iPSK not working

[craiglebutt]

Just testing iPSK, I've followed the official Cisco links and several other people who have set this up, but I must be missing something simple.

The WLC is running 8.5.140, ISE is 2.2 Patch 15

As you will see on the policy set picture I've tried to setup using End Point Groups and calling station id = mac address, with permit all and psk just to get the basic connect working.

2 Endpoint Groups IPSK-Phone630 , IPSK-Phone681, both have at least 1 mac address for testing.

All Auth Profiles Access

Type = ACCESS_ACCEPT

cisco-av-pair = psk=mode=asci

cisco-av-pair = psk=abc12345

Have attached the RADIUS failure.  The WLC is configured correctly, have tippled checked all configs but something not just there, just need a fresh set of eyes

cheers

[Colby LeMaire]

In your authorization policy, you are looking for a calling-station-id of the MAC address with colons ":" and capital letters.  If you look at the failure details, the attribute for calling-station-id uses dashes "-" and lower-case letters.  That is why you aren't matching on an authorization rule and falling down to the default of deny access.

[craiglebutt]

I see what you are saying, the ISE changes the "-" to ":", even when entering on adding devices to Endpoints and creating Policy's.

In the Radius Live Logs appears as ":"

cheers