Failed authentications with username "USERNAME"

[Matteo Comisso]

Hi all,

I've just noticed a thing looking at failed authentications on a production ISE cluster: a lot of clients, probably smartphones, are trying to connect the WPA2-Enterprise SSID using username "USERNAME". I'm suspecting this is something intentional, but I can't figure out what feature is this and how this should be helpful.

Thanks in advance!

Matteo

[Damien Miller · Accepted solution]

This was introduced for security reasons. If you look at this link i provided, you will be able to disable the masking by checking the box "Disclose invalid usernames". In earlier 2.4 patches this was only enabled for 60 minutes, if you are on a later patch you can disable it indefinitely.
https://<ise admin ip>/admin/#administration/administration_system/administration_system_settings/protocols/RADIUS

[Matteo Comisso]

Thanks Damien!

Just to complete the answer, in case someone will need in the future: in ISE 2.6 this setting has been moved under Administration > System > Settings > Security Settings

Regards,

Matteo

[Mike.Cifelli]

From a wired perspective this can potentially be due to your clients supplicant not being setup to negotiate properly. I know with NAM you can configure profiles specifically to use an unprotected identity pattern for the outer layer. The default is anonymous, but you can change it using the profile editor. Not sure what WLCs you are using, but I would agree that this is intentional. If the logs are truly from mobile devices I would start with tshooting your onboarding process. Good luck & HTH!