Authentication issues in ISE 2.0 deployment

[kamlenegi]

Hello All,

We have deployed ISE 2.0 for wired & wireless users. Now we are increasing users in LAN and facing more problems, can someone help us to fine tune ISE auth parameter. Issues are:

1. Sleep mode domain systems goes in mab authentication and stuck in preauth vlan which should be dot1x. After unplug & plug the lan cable then it works and dot1x success. Everyday users come in the morning and need to unplugged & plugged the lan cable which is not a solution.

2. IP address conflict message seems in may system after authentication success, can we do fine tune ISE for this.

3. Some systems wired auto config goes stop automatically and windows supplicant stop working. 

Please help us to do the best practice configuration.

Thanks

Kamlesh

[nspasov]

Hello Kamlesh, my comments below:

1) What type of machines and what type of Operating System are running on them

2) Who is handling the IP address assignment in your network? This sounds like a DHCP configuration issue rather than ISE. 

3) Are you turning the auto config client via GPO? If so, have you confirmed that there aren't conflicting policies that might be causing this? Event viewer should give you more info on why and who turned that service off. 

I hope this helps!

Thank you for rating helpful posts!

[kamlenegi]

Hi Neno,

We are using Windows 7 & 10 machines, maximum are win7. IP address is assigning from Window DHCP server.

How I can check auto config client via GPO?

Thanks

Kamlesh

[jan.nielsen]

IP address conflict is usually caused by a windows flaw, it can be solved with :

ip device tracking probe delay 10

http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/8021x/116529-problemsolution-product-00.html

[kamlenegi]

Thanks Jan,

Let me configure & observe.

Thanks

Kamlesh

[lajan jaleel]

Dear kamlesh,

Are you using anyconnect supplicant for authentication or you are using Windows native Authentication for Dot1x.

Also Could you please post the ISE policies for reference.

Thanks & Regards,

LAJAN JALEEL