ISE 2.3 patch 5
I'm hitting this weird issue with ISE trying to get EAP-TLS with machine authentication working.
During the initial eap-tls flow, ISE receives the client hello access-request packet from the NAD, then responds with the access-challenge that contains the server hello/certificate/server key exchange/etc. This is over 5 eap-tls fragments (5 IP packets). The NAD acknowledges these with access-requests without issue. Next the NAD sends an access-request with its certificate/client key exchange/change cipher spec/etc. At a radius level the access-request looks to be fragmented over multiple packets, but the first fragment is fragmented at IP level as well with 1518 bytes on wire and another 419 bytes on the wire - this makes up the first access-request. Packet capture on the upstream device from ISE shows it forwarding both these packets, however packet capture on the ISE shows only the first Fragmented IP protocol packet. The remaining 419 byte packet needed to reassemble to get the access-request is not seen in the capture. Looks like the ISE is silently dropping this? Hence eap-tls times out and fails.
The first fragment of the access-request is more than 1500 bytes, is this the issue? It funny that the larger fragmented packet is received but the following 419 byte one is not.
The data portion (radius stuff) of the first fragment is 1480 bytes. Now when you add the IP and ethernet headers it will be at least 1514 bytes. Not sure why the NAD will send it this big when the MTU on the interface and globally is set to 1500 bytes.
