ISE 2.2 fail to authenticate machine which is updated with Windows 10 version 1803

[siddhesh.parab@orange.com1]

Issue reported by customer :-

Upon installing ‘Feature Update to Windows 10 version 1803’ some computers fail to pick up an IP address on an ISE only port. Machines connect correctly and obtains IP on NON-ISE port.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

We have seen logs for one of the mac address. Where laptop is sending the MAC address as identify an hence taking policy for MAB instead of dot1x.

After some time laptop sending its machine certificate and its getting authenticated with proper dot1x policy.

Switch port is configured properly as below, but now question is ,why the laptop is sending MAC address initially instead of certificate and after some time its sending certificate.

Have you face similar issues from any client? What is the solution for same?

Live logs from ISE

[Jason Kunst]

Please work through the TAC on troubleshooting support issues

[siddhesh.parab@orange.com1]

Already contacted TAC.. still need more detailed resolution...any one is facing issue after upgrading windows 10 1803

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

The machine is responsible for presenting the certificate, to ISE for authenticating.

Only when the ISE is presented with the certificate, it passes the authentication.

When the supplicant is not presenting  the certificate it lands up to the MAB policies.

ISE cannot change the any of the certificate parameters of the client machine.