802.1x not working - switch port shows No response from radius-server

[MSJ1]

I am trying to 802.1x for Wired Access. While I try to connect a Laptop it shows Auth failed and from the connected switch I see below error. 

From NAS to ISE IP port 1812.1813 on udp is allowed. 

any of you faced similar issue  ? any leads will be much approcated.

32209: Nov 7 15:38:58.377 ADT: RADIUS: Retransmit to (10.2X.XXX.XX:1812,1813) for id 1645/80
032210: Nov 7 15:38:58.377 ADT: RADIUS(00000000): Started 5 sec timeout
032211: Nov 7 15:39:03.393 ADT: RADIUS(00000000): Request timed out!
032212: Nov 7 15:39:03.393 ADT: RADIUS: No response from (10.2X.XXX.XX:1812,1813) for id 1645/80
032213: Nov 7 15:39:03.393 ADT: RADIUS/DECODE: No response from radius-server; parse response; FAIL
032214: Nov 7 15:39:03.393 ADT: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL
032215: Nov 7 15:39:09.688 ADT: RADIUS/ENCODE(00000000):Orig. component type = Invalid
032216: Nov 7 15:39:09.688 ADT: RADIUS/ENCODE: Skip encoding 0 length AAA attribute formatted-clid
032217: Nov 7 15:39:09.688 ADT: RADIUS(00000000): Config NAS IP: 0.0.0.0
032218: Nov 7 15:39:09.688 ADT: RADIUS(00000000): Config NAS IPv6: ::
032219: Nov 7 15:39:09.688 ADT: RADIUS/DECODE(00000000): There is no General DB. Want server details may not be specified

032266: Nov 7 15:40:16.847 ADT: RADIUS(00000000): Started 5 sec timeout
032267: Nov 7 15:40:21.890 ADT: RADIUS(00000000): Request timed out!
032268: Nov 7 15:40:21.890 ADT: RADIUS: acct-timeout for 1DBE1694 now 35, acct-jitter 0, acct-delay-time (at 1DBE177B) now 35
032269: Nov 7 15:40:21.890 ADT: RADIUS: Retransmit to (10.XX.XXX.XX:1812,1813) for id 1646/158
032270: Nov 7 15:40:21.890 ADT: RADIUS(00000000): Started 5 sec timeout
032271: Nov 7 15:40:26.931 ADT: RADIUS(00000000): Request timed out!
032272: Nov 7 15:40:26.931 ADT: RADIUS: acct-timeout for 1DBE1694 now 40, acct-jitter 0, acct-delay-time (at 1DBE177B) now 40
032273: Nov 7 15:40:26.931 ADT: RADIUS: No response from (10.XX.XXX.XX:1812,1813) for id 1646/158
032274: Nov 7 15:40:26 ADT: %RADIUS-3-ALLDEADSERVER: Group ISE: No active radius servers found. Id 159.
032275: Nov 7 15:40:26.934 ADT: RADIUS/DECODE: No response from radius-server; parse response; FAIL
032276: Nov 7 15:40:26.934 ADT: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL
032277: Nov 7 15:48:55.523 ADT: RADIUS/ENCODE(00000000):Orig. component type = Invalid
032278: Nov 7 15:48:55.523 ADT: RADIUS(00000000): Config NAS IP: 10.XX.XXX.XX

[Mark Elsen]

- @MSJ1    It seems that your radius server are using the legacy ports 1645/1646 instead of 1812/1813            
                  Have a look at this example for a correct setup :
                              https://www.alfredtong.com/cisco/cisco-ios-how-to-configure-radius-server-for-authentication/

                   Afterwards test radius server connectivity on the switch using :
                       test aaa group <RADIUSSERVERS> admin admin$Pwd new-code
                       (example needs adaptation according to the actual group name used)

  M.

[Karsten Iwen]

It definitely could be the problem @Mark Elsen mentioned. But for that, you would have to manually disable ports 1812,1813 as they are enabled by default. Have you?

I would take some captures to see how far the RADIUS requests get to the RADIUS server.

[Aref Alsouqi]

Could you please share your sanitized RADIUS configuration for review? also, have you configure the source interface for RADIUS traffic on the NAD? if not, please try to configure that with the command "ip radius source-interface ..." and make sure the NAD source interface IP is matching the RADIUS client you configured on ISE.

[MSJ1]

@Mark Elsen @Aref Alsouqi @Karsten Iwen 

Sorry it was a firewall along the path. Since I saw ISE Server showing dead with following command show aaa servers from sw. 

I am doing dot1.x for Entra ID users showing below error. any clue on this please  ?

22045 Identity policy result is configured for password based authentication methods but received certificate based authentication request.

[Mark Elsen]

   - @MSJ1           FYI : https://community.cisco.com/t5/security-knowledge-base/how-to-troubleshoot-ise-failed-authentications-amp/ta-p/3630960#toc-hId--1364258772
                                    https://community.cisco.com/t5/network-access-control/ise-and-eap-tls/m-p/1960237#M404462

  M.

[MSJ1]

@Mark Elsen @Karsten Iwen @Aref Alsouqi 

Sorry it was a firewall rule issue along the path.

Now I am facing issue for Entra ID users for 802.1x and log is throwing below error. Any clue will be much appreciated. 

22045 Identity policy result is configured for password based authentication methods but received certificate based authentication request

[Aref Alsouqi]

No problem : D. That error would suggest a mismatch between what ISE authentication rule is expecting and what the client is using. A common root cause would be if you configure ISE authentication rule to look into EAP-PEAP and the clients supplicants are configured to do certificate authentication. You could fix this by correcting ISE authentication rule configuration.