How to check dot1x authentication details or fail reason?

[getaway51]

Hi,

I tried to find dot1x authentication details or fail reason. Reason was because I can see lots of fail radius logs of MAB but I trying to check the reason why dot1x fail-was it because it wasn't a dot1x device or it was a 3rd party device (without certs). There is no logs related dot1x, all talked abt MAB which I am not interested of.

The failed radius logs of MAB were expected since I didnt add the MAC of the device into "allowed group".

Is there anywhere I can check in ISE for this device dot1x authentication or logs? I even used ISE end-point diagnostic but no mentioned of dot1x as well. All talked abt MAB. 

sh auth sessions int Gi1/0/25 det
Interface: GigabitEthernet1/0/25
IIF-ID: 0x12AF06F6
MAC Address: 1860.2493.685d
IPv6 Address: Unknown
IPv4 Address: 10.30.3.61
User-Name: 18602493735d
Status: Unauthorized
Domain: UNKNOWN
Oper host mode: multi-auth
Oper control dir: in
Session timeout: N/A
Common Session ID: AC15678432400000457474E
Acct Session ID: Unknown
Handle: 0xf500000a
Current Policy: DOT1X_POLICY

Method status list:
Method State
dot1x Running
mab Stopped

[balaji.bandi]

ISE can provide you logs what is the reason it was failed.

here is troubleshooting good guide :

https://community.cisco.com/t5/security-documents/how-to-troubleshoot-ise-failed-authentications-amp/ta-p/3630960

[hslai · Accepted solution]

As you are seeing only MAB requests, that means the endpoints not responding to EAPoL, as shown in Figure 5 of Identity-Based Networking Services (IBNS) 2.0 deployment and configuration guide. In such case, ISE has no records and you need debug on the supplicants on the endpoints themselves.