After upgrading to ISE 1.2.0.899 patch 14 we have a problem running machine authentication for a few hosts (30 of about 3000).
Although we can see on the switch that the host presents the hostname, in ISE Operations all we get is the MAC address (for both the Identity and Endpoint ID fields).
On the switch:
show auth sessions int FastEthernet0/1
Interface: FastEthernet0/1
MAC Address: 3c97.0eed.afbc
IP Address: Unknown
User-Name: host/xxxxxxxxxx
Status: Running
Domain: UNKNOWN
Oper host mode: multi-auth
Oper control dir: both
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0AF19F16000138DC11B59C9D
Acct Session ID: 0x000292EA
Handle: 0x01000BCA
Runnable methods list:
Method State
mab Failed over
dot1x Running
In ISE we see the contents of the attached file.
The workaround we found was to move the host in a different switch, where it will authenticate, and then move it back on the initial switch where it will work now. I know it doesn't make sense but it worked...
Shut / no shut on the switch port or clearing the auth session doesn't work.
Does anybody have any idea about this problem?
Thanks in advance!
Update:
The issue seems to be related with how the policy servers cache the sessions/auth requests from the network devices. If we point the network device that hosts the problematic machines to another radius server the auth runs as expected. A number of machines have problems with a certain policy server (not always the same) while most machines authenticate correctly. The problem is that if, for whatever reason,a machine fails to auth, that policy server could "decide" to hang to that failed auth result for susequent tries.
