ISE closed mode prevents DHCP after successful 802.1x authentication

[waqas gondal]

Hi

We are using ISE 2.4 and are using enforcement (closed) mode at our main office. It is working fine on all our switch stacks (3850 version 16.6.6).

I take the same configuration and apply it to another location using the same ISE appliance, same switch model. For some reason the endpoints are stuck with 169.254.x.x IP. This is after the the 802.1x authentication has passed. When I revert ISE to monitor mode for those switches, it does not fix the problem. The PCs are still not able to get an IP, not after a reboot of the PC or defaulting the port config. The trigger for this issue is ISE going into closed mode. What could the issue be?

This is all with the native windows 10 supplicant.

[sovandy.top]

I am also facing similar problem on some PCs which can't get IP address from the DHCP server after authentication pass, but the switch is running on the low impact mode. If try to reboot the PC, the problem is fixed at that time, but it will happen again in the next time. For the implementation, we have installed Anyconnect agent, NAM module, SBL module and compliant module. 
Does anyone face this kind of issue the same to me? What is the suggestion to check on the issue?

[Marcelo Morais]

Hi,

 as soon as your PC has been assigned an APIPA IP Addr (169.254.x.x) you are probably not reaching a DHCP Server.

 From the Switch side:

1. double check if the PC is able to reach an interface with the ip helper-address command

2. try some DHCP debugs to check what is happening (Understanding and Troubleshooting DHCP)

  From the PC side:

1. disable Antivirus

2. use a Wireshark to check the packets (Wireshark DHCP)

Hope this helps !!!

[waqas gondal]

Hi Marcelo,

The DHCP is reachable, it is only some devices that have this issue. They all have the same network settings and we can see the lease going to the MAC address from the DHCP server.

[thomas]

Then closed mode 802.1X is not the issue. It is a DHCP issue.