Cisco ISE and TLS version negotation

[AdamBogdan26228]

Hi
I have Cisco ISE with AnyConnect supplicant. I would like to move completely to TLS1.2 only but as I checked some users are still connecting via TLS1 and others via TLS1.2 (yeah, in ISE all TLS versions are still enabled). As users connecting to the same ISE with the same settings in AnyConnect I guess that TLS version is negotiated by Windows. Could someone confirm that my thinking is correct ? Additionaly - this is not Cisco question - but anyone know how to check why Windows is negotiating TLS1 ? Is it because of some registry settings/etc. ?

[Mike.Cifelli]

This may assist:

---

https://support.microsoft.com/en-us/help/3121002/windows-10-devices-can-t-connect-to-an-802-1x-environment

Change tls version on windows host:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RasMan\PPP\EAP\13

TLS version DWORD value
TLS 1.0 0xC0
TLS 1.1 0x300
TLS 1.2 0xC00