ISE and Anyconnect NAM not getting the full username

[ghermocilla]

Hi,

I'm using anyconnect NAM as a supplicant in my windows 10 (ver 1903) using wired authentication.

I'm using ISE 2.4 with patch 10 installed with EAP-FAST for the protocol.

I already configured the proper settings for the NAM using the profile editor.

Whenever I authenticate using the nam, I use username@domain.com as my username.

When I view the radius live logs in ISE I get identity not found in identity store and I noticed that under the identity the username only appears without the domain.

I'm using and LDAP server as an external identity in ISE.

Is there someone having the same issues? is there something wrong in the config? or some bug maybe with anyconnect? not sending the actual username.

[Jason Kunst]

LDAP EAP-FAST is not supported
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/119149-configure-ise-00.html

here is google search
https://www.google.com/search?sxsrf=ACYBGNQWZMwSnzcLtP1-Tr9GlYLzGK2xDQ%3A1571902366856&ei=nlOxXd7rM_eFr7wPzfiRuAk&q=ise+ldap+eap+support&oq=ise+ldap+eap+support&gs_l=psy-ab.3..33i21.21323.22624..22740...0.3..0.177.1287.0j8......0....1..gws-wiz..........

[ghermocilla]

Hi Jason,
I also tried using PEAP(EAP-GTC) and the same result.
For example, I input john.doe@domain.com, when you go to radius live logs it only shows john.doe without the @domain.com
i need the whole username to authenticate.

[Jason Kunst · Accepted solution]

you will need to contact the TAC and attach to defect, I will get my coworker to take a look as well. I don't believe there is workaround

[hslai · Accepted solution]

AFAIK the usernames come from the 802.1X supplicant but not what set by ISE. Thus, please double-check how the username format is set in Configure User Credentials of AnyConnect NAM profile.

If your LDAP has an attribute matching the username format without "@domain.com", then you may pick that as the subject name attribute instead.

If it still an issue, please generate an AnyConnect DART bundle and engage Cisco TAC support.