Hi,
We have a two-mode ISE 2.7 Patch6 deployed.
Recently we rolled out 802.1X to all our customers Windows10 laptops and desktops with EAP-TLS. The majority (98%) of the users can login to the network without any issues.
Some users get this error message “Can’t verify the server’s identity. If you’re trying to connect to your organisation’s Ethernet network, go ahead and connect. Continue connecting?” About 50% of users who get this error message can access the network without any issues.
For the remaining users, they cannot login to the network. In the ISE logs, they get the following.
Event 5411 Supplicant stopped responding to ISE
Failure Reason 12935 Supplicant stopped responding to ISE during EAP-TLS certificate exchange
I ran the following on the local access switch where one of the users is patched into:
- debug radius
- debug dot1x all
- debug epm all
- conf t
- no logging console
- no logging monitor
- Logging buffered 7
- logging buffered 10000000
- exit
- clear logging
- show logging
I was able to confirm that the MTU is 1500 so was able to rule jumbo frame out as a root cause.
802.1X settings on the wired adapter are delivered via GPO
For all Laptops and Desktops, dot1x authentication needs to be enabled using the following settings, this is completed by deploying a GPO for all desktops and laptops:
For the ethernet connections properties for their network connectivity, do the following:
- Go to Properties
- Select Authentication
- Enable IEEE 802.1X authentication
- Select Microsoft Smart Card or Other Certificate:
- Select Remember my credentials for this connection each time I’m logged on
- Select Fallback to unauthorized network access
- For Microsoft Smart Card or Other Certificate, select Settings:
- Select “Use a certificate on this computer
- Select Use simple certificate selection (Recommended)
- Select Verify the server’s identity by validating the certificate
- The certificate COMPANY Trust 1 is selected.
For Additional Settings in the Authentication tab, do the following
- Select specify authentication mode
- Select User or Computer authentication
- Do not select anything else.
Verify Certificates on COMPANY Device (Laptop or Desktop)
USER CERTIFICATE:
The user logging into the network should have a certificate issued by COMPANYTrust2
MACHINE CERTIFICATE:
The machine logging into the network should have a certificate issued by COMPANYTrust1
ISE is configured as follows:
Any ideas on what I can try to get them on the network
Accepted Solutions
The cert for the ISE appliance is on the endpoint's is in the client local trust store.
-So to clarify so we are in sync:
--User cert would be in 'Personal' store (User Certificates); Computer cert would be in personal store under Certificates(Local Computer)
--Intermediate and Root Certs in the chains should be placed in their respective stores: ex: intermediate certs go in Intermediate Certification Authorities trust store; root certs go in Trusted Root Certification Authorities store;
So essentially both chains for COMPANYTrust1 and 2 need to be in the stores on the local client including the chain (whichever CA has issued ISE its identity cert) this way clients trust ISE. Once this is confirmed test again to see if your result is different for the 'Can’t verify the server’s identity.' problem.
The cert for the ISE appliance is on the endpoint's is in the client local trust store.
-So to clarify so we are in sync:
--User cert would be in 'Personal' store (User Certificates); Computer cert would be in personal store under Certificates(Local Computer)
--Intermediate and Root Certs in the chains should be placed in their respective stores: ex: intermediate certs go in Intermediate Certification Authorities trust store; root certs go in Trusted Root Certification Authorities store;
So essentially both chains for COMPANYTrust1 and 2 need to be in the stores on the local client including the chain (whichever CA has issued ISE its identity cert) this way clients trust ISE. Once this is confirmed test again to see if your result is different for the 'Can’t verify the server’s identity.' problem.
