ISE and auto-connect to wifi

[dgaikwad]

Hi Experts,

Recently I have been reported an issue that describes as follows, a laptop does not connect automatically to cooperate SSID when it wakes up from sleep. And as per the description this seems to be happening with the ones that have AnyConnect installed on them.

So, first of all is there is any connection between AnyConnect running on laptop and it not being able to connect automatically to corporate SSID?
Why would AnyConnect not allow the endpoint to connect to post it wakes from sleep?

Has anyone faced with such an issue in the past?

[balaji.bandi]

So if you do not have any connect all working as expected ?

what mode is your any connect profile, always on ?

[dgaikwad]

Is this always profile for AnyConnect or for Windows OS?
Since I have never come across configuration before...

[Aileron88]

How do you authenticate the session? What logs are you seeing on ISE for the failed sessions? 

If you are using active directory check if you have MAR enabled. It can cause issues when machines are woken up from sleep and so there is no corresponding machine authentication. 

[dgaikwad]

The authentication are done from AD, but did not a get chance to take a look at the ISE Live logs. Will check those see if there are any issues.
The other question is, what should I be expecting when I check the live logs? Authentication failures? Or some kind of errors?

[Aileron88]

Hi,

You would see authentication failures and if you dive in to them you will see something along the lines of 'no succesful machine authentication can be confirmed with Active Directory' if this is a MAR based issue.

If you go to Administration > Identity Management > External Identity Sources > Active Directory > Click on your AD domain > Advanced Settings - what do you have under 'Enable Machine Access Restrictions'?

Thanks