Authorize-only Failed

[obliks00]

Hello,

ISE is used for Authorization and include posture checks.

The user successfully logged in during the previous session. However, during the current login, the following error occurred: 5422 – Authorize Only Failed. The endpoint failed to match authorization policies.

On the ISE Live Logs, the system queried the endpoint's posture status several times before eventually denying access.

Before the failed login attempt, I noticed in Context Visibility that the endpoint status was showing as connected, even though it was actually disconnected.

Step data from failed login:

15048 Queried PIP - Session.PostureStatus 0

15048 Queried PIP - Session.PostureStatus 0

15048 Queried PIP - Session.PostureStatus 1

15048 Queried PIP - Session.PostureStatus 0

15048 Queried PIP - Session.PostureStatus 0

15016 Selected Authorization Profile - DenyAccess 1

15039 Rejected per authorization profile 0

11003 Returned RADIUS Access-Reject 0

Any insights would be greatly appreciated. Thank you.

[Mark Elsen]

  - @obliks00              FYI :   https://bst.cisco.com/bugsearch/bug/CSCwd31405?rfs=qvlogin
                                            https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi43264

  M.

[aleabrahao]

I believe the issue may be related to a stale VPN/posture session in ISE, likely caused by missing or delayed accounting updates from the VPN gateway. This stale session led ISE to evaluate the posture based on outdated information, which prevented a match with the expected authorization rule and ultimately resulted in the application of the deny access policy.
I think it would be a good idea to open a TAC case.

[Blue_Bird]

@obliks00

https://bst.cisco.com/quickview/bug/CSCwi69147

Best regards
******* If This Helps, Please Rate ******