topic Re: Cisco Identity Services Engine (ISE) in Wireless

Cisco Identity Services Engine (ISE)

Rickey369 — Mon, 05 Jul 2021 16:21:05 GMT

Hi All,

After deploying ISE , I'm encountering some problem with the few desktop users as the authentication is very slow (1-3 hours) when they connect LAN cable to their desktop.

Is this the probelm with ISE? How can i troubleshoot this? Sometimes i need to continuous restart the desktop to get authenticated to LAN network. ( Ie; to get the proper domain network, I usually get "network 3" or "network 1" instead of getting abc.com (<-- Just an example)

This problem is only with few desktop users. Most of the desktop works fine.

Is this the problem with domain controller ?

or dot1x Authentication issue ( But ISE shows Authentication success)?

Please Help!!

Re: Cisco Identity Services Engine (ISE)

pieterh — Tue, 23 Oct 2018 13:20:10 GMT

"network 3" or "network 1" instead of getting abc.com

I guess you are not deploying all workstations using central deployment (images /domain-policies)

-> you need to manually configure on those clients that "network 3" and "network 1" (IP-subnets) are also used for known corporate networks and this is not a public or home network.

or you have not added them to active directory sites and services

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Tue, 23 Oct 2018 15:19:22 GMT

Hi Pieterh,

The users are added in AD, the problem is with Slow authentication, That is the user sometimes get Network 3 or network 2 instead of getting abc.com and take long time to get abc.com or i need to restart the device several times to get abc.com

Re: Cisco Identity Services Engine (ISE)

Leo Laohoo — Tue, 23 Oct 2018 21:41:29 GMT

What is the exact version of ISE (including patch level)?

FN - 70035 - Cisco Identity Services Engine – Slow Response Time in Administration Web User Interface - Software Upgrade Recommended

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Wed, 24 Oct 2018 03:24:23 GMT

Hi Leo,

I use 1.2.1.198

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Wed, 24 Oct 2018 04:08:42 GMT

Hi Leo,

I use 1.2.1.198 with 8 patches.

Re: Cisco Identity Services Engine (ISE)

Leo Laohoo — Wed, 24 Oct 2018 04:29:16 GMT

@Rickey369 wrote:
I use 1.2.1.198 with 8 patches.

Whao. That is old & buggy. Y'sure you don't want to upgrade to something more recent?

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Wed, 24 Oct 2018 04:49:28 GMT

Yes Leo. 😞 But the issue that im facing right now is because of this old version of ISE or is it something else ?
Will this issue be resolved if update the version? if yes, what is the best version that i can update ?

Re: Cisco Identity Services Engine (ISE)

Leo Laohoo — Wed, 24 Oct 2018 04:52:17 GMT

All I can say is ISE didn't mature until 2.1 and we didn't deploy ISE until it 2.0.

However, I've never seen or heard of anyone taking an hour to login.

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Wed, 24 Oct 2018 04:52:21 GMT

Oh I see. Thanks leo. I will try updating ISE.

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Wed, 24 Oct 2018 04:56:07 GMT

But Again , This issue is with few users only. Other user has no problem in getting abc.com . Anyways I will try updating ISE.

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Wed, 24 Oct 2018 06:28:49 GMT

Hi Leo.

It does not take time to login at all. There is no issue with login. the problem is , it takes time to get the abc.com domain, instead i get network 3 or network 2 . and i need to wait for long time or i need to restart the system many times to get abc.com

The authentication for the users getting network 3 or network 2 is showing success in ISE.

Also this issue is not with all the users. Only few users , i can say 5 users have this issue out of 100 users.

Re: Cisco Identity Services Engine (ISE)

Jurgens L — Wed, 24 Oct 2018 07:13:11 GMT

You may need to check DNS, verify your end devices get the correct suffix when an IP address is assigned from the DHCP server. If you have a firewall that does AD/LDAP authentication for internet services, also verify that this is successful once connected to the network.

Upgrading from 1.2 to 2.x is a major update, you might consider rather starting up a new ISE node/s and migrate your current nodes over to the new ones to mitigate any risk. The most stable release out at the moment is 2.2.

Re: Cisco Identity Services Engine (ISE)

pieterh — Wed, 24 Oct 2018 08:20:05 GMT

1) This problem is only with few desktop users

That is the user sometimes get Network 3 or network 2 instead of getting abc.com and take long time to get abc.com or i need to restart the device several times to get abc.com.

-> can you drill this down to specific brand/model/hw-version/OS of the workstation?

I suggest checking the network drivers + configuration on the clients

dot1x should be the first method used when connecting to the network

2) you've given little information about your network and ISE setup

do you use a guest or quarantine vlan? before assigning the corporate vlan after authorization?

3) It looks to me like these clients do not receive IP-address from dhcp-server,

but reuse an address previously assigned at another network while the lease-time is still valid

-> start from the bottom!

- when displaying "network3"does this client have a correct ip-address

- is this acquired from the correct dhcp server?

- are other dhcp information correct?

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Fri, 26 Oct 2018 05:10:36 GMT

Hi pieter,

I use cisco ISE 1.2.1.198 with 8 patches. I also use dot1x auth . we use windows 10 OS. we have guest vlan ( The problem is only when user connects to with wired Connection ) and quarantine vlan ( The user is in the proper vlan when the issue is encountered ).

1. Is this really the issue because of ISE ? Because most of the user dont have this issue, As i said earlier only 5 out 100 user has this issue.

2. Is this anything to do with Domain controller ? if yes, How can i confirm and trouble shoot this ?

Re: Cisco Identity Services Engine (ISE)

Jurgens L — Fri, 26 Oct 2018 05:39:03 GMT

Have you tried to connect the user in question directly on a switchport with no 802.1X authentication enabled and with the quarantined VLAN assigned to the port and see if you get the same result?

Re: Cisco Identity Services Engine (ISE)

Rickey369 — Fri, 26 Oct 2018 05:59:09 GMT

I have not tried that. let me try this troubleshooting.
But when i connect some other laptop to that port where the user finds issue, it works !! and when i connect it back to old laptop ( laptop of the user having issue ) it shows network 2 or network 3 .

I have also tried with no 802.1x , it still shows network 2 or network 3 , but the user is able to access internet and other applications.