ISE issue with RDP

[Wei Chen]

We deployed ISE 1.4 to wired network and are using windows native 802.1x supplicants to do both user and machine authentication. The problem is when we RDP into the PC that are connected to 802.1x enabled switch ports, connectivity issues, and session failures and disconnection issues could happen. Currently we are using machine authentication only in order to temporarily fix this RDP issue.

So we would like to know if there is a work around to fix this RDP issue if we still want to use windows nativee 802.1x supplicants to do both user and machine authentication, NOT using Cisco AnyConnect Secure Mobility Client with Network Access Manager – NAM module.

[Jason Kunst · Accepted solution]

Windows native supplicant doesn't handle this well as you're switching between users/authentications, that's why Anyconnect NAM is recommended and designed to work around this issue, see explanation here.

Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 3.0 - Communicating User Guidelines [Cisco AnyConne…

There are articles out there complaining about this. here is example. Cisco has come up with a fix with its supplicant. Not sure what else to say..

http://www.techsupportforum.com/forums/f139/rdp-with-802-1x-machine-and-user-authentication-845922.html

[vaguirre17]

Hello, I have this issue but when I issue posture.

The endpoint is compliant and when the user tries the remote desktop could login and seconds after goes to a unknown status.

Running 2.6 patch 6

[laurathaqi]

Hi @vaguirre17 , 

Did you find and fix for your problem? Seems that I am running on the same issue.

Thank you,

Laura

[engineer467]

Hi All,

Did you find a fix??

Thanks.

[laurathaqi]

Hi @engineer467 

The only way out is to use AnyConnect Client. Otherwise its a limitation of Microsoft that cant be solved. 

Best wishes,

Laura

[engineer467]

Hello Laura,

Thank you for the reply.

I tried using NAM with anyconnect client. Now RDP works ok, but some users are facing network connectivity issues (Anyconnect tries to authenticate but fails after some time).