topic Re: Event 5400 Authentication failed with 22056 Failure in Network Access Control

Event 5400 Authentication failed with 22056 Failure

latenaite2011 — Tue, 08 Nov 2022 17:40:29 GMT

Hey everyone,

Just wondering if anyone knows why a user would get a Event 5400 Authentication failed (Failure Reason is 22056 Subnet not found in the applicable identity store(s). The laptop has just gone through a successful authentication and switched to a docking station (to test how a normal user would do) and we're testing this new configuration now.

In the live logs, we can see it switched from 802.1x to MAB and not sure why if it just worked with 802.1x about several minutes ago.

See attached snapshots. This is a new setup. Not sure if the mac address is still in the cache so it is not prompting to re-authenticate.

Re: Event 5400 Authentication failed with 22056 Failure

Thomas Schmitt — Tue, 08 Nov 2022 18:45:35 GMT

I didn't read your trace, but just from idea - after successful dot1x authentication an endpoint with the MC of the endpoint was created on the ISE, but docking station has another MAC address, so you got disconnected.

Re: Event 5400 Authentication failed with 22056 Failure

latenaite2011 — Tue, 08 Nov 2022 19:45:43 GMT

Thanks for the reply Thomas.

I did ask if the docking station has a different network adapter but it doesn't. Customer connects the laptop docking station that connects to the laptop using a USB C. The connection worked with the docking station at first then when he connected it, it wouldn't work anymore. Since the laptop doesn't have any physical network, he uses the docking station to connect. You can see the Live logs that the mac address is the same for the successful and the failed attempt.

Thanks!

Re: Event 5400 Authentication failed with 22056 Failure

thomas — Fri, 11 Nov 2022 21:59:27 GMT

You redacted the user/host information so I don't know if you are doing the same user/host for all of these.

Capture 1 is doing EAP-TLS which is certificate based authentication.

Capture 2 is doing PEAP+EAP-MSCHAPv2 which is username+password authentication.

Capture 3 is doing MAB and failing because the MAC Address was not found in ISE (it has never been seen before).

If you want to allow new (never-before-seen) MAC addresses onto your network, you should change the authentication policy of your respective Policy Set to simply Continue if User Not Found:

Re: Event 5400 Authentication failed with 22056 Failure

hslai — Sun, 13 Nov 2022 18:32:29 GMT

@latenaite2011

I would suggest the following:

verifying ISE working with other use cases
trying another switch port, in case the switch port gone bad
trying another docking station, in case the existing docking station is bad or has a bad network interface
trying rebooting the PC and trying another PC, in case something wrong with the client O/S