topic Re: Cisco ISE and Intel AMT $iME in Network Access Control

Cisco ISE and Intel AMT $iME

leighharrison — Mon, 04 Apr 2022 15:23:05 GMT

Hello folks,

We've got an issue using dot1x on 9300's that when a PC goes into sleep mode, the Intel NIC spits out "domain\hostname$iME" as a radius hostname, which fails auth.

Is there a trick to getting these things to authenticate? I've had a look at matching with a "starts with 'domain'" AND ends with "$iME", but that doesn't seem to work. It looks from the log like the NIC is failing TLS?

Anyone seen this and got some tips?

Best, Leigh

Re: Cisco ISE and Intel AMT $iME

Arne Bier — Tue, 05 Apr 2022 00:52:05 GMT

The EAP-FAST looks suspiciously like AnyConnect NAM - are you using Cisco AnyConnect by any chance?

Are you saying this happens before the laptop eventually goes to sleep, or after it wakes up from sleep?

Does the rest of your 802.1X work as expected? How is your supplicant configured?

Normally, when you see host/xxxx in the RADIUS User-Name then it indicates that the Windows host is trying to perform Computer authentication. This happens during the PC boot up and also during the Windows user log off process.

Re: Cisco ISE and Intel AMT $iME

Mike.Cifelli — Tue, 05 Apr 2022 19:29:48 GMT

I am with @Arne Bier on this one with the thought that NAM is in use simply because EAP-FAST is shown. Take a look at the configured unprotected identity patterns defined in the NAM profile. Wondering if that may have anything to do with what you are seeing. Pretty sure the default is set to anonymous, but worth a shot to check a box.