5400 and 5434 authentication failed

[hcl_cisco]

Hello Everyone,

Most of the time, I have faced 5400 and 5434 error message. Issue is not for all users , some of the user (like: 10/day) have faced issue on SSID.

ISE Version: 1.3.0.876

Authentication Type: EAP-TLS

Laptop Error: Can't able to connect on this network

ISE logs: 5400  authentication failed and 5434 several authentication failed (Attached logs).

Pleas let me know what will troubleshooting steps to resolve the user issue.

Please help me on this.

[pachi814]

do we have the solution for this issue ?if so please share me pachi814@gmail.com

---

@hcl_cisco wrote:

Hello Everyone,

Most of the time, I have faced 5400 and 5434 error message. Issue is not for all users , some of the user (like: 10/day) have faced issue on SSID.

ISE Version: 1.3.0.876

Authentication Type: EAP-TLS

Laptop Error: Can't able to connect on this network

ISE logs: 5400  authentication failed and 5434 several authentication failed (Attached logs).

Pleas let me know what will troubleshooting steps to resolve the user issue.

Please help me on this.

---

[ajc · Accepted solution]

As Jason indicated, you need to move from 1.3 to 2.x, BUT if you are running old appliances 3395 then you are in trouble because those ones do not accept 2.x version. At this point your only options would be running VM's or replacing appliances.

[ajc · Accepted solution]

Just to review your ISE configuration for Wireless users, take a look on the following video.

https://www.youtube.com/watch?v=OCqLRzuqCW8

You are hitting the AUTHC default policy = deny access. So looks like those enduser devices DO NOT have the proper profile configured for EAP-TLS like the next.

You also need to confirm those endusers devices have in the TRUSTED Certificate Authority list the CA that signed the ISE EAP Certificate being used.

[ajc]

More info.

[Jason Kunst]

Would recommend moving off ISE 1.3 which is EOS/EOL to ISE 2.4 the current recommended Long term release. You will have better operation.