AuthIZ profiles

Saeed Abd Elhalim Hamada — Mon, 07 Apr 2025 08:13:02 GMT

dear all i have problem with Authiz policy what i say the user must authica first and be in any groups of the list and need to be android

if i remove the last condation that contant andorid the Authiz work

Overview

Event	5400 Authentication failed
Username	test
Endpoint Id	48:9B:E0:E8:B3:AB
Endpoint Profile	Android
Authentication Policy	Wireless-802.1x-NIB-WIFI SSID >> Wireless-802.1X
Authorization Policy	Wireless-802.1x-NIB-WIFI SSID >> Default
Authorization Result	DenyAccess

Authentication Details

Source Timestamp	2025-04-07 10:09:42.769
Received Timestamp	2025-04-07 10:09:42.769
Policy Server	ISE-01
Event	5400 Authentication failed
Failure Reason	15039 Rejected per authorization profile
Resolution	Authorization Profile with ACCESS_REJECT attribute was selected as a result of the matching authorization rule. Check the appropriate Authorization policy rule-results.
Root cause	Selected Authorization Profile contains ACCESS_REJECT attribute
Username	test
Endpoint Id	48:9B:E0:E8:B3:AB
Calling Station Id	48-9b-e0-e8-b3-ab
Endpoint Profile	Android
Authentication Identity Store	NibHQ-AD
Identity Group	allow-list-testing
Audit Session Id	1510640A00021E800F4C53B6
Authentication Method	dot1x
Authentication Protocol	PEAP (EAP-MSCHAPv2)
Service Type	Framed
Network Device	WLC-01
Device Type	All Device Types
Location	All Locations
NAS IPv4 Address	10.100.16.21
NAS Port Id	capwap_900000b8
NAS Port Type	Wireless - IEEE 802.11
Authorization Profile	DenyAccess
Response Time	33 milliseconds

Other Attributes

ConfigVersionId	173
Device Port	63398
DestinationPort	1812
RadiusPacketType	AccessRequest
Protocol	Radius
NAS-Port	21617
Framed-MTU	1485
State	37CPMSessionID=1510640A00021E800F4C53B6;34SessionID=ISE-01/531755997/1489426;
undefined-186	00:0f:ac:04
undefined-187	00:0f:ac:04
undefined-188	00:0f:ac:01
NetworkDeviceProfileId	b0699505-3150-4215-a80e-6753d45bf56c
IsThirdPartyDeviceFlow	false
AcsSessionID	ISE-01/531755997/1489426
DetailedInfo	Authentication succeed
SelectedAuthenticationIdentityStores	NibHQ-AD
IdentityPolicyMatchedRule	Wireless-802.1X
AuthorizationPolicyMatchedRule	Default
EndPointMACAddress	48-9B-E0-E8-B3-AB
ISEPolicySetName	Wireless-802.1x-NIB-WIFI SSID
IdentitySelectionMatchedRule	Wireless-802.1X
AD-User-Resolved-Identities	test@nibhq.local
AD-User-Candidate-Identities	test@nibhq.local
TotalAuthenLatency	99
ClientLatency	66
AD-User-Resolved-DNs	CN=TEST,OU=Users,OU=57_Central Affairs Sector,OU=NIB-Sectors,DC=nibhq,DC=local
AD-User-DNS-Domain	nibhq.local
AD-Groups-Names	nibhq.local/Builtin/Users
AD-Groups-Names	nibhq.local/NIB-Sectors/57_Central Affairs Sector/57_Central Affairs Sector
AD-Groups-Names	nibhq.local/Users/Domain Users
AD-User-NetBios-Name	NIBHQ
IsMachineIdentity	false
UserAccountControl	66048
AD-User-SamAccount-Name	test
AD-User-Qualified-Name	test@nibhq.local
TLSCipher	ECDHE-RSA-AES256-GCM-SHA384
TLSVersion	TLSv1.2
DTLSSupport	Unknown
HostIdentityGroup	Endpoint Identity Groups:allow-list-testing
Network Device Profile	Cisco
Location	Location#All Locations
Device Type	Device Type#All Device Types
IPSEC	IPSEC#Is IPSEC Device#No
ExternalGroups	nibhq.local/S-1-5-32-545
ExternalGroups	S-1-5-21-4129499605-3250610629-1857627236-18513
ExternalGroups	S-1-5-21-4129499605-3250610629-1857627236-513
IdentityAccessRestricted	false
RADIUS Username	test
NAS-Identifier	WLC-01
Device IP Address	10.100.16.21
CPMSessionID	1510640A00021E800F4C53B6
Called-Station-ID	cc-7f-75-58-37-40:NIB_WIFI
CiscoAVPair	service-type=Framed,audit-session-id=1510640A00021E800F4C53B6,method=dot1x,client-iif-id=1711278343,vlan-id=1,cisco-wlan-ssid=NIB_WIFI,wlan-profile-name=NIB_WIFI_Global_F_a7fb7e41,AuthenticationIdentityStore=NibHQ-AD,FQSubjectName=e0d4af20-de9d-11ed-ab69-7e7af6e903ec#test@nibhq.local,UniqueSubjectID=4fced747fcb06203d7961e0773857192d1963517

