmitting the config information in the attachment,

'''

aaa authentication login default group XX_tacacs local
aaa authentication login console local
aaa authentication login CONSOLE none
aaa authentication dot1x default group radius
aaa authorization config-commands
aaa authorization exec default group XX_tacacs local if-authenticated
aaa authorization exec CONSOLE none
aaa authorization commands 1 default group XX_tacacs local if-authenticated
aaa authorization commands 15 default group XX_tacacs local if-authenticated
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting update periodic 5
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
aaa accounting exec default start-stop group baro_tacacs
aaa accounting commands 1 default start-stop group XX_tacacs
aaa accounting commands 15 default start-stop group XX_tacacs

'''

port config

interface GigabitEthernet1/0/3
switchport mode access
switchport voice vlan 40
switchport port-security maximum 2
switchport port-security maximum 1 vlan access
power inline port 2x-mode
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 1
spanning-tree portfast
spanning-tree bpduguard enable

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

thomas — Tue, 31 Mar 2020 00:35:59 GMT

NEVER use Port Security with 802.1X.

You must disable Port Security if you want to use 802.1X.

'authentication host-mode multi-domain' will ensure you only have 1 endpoint each on the Voice VLAN and Data VLAN.

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Cristian Matei — Tue, 31 Mar 2020 06:40:04 GMT

Hi,

As you're running multi-domain mode, do your computers attach to the IP Phones, or directly to the switch? Also, you should be removing port-security, as the moment you have authentication configured on the port, port-security is kinda built-in, and based on the host mode, one or multiple MAC addresses are allowed.

What is the OS on your computers, and do you use the native supplicant or AnyConnect NAM module?

Regards,

Cristian Matei.

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Tue, 31 Mar 2020 11:43:39 GMT

you have to use it for computer and ip phone connections,
my problem has nothing to do with it,
my problem with anyconnect software
thanks 🙂

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Tue, 31 Mar 2020 11:46:46 GMT

yes,running multi-domain mode
my phones are already working in this case (My 800 phones work this way)

win10 and xp
yes, AnyConnect NAM module I use
anyconnect is already running

friends,
My problem
when i restart computers
anyconnect authentication does not happen

thanks 🙂

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

thomas — Tue, 31 Mar 2020 17:04:41 GMT

Then what is your AnyConnect configuration?

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Wed, 01 Apr 2020 14:37:46 GMT

hi thomas

I'm sending in the attachment

@thomas wrote:
Then what is your AnyConnect configuration?

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Wed, 01 Apr 2020 14:36:18 GMT

I'm sending in the attachment

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Sat, 18 Apr 2020 23:32:42 GMT

Hello friends ,

are there any experienced and knowledgeable friends to help me ?
none of you have faced this problem ?
someone must have encountered this problem

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

poongarg — Sun, 19 Apr 2020 02:36:58 GMT

Can you check below setting on NAM under Client Policy, if the Connection Attempt is selected as "After user login"

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Sun, 19 Apr 2020 13:18:42 GMT

thank you for your answer buddy

settings this way

what is it supposed to be ??

can you send me a sample that works smoothly ?

thank you

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Wed, 22 Apr 2020 15:50:36 GMT

there are so many ccie here nobody know what this problem is

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Fri, 08 May 2020 21:13:55 GMT

hello to everyone
is there anyone knowledgeable to help me with this ?

if possible, friends who work in complex structures and build structures !

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

thomas — Tue, 12 May 2020 20:49:10 GMT

Did you disable Port Security on the switchports first then try AnyConnect?

802.1X and Port Security will fight for control of the port.

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Mike.Cifelli — Wed, 13 May 2020 11:33:12 GMT

I agree with others that you should not enable port sec on the port/s when using dot1x. Please flip your NAM profile to 'Connection Attempt Before Login' and share results. Another mechanism you could test as a possible solution is to configure a machine only network profile as fallback. In this scenario, once a user is logged off the network connection is terminated, and then NAM uses the next network profile (machine auth only) to connect back to the network. Perhaps in this scenario into a restricted network. Make sure for your original test that you have the proper policy conditions setup in ISE authz policies. On a computer reboot your eapchaining result should equal user fail:computer pass. HTH!

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Wed, 13 May 2020 13:03:03 GMT

hi mike
thanks for your answer

I tested it with network profile without using anyconnect nam but it does not connect to network when restart

İSE If there was an incorrect configuration done, no connections could be made ? (is it correct)

Whether the port is security or not, it needs to be authentication, (I think that there is no factor preventing authentication when I turn the PC off and on)

I probably tried the switch side config, but I also encountered the same problem with switches of different brands

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Mike.Cifelli — Wed, 13 May 2020 14:00:34 GMT

I tested it with network profile without using anyconnect nam but it does not connect to network when restart
-What I meant was configure another network profile for NAM to use after the first one fails. See screenshot. Setup the second one for machine auth only via eap-tls. If you decide to test this I am willing to bet you will need to make allowed protocol adjustments in ISE.

İSE If there was an incorrect configuration done, no connections could be made ? (is it correct)
-No. Dot1x connection attempts can still be made, but if policy is wrong it could cause onboarding issues.
Whether the port is security or not, it needs to be authentication, (I think that there is no factor preventing authentication when I turn the PC off and on)
I probably tried the switch side config, but I also encountered the same problem with switches of different brands
Please run the tests again (reboot) and debug on switch & share debug output:
debug dot1x all
debug authentication all
debug aaa authentication

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Thu, 14 May 2020 10:16:37 GMT

hi thomas
What does it have to do with Port Security?
anyconnect agent does not look at port security

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

Yunus Emre DEV — Thu, 14 May 2020 10:34:57 GMT

hi mike
Thank you for the answer

I tried it without installing anyconnect
I tried activating wired 802.1x from windows services and I tried it that way it didn't work again (it worked, but when I restarted the computer it didn't authenticate)

Can you check if there is an error if I send the configuration (ISE configuration) ?

Or can you pass me the config of any working place? (ISE configuration) ?

thank you

Re: Cisco ise 2.4 anyconnect all windows restart authentication failed dot1x

thomas — Sun, 17 May 2020 00:35:40 GMT

It's time to call TAC.

In the future, please provide relevant configurations and errors in the beginning of your post to make it faster and easier for people to provide suggestions. See How to Ask The Community for Help.