ISE Wireless Connection issues

Jason Regan · ‎07-23-2014

Hi,

One of our remote offices is having real issues with Wireless connectivity.

The errors we have been receiving are as follows:

Event	5440 Endpoint abandoned EAP session and started new
Failure Reason	5440 Endpoint abandoned EAP session and started new
Resolution	Verify known NAD or supplicant issues and published bugs. Verify NAD and supplicant configuration.
Root cause	Endpoint started new authentication while previous is still in progress. Most probable that supplicant on that endpoint stopped conducting the previous authentication and started the new one. Closing the previous authentication

*apfMsConnTask_0: Jul 22 11:52:31.810: 58:94:6b:2b:53:0c Association received from mobile on AP c4:7d:4f:35:a7:e0

And after a while those logs will be repeated :

*dot1xMsgTask: Jul 22 11:52:31.872: 58:94:6b:2b:53:0c Sending EAP-Request/Identity to mobile 58:94:6b:2b:53:0c (EAP Id 1)

*osapiBsnTimer: Jul 22 11:52:36.848: 58:94:6b:2b:53:0c 802.1x 'txWhen' Timer expired for station 58:94:6b:2b:53:0c and for message = M0

*dot1xMsgTask: Jul 22 11:52:36.848: 58:94:6b:2b:53:0c dot1x - moving mobile 58:94:6b:2b:53:0c into Connecting state

*dot1xMsgTask: Jul 22 11:52:36.849: 58:94:6b:2b:53:0c Sending EAP-Request/Identity to mobile 58:94:6b:2b:53:0c (EAP Id 2)

*osapiBsnTimer: Jul 22 11:52:41.848: 58:94:6b:2b:53:0c 802.1x 'txWhen' Timer expired for station 58:94:6b:2b:53:0c and for message = M0

*dot1xMsgTask: Jul 22 11:52:41.849: 58:94:6b:2b:53:0c dot1x - moving mobile 58:94:6b:2b:53:0c into Connecting

And after 13 retries :

*dot1xMsgTask: Jul 22 11:53:31.849: 58:94:6b:2b:53:0c Reached Max EAP-Identity Request retries (13) for STA 58:94:6b:2b:53:0c

*dot1xMsgTask: Jul 22 11:53:31.849: 58:94:6b:2b:53:0c Sent Deauthenticate to mobile on BSSID c4:7d:4f:35:a7:e0 slot 1(caller 1x_auth_pae.c:3057)

*apfMsConnTask_0: Jul 22 11:52:31.810: 58:94:6b:2b:53:0c Association received from mobile on AP c4:7d:4f:35:a7:e0

And after a while those logs will be repeated :

*dot1xMsgTask: Jul 22 11:52:31.872: 58:94:6b:2b:53:0c Sending EAP-Request/Identity to mobile 58:94:6b:2b:53:0c (EAP Id 1)

*osapiBsnTimer: Jul 22 11:52:36.848: 58:94:6b:2b:53:0c 802.1x 'txWhen' Timer expired for station 58:94:6b:2b:53:0c and for message = M0

*dot1xMsgTask: Jul 22 11:52:36.848: 58:94:6b:2b:53:0c dot1x - moving mobile 58:94:6b:2b:53:0c into Connecting state

*dot1xMsgTask: Jul 22 11:52:36.849: 58:94:6b:2b:53:0c Sending EAP-Request/Identity to mobile 58:94:6b:2b:53:0c (EAP Id 2)

*osapiBsnTimer: Jul 22 11:52:41.848: 58:94:6b:2b:53:0c 802.1x 'txWhen' Timer expired for station 58:94:6b:2b:53:0c and for message = M0

*dot1xMsgTask: Jul 22 11:52:41.849: 58:94:6b:2b:53:0c dot1x - moving mobile 58:94:6b:2b:53:0c into Connecting

And after 13 retries :

*dot1xMsgTask: Jul 22 11:53:31.849: 58:94:6b:2b:53:0c Reached Max EAP-Identity Request retries (13) for STA 58:94:6b:2b:53:0c

*dot1xMsgTask: Jul 22 11:53:31.849: 58:94:6b:2b:53:0c Sent Deauthenticate to mobile on BSSID c4:7d:4f:35:a7:e0 slot 1(caller 1x_auth_pae.c:3057)

We have tried changing the timeout from 5 to 15 and then 20 seconds but this is still not helping the cause.

The problem is persistent but also appears to be random in who it affects.

I've been leaning to the issue being with DHCP and Authentication but has anyone encountered this previously and what was the fix if any?

I'm also aware of discussions on here about a bug that will be fixed in ISE1.3 but cannot wait for this.

Any help/guidance would be greatly appreciated

Thanks

Jason

nspasov · ‎07-23-2014

What is the round-trip time between the clients and the ISE server?

Thank you for rating helpful posts!

Jason Regan · ‎07-24-2014

Hi neno,

I think latency is the issue as here are the steps

11001	Received RADIUS Access-Request
	11017	RADIUS created a new session
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15004	Matched rule
	15048	Queried PIP
	15048	Queried PIP
	15004	Matched rule
	11507	Extracted EAP-Response/Identity
	12500	Prepared EAP-Request proposing EAP-TLS with challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12701	Extracted EAP-Response/NAK requesting to use LEAP instead
	12700	Prepared EAP-Request proposing LEAP with challenge
	11006	Returned RADIUS Access-Challenge
	11001	Received RADIUS Access-Request
	11018	RADIUS is re-using an existing session
	12702	Extracted EAP-Response containing LEAP challenge-response and accepting LEAP as negotiated
	15041	Evaluating Identity Policy
	15006	Matched Default Rule
	15013	Selected Identity Source - ActiveDirectory
	24430	Authenticating user against Active Directory
	24402	User authentication against Active Directory succeeded
	22037	Authentication Passed
	24422	ISE has confirmed previous successful machine authentication for user in Active Directory
	15036	Evaluating Authorization Policy
	24432	Looking up user in Active Directory - CPMUK\jferguson
	24416	User's Groups retrieval from Active Directory succeeded
	24420	User's Attributes retrieval from Active Directory succeeded
	15004	Matched rule
	15048	Queried PIP
	15048	Queried PIP
	15016	Selected Authorization Profile - Omni-Permit-All
	12705	LEAP authentication passed; Continuing protocol
	11503	Prepared EAP-Success
	11006	Returned RADIUS Access-Challenge( Step latency=18095 ms)
	5440	Endpoint abandoned EAP session and started new

mohanak · ‎07-24-2014

CSCuj98726

Description

Symptom:
iOS device can bypass account suspension/lock even it is enabled, due to it will be reported as '5440 Endpoint abandoned EAP session and started new' instead of wrong password.

Conditions:
enable acount suspension/lock and iOS device use EAP authentication

Workaround:
Set the PEAP Retries to 0 in the selected Allowed Protocols configuration for the Authentication. This can be found under Policy -> Results -> Authentication -> Allowed Protocols.

Further Problem Description:
iOS does not support PEAP retries inside the TLS tunnel via MSChapv2 and when receiving a password retry will abandon the EAP session. Turning off the retry mechanism will cause an access-reject to be sent for every failed password.

Known Affected Releases:

(1)

1.2(0.899)

Known Fixed Releases:

(2)

1.2(1.198)

1.2(0.905)

Jason Regan · ‎07-24-2014

Thanks Mohanak,

I will look and patching to latest version as I am currently running 1.2(0.899) and will let you know how that goes for me

Thanks