topic Re: 5440 Endpoint abandoned EAP session and started new in Network Access Control

5440 Endpoint abandoned EAP session and started new

getaway51 — Mon, 01 Jun 2020 15:38:58 GMT

Hi,

I gt this error and checked authentication report. I attached logs here.

May I knw wht could be causing the problem? is it a bug?

It seems the device nvr established session with the ISE. It just keeps authenticating.

Re: 5440 Endpoint abandoned EAP session and started new

RaphaelRich29893 — Mon, 01 Jun 2020 16:42:12 GMT

I am also facing a similar issue. Do let me know as well if you find out any helpful guide.

Re: 5440 Endpoint abandoned EAP session and started new

getaway51 — Mon, 01 Jun 2020 17:36:51 GMT

Hi,

Previously dot1x laptop was working fine. Only recently after the lockdown,
problem started. These are windows10.
Not sure if it is cert issue.
The timer when sh auth br keeps resetting due to AZ and UZ intermittent.
Are yours the same?

Re: 5440 Endpoint abandoned EAP session and started new

thomas — Tue, 02 Jun 2020 15:15:11 GMT

From your attached text file:

Event	5440 Endpoint abandoned EAP session and started new
Failure Reason	5440 Endpoint abandoned EAP session and started new
Resolution	Verify known NAD or supplicant issues and published bugs. Verify NAD and supplicant configuration.
Root cause	Endpoint started new authentication while previous is still in progress. Most probable that supplicant on that endpoint stopped conducting the previous authentication and started the new one. Closing the previous authentication.

This is almost always an endpoint supplicant configuration issue. Specifically, it does not trust the ISE certificate. This is similar to what your web browser does when it goes to a site using HTTPS with a self-signed/mis-matched domain/expired certificate.

Please verify your endpoint is properly configured for 802.1X and that ISE has a certificate provisioned from a publicly-signed CA. Never use a self-signed certificate in ISE for a production deployment.

Re: 5440 Endpoint abandoned EAP session and started new

getaway51 — Tue, 02 Jun 2020 15:49:51 GMT

Hi,

Is there a way I can get more details from the ISE troubleshooting tool
tcpdump or endpoint debug?
Really running out of option here

Re: 5440 Endpoint abandoned EAP session and started new

getaway51 — Tue, 02 Jun 2020 16:40:03 GMT

Hi,

I have check the radius log and attached the full steps here. Last few steps keeps repeating itself. Based in the full steps, Can I said tht ISE received the client certs but Client Cert Validation failed?

11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge

Re: 5440 Endpoint abandoned EAP session and started new

Greg Gibbs — Tue, 02 Jun 2020 22:44:19 GMT

What the logs show is that ISE is sending an Access-Challenge but, instead of receiving a response to that challenge, it is receiving a new Access-Request from the client. As @thomas stated, this is an issue with the supplicant not completing the process.

As I suggested in your other post here, you need to start looking at packet captures on the client and possibly debugs on the switch. This can be related to certificate issues, supplicant configuration issues or bugs, or even 3rd-party software (I've seen an old Citrix client adapter intercept EAPOL traffic in a customer's environment in the past).

I would suggest opening a TAC case to investigate in more detail.

Re: 5440 Endpoint abandoned EAP session and started new

thomas — Tue, 02 Jun 2020 22:57:21 GMT

Yes, please call TAC.

You have provided very little information to allow us to help you troubleshoot across the endpoint or supplicant, the network device, or ISE configuration. See How to Ask the Community for Help.

Re: 5440 Endpoint abandoned EAP session and started new

Andrii Oliinyk — Fri, 19 Feb 2021 13:18:44 GMT

Thomas,

in environment where ISE's system certificates are mandatory to be unique per function&node having public CA as n issuer is impractically expensive. Usually enterprise allocate its own CA to sign certificates for admin/eap functions accompanied with gpupdates across AD-assets pushing domestic generated certs to internal clients. of course it's irrelevant to functions like portal.

