Reauthentication Problem in Endpoints Using Cisco ISE 1.1

[sachpednekar]

Hi,

Can anyone suggest me if laptop/desktop goes on sleep mode or keep connected with interace configured for 802.1X for more than 12 hours it does not work or not connect to Exchange server, Cisco ISE console, office communicator...

for re authentication i need to restart PC/ Laptop or unplug and replug lan cable from it!

but before restartiong i am able to ping all DNS, DHCP, OCS, everything....

below is the interface configuration

sh running-config interface gigabitEthernet 3/0/19
Building configuration...

Current configuration : 909 bytes
!
interface GigabitEthernet3/0/19
description Access Ports
switchport access vlan 309
switchport mode access
ip access-group ACL-ALLOW in
no logging event link-status
power inline never
srr-queue bandwidth share 1 60 30 10
srr-queue bandwidth shape 10 0 0 0
priority-queue out
authentication control-direction in
authentication event fail action next-method
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
mls qos trust dscp
dot1x pae authenticator
dot1x timeout tx-period 10
no cdp enable
spanning-tree bpduguard enable
spanning-tree guard loop
service-policy input access_in
ip dhcp snooping limit rate 20
end

[Tarik Admani]

Hi

When the machine is in the state can you issue a "show authentication sess interface gig 3/0/19" you should be able to see what state the client is in. Also do you see any events in the monitoring and reporting section in ISE at this time. I have seen that when a machine is locked this port stays up and you do not have to reauthenticate.

thanks,

Tarik Admani
*Please rate helpful posts*

[Peter Koltl]

debug radius

debug authentication all

What happens if you restart the Wired Autoconfiguration service?

[Tabish Mirza]

Hi Sachin,

How did you solve this issue as I am getting same problem.

Please help me.

Thanks

Sent from Cisco Technical Support iPhone App

[sachpednekar]

Hi Tabish,

I have made below changes on interface which are shown in bold letters!

In my configuration

authentication order was wrong

and you can give reauthenticatin timer reauthenticate through interface as well as through Server

In my configuration I have configured it to the ISE server.

authentication control-direction in

authentication event fail action next-method

authentication event server alive action reinitialize

authentication host-mode multi-auth

authentication open

authentication order dot1x mab

authentication priority dot1x mab

authentication port-control auto

authentication periodic

authentication timer reauthenticate server

authentication violation restrict

mab

mls qos trust dscp

dot1x pae authenticator

dot1x timeout tx-period 10

if you need any more information please reply back and if possible send me interface configuration.

Thanks,

Sachin

[Tabish Mirza]

Hi Sachin,

Thanks for your prompt response. Here is the port configuration. My users are connected behind Cisco IP Phone & We are using CWA for wired guest as well.

interface GigabitEthernet0/1

switchport access vlan 120

switchport mode access

switchport voice vlan 121

authentication event fail action next-method

authentication event server dead action reinitialize vlan 120

authentication event server alive action reinitialize

authentication host-mode multi-auth

authentication order mab dot1x

authentication priority dot1x mab

authentication port-control auto

authentication periodic

authentication timer reauthenticate server

mab

dot1x pae authenticator

dot1x timeout tx-period 60

spanning-tree portfast

ip dhcp snooping limit rate 30

interface GigabitEthernet0/1

switchport access vlan 120

switchport mode access

switchport voice vlan 121

authentication event fail action next-method

authentication event server dead action reinitialize vlan 120

authentication event server alive action reinitialize

authentication host-mode multi-auth

authentication order mab dot1x

authentication priority dot1x mab

authentication port-control auto

authentication periodic

authentication timer reauthenticate server

mab

dot1x pae authenticator

dot1x timeout tx-period 60

spanning-tree portfast

ip dhcp snooping limit rate 30

Thanks

[sachpednekar]

Hi

Change authentication order to dot1x mab



Sent from Cisco Technical Support iPhone App

[Naveen Kumar]

Authentication order:

switch(config-if)# authentication order [dot1x | mab] | {webauth}