i have configure closed mode and i have authiz profile for any Dynamic VLAN 50
and my authiz policy if user found in external Idi store then apply Auhiz profls that assigned the pc in vlan 50
problem is the user hit for the default policy and deny acc
Jan 29 15:06:01.998: %DOT1X-5-FAIL: Switch 1 R0/0: sessmgrd: Authentication failed for client (7486.e23c.1af3) with reason (Timeout) on Interface Gi6/0/23 AuditSessionID 01000C0A0000E845B2602950 Username: NIBHQ\6886
Jan 29 15:06:29.998: %DOT1X-5-FAIL: Switch 1 R0/0: sessmgrd: Authentication failed for client (7486.e23c.1af3) with reason (Timeout) on Interface Gi6/0/23 AuditSessionID 01000C0A0000E845B2602950 Username: NIBHQ\6886
Jan 29 15:06:30.009: %MAB-5-FAIL: Switch 1 R0/0: sessmgrd: Authentication failed for client (7486.e23c.1af3) with reason (Cred Fail) on Interface Gi6/0/23 AuditSessionID 01000C0A0000E845B2602950
Jan 29 15:06:30.011: %SESSION_MGR-5-FAIL: Switch 1 R0/0: sessmgrd: Authorization failed or unapplied for client (7486.e23c.1af3) on Interface GigabitEthernet6/0/23 AuditSessionID 01000C0A0000E845B2602950. Failure reason: Authc fail. Auth
Authentication Details
|
Other Attributes
|
Result
|
Steps
| Step ID | Description | Latency (ms) | |
| 11001 | Received RADIUS Access-Request - NibHQ-AD | ||
| 11017 | RADIUS created a new session - nibhq.local | 0 | |
| 15049 | Evaluating Policy Group - NibHQ-AD | 0 | |
| 15008 | Evaluating Service Selection Policy | 1 | |
| 15048 | Queried PIP - DEVICE.Device Type | 0 | |
| 15048 | Queried PIP - Radius.NAS-Port-Id | 0 | |
| 15048 | Queried PIP - DEVICE.Network Device Profile | 0 | |
| 15048 | Queried PIP - Normalised Radius.RadiusFlowType | 1 | |
| 11507 | Extracted EAP-Response/Identity | 0 | |
| 12500 | Prepared EAP-Request proposing EAP-TLS with challenge | 0 | |
| 12625 | Valid EAP-Key-Name attribute received | 1 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 3 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12301 | Extracted EAP-Response/NAK requesting to use PEAP instead | 0 | |
| 12300 | Prepared EAP-Request proposing PEAP with challenge | 0 | |
| 12625 | Valid EAP-Key-Name attribute received | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 3 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12302 | Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated | 0 | |
| 61025 | Open secure connection with TLS peer | 0 | |
| 12318 | Successfully negotiated PEAP version 0 | 1 | |
| 12800 | Extracted first TLS record; TLS handshake started | 0 | |
| 12805 | Extracted TLS ClientHello message | 0 | |
| 12806 | Prepared TLS ServerHello message | 0 | |
| 12807 | Prepared TLS Certificate message | 0 | |
| 12808 | Prepared TLS ServerKeyExchange message | 7 | |
| 12810 | Prepared TLS ServerDone message | 0 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 3 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 0 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 3 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 1 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 4 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 0 | |
| 12318 | Successfully negotiated PEAP version 0 | 0 | |
| 12810 | Prepared TLS ServerDone message | 0 | |
| 12812 | Extracted TLS ClientKeyExchange message | 3 | |
| 12803 | Extracted TLS ChangeCipherSpec message | 0 | |
| 12804 | Extracted TLS Finished message | 0 | |
| 12801 | Prepared TLS ChangeCipherSpec message | 0 | |
| 12802 | Prepared TLS Finished message | 0 | |
| 12816 | TLS handshake succeeded | 0 | |
| 12310 | PEAP full handshake finished successfully | 0 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 4 | |
| 11018 | RADIUS is re-using an existing session | 1 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 0 | |
| 12313 | PEAP inner method started | 0 | |
| 11521 | Prepared EAP-Request/Identity for inner EAP method | 0 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 2 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 1 | |
| 11522 | Extracted EAP-Response/Identity for inner EAP method | 0 | |
| 11806 | Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge | 0 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 4 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 0 | |
| 11808 | Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated | 0 | |
| 15041 | Evaluating Identity Policy | 0 | |
| 15013 | Selected Identity Source - NibHQ-AD | 1 | |
| 24430 | Authenticating user against Active Directory - NibHQ-AD | 0 | |
| 24325 | Resolving identity - NIBHQ\6886 | 2 | |
| 24313 | Search for matching accounts at join point - nibhq.local | 0 | |
| 24315 | Single matching account found in domain - nibhq.local | 0 | |
| 24323 | Identity resolution detected single matching account | 0 | |
| 24343 | RPC Logon request succeeded - 6886@nibhq.local | 2 | |
| 24402 | User authentication against Active Directory succeeded - NibHQ-AD | 0 | |
| 22037 | Authentication Passed | 0 | |
| 11824 | EAP-MSCHAP authentication attempt passed | 0 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 0 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 2 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 0 | |
| 11810 | Extracted EAP-Response for inner method containing MSCHAP challenge-response | 0 | |
| 11814 | Inner EAP-MSCHAP authentication succeeded | 0 | |
| 11519 | Prepared EAP-Success for inner EAP method | 0 | |
| 12314 | PEAP inner method finished successfully | 0 | |
| 12305 | Prepared EAP-Request with another PEAP challenge | 1 | |
| 11006 | Returned RADIUS Access-Challenge | 0 | |
| 11001 | Received RADIUS Access-Request | 2 | |
| 11018 | RADIUS is re-using an existing session | 0 | |
| 12304 | Extracted EAP-Response containing PEAP challenge-response | 0 | |
| 24715 | ISE has not confirmed locally previous successful machine authentication for user in Active Directory | 0 | |
| 15036 | Evaluating Authorization Policy | 0 | |
| 24209 | Looking up Endpoint in Internal Endpoints IDStore - NIBHQ\6886 | 1 | |
| 24211 | Found Endpoint in Internal Endpoints IDStore | 1 | |
| 24432 | Looking up user in Active Directory - NIBHQ\6886 | ||
| 24355 | LDAP fetch succeeded | ||
| 24416 | User's Groups retrieval from Active Directory succeeded | ||
| 15048 | Queried PIP - NibHQ-AD.ExternalGroups | 3 | |
| 15048 | Queried PIP - Network Access.AuthenticationStatus | 0 | |
| 15048 | Queried PIP - Session.PostureStatus | 1 | |
| 15048 | Queried PIP - Session.PostureStatus | 0 | |
| 15016 | Selected Authorization Profile - DenyAccess | 1 | |
| 15039 | Rejected per authorization profile | 0 | |
| 12306 | PEAP authentication succeeded | 0 | |
| 61026 | Shutdown secure connection with TLS peer | 1 | |
| 11503 | Prepared EAP-Success | 0 | |
| 11003 | Returned RADIUS Access-Reject | 0 |
1 Accepted Solution
Accepted Solutions
@Saeed Abd Elhalim Hamada the output above confirms the AD groups that user is a member of
None of which seem to be
So the user won't match that rule and is hitting the default, which is rejecting.
Check the user is a member of the correct AD group. Or amend the rule to permit traffic from another group.
