topic Re: ISE 802.1x Authentication Failure - 12535 The EAP-TLS session tick in Network Access Control

ISE 802.1x Authentication Failure - 12535 The EAP-TLS session ticket

matthew.goli1 — Wed, 14 Jan 2026 17:20:36 GMT

Hello,

I have been experiencing a number of Windows endpoints failing 802.1x authentication with the failure reason of "12535 The EAP-TLS session ticket received from supplicant is expired". When this occurs the endpoint's Wired Event log shows this event message:
============================================

Wired 802.1X Authentication failed.

Network Adapter: Intel(R) Ethernet Connection (11) I219-LM

Interface GUID: {caad02e9-f125-4451-bed6-b19c17cfd2b1}

Peer Address: 5067AECA6791

Local Address: D8BBC181B75E

Connection ID: 0x2

Identity: host/S23IA15.wfn.int

User: -

Domain: -

Reason: 0x50005

Reason Text: The message received was unexpected or badly formatted.

Error Code: 0x80090326

============================================

Googling this isn't turning up many answers for me yet.

When the client fails 802.1x authentication, it then authenticates via MAB successfully, but our MAB policy places a Block all ACL on that endpoint causing a disruption.

After a few minutes the client re-authenticates successfully with 802.1x.

This is on an ISE deployment with ISE version 3.2 patch 9.

I did have a TAC open and we disabled "EAP TLS Session Resume" based on their recommendations but still seeing this issue occur randomly across different clients on our network.

Wondering if anyone here has some more insight on this issue and what can be done about it.

Matt.

Re: ISE 802.1x Authentication Failure - 12535 The EAP-TLS session tick

Arne Bier — Tue, 20 Jan 2026 01:07:27 GMT

I was under the impression that this relates to the Stateless Session Resume (which is separate to the EAP-TLS Session Resume feature - this feature is where the Server (ISE) keeps track of the session lifetime) - have you got this enabled still? Try disabling that. I don't know how many vendor products support this (Windows native supplicant probably does).

Re: ISE 802.1x Authentication Failure - 12535 The EAP-TLS session tick

Cristian Matei — Sat, 24 Jan 2026 19:17:48 GMT

Hi,

@matthew.goli1 Try disabling Credential Guard on client side:

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure?tabs=reg

Thanks,

Cristian.