https://community.cisco.com/t5/network-access-control/ise-issue/m-p/5337905#M598505 <P>After upgrading several corporate laptops from Windows 10 to Windows 11, the IT team begins to notice that many devices are being blocked by the Cisco Identity Services Engine (ISE) during network authentication. Upon investigation, they discover that the issue stems from session duplication caused by the OS upgrade.</P><P>When Windows 11 is installed over Windows 10, certain machine identifiers—such as the MAC address, hostname, and certificate—remain unchanged. However, the upgrade process triggers a re-registration of the device in Active Directory and the endpoint database used by ISE. This results in two conflicting sessions being created for the same physical device: one associated with the old Windows 10 profile and another with the new Windows 11 profile.</P><P>Cisco ISE, configured with strict posture and profiling policies, detects this duplication as a potential security risk. It flags the device as non-compliant due to inconsistent endpoint attributes and blocks network access. The NAC system interprets the duplicated session as a rogue device or a spoofing attempt.</P> Mon, 13 Oct 2025 07:41:27 GMT natixis 2025-10-13T07:41:27Z https://community.cisco.com/t5/network-access-control/ise-issue/m-p/5337905#M598505 <P>After upgrading several corporate laptops from Windows 10 to Windows 11, the IT team begins to notice that many devices are being blocked by the Cisco Identity Services Engine (ISE) during network authentication. Upon investigation, they discover that the issue stems from session duplication caused by the OS upgrade.</P><P>When Windows 11 is installed over Windows 10, certain machine identifiers—such as the MAC address, hostname, and certificate—remain unchanged. However, the upgrade process triggers a re-registration of the device in Active Directory and the endpoint database used by ISE. This results in two conflicting sessions being created for the same physical device: one associated with the old Windows 10 profile and another with the new Windows 11 profile.</P><P>Cisco ISE, configured with strict posture and profiling policies, detects this duplication as a potential security risk. It flags the device as non-compliant due to inconsistent endpoint attributes and blocks network access. The NAC system interprets the duplicated session as a rogue device or a spoofing attempt.</P> Mon, 13 Oct 2025 07:41:27 GMT https://community.cisco.com/t5/network-access-control/ise-issue/m-p/5337905#M598505 natixis 2025-10-13T07:41:27Z https://community.cisco.com/t5/network-access-control/ise-issue/m-p/5338144#M598517 <P>Please share the exact errors and "strict posture and profiling policies" that cause non-compliance.<BR />If you think it's an bug, call TAC.</P> Mon, 13 Oct 2025 21:54:57 GMT https://community.cisco.com/t5/network-access-control/ise-issue/m-p/5338144#M598517 thomas 2025-10-13T21:54:57Z https://community.cisco.com/t5/network-access-control/ise-issue/m-p/5338446#M598536 <P>11001 Received RADIUS Access-Request - AD<BR />11017 RADIUS created a new session - zz@dz.zzbp.corp<BR />15049 Evaluating Policy Group - dz.zzbp.corp<BR />15008 Evaluating Service Selection Policy - dz.zzbp.corp<BR />15048 Queried PIP - DEVICE.Device Type<BR />15048 Queried PIP - dz.zzbp.corp<BR />11507 Extracted EAP-Response/Identity - AD<BR />12500 Prepared EAP-Request proposing EAP-TLS with challenge - dz.zzbp.corp<BR />12625 Valid EAP-Key-Name attribute received - AD<BR />11006 Returned RADIUS Access-Challenge - AD<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12301 Extracted EAP-Response/NAK requesting to use PEAP instead<BR />12300 Prepared EAP-Request proposing PEAP with challenge<BR />12625 Valid EAP-Key-Name attribute received<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12302 Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated<BR />12318 Successfully negotiated PEAP version 0<BR />12800 Extracted first TLS record; TLS handshake started<BR />12805 Extracted TLS ClientHello message<BR />12806 Prepared TLS ServerHello message<BR />12807 Prepared TLS Certificate message<BR />12808 Prepared TLS ServerKeyExchange message<BR />12810 Prepared TLS ServerDone message<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12318 Successfully negotiated PEAP version 0<BR />12810 Prepared TLS ServerDone message<BR />12812 Extracted TLS ClientKeyExchange message<BR />12803 Extracted TLS ChangeCipherSpec message<BR />12804 Extracted TLS Finished message<BR />12801 Prepared TLS ChangeCipherSpec message<BR />12802 