ISE 1.3 Upgrade LDAP Issue

[dylanhorner]

We recently upgraded to 1.3 and everything seems fine except that we noticed that the catalyst switches we use AD authentication through ISE for stopped dropping us automatically in enable mode. I did rejoin the device to AD as required post upgrade and have since unjoined and rejoined. When I run the test user option for the AD Identity store I get an error saying its unable to fetch LDAP attributes, see attached. There is also a similar error in the syslog anytime a user logs into the switch. I went back on the syslogs and these errors were not happening until the upgrade. I am assuming this somehow correlates to my issue. Anyone else experienced this post upgrade? Thanks.

[jan.nielsen]

Are you using LDAP or native AD join ?

There are some issues with LDAP and quotes in the group names, which is not supported. I also have had issues with 1.3 and using comma and users names, so something like Doe, John. is not possible as the name of a user in AD.

As for native AD, i have not had any issues with ISE 1.3

[dylanhorner]

Its native AD join. Joins fine, just errors on the ldap when you do a "test user". I am assuming its related since a syslog message across with a similar error when I authenticate to a switch, see attached.

[Venkatesh Attuluri]

what is the protocol you are using  EAPTLS. LDAP do not support mschapv2 , EAPTLS supported