Result

RadiusPacketType

AccessReject

Session Events

2025-04-07 10:09:42.769

Authentication failed

Steps

Step ID	Description	Latency (ms)
11001	Received RADIUS Access-Request - NibHQ-AD
11017	RADIUS created a new session - nibhq.local	0
15049	Evaluating Policy Group - NibHQ-AD	1
15008	Evaluating Service Selection Policy	0
15048	Queried PIP - DEVICE.Device Type	0
15048	Queried PIP - Radius.NAS-Port-Id	1
15048	Queried PIP - DEVICE.Network Device Profile	0
15048	Queried PIP - Normalised Radius.RadiusFlowType	0
15048	Queried PIP - Radius.Called-Station-ID	0
11507	Extracted EAP-Response/Identity	1
12500	Prepared EAP-Request proposing EAP-TLS with challenge	0
12625	Valid EAP-Key-Name attribute received	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	5
11018	RADIUS is re-using an existing session	0
12301	Extracted EAP-Response/NAK requesting to use PEAP instead	0
12300	Prepared EAP-Request proposing PEAP with challenge	0
12625	Valid EAP-Key-Name attribute received	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	4
11018	RADIUS is re-using an existing session	0
12302	Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated	0
61025	Open secure connection with TLS peer	1
12319	Successfully negotiated PEAP version 1	0
12800	Extracted first TLS record; TLS handshake started	0
12805	Extracted TLS ClientHello message	0
12806	Prepared TLS ServerHello message	0
12807	Prepared TLS Certificate message	0
12808	Prepared TLS ServerKeyExchange message	8
12810	Prepared TLS ServerDone message	0
12305	Prepared EAP-Request with another PEAP challenge	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	7
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	0
12305	Prepared EAP-Request with another PEAP challenge	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	6
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	0
12305	Prepared EAP-Request with another PEAP challenge	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	25
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	0
12319	Successfully negotiated PEAP version 1	0
12810	Prepared TLS ServerDone message	0
12812	Extracted TLS ClientKeyExchange message	2
12803	Extracted TLS ChangeCipherSpec message	0
12804	Extracted TLS Finished message	0
12801	Prepared TLS ChangeCipherSpec message	0
12802	Prepared TLS Finished message	0
12816	TLS handshake succeeded	0
12310	PEAP full handshake finished successfully	0
12305	Prepared EAP-Request with another PEAP challenge	1
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	4
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	0
12313	PEAP inner method started	0
11521	Prepared EAP-Request/Identity for inner EAP method	0
12305	Prepared EAP-Request with another PEAP challenge	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	6
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	0
11522	Extracted EAP-Response/Identity for inner EAP method	0
11806	Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge	0
12305	Prepared EAP-Request with another PEAP challenge	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	6
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	0
11808	Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated	0
15041	Evaluating Identity Policy	1
15013	Selected Identity Source - NibHQ-AD	1
24430	Authenticating user against Active Directory - NibHQ-AD	0
24325	Resolving identity - test	2
24313	Search for matching accounts at join point - nibhq.local	0
24319	Single matching account found in forest - nibhq.local	0
24323	Identity resolution detected single matching account	0
24343	RPC Logon request succeeded - test@nibhq.local	2
24402	User authentication against Active Directory succeeded - NibHQ-AD	0
22037	Authentication Passed	0
11824	EAP-MSCHAP authentication attempt passed	0
12305	Prepared EAP-Request with another PEAP challenge	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	4
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	1
11810	Extracted EAP-Response for inner method containing MSCHAP challenge-response	0
11814	Inner EAP-MSCHAP authentication succeeded	0
11519	Prepared EAP-Success for inner EAP method	0
12314	PEAP inner method finished successfully	0
12305	Prepared EAP-Request with another PEAP challenge	0
11006	Returned RADIUS Access-Challenge	0
11001	Received RADIUS Access-Request	3
11018	RADIUS is re-using an existing session	0
12304	Extracted EAP-Response containing PEAP challenge-response	0
24715	ISE has not confirmed locally previous successful machine authentication for user in Active Directory	0
15036	Evaluating Authorization Policy	1
24209	Looking up Endpoint in Internal Endpoints IDStore - test	0
24211	Found Endpoint in Internal Endpoints IDStore	1
15048	Queried PIP - Network Access.AuthenticationStatus	0
24432	Looking up user in Active Directory - test
24355	LDAP fetch succeeded
24416	User's Groups retrieval from Active Directory succeeded
15048	Queried PIP - NibHQ-AD.ExternalGroups	3
15048	Queried PIP - Session.Device-OS	0
15016	Selected Authorization Profile - DenyAccess	1
15039	Rejected per authorization profile	0
12306	PEAP authentication succeeded	0
61026	Shutdown secure connection with TLS peer	0
11503	Prepared EAP-Success	0
11003	Returned RADIUS Access-Reject	1

Re: AuthIZ profiles

PSM — Mon, 07 Apr 2025 12:49:41 GMT

This is because from the radius packet ISE is not able to identify if it the device OS is android. Either you remove this or you find another better attribute which can be used in condition.

Re: AuthIZ profiles

Saeed Abd Elhalim Hamada — Mon, 07 Apr 2025 20:49:13 GMT

ok i use profile called android and also didnt work

Re: AuthIZ profiles

PSM — Wed, 09 Apr 2025 10:49:37 GMT

Can you share updated policy and logs ?

topic Re: AuthIZ profiles in Network Access Control

AuthIZ profiles

Overview

Authentication Details

Other Attributes

Result

Session Events

Steps

Re: AuthIZ profiles

Re: AuthIZ profiles

Re: AuthIZ profiles