topic Re: ISE 2.7 TEAP windows 10 Remote Desktop fail in Network Access Control

ISE 2.7 TEAP windows 10 Remote Desktop fail

Juan Marilaf Millahual — Mon, 22 Aug 2022 03:07:22 GMT

I have windows 10 with TEAP (mschap-v2) and native windows supplicant, all windows fine with connectivity and ISE. My problem begin when I execute Remote Desktop between PC windows with TEAP 802.1X. Remote Desktop can't works fine and the connection it's not successful.

Microsoft say adjust connection type to "user or computer", but this don't solve it

please someone have an idea?

Re: ISE 2.7 TEAP windows 10 Remote Desktop fail

Ambuj M — Mon, 22 Aug 2022 04:56:13 GMT

so you have 2 PC authenticated with 802.1X and working and when you initiate RDP between them RDP connection it does not work ?

what does your authorization policy looks like ?

Re: ISE 2.7 TEAP windows 10 Remote Desktop fail

Juan Marilaf Millahual — Mon, 22 Aug 2022 05:08:06 GMT

Yes I have two PC with Teap , both with mschap-v2, all is alright but RDP is not works and all PC is in the same network segment no firewall between PC

Re: ISE 2.7 TEAP windows 10 Remote Desktop fail

Ambuj M — Mon, 22 Aug 2022 15:29:11 GMT

what does the authorization policy look like for these PCs ? are you pushing any dynamic ACL as part of authorization or dynamic vlan, any ACL on VLAN SVI ?

Re: ISE 2.7 TEAP windows 10 Remote Desktop fail

Juan Marilaf Millahual — Mon, 22 Aug 2022 16:04:06 GMT

Hi

The DACL is permit ip any any

Re: ISE 2.7 TEAP windows 10 Remote Desktop fail

Ambuj M — Mon, 22 Aug 2022 17:21:32 GMT

I remember reading some limitation on this with windows native supplicant, not able to find the document, do you think you can try with Cisco NAM.

try this workaround with NAM see if it helps.

https://community.cisco.com/t5/network-access-control/unable-to-rdp-to-windows-desktop-after-dot1x-enabled/td-p/4317334

Re: ISE 2.7 TEAP windows 10 Remote Desktop fail

Juan Marilaf Millahual — Mon, 22 Aug 2022 19:09:06 GMT

Hi

Cisco Anyconnect NAM don’t have the option TEAP

😞

Re: ISE 2.7 TEAP windows 10 Remote Desktop fail

Greg Gibbs — Mon, 22 Aug 2022 22:36:27 GMT

As stated in the link shared below, the Windows supplicant does not initiate an 802.1x session when an RDP login happens. The only workaround is to use AnyConnect NAM as the supplicant instead of the native supplicant.
AnyConnect NAM supports EAP-FAST for EAP Chaining. This support actually pre-dates TEAP and was the basis for the standards-based TEAP protocol.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/eap-fast/200322-Understanding-EAP-FAST-and-Chaining-imp.html