Dear all,
I'm particularly new on the ISE field, so pardon me if I'm explaining something wrong. I'll write only about wired endpoints.
Can someone please guide me further because I fell like I'm hitting the end in a case where I'm having multiple endpoints which are dot1x auth capable, and are configured to authenticate that way, same as network devices and also ISE, and in the end those endpoints aren't authenticated and being rejected, while ISE live logs showing that those endpoints are being rejected per auth profile which is the one configured for MAB authentication, and I'm not seeing that ISE has recorded or shown me a live log where it tells me that dot1x auth has occurred at all, it shows me only the livelog wich refers to the tried MAB auth policy
The point is that this shouldn't happen at all, authentication order and priority is set to first do dot1x then to MAB as fallback. (this is proven by the fact that we have hunderts of other endpoints where dot1x auth occurs at first and was successful).
All those endpoints, the one that do auth per dot1x or not,are:
- domain members,
- the same GPO are applied to them, the ones that which relate to network adapter settings
- they have a valid certificate for client authen on their local store,
- they share the same NAD's
- on int conf auth order and priority is configured dot1x then mab
- also the authentication policy on policy sets is set dot1x above mab,
- none of those endpoints are entered into User identity groups on ISE,
When I'm checking directly on the switch with sh auth ses int gi1/0/10 details, it says dot1x running, after some time nothing happens, then it states dot1x stopped and mab stopped, simultaneously watching ISE live logs, no log about that particular endpoint performing dot1x only the one where ISE rejects the enpoint per MAB.
I've tried with clear auth ses int or mac on switched, to shut no shut the interface, it changes nothing. Also tried to remove mab command from the interface on those problematic endpoints, to see will they somehow onyl do dot1x, nothing.
Does anyone have a hint where to look at, what to do next, how to force the enpoint/switch/ISE execute dot1x, how to troubleshoot further? If more information is needed, I will try to provide more. Thanks
