topic Re: ISE causes infinity login Windows 10 in Network Access Control

ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 15:47:32 GMT

I been having issues with ISE on my Lan, I will try to give as many details as I can.

The main issue is an Infinity Login on windows 10 for every user, but if I remove all the authentication config from the switch then it log in just fine.

The desirable configuration on the ports is->

switchport mode access
switchport block unicast
switchport voice vlan 3
load-interval 30
authentication event fail action next-method
authentication event server dead action reinitialize vlan 5
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 8
storm-control broadcast level bps 20m
spanning-tree portfast
spanning-tree bpduguard enable

If I remove all the " authentication + dot1x " configs on the switch, the login goes fine.

The logs on ISE when we attempt to login with the desirable configuration pretty much it says that the authentication was successful. We already opened all the ACL.

After attempting to login it creates an "Unknown account" profile locally on the workstation.

Re: ISE causes infinity login Windows 10

balaji.bandi — Sun, 31 Dec 2023 16:09:11 GMT

This hard to tell what went to wrong ?

how is your Windows 10 configured - have Certificate ?

You do not have Access vlan for Data - are you using default VLAN 1 here for Data ?

why do you need - switchport block unicast (is this requirement ?)

check the connected port information while authentication taking time :

show access-session interface gigabitEthernet 1/0/1 details

there is big guide to troubleshoot - Windows 10 PC / Switch and ISE side ?

https://community.cisco.com/t5/security-knowledge-base/how-to-troubleshoot-ise-failed-authentications-amp/ta-p/3630960#toc-hId-737186778

check the deployment guide :

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

Re: ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 16:42:29 GMT

Yes windows 10 has certificates, ISE is supposed to assign the correct VLAN ( in my case VLAN 5 )

block unicast is a requirement.

The authentication dot1x shows as Authc Success

Seems like the authentication process goes fine, have no clue why can't login

Obs: Its also going to the correct VLAN ( 5 ) , it shows on the Server Policies portion.

Re: ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 17:17:15 GMT

Outcome from show authent sess inter .... I covered some info on purpose and the VLAN 55 is correct.

Re: ISE causes infinity login Windows 10

Rob Ingram — Sun, 31 Dec 2023 18:26:19 GMT

@guizerabc the output looks ok, except the short lifetimes, but I don't expect them to cause a problem with logging into windows.

Do you mean the problem is despite succesful authentication to the network via ISE the user can never actually login to windows?

What is the supplicant configuration on Windows 10? I assume it's deployed via GPO?.

Re: ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 19:23:46 GMT

That is correct, despite successful authentication, can't login... Stays at the " welcome " sign spinning forever. Yes the supplicant configuration on Win 10 is deployed via GPO, not sure the exact configuration but i can check. Anything specific on how does that has to be ?

Re: ISE causes infinity login Windows 10

Rob Ingram — Sun, 31 Dec 2023 19:53:23 GMT

@guizerabc Under normal circumstances I would not expect a problem logging into windows. Check the windows event logs at time of logging into the device for some clues.

Are you performing machine authentication and/or user authentication?

Re: ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 20:05:01 GMT

I will check the logs right now. Its set to authenticate via User OR Computer.

Re: ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 20:13:06 GMT

@Rob Ingram

Found the error at the log.

Error: Failed to get the user token; The system could not find the environment option that was entered.

Error: Couldn't retrieve user directory path.

Warning: Failed to get any user session after enumerating all sessions.

Re: ISE causes infinity login Windows 10

Rob Ingram — Sun, 31 Dec 2023 20:48:31 GMT

@guizerabc

@guizerabc wrote:

Error: Couldn't retrieve user directory path.

Do you have GPO that sets a user directory path that is a network location? Perhaps this is unreachable because the computer does not get the correct IP address or the DACL prevents access and this has a knock on affect staling the login process?

Re: ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 21:25:02 GMT

Sorry, that was because was trying with an ADM account. Yes, we have a GPO that sets that. Now i have tried with a regular user account and the errors are Failed to find an active session.../ Failed to find session after enumerating each session...

and a Warning: Failed to obtain loggedin user Info, aborting discovery...

( i left the computer trying to log in for 10 min to collect the logs )

Update.

AT 16:05 I tried to log in.

16:05 we had Failed to find an active session...+ Failed to find session after enumerating each session... and a Warning: Failed to obtain loggedin user Info, aborting discovery...

16:07 the errors about the path and Failed to get user token appears.

Re: ISE causes infinity login Windows 10

MHM Cisco World — Sun, 31 Dec 2023 23:31:43 GMT

First happy new year

Second you use multi-auth and then you use dead server event reinitialze vlan 5' I think this wrong you need to change it to authorize vlan 5

Do this and monitor the auth/authz

MHM

Re: ISE causes infinity login Windows 10

guizerabc — Sun, 31 Dec 2023 23:58:42 GMT

Happy new year!!!

I did change the reinitialize for authorize, it didn't work =/

Error: Failed to find an active session...

Error: Failed to find session after enumerating each session...

Warning: Failed to obtain loggedin user info, aborting discovery...

Re: ISE causes infinity login Windows 10

MHM Cisco World — Mon, 01 Jan 2024 00:00:16 GMT

Can I see last port config

MHM

Re: ISE causes infinity login Windows 10

guizerabc — Mon, 01 Jan 2024 00:04:55 GMT

Sure,

switchport mode access
switchport block unicast
switchport voice vlan 3
load-interval 30
duplex full
authentication event fail action next-method
authentication event server dead action authorize vlan 5
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 8
storm-control broadcast level bps 20m
spanning-tree portfast
spanning-tree bpduguard enable

Re: ISE causes infinity login Windows 10

balaji.bandi — Mon, 01 Jan 2024 09:57:01 GMT

Can you confirm the below :

ISE is supposed to assign the correct VLAN ( in my case VLAN 5 )

I covered some info on purpose and the VLAN 55 is correct.

can you also post the profile settings from ISE.

what is the ISE version ?

what switch model and IOS Code running ?

what AD Server ?

Re: ISE causes infinity login Windows 10

MHM Cisco World — Mon, 01 Jan 2024 11:40:47 GMT

there are two session the auth and account, the auth timeout is from server and It OK for me
the account session timeout is so little
so can you remove below command

switch(config)# aaa accounting update periodic number <- or make it higher than the Server reauth timeout

MHM

Re: ISE causes infinity login Windows 10

Arne Bier — Mon, 01 Jan 2024 22:01:27 GMT

Is the dACL permissive enough ? Have you done a

show ip access-list XXXXX

on the string that is shown after the ACL ACL ?

Re: ISE causes infinity login Windows 10

hslai — Tue, 02 Jan 2024 05:04:24 GMT

...

Error: Failed to find an active session...
Error: Failed to find session after enumerating each session...
Warning: Failed to obtain loggedin user info, aborting discovery...

@guizerabc These messages seem from Cisco Secure Client (including AnyConnect) ISE posture module.

I would suggest disabling such posture checks for now to make the use case simpler to debug.

Re: ISE causes infinity login Windows 10

guizerabc — Tue, 02 Jan 2024 13:43:18 GMT

Can you drive me thru on how to disable those posture module ? This is how it looks like right now.

Update: I had disabled the Posture Policy under Policy>Posture

and also at the Client Provisioning Policy.

Both disabled and still same issue. About to look at the logs right now.