802.1x authentication with Cisco ISE/Windows 11

[network_geek1979]

Team, we see issues with 802.1x authentication after Windows 11 upgrades.

Few complaints coming in are when the machine is idle for some time the 802.1x authentication breaks and the end users  computer goes in the default Internet only access VLAN. This typically happens for end users who are using docking stations.

Unless the end user does not unplug/plug the cable the 802.1x authentication does not succeed.

We are not using any posture assessments, we have only the 802.1x authentications.

I know that Windows 11 and 802.1x authentication have been a challenge but specifically any suggestion? Anyone has come across these issues?

Regards!!

N.

[Marvin Rhoads]

Are you using EAP-MSCHAPv2? There is a known issue whereby Windows 11 update 22H2 credential Guard feature disables the MSCHAPv2 protocol since it is considered insecure. You can re-enable it via registry key (most commonly set via GPO).

The long term recommendation is to move to a secure inner method like EAP-TLS but that requires a PKI to issue certificates and takes a bit of planning and deployment testing.

[network_geek1979]

Hi Marvin,
At our end we using EAP-TLS. Again, we see these issues after Windows 11 only.

Thanks!

[Marvin Rhoads]

That's a new one by me then. It does sound like something changed in the supplicant behaviour though.

What does the RADIUS live log indicate is happening?

[network_geek1979]

The Radius live logs show that user sessions is toggling between Production VLAN and Guest VLAN.
We are not sure why this is going on.

[Greg Gibbs · Accepted solution]

This sounds like another case of FlexAuth (order mab dot1x, priority dot1x mab) with legacy IBNS configuration on the switch. See this whitepaper for the expected behaviour and workaround using the 'terminate-action-modifier=1' Cisco AV pair (in the footer on page 3).
Flexible Authentication Order, Priority, and Failed Authentication

This doc also shows an example of how to use this option:
Top Ten mis-configured Cisco IOS Switch settings for ISE integration  

[network_geek1979]

In our case we do the dot1x first, and then mab.

This is for both, order and priority.

[hslai · Accepted solution]

@network_geek1979 If you still have some Windows 10 clients with similar docking stations and working fine, then Windows 11 is more likely the source of this networking problem. The following two articles might interest you, in case you have not read them yet:

• 802.1x authentication broken after Windows 11 upgrade - reddit/r/sysadmin
• Advanced troubleshooting 802.1X authentication - Microsoft Learn Doc

I have only tested a couple of Windows 11 VM with manual configured wired .1X and found it prompted for more user interactions for domain login.