topic Re: ISE 5200 authentication failed in Network Access Control

ISE 5200 authentication failed

palani2010 — Thu, 02 Jan 2025 12:18:40 GMT

As per ISE Logs, we do see username as USERNAME but user is not prompt for username and password while accessing in SSID

SSID with EAP-TLS configured. Why do we see this behaviour

Cisco ISE Version - 3.2

Re: ISE 5200 authentication failed

MHM Cisco World — Thu, 02 Jan 2025 12:22:05 GMT

are you sure this EAP-TLS ?
also are you sure the Username contain HostName or Mac Address?

MHM

Re: ISE 5200 authentication failed

palani2010 — Thu, 02 Jan 2025 17:17:04 GMT

Yes it is EAP-TLS.

username showing as USERNAME.

Re: ISE 5200 authentication failed

PSM — Fri, 03 Jan 2025 07:40:35 GMT

Hi @palani2010 Since it is EAP-TLS authentication it is supposed to use certificate and not username and password. Username is logs is derived from the certificate attributes. You can verify Certificate Authentication Profile setting (Administration >Identity Management > Certificate Authentication Profiles List ) to see what has been configured for ISE to use an identity. If you are using default Certificate Authentication Profile in your policy, default Profile has Subject- Common Name attribute as Identity.

It looks your certificates does not have value in the filed for the attributes selected in certificate authentication profile.