Prepared TLS Finished message<BR />12816 TLS handshake succeeded<BR />12310 PEAP full handshake finished successfully<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12313 PEAP inner method started<BR />11521 Prepared EAP-Request/Identity for inner EAP method<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />11522 Extracted EAP-Response/Identity for inner EAP method<BR />11806 Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12523 Extracted EAP-Response/NAK for inner method requesting to use EAP-TLS instead<BR />12522 Prepared EAP-Request for inner method proposing EAP-TLS with challenge<BR />12625 Valid EAP-Key-Name attribute received<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12524 Extracted EAP-Response containing EAP-TLS challenge-response for inner method and accepting EAP-TLS as negotiated<BR />12800 Extracted first TLS record; TLS handshake started<BR />12545 Client requested EAP-TLS session ticket<BR />12546 The EAP-TLS session ticket received from supplicant. Inner EAP-TLS does not support stateless session resume. Performing full authentication<BR />12805 Extracted TLS ClientHello message<BR />12806 Prepared TLS ServerHello message<BR />12807 Prepared TLS Certificate message<BR />12808 Prepared TLS ServerKeyExchange message<BR />12809 Prepared TLS CertificateRequest message<BR />12810 Prepared TLS ServerDone message<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />12810 Prepared TLS ServerDone message<BR />12571 ISE will continue to CRL verification if it is configured for specific CA - certificate for<BR />12571 ISE will continue to CRL verification if it is configured for specific CA - certificate for NATIXIS-ALG-DCRT01-CA<BR />12811 Extracted TLS Certificate message containing client certificate<BR />12812 Extracted TLS ClientKeyExchange message<BR />12813 Extracted TLS CertificateVerify message<BR />12803 Extracted TLS ChangeCipherSpec message<BR />12804 Extracted TLS Finished message<BR />12801 Prepared TLS ChangeCipherSpec message<BR />12802 Prepared TLS Finished message<BR />12816 TLS handshake succeeded<BR />12509 EAP-TLS full handshake finished successfully<BR />12527 Prepared EAP-Request for inner method with another EAP-TLS challenge<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />12526 Extracted EAP-Response for inner method containing TLS challenge-response<BR />61025 Open secure connection with TLS peer<BR />15041 Evaluating Identity Policy<BR />15048 Queried PIP - Normalised Radius.RadiusFlowType<BR />22072 Selected identity source sequence - zz_Cert_AD_Intern<BR />22070 Identity name is taken from certificate attribute<BR />22037 Authentication Passed<BR />12528 Inner EAP-TLS authentication succeeded<BR />11519 Prepared EAP-Success for inner EAP method<BR />12314 PEAP inner method finished successfully<BR />12305 Prepared EAP-Request with another PEAP challenge<BR />11006 Returned RADIUS Access-Challenge<BR />11001 Received RADIUS Access-Request<BR />11018 RADIUS is re-using an existing session<BR />12304 Extracted EAP-Response containing PEAP challenge-response<BR />24715 ISE has not confirmed locally previous successful machine authentication for user in Active Directory<BR />15036 Evaluating Authorization Policy<BR />24209 Looking up Endpoint in Internal Endpoints IDStore - zz@dz.zzbp.corp<BR />24211 Found Endpoint in Internal Endpoints IDStore<BR />15048 Queried PIP - Radius.User-Name<BR />15048 Queried PIP - EndPoints.LogicalProfile<BR />24432 Looking up user in Active Directory - xxx@dz.xxx.corp<BR />24325 Resolving identity<BR />24313 Search for matching accounts at join point<BR />24319 Single matching account found in forest<BR />24323 Identity resolution detected single matching account<BR />24355 LDAP fetch succeeded<BR />24416 User's Groups retrieval from Active Directory succeeded<BR />24355 LDAP fetch succeeded<BR />24420 User's Attributes retrieval from Active Directory succeeded<BR />24100 Some of the expected attributes are not found on the subject record. The default values, if configured, will be used for these attributes<BR />15048 Queried PIP - AD.ExternalGroups<BR />15016 Selected Authorization Profile - zz_Users<BR />11022 Added the dACL specified in the Authorization Profile<BR />22081 Max sessions policy passed<BR />22080 New accounting session created in Session cache<BR />12306 PEAP authentication succeeded<BR />11503 Prepared EAP-Success<BR />11002 Returned RADIUS Access-Accep</P> Tue, 14 Oct 2025 15:06:24 GMT https://community.cisco.com/t5/network-access-control/ise-issue/m-p/5338446#M598536 natixis 2025-10-14T15:06:24Z