ISE Radius Access-Request will not be challenged

[alex.f.]

Hi there,
I have encountered the following problem.
ISE small network deployment with two VMs each Pri/Sec (PAN,MnT,PSN) on Proxmox virtualisation.
Authenticators are Meraki Wired/Wireless configured with the Dashboard.
A test for a radius access request sent from the Meraki Dashboard (Switching - Access Policies) to both ISE PSN gets a response from ISE02 (Pri) but not from ISE01 (Sec).
The same test for a Radius Access request sent from the Meraki Dashboard (Wireless - Access Policies) to both ISE PSN is getting a response from both PSN (Pri/Sec).
There is no firewall or routing in place and both ISE nodes are reachable via ping.
A pcap on the Core SW shows that the EAP packets are being sent to the VMs.
A pcap on the Proxmox VMs interface shows that the EAP packet for the radius access request is reaching the dedicated node, but it is not being answered when sent from the switching access policy.

[thomas]

If certain RADIUS requests work (wireless) and others do not (wired) to your secondary PSN, are you seeing any Access-Rejects in the ISE LiveLogs from the switching requests to the 2nd node? If so, what is the reason?

Turn off all RADIUS Suppression to ensure you are seeing all RADIUS Failed attempts:

[Arne Bier]

@alex.f. - are you able to issue a ping from the Switch Dashboard "Tools tab" (ping from .13 to .122) ?

If ping succeeds, then the next thing I would check is whether the Switch (.13 address) is defined in ISE 

[alex.f.]

Yes, ping from the Meraki Dashboard is done successfully and the Switches are Network Devices in ISE.

But all Switches in one Network Devices Object. 

 

[Arne Bier]

Have you tried performing a manual sync up of ISE01?  We have to rely on every node getting the same programming from the PAN - I have seen it once where I was configuring in the GUI, but one of the PSN's wasn't getting the changes I was making - I had to manually sync the node.

If that doesn't work, then it would check your ISE RADIUS Policy Set - are the hit counters increasing?  If not, then the Meraki is possibly not sending the request to that ISE - you can prove that ultimately by running a tcpdump on ISE01 while running that test from Meraki switch.