PEAP-Native Windows suplicant does not work with RSA token through WLC 7.0 and ISE 2.4

[erickflamenco]

Hi Community,

I have a case where a PEAP(MS chap v2)-Native Windows suplicant does not works with RSA token through WLC 7.0 and ISE 2.4 always returns wrong password, as if it is not looking for at the external identity Store.

Same PEAP-Native Windows suplicant does works fine with Internal ISE 2.4 user/Password, through WLC 7.0.

Same Internal ISE 2.4 user, works fine when from Anyconnect VPN to ASA then ISE2.4 and finally to RSASecure Token Server, also works fine as a Super Administrator in ISE admin Portal with RSASecure Token Passcode.

It´s prety some like this:

https://community.cisco.com/t5/wireless-mobility-documents/peap-gtc-does-not-work-with-external-token-server-over-wlc/ta-p/3108007

Without GTC.

Some ideas?

Thanks a lot for your insights.

[howon · Accepted solution]

Only EAP-GTC is supported for RSA or RADIUS token server.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/b_ise_admin_guide_26_chapter_01110.html#concept_BD3A270FEC0C411DA10FB808C14B48D5