topic Re: DTLS Handshake Fails and than Connects in Network Access Control https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296288#M596635 <P>Interesting - where do you see the CoA failure? Was it a CoA failure, or a TLS establishment failure?</P> Tue, 03 Jun 2025 20:48:30 GMT Arne Bier 2025-06-03T20:48:30Z DTLS Handshake Fails and than Connects https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296245#M596631 <P>When I do a CoA command on my cisco ISE Server to any device it fails about ten times then it succeeds. It isn't a big deal because it eventually succeeds, but I'm wondering if anyone has an idea why it fails 10 times before it succeeds.</P><P>Switch Cisco 9300</P><P>ISE Server Firmware:&nbsp;<SPAN>3.4.0.608</SPAN></P><P>aaa server radius dynamic-author<BR />client 192.168.1.2 dtls client-tp CiscoISEServer1-SelfSigned server-tp Switch-SELF-SIGNED<BR />client 192.168.1.3 dtls client-tp CiscoISEServer2-SelfSigned server-tp Switch-SELF-SIGNED<BR />dtls ip radius source-interface Vlan10</P><P><STRONG>Fails (Ten Times)</STRONG></P><H3><SPAN>Steps</SPAN></H3><TABLE border="0" cellpadding="3"><TBODY><TR><TD>&nbsp;</TD><TD>Step ID</TD><TD>Description</TD><TD>Latency (ms)</TD></TR><TR><TD>&nbsp;</TD><TD>91070</TD><TD>RADIUS DTLS CoA handshake started</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91106</TD><TD>RADIUS DTLS: received client hello verify request</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91043</TD><TD>RADIUS DTLS: received server hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91044</TD><TD>RADIUS DTLS: received server certificate</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91046</TD><TD>RADIUS DTLS: received server done message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91048</TD><TD>RADIUS DTLS: sent client key exchange message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91040</TD><TD>RADIUS DTLS: sent change cipher spec message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91041</TD><TD>RADIUS DTLS: sent finished message</TD><TD>0</TD></TR></TBODY></TABLE><P><STRONG>Connects one time</STRONG></P><H3><SPAN>Steps</SPAN></H3><TABLE border="0" cellpadding="3"><TBODY><TR><TD>&nbsp;</TD><TD>Step ID</TD><TD>Description</TD><TD>Latency (ms)</TD></TR><TR><TD>&nbsp;</TD><TD>91070</TD><TD>RADIUS DTLS CoA handshake started</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91106</TD><TD>RADIUS DTLS: received client hello verify request</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91042</TD><TD>RADIUS DTLS: sent client hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91043</TD><TD>RADIUS DTLS: received server hello message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91044</TD><TD>RADIUS DTLS: received server certificate</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91046</TD><TD>RADIUS DTLS: received server done message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91048</TD><TD>RADIUS DTLS: sent client key exchange message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91040</TD><TD>RADIUS DTLS: sent change cipher spec message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91041</TD><TD>RADIUS DTLS: sent finished message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91041</TD><TD>RADIUS DTLS: sent finished message</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91049</TD><TD>RADIUS DTLS: read server session ticket</TD><TD>0</TD></TR><TR><TD>&nbsp;</TD><TD>91039</TD><TD>RADIUS DTLS: received finished message</TD><TD>0</TD></TR></TBODY></TABLE> Tue, 03 Jun 2025 16:20:59 GMT https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296245#M596631 BlackDiamond71 2025-06-03T16:20:59Z Re: DTLS Handshake Fails and than Connects https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296288#M596635 <P>Interesting - where do you see the CoA failure? Was it a CoA failure, or a TLS establishment failure?</P> Tue, 03 Jun 2025 20:48:30 GMT https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296288#M596635 Arne Bier 2025-06-03T20:48:30Z Re: DTLS Handshake Fails and than Connects https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296292#M596636 <P>The Cisco ISE log just says "<SPAN>5450 RADIUS DTLS handshake failed". After about ten attempts/logs later it says "5241 RADIUS DTLS handshake succeeded"</SPAN></P> Tue, 03 Jun 2025 21:01:43 GMT https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296292#M596636 BlackDiamond71 2025-06-03T21:01:43Z Re: DTLS Handshake Fails and than Connects https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296296#M596637 <P>I haven't used DTLS yet - but <A href="https://community.cisco.com/t5/networking-knowledge-base/configuring-radius-over-dtls-with-cat9k-and-ise-3-0/ta-p/4438427" target="_self">I found a great Cisco article</A> - have you seen this?</P> <P>The suggestion to run a tcpdump seems a good one - to see why the TLS handshake is failing - perhaps it's negotiating various TLS versions and ciphers until Cat9K and ISE agree ?</P> Tue, 03 Jun 2025 21:44:20 GMT https://community.cisco.com/t5/network-access-control/dtls-handshake-fails-and-than-connects/m-p/5296296#M596637 Arne Bier 2025-06-03T21:44:20Z