topic Re: Strange events after upgrade of Cisco ISE in Network Access Control

Strange events after upgrade of Cisco ISE

donnie — Sun, 02 Aug 2020 00:34:41 GMT

Hi all,

My 802.1x environment consist of 2x Cisco ISE (primary and secondary) units with windows AD.

My AD is configured with GPO which is applied to my users machine to dictate how they would authenticate against my cisco ISE as shown below.

1) using user certificate for authentication for users who are assigned individual PCs.

PC would be authorized to access the network once user cert authentication/authorization succeeds.

2) using machine certificate for authentication for machines which are shared among multiple users.

PC would be authorized to access the network once machine cert authentication/authorization succeeds.

I have upgraded my cisco ISE (cluster of 2x nodes) from v2.4 patch 8 to v2.4 patch 12 (25th july) and then to v2.6 patch 6 on 1st August.

With reference to attached i notice the following peculiar log events in cisco ise that was not there before i embark on my upgrade prior to 25th July.

1) My secondary ISE unit ISE02 was never involved in the authentication or authorization as long as my primary unit ISE01 is working. Ever since the upgrade conducted on 25th July, I started to see "dynamic authorization" by my secondary unit ISE02 in my ISE logs even though ISE01 is working as the active unit. Is this behavior normal?

2) The attached logs shows "Dynamic authorization" succeeded for machine authentication but not user authentication. Is this a concern?

At this moment my users do not feel any impact (lag or disconnectivity) when they authenticate (be it user or machine cert authentication) to my network through 802.1x against my cisco ISE. Please advise what i should do with regards to the dynamic authorization which starts to appear in my logs ever since upgrading my cisco ISE. TIA!

Re: Strange events after upgrade of Cisco ISE

Mohammed al Baqari — Sun, 02 Aug 2020 07:40:09 GMT

Start by confirming that your NAD devices aren't sending authentication
requests to ISE02. This can be one of the causes. Also, ensure that both
ISE nodes are having the same system certificates.

If user authentication is failing on ISE02 this will be a problem in case
of the failover (or ISE01 is down) cause users won't be able to connect.

***** please remember to rate useful posts.

Re: Strange events after upgrade of Cisco ISE

Marvin Rhoads — Mon, 03 Aug 2020 12:01:59 GMT

In an ISE deployment all nodes with the PSN role are active and able to handle authentications. That's independent of which node is in the primary or secondary PAN or MnT role.

Some NADs (e.g. ASAs) will fall back to using the second configured aaa server (= ISE PSN) when it sees a failure of the first one and not fail back unless you manually change it (or it sees a subsequent failure of the second node).

Re: Strange events after upgrade of Cisco ISE

donnie — Tue, 04 Aug 2020 03:02:40 GMT

Hi Marvin,

With reference to my attached logs, there were no failure of any kind for my primary node. But "dynamic authorization failed" is still seen on my secondary node which is puzzling.

Re: Strange events after upgrade of Cisco ISE

thomas — Tue, 11 Aug 2020 22:31:44 GMT

"Dynamic Authorization" is referring to the RADIUS CoA process.

I did a quick Excel Pivot Table with your CSV and found that all of the failures are happening on ISE02 with your NAD @ 192.168.210.51.

	Fail	Pass
192.168.164.95	1	21
Authentication failed	1	0
ISE01	1	0
Authentication succeeded	0	21
ISE01	0	21
192.168.210.51	70	0
Dynamic Authorization failed	70	0
ISE02	70	0

I would suggest verifying your NAD configs match with respect to RADIUS CoA:

aaa server radius dynamic-author
 client {ISE01_IP} server-key {key} 
 client {ISE02_IP} server-key {key