802.1x Anyconnect NAM & RDP Issue

[KelvinT]

Hi,

We are deploying EAP-Chaining wired with Anyconnect NAM.  ISE 2.7 patch 2.  We are also using PIV card for the user.  When we login locally it is successful.  When we attempt to RDP into the same machine it appear to login successful but continuously looping to the login page.  ISE shows successful user/machine authc.

Any idea what the cause is?  Maybe a setting on Windows 10 like a registry or configuration on Anyconnect to resolve this?

Thanks

[Mike.Cifelli]

A few things to check/consider: When attempting to RDP to a client is the local user completely logged out of the machine?  When installing NAM there is a regkey that enforces single logon.  You can tweak this via:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{B12744B8-5BB7-463a-B85E-BB7627E73002}

To configure single or multiple user logon, add a DWORD named EnforceSingleLogon (this should already be there), and give it a value of 1 or 0.

1 restricts logon to a single user.

0 allows multiple users to be logged on.

Is it possible there is a local client firewall blocking the attempt? Also, what version of AnyConnect are you testing with? I know older versions had bugs that relate to your issue (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvo47467/?rfs=iqvred)

HTH!

[KelvinT]

Hi Mike and thanks for the quick reply.

Anyconnect 4.8.  Disabling the FW will probably not be an option.  Yes there is no other user logged on.  We attempted right after reboot.

Question.....Is there a fix for this bug?

Cisco Bug: CSCus48622 - Smart Card redirection support

[Mike.Cifelli]

Question.....Is there a fix for this bug?

-Not that I can see in the link provided.  You could work with TAC to determine that answer and/or check release notes.  I would recommend testing with the latest 4.9.x client, and then generate a DART bundle after the issue occurs to share with TAC.  You can also use the bundle yourself to identify possible anomalies.  

[KelvinT]

Good point.  I will do that.

Thanks Mike

[KelvinT · Accepted solution]

Hi Mike,

From what I am told by TAC support it, as you said, not  a supported feature yet.  It was sent to enhancement for consideration.

But I'm thinking the better work around is EAP-TEAP since ISE 2.7 support it.  Hence:  No Anyconnect NAM.

I'll keep you posted if this works or not.