cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
 
ISE 2.3 Patch 7 has been posted. This will be the last patch for the ISE 2.3 release!
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

176
Views
0
Helpful
9
Replies

ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

Hi,

 

We are migrating configuration from ISE 1.4 to ISE 2.6. To authenticate, PCs use AD credentials as user and machine via EAP-FAST, but we found that is failing. I see user is succes and machine failes to against AD. I checked configuration in ISEv1.4 and is the same as ISEv2.6. We are using a PC with Anyconnectv4.5 to test and it can authenticate with any problem in ISEv1.4.

 

In logs I see this issue, also I attached a txt file with the logs from this authentication test

24344RPC Logon request failed - STATUS_WRONG_PASSWORD,ERROR_INVALID_PASSWORD,PR-RCUEVASIL$@

 

This is the current configuration in ISEv2.6, same as ISEv1.4

 

Captura de pantalla (1046).pngCaptura de pantalla (1050).pngInkedCaptura de pantalla (1047)_LI.jpg

InkedCaptura de pantalla (1048)_LI.jpg

 

 

Thank you for your help.

9 REPLIES 9
Beginner

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

At first glance, it seems as though the computer account password is incorrect which would mean that either the computer is not joined to the domain or would need to be removed and rejoined.  That is what the RPC Logon Failed message means.  But you say it works just fine on the other ISE instance.  Are both ISE instances joined to the same AD domain?  If the machine fails on the new ISE and you move it to the old ISE, does it work?  If that is the case, then the AD machine account isn't the problem.

Can you send a screenshot of your Radius Live Logs screen filtered on the Endpoint ID (Mac Address) of the machine you are testing?  And also send a screenshot of the details of the Live Log entries showing the failures.  Send the entire details page so we can see all of the attributes of the session.  Also, send screenshots of how you have the Anyconnect NAM profile configured specifically for the machine authentication section.

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

Hi,

 

Here are screenshots from page log for this test user, this is using Anyconnect 4.5 and have the configuration to authenticate with credentials stored for AD, but when connected NAM requires additional credentials.

 

Captura de pantalla (1052).pngCaptura de pantalla (1054)_LI.jpgCaptura de pantalla (1055)_LI.jpgCaptura de pantalla (1056)_LI.jpgCaptura de pantalla (1057)_LI.jpgCaptura de pantalla (1058)_LI.jpgCaptura de pantalla (1060)_LI.jpg

 

Also, this are the erros that live logs shows:

Captura de pantalla (1060).png

Beginner

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

Remove the computer from the domain and rejoin it.  Then test again and see if it still complains about the password for the machine account.

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

And that is why NAM requires login? Users only suppose to connect PC wired or wireless and gets automatically autenticated, but instead NAM shows login window.

Highlighted
Beginner

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

When the supplicant attempts authentication using one form of credentials/certificate and that fails, then the supplicant will prompt for other credentials or certificate.  So yes, when the initial credentials fail, NAM prompts for other credentials.

Enthusiast

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

Are you using machine certificates or machine credentials for machine authentication? If you're using Machine Credentials for your NAM profile then you won't be able to use the native machine credentials by default, only machine certificates. 

 

Can you show us what settings you have in your NAM XML profile under the <machine> section? 


If it shows  <authenticateWithPassword> you're using credentials, if it shows </authenticateWithCertificate> then you're using certificates. 

 

With Windows 8/10 AnyConnect is no longer able to utilize the machine credentials for authentication. Microsoft made a change that limits what third party (i.e. AnyConnect) can access--one of the things they have limited is access to the decrypted machine credentials. 

 

To utilize machine credentials, you have to make a change to the registry. See these articles for details:

 

https://social.technet.microsoft.com/Forums/ie/en-US/31825350-d3bf-4366-a4f5-acdca2f3cb81/allow-lsa-to-send-unencrypted-secrets-to-make-cisco-anyconnect-work?forum=win10itprosecurity

 

https://community.cisco.com/t5/vpn-and-anyconnect/windows-10-machine-authentication-with-anyconnect-nam/td-p/3462166

 

OR, if you have certificates on your machine, you can utilize Machine Certificates instead of Machine Credentials. 

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

I think the problem is the register, we tried with a machine with register modified to allows unencrypted secrets and it works. But the other machine is not modified.

Enthusiast

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

Yep, if it's a newer Windows machine then it will require the registry modification if you want to use the machine credentials. However, you can use machine certificates if they're already deployed in your environment (that is what I did on a recent deployment). 

Re: ISE 2.6 EAP-Fast failure - User succes and machine failed - Anyconnect 4.5

Now both machines works in wired 801.x authentication. I see the same problem is present in wireless network, it shows same behavior, requires login to user and looks like NAM doesn't use machine for both user and machine authentication. This time in both machines with register modified. This end customer is using same WLC for ISEv2.4 and ISEv2.6. I checked model and OS is compatible, WLC 5508 with 8.3.131.

 

Configuration in wireless is following:

 

Captura de pantalla (1062).pngCaptura de pantalla (1069).pngCaptura de pantalla (1068).pngCaptura de pantalla (1067).pngCaptura de pantalla (1066).pngCaptura de pantalla (1065).pngCaptura de pantalla (1064).pngCaptura de pantalla (1063).png