12934 Supplicant stopped responding to ISE during PEAP tunnel establishment, after an successful session

[rayyaanfayker0006]

Hi 

I have my clients connecting via Peap sessions, but a few weeks ago my clients started to fail authentication randomly during to day. If i look at the logs i see the client authenticate successfully via PEAP (EAP-MSCHAPv2) but then a few hours later the client gets locked out with "12934 Supplicant stopped responding to ISE during PEAP tunnel establishment" error and only when the client disconnects from wired the reconnects does the client authenticate successfully.  this happens to all my wired clients. note that i have a firewall between the client to ISE and i only allow the Cisco switch to talk to ISE that i believe is correct. Is there something wrong with the IBNS 2 configure or can it be the clients that is causing this issue. 

12305	Prepared EAP-Request with another PEAP challenge
	11006	Returned RADIUS Access-Challenge
	12934	Supplicant stopped responding to ISE during PEAP tunnel establishment ( Step latency=120000 ms)
	61025	Open secure connection with TLS peer
	5411	Supplicant stopped responding to ISE

[pnowikow]

I have this same issue with some of my clients but its intermittent.  Would you mind sharing the switch model, IOS version and ISE versions (include patch levels) with me?  Are you using IP device tracking?  Also what does your port level config look like?  What is the latency from the PC/endpoint and your ISE nodes?

Thanks,

Pete

[Mohammed al Baqari]

Hi,

This is a problem at client side. You can use DART tool to generate NAM
logs, if you use AnyConnect NAM. Otherwise, look at windows event viewer.

Most of these issues gets fixed with network driver upgrade from my
experience.

**** please remember to rate useful posts

[Panos Bouras · Accepted solution]

Hi,

You're correct regarding how authentication works, Switch acts as a "proxy" between supplicant and ISE. Review your firewall logs for any indication of blocked communication between the switch and ISE.
The best way to troubleshoot this, is to look at client logs either Anyconnect DART or Windows Logs.
You can always try to get a packet capture and review, if the issue affects specific clients you can SPAN their port and capture 802.1x traffic, then check ISE certificate at server hello and any responses from the client.