ISE Alarm : Info : EAP Connection Timeout : Server=<Name>; NAS IP Address=x.x.x.x; NAS Identifier=N/A

[pnowikow]

Alarm Name : 
Supplicant stopped responding

Details : 
EAP Connection Timeout : Server=<Name>; NAS IP Address=x.x.x.x; NAS Identifier=N/A

Description : 
ISE sent last message to the client 120 seconds ago but client still has not responded

Severity : 
Info

Suggested Actions : 
Verify that supplicant is configured properly to conduct a full EAP conversation with ISE. Verify that NAS is configured properly to transfer EAP messages to/from supplicant. Verify that supplicant or NAS does not have a short timeout for EAP conversation. Check the network that connects the Network Access Server to ISE. If external ID store is used for the authentication then is may be not responding fast enough for current timeouts.

*** This message is generated by Cisco Identity Services Engine (ISE) ***

Sent By Host : CiscoISEVM01

[Colby LeMaire · Accepted solution]

This is another normal alarm.  If the client starts the authentication process but then doesn't finish, ISE will fire this alarm after 2 minutes.  So this can happen if a client is connecting to wireless but then switches to wired in the middle of authentication.  Or if a client computer is woken up but then disconnected from the wired network.  It isn't an issue unless it is widespread and impacting users.

[pnowikow]

@Colby LeMaire I'm getting way too many of these errors so feel comfortable suppressing them.  How can I troubleshoot EAP issues in ISE?  Would wireshark help prove anything or Event Logs for 802.1x.  It's only Win10 machines which experience failures periodically.  Recently we moved from Monitor Mode to Low-Impact Mode so each time the EAP communication fails, Windows 10 waits 20 min until it tries again and by then the user has called the HelpDesk.  As a workaround, we add them to a MAB identity group which gives them network access. 

I've tried to force the endpoints to use TLS 1.2 by editing this reg key HKLM\SYSTEM\CurrentcontrolSet\Services\RasMan\PPP\EAP\13 and adding a DWORD called TlsVersion with c00 in the data.  Some work fine with this change while others don't.  Over the summer we were upgrading Windows 10 from 1803 to 1909 and simultaneously migrating to Low-Impact Mode.  I know it's a Windows supplicant issue but I can't seem to resolve it.  I'm trying my best not to remove Low-Impact Mode across the board but I'm going to have to unless I can find a fix.