topic Re: Cisco ISE and windows 11 in Network Access Control

Cisco ISE and windows 11

R1nzler — Fri, 12 Aug 2022 07:56:34 GMT

hello to all,

does anyone have tested a windows 11 machine with ISE?

I'm testing windows 11 and it does not authenticate automatically.

I have to login to the session and then windows 11 prompt me with the message "action required" and then takes me to the network do manually sign in to the network.

On windows 10 it works perfectly.

Re: Cisco ISE and windows 11

Mark Elsen — Fri, 12 Aug 2022 10:21:49 GMT

- For starters ,what is your ISE version , for ISE 3.1 checkout : https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/compatibility_doc/b_ise_sdt_31.html#microsoftwindows . for the rest you will need to provide more details as to which authentication solutions are being used. If , for instance , there is a supplicant , then is it compatible with Windows 11 ? After explaining all of this , a screenshot may also be helpful.

Re: Cisco ISE and windows 11

Charlie Moreton — Fri, 12 Aug 2022 15:35:44 GMT

How to Ask the Community for Help

Re: Cisco ISE and windows 11

thomas — Mon, 15 Aug 2022 19:46:12 GMT

Yes, Windows 11 works with ISE.

You have not provided any information about how you expect Windows to connect to your network:

network type: wired or wireless?
authentication type: MAB, user authentication, machine authentication?
credentials: pre-shared key, username+password, digital certificate ?

You have not provided any ISE LiveLog error messages to potentially understand what ISE is seeing - if anything - and possibly why it is being rejected.

You have not provided any Screenshots of the actual Windows error.

See

Re: Cisco ISE and windows 11

Benoit Mennesson — Thu, 22 Sep 2022 17:38:42 GMT

Hello, I also have this issue.

We are working with ISE 3.1, the wifi authentification is done via local certificates delivered with Intune CSP. Our windows 11 computer aren't connecting automatically, and also whenever we try to connect to our primary SSID we get the following message (sorry for french) :

Our windows 10 computer are working fine. I've checked the ise live logs, it seems that the Windows 11 computer fall into our "Windows 10 workstation" Endpoint profile

I have tried playing with Regedit to try and disable this function (https://windowsreport.com/wifi-action-needed-windows-10/) but it doesn't seem to work on Windows 11. Are there any ise config requirements know for windows 11 ? Thanks a lot

Re: Cisco ISE and windows 11

Benoit Mennesson — Thu, 22 Sep 2022 17:39:59 GMT

In the live logs I also have the following error message : 5440 Endpoint abandoned EAP session and started new

Re: Cisco ISE and windows 11

ahollifield — Fri, 23 Sep 2022 01:37:31 GMT

Check your wireless NIC Card drivers. Make sure your windows install has the latest hotfixes too.

Re: Cisco ISE and windows 11

Benoit Mennesson — Fri, 23 Sep 2022 11:55:57 GMT

Hello, thanks for the response. I have an intel AX201 wireless card, that has been updated to the latest driver (22.160.0.) I sadly still have the issue, the "Connect automatically" box is checked.

Re: Cisco ISE and windows 11

ahollifield — Fri, 23 Sep 2022 12:01:18 GMT

The other way I've this manifest is bad RF. What does your RF environment look like? Have you done an active survey of your environment? Interference sources, etc.

Re: Cisco ISE and windows 11

Benoit Mennesson — Fri, 23 Sep 2022 12:19:20 GMT

Yes we have had ESI tech do an exit survey after we installed our new 9k cisco ap's, and we followed their recommandation (a lot of them were indeed regarding our RF profiles.)

Our RF profile looks like this currently (for 2.4 and 5ghz) :

We don't have any channel overlap, our tx power is fine, and our RSSI is -75.

Are there specific RF config requirements for Windows 11 we need to do ? Thanks a lot

Re: Cisco ISE and windows 11

ahollifield — Fri, 23 Sep 2022 13:13:55 GMT

No, nothing specific. Does that message say the certificate isn't trusted? Sorry I don't speak French; but if so that is your issue.

Re: Cisco ISE and windows 11

Benoit Mennesson — Fri, 23 Sep 2022 13:32:56 GMT

No problem, the message says the following :
"Continue connecting? If you expect to find ia-secur in this location, go ahead and connect. Otherwise, it may be a different network with the same name." There is also a pop-up windows message that says "Action required" instead of automatically connecting to our wifi.

Re: Cisco ISE and windows 11

ahollifield — Fri, 23 Sep 2022 13:38:19 GMT

Got it, so looks like two profiles for the same SSID are being pushed to the device or the settings in the inTune do not match what security requirements are in place for the SSID (PEAP vs EAP-TLS, computer/user auth, etc.). If you "forget" the network and re-join do you see the same error?

Re: Cisco ISE and windows 11

Benoit Mennesson — Fri, 23 Sep 2022 14:33:11 GMT

We do not have the option to "forget the network", since it is being pushed with certificats via intune csp.

Re: Cisco ISE and windows 11

ahollifield — Fri, 23 Sep 2022 14:53:57 GMT

Yeah then something is wrong with that InTune profile and/or your trusted certificates on the endpoint.

Re: Cisco ISE and windows 11

Benoit Mennesson — Fri, 23 Sep 2022 17:07:36 GMT

The same intune profile is pushed on all of our Windows 10 workstation and there are no issues. So again I ask, are there special config requirements for windows 11 ?

Re: Cisco ISE and windows 11

Benoit Mennesson — Fri, 23 Sep 2022 17:33:17 GMT

We are pushing the same exact intune profile on our windows 10 workstation and there are no issues. Again I ask, are there specific config requirements for windows 11 ?

Re: Cisco ISE and windows 11

ahollifield — Fri, 23 Sep 2022 17:45:08 GMT

From an ISE prospective, no. From an InTune or Windows 11 prospective, maybe?

Re: Cisco ISE and windows 11

Willdozer — Thu, 13 Oct 2022 21:38:18 GMT

I too have the issue with Windows 11 where it prompts with "Action needed" and "You'll need to sign in or take other action go get full network access." except via wired (wireless works just fine). Running ISE 3.1 with the latest patch. On the switch port authentication display it sits at 'dot1x = running' and will run well beyond the dot1x timer setting. Like what was mentioned before, it looks like it is working on authenticating with the 'endpoint abandoned EAP session and started new' but will not continue until I "Sign in" to the network in Windows. I've verified our domain root CA's certificate is listed under the Trusted Root Certification Authorities and yet it seems like Windows does not trust the network.

We opened up a ticket with Microsoft but at this point they've been useless and give no effort in responding in less than a week's time with each email.

We want to start deploying Windows 11 but this is holding it up.

Any help would be appreciated!

Re: Cisco ISE and windows 11

Arne Bier — Sun, 16 Oct 2022 20:30:34 GMT

@Willdozer - do you have some screenshots of the Windows 11 wired supplicant configuration that you're able to post here? You can always obscure any customer sensitive data.