Re: 5440 Endpoint abandoned EAP session and started new

laurathaqi — Wed, 12 May 2021 10:47:29 GMT

Guys, I am having the same issue.

Did someone solve this issue or has any recommendation to try further deep debugging.

Thank you,

Laura

Re: 5440 Endpoint abandoned EAP session and started new

Andrii Oliinyk — Wed, 12 May 2021 11:07:00 GMT

Hi Laura

did u uncheck already EAP-TLS L-bit in protocols list u allowed for corresponding policy?

capturing on port with endpoint would be useful otherwise.

Re: 5440 Endpoint abandoned EAP session and started new

laurathaqi — Wed, 12 May 2021 14:56:43 GMT

Hi @Andrii Oliinyk

I did that, in fact it wasn't checked at all on the ISE version 3.0. But I made sure to doublecheck however the issue persists.

Do you have any idea on the troubleshooting steps I would be needing to take to narrow the issues scope.

Looking forward to hearing from you.

Thank you,

Laura

Re: 5440 Endpoint abandoned EAP session and started new

FernandoDiaz1992 — Wed, 14 Jul 2021 01:26:44 GMT

Did you solve the problem?
I have ISE 3.0 and I have the same problem in several users.

Did you solve the problem?
I have ISE 3.0 and I have the same problem in several users.

Re: 5440 Endpoint abandoned EAP session and started new

laurathaqi — Wed, 14 Jul 2021 06:37:48 GMT

Hi @FernandoDiaz1992

The issue at my end was the root cert was not selected on the supplicant side.

Root cert needs to be imported and installed on supplicant, and then on Security settings, needs to be checked.

Hope it helps.

Best,

Laura

Re: 5440 Endpoint abandoned EAP session and started new

rishi.sumbal — Mon, 27 Sep 2021 12:37:43 GMT

Hello Laura,

do you mean with "the root cert was not selected on the supplicant side", that the proper root CA was not checked in the list of root CAs under the Network Authentication Method Properties ?

Is this also what you mean with the security settings?

Thank you

Rishi

Re: 5440 Endpoint abandoned EAP session and started new

vaguirre17 — Thu, 27 Jul 2023 17:15:32 GMT

Its an endpoint issue if is for only for few users. if is for all the sessions in one NAD could be an issue with the switch. With one customer we opened a SR and could find the endpoint is not replying the eap packets. increase timers could be an option but we got fixed at all using nam instead the native supplicant.

when is a Certificate issue yu could see in the live logs a different error. something like

	12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate

Re: 5440 Endpoint abandoned EAP session and started new

Andrii Oliinyk — Fri, 28 Jul 2023 07:18:40 GMT

not exactly. i had a situation where endpoints just silently have been starting new session.

Re: 5440 Endpoint abandoned EAP session and started new

mightncube — Fri, 22 Sep 2023 10:05:40 GMT

Have been having this issue, did a lot of digging and searching,,

Among certificate issues that have already been mention.

There has been a drive by Microsoft to use Credential Guard.
Turns out credential guard doesn't work well with MSCHAPv2, regards it as unsecure and advices us to use certificates.

You might wanna dig deep on the user machines doing this first point is checking the WLAN-Autoconfig logs on Event Viewer.

Then check this article, might help someone.

https://www.neighborgeek.net/2016/08/windows-10-credential-guard-breaks-wifi.html

Re: 5440 Endpoint abandoned EAP session and started new

Ravi Verman — Thu, 27 Jun 2024 09:23:20 GMT

Is that issue resolved ? same issue i am facing on Windows 23 H2 version machines.

pls. share if any found.

Re: 5440 Endpoint abandoned EAP session and started new

Mateen Ahmad — Tue, 10 Sep 2024 07:09:24 GMT

I am using self sign certificate only but also from supplicant settings I have disabled to verify server certificate