09-03-2013 11:20 AM - last edited on 03-25-2019 05:30 PM by ciscomoderator
Background:
Deployed a Cisco ISE 1.1.2. that is used to authenticate and posture validate for wired users, attached to Cisco IP Phones. Backend database is Microsoft AD.
Problem:
At the first time both, users and IP Phones, pass authentication and posture validation steps successfully. When the user logs off from windows, the log off is done whithout any problem, and I can see it switch.
The problem takes place when the user try to log on again. The ise does not match the configured authenticion rules as in the first time, and put the user directly to default "DenyAccess" policy (rule).
Anyone out there experienced something similar or have any ideas on why this is happening?
Thanks.
09-05-2013 12:14 PM
Cisco ISE network enforcement points (switches) may be missing key configuration commands, may be assigning the wrong port (i.e., a port other than 1700), or have an incorrect or incorrectly entered key.
Ensure the following commands are present in the switch configuration file.
aaa server radius dynamic-author
client
09-06-2013 12:23 AM
Hi
Possible Causes
• This could be either a MAB or 802.1X authentication issue.
• The authorization profile could be missing the Cisco av-pair=”device-traffic-class=voice” attribute. As a result, the switch does not recognize the traffic on the voice VLAN.
• The administrator did not add the endpoint as static identity, or did not allow an unregistered endpoint to pass. create a policy rule to (“Continue/Continue/Continue” upon failure).
Resolution
• Verify that the Authorization Policy is framed properly for groups and conditions, and check to see whether the IP phone is profiled as an “IP phone”or as a “Cisco-device.”
• Verify the switch port configuration for multidomain and voice VLAN configuration.
• Add the continue/continue/continue to allow the endpoint to pass:
Choose Policy > Policy Elements > Results > Authentication > Allowed
Protocols to create a Protocol Policy. MAC authentications use PAP/ASCII and EAP-MD5 protocols. Enable the following MAB Protocols settings:
– Process Host Lookup
– PAP/ASCII
– Detect PAP as Host Lookup
– EAP-MD5
– Detect EAP-MD5 as Host Lookup
• From the main menu, choose Policy > Authentication.
• Change the authentication method from Simple to Rule-Based
• Use the action icon to create new Authentication Method entries for MAB:
– Name: MAB
– Condition: IF MAB RADIUS:Service-Type == Call Check
– Protocols: allow protocols MAB_Protocols and use
– Identity Source: Internal
– Hosts: Continue/Continue/Continue
09-06-2013 09:36 PM
Please refer to the discussion below
09-07-2013 05:01 PM
Troubleshooting Steps:
1. Choose Monitor > Authentications.
2. Scroll over and look for the "Failure reason."
Please Look for the details of the failed authentication record and click on the failure reason link under
Details > Resolution for the Authentication. The failure reason should be listed.
Correct the failure reason per the findings that are defined in the Possible Causes.
09-07-2013 07:14 PM
Check the Cisco ISE dashboard (Monitor > Authentications) for any indication regarding the nature of RADIUS communication loss. (Look for instances of your specified RADIUS usernames and scan the system messages that are associated with any error message entries.)
Log into the Cisco ISE CLI and enter the following command to produce RADIUS attribute output that may aid in debugging connection issues:
test aaa group radius
If this test command is successful, you should see the following attributes:
•Connect port
•Connect NAD IP address
•Connect Policy Service ISE node IP address
•Correct server key
•Recognized username or password
•Connectivity between the NAD and Policy Service ISE node
You can also use this command to help narrow the focus of the potential problem with RADIUS communication by deliberately specifying incorrect parameter values in the command line and then returning to the administrator dashboard (Monitor > Authentications) to view the type and frequency of error message entries that result from the incorrect command line. For example, to test whether or not user credentials may be the source of the problem, enter a username and or password that you know is incorrect, and then go look for error message entries that are pertinent to that username in the Monitor > Authentications page to see what Cisco ISE is reporting.)
Note This command does not validate whether or not the NAD is configured to use RADIUS, nor does it verify whether the NAD is configured to use the new AAA model.
09-07-2013 11:39 PM
Paulo,
Can you tell us more about the policies? Are you doing machine authentication and does your authentication policy for user authentication also include a condition for machine authentication? If you can provide some screenshots of your authorization policies along with the authentication report, that will help troubleshoot your issue much faster.
Thanks,
Tarik Admani
*Please rate helpful posts*
09-09-2013 10:07 AM
Hello everyone!
Thank you so much fore your help and attention!
But before changing any policy statement. I preffer try to find a solution/workaround in client machine side.
I've been doing some tests on the LAB environment, and I think that I find out the way to solve the problem.
I'm going to do more consistent tests in production inviroment.
The solution consists in the machine dot1x suplicant side (seet attachement - sorry my windows is in Portuguese).
.
10-04-2013 06:53 AM
Hello guys,
The as I metioned before. The I've got the enviromment working fine by enabling only "User Authentication" and "Single Sing On" as showed in picture I sent before.
Thanks every one for helping me.
Paulo Magalhães
*Please rate helpful posts*
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide