cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
15256
Views
10
Helpful
18
Replies

Eap tls / PEap authentication failing cisco ise 2.7

Tutu
Level 1
Level 1

Hi guys i keep getting this error message when trying to authenticate user and machine. it worked fine before but now it gives me this error.

 

I am not sure what is going on,

 

Overview
Event 5440 Endpoint abandoned EAP session and started new
Username \tempadmin
Endpoint Id E8:D8:D1:40:35:DD
Endpoint Profile
Authentication Policy Wired
Authorization Policy Wired
Authorization Result

Authentication Details
Source Timestamp 2021-01-28 10:48:42.487
Received Timestamp 2021-01-28 10:48:42.487
Policy Server -ISE-PAN
Event 5440 Endpoint abandoned EAP session and started new
Failure Reason 5440 Endpoint abandoned EAP session and started new
Resolution Verify known NAD or supplicant issues and published bugs. Verify NAD and supplicant configuration.
Root cause Endpoint started new authentication while previous is still in progress. Most probable that supplicant on that endpoint stopped conducting the previous authentication and started the new one. Closing the previous authentication.
Username \tempadmin
Endpoint Id E8:D8:D1:40:35:DD
IPv4 Address 10.100.105.73
Authentication Protocol PEAP
Network Device Test_Switch
Device Type All Device Types#Wired
Location All Locations#test_switch
NAS IPv4 Address 10.200.208.100
NAS Port Id GigabitEthernet1/0/10
NAS Port Type Ethernet

Other Attributes
ConfigVersionId 1597
AcsSessionID -ISE-PAN/400522847/105868
NAS-Port 50110
CPMSessionID 0AC8D064000000210F5A7666
EndPointMACAddress E8-D8-D1-40-35-DD
EapChainingResult No chaining
ISEPolicySetName Wired
StepLatency 74=18042
TLSCipher ECDHE-RSA-AES256-GCM-SHA384
TLSVersion TLSv1.2
DTLSSupport Unknown
Network Device Profile Cisco
Location Location#All Locations#test_switch
Device Type Device Type#All Device Types#Wired
IPSEC IPSEC#Is IPSEC Device#No
Device IP Address 10.200.208.100

Result
RadiusPacketType Drop


Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
15049 Evaluating Policy Group
15008 Evaluating Service Selection Policy
15048 Queried PIP - DEVICE.Device Type
15048 Queried PIP - DEVICE.Location
11507 Extracted EAP-Response/Identity
12100 Prepared EAP-Request proposing EAP-FAST with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12301 Extracted EAP-Response/NAK requesting to use PEAP instead
12300 Prepared EAP-Request proposing PEAP with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12302 Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated
12318 Successfully negotiated PEAP version 0
12800 Extracted first TLS record; TLS handshake started
12805 Extracted TLS ClientHello message
12806 Prepared TLS ServerHello message
12807 Prepared TLS Certificate message
12808 Prepared TLS ServerKeyExchange message
12810 Prepared TLS ServerDone message
12811 Extracted TLS Certificate message containing client certificate
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12304 Extracted EAP-Response containing PEAP challenge-response
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12304 Extracted EAP-Response containing PEAP challenge-response
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12304 Extracted EAP-Response containing PEAP challenge-response
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12304 Extracted EAP-Response containing PEAP challenge-response
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12304 Extracted EAP-Response containing PEAP challenge-response
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12304 Extracted EAP-Response containing PEAP challenge-response
12318 Successfully negotiated PEAP version 0
12812 Extracted TLS ClientKeyExchange message
12813 Extracted TLS CertificateVerify message
12804 Extracted TLS Finished message
12801 Prepared TLS ChangeCipherSpec message
12802 Prepared TLS Finished message
12816 TLS handshake succeeded
12310 PEAP full handshake finished successfully
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12304 Extracted EAP-Response containing PEAP challenge-response
12313 PEAP inner method started
11521 Prepared EAP-Request/Identity for inner EAP method
12305 Prepared EAP-Request with another PEAP challenge
11006 Returned RADIUS Access-Challenge
5440 Endpoint abandoned EAP session and started new ( [step latency=18042 ms] Step latency=18042 ms)

18 Replies 18

Hi @Tutu

Ok, is Microsoft Credential Guard enabled on this client? Because that would block the transmission of the machine credentials via PEAP/EAP-MSCHAPv2.

https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-considerations

I have disabled it already but still the same thing.

Can you provide a screenshot from the keys under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\ ?

hslai
Cisco Employee
Cisco Employee

Your AnyConnect NAM is configured for EAP-FAST (EAP-MSCHAPv2) with EAP Chaining enabled.

Your native supplicant should use the option "Automatically use my Windows log-on name and password (and domain if any)", if both the computer and the user are in the AD domain and using their AD credentials. Otherwise, please select "user authentication" as the authentication mode, if the user is not in AD or not using the AD credentials.