topic Re: After ISE 3.2 patch-3 External Authentication stopped working in Network Access Control

After ISE 3.2 patch-3 External Authentication stopped working

dan.l.smith — Wed, 23 Aug 2023 19:07:20 GMT

Currently running ISE 3.2 patch2, after installing patch 3 external authentication stops working for all devices as well as logging into the ISE itself. Internal local login still works. While logged in with the local account the external indentities diag tool shows all green and test users function is successful. however the web ui and devices still do

After rolling back to Patch 2 everything works again.

Re: After ISE 3.2 patch-3 External Authentication stopped working

balaji.bandi — Wed, 23 Aug 2023 20:05:22 GMT

May be worth opening TAC case to investigate for you.

Re: After ISE 3.2 patch-3 External Authentication stopped working

thomas — Thu, 24 Aug 2023 17:35:48 GMT

You have provided no specific error messages or logs or anything for us to help you. "external authentication stops working" is not an actual error and could be anything.

Please see and try again or submit your case to TAC and they may spend the time collecting the necessary information to troubleshoot it with you.

Re: After ISE 3.2 patch-3 External Authentication stopped working

adamscottmaster2013 — Fri, 25 Aug 2023 11:56:13 GMT

@thomas: You sound like Cisco TAC, LOL....

@dan.l.smith: patch 3 is really buggy and IMHO, broken. I don't know how much QA Cisco did with patch 3 but it does appear they did a very poor job on it. FWIW, I also have a TAC case with Cisco on ISE 3.2 patch-3 and the case is currently in the hand of the BU.

Re: After ISE 3.2 patch-3 External Authentication stopped working

TravisIS — Fri, 25 Aug 2023 15:03:47 GMT

@adamscottmaster2013same experience here - as of Patch 3, CRL retrieval is failing for EAP-TLS auth. Had to check the option to continue with auth even if the CRL check fails.

Re: After ISE 3.2 patch-3 External Authentication stopped working

thomas — Sat, 26 Aug 2023 00:27:23 GMT

@adamscottmaster2013 , no I'm not TAC but I do see many people posting questions here that do not understand how to help us help them. We cannot see their screens and their configs or know what their scenario is so they need to quickly and efficiently communicate it to us. I don't know why they think we can solve it faster than TAC with no visibility into the real problem. And we are all just trying to help here and we would rather not waste our time asking you 20 questions about your scenario to understand your situation.

Everyone here his trying to help but TAC gets paid to ask for troubleshooting details - we don't.

Re: After ISE 3.2 patch-3 External Authentication stopped working

Naresh Ginjupalli — Tue, 29 Aug 2023 17:06:23 GMT

Hi Dan,

Can I get more details on this issue? If there is already an SR opened please get us SR number and I will get the details from SR. If SR is not yet opened, I am interested to work with you to get more details on this issue and get this addressed ASAP.

Re: After ISE 3.2 patch-3 External Authentication stopped working

Naresh Ginjupalli — Tue, 29 Aug 2023 17:08:42 GMT

Hi Adam,

Can I please get SR details, if it is already opened? We are noticed the issue with CRL and want to see if the scenario we discovered is the same as of yours.

Re: After ISE 3.2 patch-3 External Authentication stopped working

adamscottmaster2013 — Tue, 29 Aug 2023 17:54:38 GMT

@Naresh Ginjupalli: Yes, I have the ticket opened three weeks ago and it is not CRL. The issue is upgrading the 3.2 cluster (1 PAN, 1 Secondary PAN, 2 PSN nodes) from patch-2 to patch-3. Followed the instruction and the PAN started upgrade process but the Secondary and PSN nodes did not get upgraded. It is currently being investigated by BU and developers.

Btw, how much "leverage" do you have in getting it resolved quickly :-)?

Re: After ISE 3.2 patch-3 External Authentication stopped working

TravisIS — Tue, 29 Aug 2023 20:11:39 GMT

Naresh - were you asking me to respond to the CRL issue or Adam?

Please let me know - I have a TAC case open for this defect (SR 696031940) however as it takes all dot1x auth down to replicate, I haven't yet had an opportunity to perform the necessary pcap etc but there are notes attached to the case you could look at for similarities if you like.

Re: After ISE 3.2 patch-3 External Authentication stopped working

Naresh Ginjupalli — Tue, 29 Aug 2023 23:06:09 GMT

Hi Adam,

I am analysing the SR for more details and will get back to you shortly on this.

Re: After ISE 3.2 patch-3 External Authentication stopped working

Naresh Ginjupalli — Tue, 29 Aug 2023 23:27:16 GMT

Thank you Travis, I looked at the SR and I am analysing the data provided in SR. Will get more details in a day.

Re: After ISE 3.2 patch-3 External Authentication stopped working

Naresh Ginjupalli — Tue, 29 Aug 2023 23:29:28 GMT

Apologize. I need SR number to expedite it.

Re: After ISE 3.2 patch-3 External Authentication stopped working

Naresh Ginjupalli — Thu, 31 Aug 2023 14:45:51 GMT

@TravisIS We conducted internal validations on this and we are able to reproduce the issue internally and we are further validating the issue with CRL check. Will get back to you with more details on this shortly.

Re: After ISE 3.2 patch-3 External Authentication stopped working

TravisIS — Thu, 31 Aug 2023 14:50:54 GMT

@Naresh Ginjupalli - Thank you for looking into this - I will notify my TAC engineer of this as well; I still need to perform a couple of PCAPs for her but if you can reproduce the issue in the lab that's great!

Re: After ISE 3.2 patch-3 External Authentication stopped working

hslai — Fri, 01 Sep 2023 20:22:44 GMT

@dan.l.smith Please provide the SR number of your TAC case.

Re: After ISE 3.2 patch-3 External Authentication stopped working

TravisIS — Mon, 30 Oct 2023 17:05:59 GMT

Hi Naresh,

The CRL issue is now fixed in 3.2 Patch 4. There is a laundry list of fixed bugs in this patch, those of you on Patch 3 would do well to review the release notes at your earliest opportunity.