Hi all,
We deployed ISE in Azure back in March (version 3.3.0.430) with the following setup:
- 4 x ISE servers (PAN/PSNs)
- ExpressRoute from on-premise to Azure
- Meraki APs
We noticed we have hundreds of clients stopped responding errors every day and when we look further the main error is "12935 Supplicant stopped responding to ISE during EAP-TLS certificate exchange". Quite a few online posts suggest this is an MTU sizing issue where Azure drops fragmented packets.
The deployment guide suggests that this is a known issue with DMVPN and SD-WAN connections and the fix is to contact Microsoft support for them to allow "out-of-order fragments" option.
We logged this with Microsoft and apparently this isn't just a case of enabling a setting and the fix is to create a brand new subscription, use gen 7 VMs and route traffic via the internet!!! Obviously this isn't viable as our connection to Azure has to go via our Express Route circuit!
The guide suggests this has now been fixed in East Asia and West Central US however nothing has changed in UK South.
Has anyone else come across a similar issue and managed to get the issue resolved without the things they suggested to us?
Also is there anywhere in ISE where we can prove that Azure is dropping fragmented packets so we can go back to our account manager with evidence?
TIA.
