topic Re: Wireless with ISE, the process stop in Network Access Control

Wireless with ISE, the process stop

naoki_Japan — Mon, 27 Sep 2021 08:13:47 GMT

I wanna introduce the combination of machine authentication and dot1X with ISE via AD using wireless and wired.

To do that, I separated authorization rule into two parts "almost like" below.(off courser, I use Wired or Wireless dot1X with Authentication field)

1 AD_LOGIN_COMPUTER

if AD:External group equals AD/Users/Domains Computers and

Radius:NAS-Port-Type Equal Ethernet ※(Wireless - IEE802.11 )

......

then

.....

2. AD_LOGIN_USERS

if AD:External group equals AD/Users/Domains Users and

Radius:NAS-Port-Type Equal Ethernet ※(Wireless - IEE802.11 )

Network Access: WasMachineAuthenticated Equals True

then Permit all

As for wired users, they are successfully authenticated with the order, machine authentication → user authentication.

However, for wireless users, they are authenticated only with machine authentication. I do not know why user authentication process is not processed.

Is there anyone teach me the solutions?

Re: Wireless with ISE, the process stop

Mike.Cifelli — Mon, 27 Sep 2021 12:52:55 GMT

However, for wireless users, they are authenticated only with machine authentication. I do not know why user authentication process is not processed.

-Please share additional information so the community can better assist. The following items are things to share/consider:

--A Radius live log from successful wired and failed wireless session.

--Type of supplicant being used? Version of ISE?

--I would generate a DART bundle from troubled wireless client unable to properly onboard as expected and parse logs.

Re: Wireless with ISE, the process stop

Dustin Anderson — Mon, 27 Sep 2021 20:50:27 GMT

You would need to check the 802.1x settings for wireless. We use similar for wireless PCs and get machine when they are not logged in and user when logged in, but 802.1x needs to be set to user or computer, not just computer.

Re: Wireless with ISE, the process stop

naoki_Japan — Tue, 28 Sep 2021 06:03:26 GMT

As I re-confirmed the setting of wireless PC, I found my mistake.

Thank you for your support!

Re: Wireless with ISE, the process stop

naoki_Japan — Tue, 28 Sep 2021 06:05:12 GMT

As you advised, I re-checked the setting of devices and found miss-configuration on my PC.

Thank you for big help