topic Re: Explicit Eap failure received, EAP Error: 0x80420014 in Network Access Control

Explicit Eap failure received, EAP Error: 0x80420014

skc455 — Sat, 19 Sep 2020 07:36:45 GMT

Hello, need some inputs on how to solve this issue. We currently have ise 2.6 implementing wireless 802.1x using windows supplicant. Currently performing peap using certificates. Auto enrolled certs to be issued to user and computer via gpo and on supplicant we are using user or machine authentication. Here is the issue: My laptop has my user and machine cert already installed so I can see both machine auth user auth happening on ISE, but when another user tries to login to my laptop it disconnects from wifi not allowing the user to get his certificate. I see no authc failures in ise but in wlan-autoconfig logs in supplicant I see:

Identity: NULL
User: abc
Domain: xyz
Reason: Explicit Eap failure received
Error: 0x80420014
EAP Reason: 0x80420100
EAP Root cause String: Network authentication failed\nThe user certificate required for the network can't be found on this computer.

EAP Error: 0x80420014

Its like a chicken or egg situation, without cert user cant get access to corp wifi network, in order to get cert user needs access to corp wifi. How can this issue be resolved?

Re: Explicit Eap failure received, EAP Error: 0x80420014

thomas — Tue, 22 Sep 2020 04:28:30 GMT

How did you get your user certificate installed on the PC originally?

Was it manually installed or did you allow non-certificate authentication (EAP-MSCHAPv2) to then provision it with limited access?

Re: Explicit Eap failure received, EAP Error: 0x80420014

skc455 — Tue, 22 Sep 2020 15:14:02 GMT

It was installed via GPO by connecting to wired network.

Re: Explicit Eap failure received, EAP Error: 0x80420014

thomas — Tue, 22 Sep 2020 15:58:09 GMT

Then allow your users limited access when authenticating via username/password to get on the network and connected to the AD domain controller to get the necessary Group Policy Objects (GPOs) pushed including a user certificate so they can re-connect with a user cert with full access.