AnyConnect Authentication fails and then succeeds

[TobiasBlachetta7285]

Hi,

I have a really strange behaviour in our new ISE 2.6 cluster.

When an AnyConnect client connects to our ASA 5545-X, the ASA talks radius to our ISE cluster.

The log shows:

2019-05-27 10:30:18.03	RADIUS Accounting watchdog update
2019-05-27 10:30:17.846	RADIUS Accounting start request
2019-05-27 10:30:17.84	Authentication failed
2019-05-27 10:30:17.818	Authentication succeeded

It's a local user which gets authenticated, it always fails first, then succeeds, the Anyconnect client shows no failure at all, it just connects successfully.

Failed attempt:

11001	Received RADIUS Access-Request
	11017	RADIUS created a new session
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15048	Queried PIP - Cisco-VPN3000.CVPN3000/ASA/PIX7x-Tunnel-Group-Name
	15041	Evaluating Identity Policy
	15013	Selected Identity Source - Internal Users
	24210	Looking up User in Internal Users IDStore - testuser
	24212	Found User in Internal Users IDStore
	22040	Wrong password or invalid shared secret
	22057	The advanced option that is configured for a failed authentication request is used
	22061	The 'Reject' advanced option is configured in case of a failed authentication request
	11003	Returned RADIUS Access-Reject

And successfull attempt:

11001	Received RADIUS Access-Request
	11017	RADIUS created a new session
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15048	Queried PIP - Cisco-VPN3000.CVPN3000/ASA/PIX7x-Tunnel-Group-Name
	15041	Evaluating Identity Policy
	15013	Selected Identity Source - Internal Users
	24210	Looking up User in Internal Users IDStore - testuser
	24212	Found User in Internal Users IDStore
	22037	Authentication Passed
	24715	ISE has not confirmed locally previous successful machine authentication for user in Active Directory
	15036	Evaluating Authorization Policy
	24209	Looking up Endpoint in Internal Endpoints IDStore - testuser
	24211	Found Endpoint in Internal Endpoints IDStore
	15048	Queried PIP - Network Access.AuthenticationStatus
	15016	Selected Authorization Profile - VPN
	15048	Queried PIP - Network Access.UserName
	15048	Queried PIP - InternalUser.IPAddress
	22081	Max sessions policy passed
	22080	New accounting session created in Session cache
	11002	Returned RADIUS Access-Accept

How can I fix the first failed attempt?

[Jason Kunst]

Check the authentication policy and make sure its set to continue for unknown users.

If this doesn’t work open a tac case.

[paul · Accepted solution]

It looks like to me you have mistakenly configure AAA authorization on your VPN tunnel group on your ASA.  You should only be doing RADIUS authentication and accounting.  Make sure you don't have authorization enabled.

[TobiasBlachetta7285]

Thanks Paul, that worked!

I thought that I needed authorization to push the profile to the client (the profile gives the IP address to the user, which is configured in the local user on ISE). But this works anyway.

Best regards,

Tobias