topic TEAP (EAP-TLS) issue with user authentication in Network Access Control

TEAP (EAP-TLS) issue with user authentication

abdullaS — Mon, 11 Aug 2025 08:19:54 GMT

We configured EAP chaining for TEAP and enabled certificate-based authentication for both user and machine.

Below are some key points:

ISE 3.3p7
Win 11
TEAP and EAP chaining protocols are enabled
We followed this doc
Below is AuthZ policy set, and actions are permit all for both (for the sake of testing only)
Here is the live logs result
Here is the adapter auth settings
Correct root cert is selected in both auth methods
User and machine cert enrollment is also working fine

Issue: The machine gets successfully authenticated on wired connection and hit the correct policy but when the user log in, it hits the default ACCESS_REJECT policy.

Live logs results:

During machine auth =

EapChainingResult

User failed and machine succeeded

During user auth =

EapChainingResult

User succeeded and machine failed

We are not able to achieve User and machine succeeded result.

Any leads will be helpful!

Re: TEAP (EAP-TLS) issue with user authentication

JPavonM — Mon, 11 Aug 2025 08:52:16 GMT

Do you have such authorization policy for both suceeded?

Re: TEAP (EAP-TLS) issue with user authentication

MHM Cisco World — Mon, 11 Aug 2025 09:02:37 GMT

only change the order of Authz
1- both success
2- user failed and machine success

this order is write in doc you share and this what I know how you config chain

MHM

Re: TEAP (EAP-TLS) issue with user authentication

abdullaS — Mon, 11 Aug 2025 09:05:33 GMT

Yes this one.. but i cannot see eap chain result of both succeeded in the live logs when user login

Re: TEAP (EAP-TLS) issue with user authentication

abdullaS — Mon, 11 Aug 2025 12:10:41 GMT

Update:

This issue was resolved. There were some mismatch attributes in SAN of the user cert after making some changings the issue was resolved.