5440 Endpoint abandoned EAP session and started new

[lin.yang2]

Overview

Event	5440 Endpoint abandoned EAP session and started new
Username	zhenwei.zhang
Endpoint Id	B6:E3:3D:A9:F3:94
Endpoint Profile
Authentication Policy	Ordos_802.1x_AD_auth
Authorization Policy	Ordos_802.1x_AD_auth
Authorization Result

Authentication Details

Source Timestamp	2022-04-25 06:34:47.92
Received Timestamp	2022-04-25 06:34:47.92
Policy Server	ise
Event	5440 Endpoint abandoned EAP session and started new
Failure Reason	5440 Endpoint abandoned EAP session and started new
Resolution	Verify known NAD or supplicant issues and published bugs. Verify NAD and supplicant configuration.
Root cause	Endpoint started new authentication while previous is still in progress. Most probable that supplicant on that endpoint stopped conducting the previous authentication and started the new one. Closing the previous authentication.
Username	zhenwei.zhang
Endpoint Id	B6:E3:3D:A9:F3:94
Authentication Protocol	PEAP
Network Device	Ordos_C9800
Device Type	All Device Types
Location	All Locations
NAS IPv4 Address	10.204.60.3
NAS Port Id	capwap_90000029
NAS Port Type	Wireless - IEEE 802.11
Response Time	41 milliseconds

Other Attributes

ConfigVersionId	217
AcsSessionID	ise/439644191/19875
NAS-Port	91918
CPMSessionID	033CCC0A00003896611F97C9
EndPointMACAddress	B6-E3-3D-A9-F3-94
ISEPolicySetName	Ordos_802.1x_AD_auth
StepLatency	21=18618
DTLSSupport	Unknown
Network Device Profile	Cisco
Location	Location#All Locations
Device Type	Device Type#All Device Types
IPSEC	IPSEC#Is IPSEC Device#No
Device IP Address	10.204.60.3
Called-Station-ID	9c-d5-7d-bc-d8-40:Envision-AESC

Result

RadiusPacketType

Drop

 Steps

	11001	Received RADIUS Access-Request
	11017	RADIUS created a new session
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15048	Queried PIP - Radius.NAS-Port-Type
	11507	Extracted EAP-Response/Identity
	12300	Prepared EAP-Request proposing PEAP with challenge
	12625	Valid EAP-Key-Name attribute received
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12302	Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated
	12318	Successfully negotiated PEAP version 0
	12800	Extracted first TLS record; TLS handshake started
	12805	Extracted TLS ClientHello message
	12806	Prepared TLS ServerHello message
	12807	Prepared TLS Certificate message
	12808	Prepared TLS ServerKeyExchange message
	12810	Prepared TLS ServerDone message
	12305	Prepared EAP-Request with another PEAP challenge
	11006	Returned RADIUS Access-Challenge
	5440	Endpoint abandoned EAP session and started new ( Step latency=18618 ms)

问题：用户认证失败，提示5440错误

我的无线AC的version为

C9800#SHOW VERsion
Cisco IOS XE Software, Version 17.03.03
Cisco IOS Software [Amsterdam], C9800 Software (C9800_IOSXE-K9), Version 17.3.3, RELEASE SOFTWARE (fc7)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2021 by Cisco Systems, Inc.
Compiled Thu 04-Mar-21 12:37 by mcpre

我的ISE版本为3.1

[Marcelo Morais · Accepted solution]

Hi @lin.yang2 ,

 please take a look at: BRKSEC-3383 Troubleshooting ISE, special attention to pg. 10 - 802.1x Endpoint Abandoned EAP Session.

Hope this helps !!!

[maggie.26.1989]

That link doesn't work.It says page not found.

[Mike.Cifelli · Accepted solution]

5440 Endpoint abandoned EAP session and started new

-This is usually an indication of a misconfigured supplicant and/or end user possibly being inpatient and initiating a new auth session before initial one completes.  This may help too: ISE Secure Wired Access Prescriptive Deployment Guide - Cisco Community

[Marcelo Morais · Accepted solution]

Although this is an old post ... I would like to add some points for future reference:

1. special attention to: CSCwd35786 ENH: ISE: 5440 Endpoint abandoned EAP session events need to have visibility in ISE reports

Note: the best Workaround is, at Operations > Reports > Reports > Diagnostics > RADIUS Errors, click the Advanced Filter and Failure Reason CONTAINS 5440.

2. check the CSCwc93451 Profiler should ignore non-positive RADIUS syslog messages for forwarding from default RADIUS probe

" ... Conditions:
Normal operation with profiler default RADIUS probe enabled. You will see messages forwarded like: "5440 NOTICE RADIUS: Endpoint abandoned EAP session and started new , 12934 WARN Failed-Attempt: Supplicant stopped responding, etc. We should only be sending successful authentications, accounting start/stop/interim, ie, 5200, 3000, 3001 & 3002. There are additional successful codes other than 5200. These need to be inculded as well. Everything else should be filtered out and not sent to VCS or DB. ... "

Fixed on ISE3.1 P5 and ISE2.7 P8.

Hope this helps !!!