From my understanding of FIPS mode on ISE in order for radius to function on the network access device, it must be configured to utilize AES Key Wrapping. From the guides I've found online to configure the key-wrap the following commands are necessary;
aaa group server radius ISE_radius
server name ISE1
server name ISE2
key-wrap enable
radius server ISE1
address ipv4 X.X.254.224 auth-port 1812 acct-port 1813
key-wrap encryption-key 0 serverISE1Asdf01 message-auth-code-key 0 serverISE1serverISE1 format ascii
radius server ISE2
address ipv4 X.X.254.225 auth-port 1812 acct-port 1813
key-wrap encryption-key 0 serverISE1Asdf01 message-auth-code-key 0 serverISE1serverISE1 format ascii
But looking at the show radius server-group all command it looks like authentications are passing but authorizations are failing.
sw1#show radius server-group all
Server group radius
Sharecount = 1 sg_unconfigured = FALSE
Type = standard Memlocks = 1
Server(X.X.254.224:1812,1813,ISE1) Transactions:
Authen: 3 Author: 3 Acct: 305
Server_auto_test_enabled: FALSE
Keywrap enabled: FALSE
Server(X.X.254.225:1812,1813,ISE2) Transactions:
Authen: 0 Author: 0 Acct: 297
Server_auto_test_enabled: FALSE
Keywrap enabled: FALSE
Server group ISE_radius
Sharecount = 1 sg_unconfigured = FALSE
Type = standard Memlocks = 1
Server(X.X.254.224:1812,1813,ISE1) Transactions:
Authen: 402 Author: 0 Acct: 181
Server_auto_test_enabled: FALSE
Keywrap enabled: TRUE
Server(X.X.254.225:1812,1813,ISE2) Transactions:
Authen: 291 Author: 0 Acct: 35
Server_auto_test_enabled: FALSE
Keywrap enabled: TRUE
sw1#show authentication sessions interface gi1/0/5 details
Interface: GigabitEthernet1/0/5
IIF-ID: 0x18C8245F
MAC Address: 1111.aaaa.bbbb
IPv6 Address: fe80::1
IPv4 Address: X.X.200.51
User-Name: host/1
Status: Authorized
Domain: UNKNOWN
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Common Session ID: 37100113000002FA19777735
Acct Session ID: 0x000002cb
Handle: 0x370002f0
Current Policy: POLICY_Gi1/0/5
Local Policies:
Service Template: DEFAULT_CRITICAL_VOICE_TEMPLATE (priority 150)
Voice Vlan: Vlan: 200
Server Policies:
Method status list:
Method State
dot1x Authc Failed
Any thoughts as to why key wrap isn't working?
