Cisco ISE 2.2 first time login to corporate notebook

[Sp@wn]

Hi,

We have ISE 2.2 patch 10.We use PAP mschapv2 dot1x user authentication. When clients try login to their new laptop coming from IT departmant they get the following error;

We can't sign you in with this credential because your domain isn't available.

How do we get over it?

Regards,

[marce1000]

 - You will probably have to verify your ise-policies. For starters check what is in the ISE auth log(s) for the corresponding authentication attempts.

M.

[Sp@wn · Accepted solution]

ISE did not have any log when the user tried to log in. Wireless connection could not be established because there are no cached users on the PC. I created another rule for domain computers and I created authz policy for them. In the ACL, I gave just LDAP, DNS, DHCP access and I blocked the rest of everything. After that users was able to join wireless connection and they could log in the their laptop. And now they able access the network with their user permissions.

[hslai]

It looks like you solved it yourself with marce1000's advice. It's correct that the computer needs AD access for an AD user able to login. Do consider the pointers from paul.

[paul]

Why are you allowing the laptop's to go to PEAP User mode authentication?  If you are allowing Domain Users to authenticated you have a hole in your security design.  Any user can bring in any device they want and user their AD credentials to attach to the network.  If you don't have user based policies, configure only PEAP Computer Auth.  If you have user policy requirements you should look to user EAP-TLS or NAM with EAP Chaining.

[Sp@wn]

We also doing posture after user logged in their computer. And one of the posture conditions is that the computer must a domain computer. Thanks your advices. I found my solution.

[zunaid.cse]

Hi,

Can i troubleshoot your problem using remote session.

My Details:

Muhammad Zunaid Bhuiyan

Email: zunaid.cse@gmail.com

Mobile: +880196240005