Cisco ISE Failure: 24408 User authentication against Active Directory failed since user has entered the wrong password

[Marc Aemmer]

Hi,

Since we implemented Cisco ISE we receive the following failure on several Notebooks:

Authentication failed : 24408 User authentication against Active Directory failed since user has entered the wrong password

This happens 2 or 3 times per Day. So basically the authentications are working. But when the failure appears, the connection is lost for a short time.

The Clients are using PEAP(EAP-MSCHAPv2) for Authentication. We've got a Cisco Wireless Environment (WLC 5508).

Why is this happening?

Thanks,

Marc

[Ravi Singh]

This error occurs due to wrong password. But as you are saying there is failure, I would like to suggest you that please check when failure happen there is proper connectivity between AD  and ISE. What I feel that there is network issue between ISE and AD

[Jatin Katyal · Accepted solution]

The possible causes of this error message are:

1.] If the end user entered an incorrect username.

2.] The shared sceret between WLC and ISE is mismatched. With this we'll see continous failed authentication.

3.] As long as a PSN not receiving a response from the supplicant within this limit during an EAP conversation, it will throw this error code. In majority of cases it says eap session timed out.

In your cases, the 3rd option seems to be the most closest one.

.

Jatin Katyal
- Do rate helpful posts -

[Prashobcv93]

Is there a resolution for each possibility?