topic Re: Radius Testing - Cisco ISE - not all passing in Wireless

Radius Testing - Cisco ISE - not all passing

jake.ryan1 — Thu, 05 Sep 2019 10:14:09 GMT

Hello

Firmware: 25.13

Cisco ISE: 2.3.0.298

just testing the radius authentication from the dashboard to our Cisco ISE radius

Total APs:	9
APs passed:	4
APs failed:	5
APs unreachable:	0

these are same subnet, same site, same everything

each time I test I receive different results and sometime I receive an error

RADIUS attributes used:
Airespace-ACL-Name:HS-Laptop

RADIUS attributes unused:
User-Name: *domain\user*
State:ReauthSession:0a2d000fKS4uutHjQp5FArmB2ZstcLZ63zRmIXdtubIA7tDgTB4

I managed to find a good site explaining this a long time ago but I am unable to find it now so looking for help with a solution of explanation

our old Cisco ISE box (decommissioned) used to always be 100% but as I am not a Cisco ISE person I unable to to even work out the difference

and cisco forums are a mess so hoping here someone can point me in the correct direction

Working AP ISE output:

Authentication Details

Source Timestamp	2019-09-05 09:42:20.332
Received Timestamp	2019-09-05 09:42:20.333
Policy Server	servername
Event	5200 Authentication succeeded
Username	domain\user
Endpoint Id	00:00:00:00:00:02
Calling Station Id	00-00-00-00-00-02
Authentication Identity Store	HS_AD
Authentication Method	MSCHAPV2
Authentication Protocol	PEAP (EAP-MSCHAPv2)
Network Device	Meraki_AP
Device Type	All Device Types#Meraki_AP
Location	All Locations
NAS IPv4 Address	10.45.99.12
NAS Port Type	Wireless - IEEE 802.11
Authorization Profile	HS_Laptop_Permit_All
Response Time	19 milliseconds

failing AP ISE output

Authentication Details

Source Timestamp	2019-09-05 09:42:21.899
Received Timestamp	2019-09-05 09:42:21.9
Policy Server	servername
Event	5400 Authentication failed
Failure Reason	12953 Received EAP packet from the middle of conversation that contains a session on this PSN that does not exist
Resolution	Verify known NAD issues and published bugs. Verify NAD configuration. Turn debug log on DEBUG level to troubleshoot the problem.
Root cause	Session was not found on this PSN. Possible unexpected NAD behavior. Session belongs to this PSN according to hostname but may has already been reaped by timeout. This packet arrived too late.
Username	domain\user
Endpoint Id	00:00:00:00:00:02
Calling Station Id	00-00-00-00-00-02
Network Device	Meraki_AP
Device Type	All Device Types#Meraki_AP
Location	All Locations
NAS IPv4 Address	10.45.99.13
NAS Port Type	Wireless - IEEE 802.11
Response Time	4 milliseconds

any help on this is greatly appreciated

Re: Radius Testing - Cisco ISE - not all passing

Nolan H. — Thu, 05 Sep 2019 14:28:59 GMT

I can't help here as I don't mess with ISE, but found the following links that might be of assistance (unless you've already read them then never mind lol).

You'll want to make sure your ISE is updated/patched etc.

Are you able to open up a TAC case for your issue?

https://community.cisco.com/t5/identity-services-engine-ise/ise-2-4-and-error-12953/td-p/3828922

https://community.cisco.com/t5/wireless-security-and-network/ise-ad-802-1x-authentication-failure-all-of-the-sudden/td-p/2502236

Old, mentioning if you have load-balancer in the mix

https://community.cisco.com/t5/policy-and-access/ise-eap-authentication-fails/td-p/2658436

Old, but mentioning switch IOS version

https://community.cisco.com/t5/policy-and-access/ise-ad-authentication-stop-working-for-wireless/td-p/2363848

Old, but might help?

Re: Radius Testing - Cisco ISE - not all passing

raj.yarlagadda@meraki.com — Thu, 05 Sep 2019 17:13:06 GMT

Hi @jake.ryan1

Do you have radius accounting enabled? If so you might be running into an ISE bug.

Can you try disabling accounting and see if you still see the same issue?

P.S: For security reasons, it will be a good idea to mask out sensitive information like Re-auth session IDs and all 🙂

Cheers!

Raj

Re: Radius Testing - Cisco ISE - not all passing

Philip D'Ath — Thu, 05 Sep 2019 20:49:25 GMT

Are all the APs listed as clients in ISE?

Re: Radius Testing - Cisco ISE - not all passing

jake.ryan1 — Thu, 05 Sep 2019 22:58:33 GMT

Hi Raj

sorry I was not sure what is passed in all these things

do you have any description of what the ISE bug could be as I am sure we are running accounting

cheers

Re: Radius Testing - Cisco ISE - not all passing

jake.ryan1 — Thu, 05 Sep 2019 23:00:03 GMT

Hi Philip

i am covering our entire network subbnet with meraki so authentication is covered at this point as you can see the Same subnet is taking authentication the same as the AP which is not

Re: Radius Testing - Cisco ISE - not all passing

raj.yarlagadda@meraki.com — Fri, 06 Sep 2019 16:02:11 GMT

Hi @jake.ryan1 I was looking into the Auth error details and found this article in Cisco forums which is related to the auth error you are seeing. You can see the bug id in there.

https://community.cisco.com/t5/policy-and-access/ise-ad-authentication-stop-working-for-wireless/td-p/2363848

Cheers!

Raj

Re: Radius Testing - Cisco ISE - not all passing

Eric101 — Fri, 11 Oct 2019 17:16:55 GMT

We came across the same issue and found bug https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq00652/?rfs=iqvred which was affecting our test results.