cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
12288
Views
0
Helpful
5
Replies

5400 and 5434 authentication failed

hcl_cisco
Beginner
Beginner

Hello Everyone,

 

Most of the time, I have faced 5400 and 5434 error message. Issue is not for all users , some of the user (like: 10/day) have faced issue on SSID.

 

ISE Version: 1.3.0.876

Authentication Type: EAP-TLS

Laptop Error: Can't able to connect on this network

ISE logs: 5400  authentication failed and 5434 several authentication failed (Attached logs).

 

Pleas let me know what will troubleshooting steps to resolve the user issue.

Please help me on this.

 

2 Accepted Solutions

Accepted Solutions

ajc
Rising star
Rising star

Just to review your ISE configuration for Wireless users, take a look on the following video.

 

https://www.youtube.com/watch?v=OCqLRzuqCW8

 

You are hitting the AUTHC default policy = deny access. So looks like those enduser devices DO NOT have the proper profile configured for EAP-TLS like the next.

 

You also need to confirm those endusers devices have in the TRUSTED Certificate Authority list the CA that signed the ISE EAP Certificate being used.

 

 

View solution in original post

As Jason indicated, you need to move from 1.3 to 2.x, BUT if you are running old appliances 3395 then you are in trouble because those ones do not accept 2.x version. At this point your only options would be running VM's or replacing appliances.

View solution in original post

5 Replies 5

pachi814
Beginner
Beginner

do we have the solution for this issue ?if so please share me pachi814@gmail.com


@hcl_cisco wrote:

Hello Everyone,

 

Most of the time, I have faced 5400 and 5434 error message. Issue is not for all users , some of the user (like: 10/day) have faced issue on SSID.

 

ISE Version: 1.3.0.876

Authentication Type: EAP-TLS

Laptop Error: Can't able to connect on this network

ISE logs: 5400  authentication failed and 5434 several authentication failed (Attached logs).

 

Pleas let me know what will troubleshooting steps to resolve the user issue.

Please help me on this.

 


 

As Jason indicated, you need to move from 1.3 to 2.x, BUT if you are running old appliances 3395 then you are in trouble because those ones do not accept 2.x version. At this point your only options would be running VM's or replacing appliances.

ajc
Rising star
Rising star

Just to review your ISE configuration for Wireless users, take a look on the following video.

 

https://www.youtube.com/watch?v=OCqLRzuqCW8

 

You are hitting the AUTHC default policy = deny access. So looks like those enduser devices DO NOT have the proper profile configured for EAP-TLS like the next.

 

You also need to confirm those endusers devices have in the TRUSTED Certificate Authority list the CA that signed the ISE EAP Certificate being used.