If you check your Authentiction details. You will probably see no certificate found for the user. There is an issue with distributed AD environments:
In a distributed environment, a delay occurs before any domain controller has received the certificates and CRLs through Active Directory replication. The delay will vary depending on the Active Directory environment configuration.
So I'd ask the AD guys, what replication type and schedule are they running? This can be troubleshot watching the Published Certificates tab of the user record. Open and close the record while enrolling and after to see when it shows up.
What you should see is something like this in ISE record details, Steps section:
12811 Extracted TLS Certificate message containing client certificate |
12812 Extracted TLS ClientKeyExchange message |
12813 Extracted TLS CertificateVerify message |
12804 Extracted TLS Finished message |
12801 Prepared TLS ChangeCipherSpec message |
12802 Prepared TLS Finished message |
12816 TLS handshake succeeded |
12509 EAP-TLS full handshake finished successfully |
12505 Prepared EAP-Request with another EAP-TLS challenge |
11006 Returned RADIUS Access-Challenge |
11001 Received RADIUS Access-Request |
11018 RADIUS is re-using an existing session |
12504 Extracted EAP-Response containing EAP-TLS challenge-response |
Evaluating Identity Policy |
15048 Queried PIP |
15048 Queried PIP |
15004 Matched rule |
22037 Authentication Passed |
12506 EAP-TLS authentication succeeded |
11503 Prepared EAP-Success |
As far as your question:
does anyone know how often does the ISE pulls AD for information....?
It only "Pulls" information when you populate the AD dictionary (Groups and/or User attributes) in External Identities.
As far as how often if performs a lookup. It performs a lookup for every authentication as required and every processing of an Authorization Policy rule that requires a reference to that specifc rule. (think of multiple situations for processing rules which in turn would result in CoA processings for the session)
So your comment:
UUmmmm thinking about this though, ISE should check the User "state" in AD every time the user tries to Authenticate....so could we possibly be talking about an AD replication issue here instead of ISE to AD???
good troubleshooting /thinking!
I hope you find this answer useful, if it was satisfactory for you, please mark the question as Answered.
Please rate post you consider useful.
-James
