Dot1x radsec IPv6

[david-w-rollins14-ctr]

I had Dot1x authenticating with ISE for quite some time, using IPv4/IPv6 implementation and RADSEC. I had to remove IPv6 from the entire network, due to management decisions. Right after I removed IPv6, Dot1x stopped working completely. I remembered that Radius does not appreciated FQDN when using just IPv4. So I reverted those switch configs for radius servers to IPv4 and MAB started working. But Dot1x still will not succeed. 

Using EAP-TLS for authentication. Packet capture from the workstation appears to reveal that the switch and wks appear to be exchanging EAP traffic with each other. I can verify that DTLS is established with ISE. ISE still reports no response from supplicant. 

sh aaa servers log reveals Access Timeouts and Transaction failures.

My question is, are there any known limitations with RADSEC and dot1x(EAP-TLS). Is there any known issues with ISE and changing the IP addresses and/or removing ipv6?

[Arne Bier]

I would not have expected changes to the IP layer to affect how EAP works, since the EAPOL frames are shoved into RADIUS UDP packets - and those are transported by the IP layer (v4 or v6) - if MAB works, then I have to assume the RADIUS comms between the switch and ISE is working (using IPv4 in your case, after removing v6)

The "show aaa servers" should reveal that the servers are in "UP" status. I'd be surprised if an EAP payload uses a different IP RADIUS transport than a MAB request. But I suppose anything is possible in IOS-XE or ISE ... it just doesn't make sense.

If you're able to remove the aaa config on the switch, and re-add it, perhaps that will be a useful troubleshooting step. 

And if issue still exists, then remove the ISE Network Device entry, and re-add that.