topic Re: Show rejected users in ISE (Invalid username or password specified in Network Access Control

Show rejected users in ISE (Invalid username or password specified)

dijix1990 — Mon, 22 Jan 2024 11:28:56 GMT

Ise has policy which prevent blocking in AD

22017 Selected Identity Source is DenyAccess - because of Number of bad password attempts for AD instance is higher than the configuration in Active Directory, Skipping the AD authentication.

Can we manually clean time period after client resolve problem? (forget ssid to try again with right username and pass)?

Re: Show rejected users in ISE (Invalid username or password specified

MHM Cisco World — Mon, 22 Jan 2024 14:33:20 GMT

reduce the reject time from 60 to be 15 and check
MHM

Re: Show rejected users in ISE (Invalid username or password specified

dijix1990 — Mon, 22 Jan 2024 14:44:44 GMT

Yes I know it will help (but reducing not recommended), but maybe it has special link to see database with rejected endpoints by feature "continue rejecting requests" as wlc dynamic rejection where we can delete excluded endpoint manually

Re: Show rejected users in ISE (Invalid username or password specified

MHM Cisco World — Mon, 22 Jan 2024 14:52:35 GMT

client failed to auth for specific attempt
the ISE reject it
WLC detect this reject and add client to excluded list for specific time
after that the WLC remove the client from list and client can try again auth
here I think the excluded list in wlc must longer than auto reject of ISE no more short to ensure that client can auth again via ISE
MHM

Re: Show rejected users in ISE (Invalid username or password specified

dijix1990 — Mon, 22 Jan 2024 15:02:28 GMT

ise prevent blocking clients in the AD and when it happens I can see it in live log ise. So in the wlc database for excluding clients I can't see this client (which was blocking by ise). And maybe I can see it in the ise?

Re: Show rejected users in ISE (Invalid username or password specified

MHM Cisco World — Mon, 22 Jan 2024 15:04:58 GMT

did you enable the excluded list under WLAN ?
MHM

Re: Show rejected users in ISE (Invalid username or password specified

dijix1990 — Mon, 22 Jan 2024 15:06:57 GMT

Of course

Re: Show rejected users in ISE (Invalid username or password specified

MHM Cisco World — Mon, 22 Jan 2024 15:12:30 GMT

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html

OK go to excluded list policy and select all option
I dont know if ISE return timeout or failure for auto reject client

MHM

Re: Show rejected users in ISE (Invalid username or password specified

dijix1990 — Tue, 23 Jan 2024 06:05:59 GMT

My environment has config for excluding, but I think I'm not able to see it in WLC because of ISE has own database for excluding