Cisco ISEv2 & Guest on 3750x SW Wired

[Hisham_IBM]

Hello,

Could anyone give me a suggestion to solve the below reported problem, really, it is very strange

After downloading DACL from Cisco ISE-2 to switch 3750x, I receive immediately "REASON Provisioning Failed" ?

Jan 26 16:33:25.827: %EPM-6-AAA: POLICY xACSACLx-IP-NG_WIRED_GUEST-56a7960f| EVENT DOWNLOAD_REQUEST
Jan 26 16:33:25.836: %EPM-6-AAA: POLICY xACSACLx-IP-NG_WIRED_GUEST-56a7960f| EVENT DOWNLOAD-SUCCESS
Jan 26 16:33:25.911: %EPM-4-POLICY_APP_FAILURE: Policy Application Failed for Client [10.0.121.24] MAC [28d2.4426.02ae] AuditSessionID [0A0000650000004A063C060F] forPOLICY_TYPE Named Acl POLICY_NAME xACSACLx-IP-NG_WIRED_GUEST-56a7960f  REASON Provisioning Failed

Thanks,

[nspasov]

Hi Hisham-

Can you tell me if you:

1. Confirmed that the DACLs syntax is correct? Please copy the syntax of it here.

2. Do you have "ip device tracking" enabled on the switch?

Thank you for rating helpful posts!

[Hisham_IBM]

Hello Neno,

finally, I took the step to upgrade the IOS of 3750x and everything worked fine even if Cisco did not announce any BUGs for c3750e-universalk9-mz.152-3.E and it worked fine after upgrading IOS to c3750e-universalk9-mz.150-2.SE9.bin, I can see the whole transactions (dot1x then MAB) :

Jan 26 19:40:42.564: %DOT1X-5-FAIL: Authentication failed for client (28d2.4426.02ae) on Interface Gi1/0/16 AuditSessionID 0A0000650000000D002DA062
Jan 26 19:40:42.564: %AUTHMGR-5-START: Starting 'mab' for client (28d2.4426.02ae) on Interface Gi1/0/16 AuditSessionID 0A0000650000000D002DA062
Jan 26 19:40:42.597: %MAB-5-SUCCESS: Authentication successful for client (28d2.4426.02ae) on Interface Gi1/0/16 AuditSessionID 0A0000650000000D002DA062
Jan 26 19:40:42.597: %EPM-6-POLICY_REQ: IP 0.0.0.0| MAC 28d2.4426.02ae| AuditSessionID 0A0000650000000D002DA062| AUTHTYPE DOT1X| EVENT APPLY
Jan 26 19:40:42.606: %EPM-6-AAA: POLICY xACSACLx-IP-PERMIT_ALL_TRAFFIC-56161e32| EVENT DOWNLOAD-REQUEST
Jan 26 19:40:42.639: %EPM-6-AAA: POLICY xACSACLx-IP-PERMIT_ALL_TRAFFIC-56161e32| EVENT DOWNLOAD-SUCCESS
Jan 26 19:40:42.648: %EPM-6-POLICY_APP_SUCCESS: IP 10.0.121.24| MAC 28d2.4426.02ae| AuditSessionID 0A0000650000000D002DA062| AUTHTYPE DOT1X| POLICY_TYPE Named ACL| POLICY_NAME xACSACLx-IP-PERMIT_ALL_TRAFFIC-56161e32| RESULT SUCCESS
Jan 26 19:40:42.656: %EPM-6-POLICY_APP_SUCCESS: IP 10.0.121.24| MAC 28d2.4426.02ae| AuditSessionID 0A0000650000000D002DA062| AUTHTYPE DOT1X| POLICY_TYPE URL Redirect| POLICY_NAME https://NG-DC-ISE-01.newcairo.local:8443/portal/gateway?sessionId=0A0000650000000D002DA062&portal=0ce17ad0-6d90-11e5-978e-005056bf2f0a&action=cwa&token=a3bd77c7d8aec8621a7c17fc0785b1af| RESULT SUCCESS
Jan 26 19:40:42.656: %EPM-6-POLICY_APP_SUCCESS: IP 10.0.121.24| MAC 28d2.4426.02ae| AuditSessionID 0A0000650000000D002DA062| AUTHTYPE DOT1X| POLICY_TYPE URL Match ACL| POLICY_NAME cwa-redirect| RESULT SUCCESS
Jan 26 19:40:43.210: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (28d2.4426.02ae) on Interface Gi1/0/16 AuditSessionID 0A0000650000000D002DA062

[Hisham_IBM]

Thanks for your response, It is highly appreciated ...

[nspasov · Accepted solution]

Yeah, the 15.x train has been bumpy and I have seen funky issues with it. Glad the upgrade took care of the issue! Also, thank you for coming back and posting the solution (+5 from me)

Now if your issue is resolved you should mark the thread as "answered" :)

Thank you for rating helpful posts!