I have setup EAP-FAST with EAP-Chaining for a Win7 box. I am getting a credential prompt on the Cisco NAM and I cant figure out why. When I connect both user and machine seem to pass but then the NAM prompts for credentials and CoA reverts to Internet only. I have followed this guide but obviously not getting the same result.
http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_80_eapchaining_deployment.pdf
When User fails but machine passes
Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new sessionF
15049 Evaluating Policy Group
15008 Evaluating Service Selection Policy
15048 Queried PIP - Radius.Service-Type
15048 Queried PIP - Radius.NAS-Port-Type
15004 Matched rule - EXAMPLE-EAP-TLS
11507 Extracted EAP-Response/Identity
12100 Prepared EAP-Request proposing EAP-FAST with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12102 Extracted EAP-Response containing EAP-FAST challenge-response and accepting EAP-FAST as negotiated
12800 Extracted first TLS record; TLS handshake started
12175 Received Tunnel PAC
12805 Extracted TLS ClientHello message
12806 Prepared TLS ServerHello message
12801 Prepared TLS ChangeCipherSpec message
12802 Prepared TLS Finished message
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12804 Extracted TLS Finished message
12816 TLS handshake succeeded
12132 EAP-FAST built PAC-based tunnel for purpose of authentication
12209 Starting EAP chaining
12210 Received User Authorization PAC
12211 Received Machine Authorization PAC
12218 Selected identity type 'User'
15041 Evaluating Identity Policy
15006 Matched Default Rule
22072 Selected identity source sequence - EXAMPLE_IDS
15013 Selected Identity Source - EXAMPLE
24432 Looking up user in Active Directory - EXAMPLE
24326 Searching subject object by UPN - USER1@internal.EXAMPLE.net
24328 Subject object not found in a cache
24330 Lookup SID By Name request succeeded
24332 Lookup Object By SID request succeeded
24336 Subject object cached
24351 Account validation succeeded
24420 User's Attributes retrieval from Active Directory succeeded - EXAMPLE
22037 Authentication Passed
12124 EAP-FAST inner method skipped
12219 Selected identity type 'Machine'
15041 Evaluating Identity Policy
15004 Matched rule - Default
15006 Matched Default Rule
22072 Selected identity source sequence - EXAMPLE_IDS
15013 Selected Identity Source - EXAMPLE
24433 Looking up machine in Active Directory - EXAMPLE
24326 Searching subject object by UPN - C0001-USER1$@internal.EXAMPLE.net
24327 Subject object found in a cache
24329 Subject cache entry expired
24330 Lookup SID By Name request succeeded
24332 Lookup Object By SID request succeeded
24336 Subject object cached
24351 Account validation succeeded
24439 Machine Attributes retrieval from Active Directory succeeded - EXAMPLE
22037 Authentication Passed
12124 EAP-FAST inner method skipped
12964 Sent EAP Result TLV indicating success
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12106 EAP-FAST authentication phase finished successfully
11503 Prepared EAP-Success
15036 Evaluating Authorization Policy
15048 Queried PIP - Radius.Service-Type
15048 Queried PIP - Radius.NAS-Port-Type
15048 Queried PIP - Network Access.EapTunnel
24432 Looking up user in Active Directory - EXAMPLE
24325 Resolving identity - USER1
24313 Search for matching accounts at join point - internal.EXAMPLE.net
24319 Single matching account found in forest - EXAMPLE.net
24323 Identity resolution detected single matching account
24355 LDAP fetch succeeded - internal.EXAMPLE.net
24416 User's Groups retrieval from Active Directory succeeded - EXAMPLE
24433 Looking up machine in Active Directory - EXAMPLE
24325 Resolving identity - host/C0001-USER1
24313 Search for matching accounts at join point - internal.EXAMPLE.net
24319 Single matching account found in forest - EXAMPLE.net
24323 Identity resolution detected single matching account
24355 LDAP fetch succeeded - internal.EXAMPLE.net
24435 Machine Groups retrieval from Active Directory succeeded - EXAMPLE
15048 Queried PIP - EXAMPLE.ExternalGroups
15004 Matched rule - WIRED_MACH_EAP-TLS
15016 Selected Authorization Profile - D_INTERNET_ONLY
11022 Added the dACL specified in the Authorization Profile
11002 Returned RADIUS Access-Accept
