Strange AnyConnect Client Issues with the NAM Module.

[Matthew Martin]

Hello All,

AnyConnect Base Client: 4.2.03013
Network Access Manager Module 4.2.03013
ISE Compliance Module 4.2.03013

Cisco ISE Server: 2.0.0.306

On some of our client deployments (*all Windows 7 PCs) we have noticed that the ISE Posture modules continue to display "No Policy Server Found". Even though they have the same exact configuration and config profiles that other PCs have, which seem to work just fine for most.

We thought we might have narrowed the issue down to the Wired NIC giving us the trouble. However, we had a Dell tower that was unable to find the Policy server, so we checked another Dell Desktop PC which is the exact same model, same NIC card and same Drivers as well, and that one worked just fine.

Another reason that we thought the issue might be the NIC was because if we plugged a USB to Ethernet adapter into the tower and connected the Ethernet cable to that instead, it instantly found the Policy server and was able to Posture without issue. But, since another tower of the same model, with the same hardware and drivers worked just fine, now we're not so sure.

I'm not 100% positive, but I believe when we see these computers that get the "No Policy Server Detected" message, they don't even show up on the Core Switch as even attempting to authenticate on the port with 802.1x, *i.e. using the "show auth session int Gix/xx" command... When that does happen, their IP Phones do show on the port as authenticated just fine (*using mab), but the PC isn't.

Any thoughts or suggestions would be greatly appreciated!

Thanks in Advance,
Matt

[Gagandeep Singh]

Are you using proxy on switch for redirection on 8080 port which might leads to the discovery packets not getting redirected.

Even if any machines which worked were working based on previously connected PSN.

Make switch listen on port 80.

Regards

Gagan

[Matthew Martin]

Hey Gagandeep, thanks for the reply.

Sorry for the delay getting back to, its been a very busy couple of days.

No, I don't believe there is any Proxy setup on our 4510R+E. Would there be any kind of generic configuration on the switch that I should look for to verify this for sure? I know we have a WSA, but it's only currently running in our remote branch locations, which do not yet have AnyConnect, only our HQ does.

We were able to get most of our clients past this point of "No Policy Server Detected" and now we seem to be having another issue with AnyConnect. Even though the client's ISEPosture Module is displaying them as "Compliant", the ISE LiveLog is showing them as getting the Authorization policy for posture Unknown. And so far the only way to fix this was to right click the AnyConnect icon in taskbar and click on "Network Repair". For a few PCs we had to click Network Repair a few times and others had to be rebooted, as well as Network Repair. This morning alone we had 20 or so PCs that needed this done for them, and all were not the same model of PC. Some were Dells, some were ThinkPads, etc...

We thought this issue was only occurring when a PC was in Sleep mode for an extended period and upon wakeup, AnyConnect would go Compliant. However, ISE reports them as getting the "Unknown" auth policy, until one or more Network Repairs are performed on the client.

Any idea if this is a known issue with AnyConnect and ISEPosture?

Thanks,
Matt

[Gagandeep Singh]

I was like searching from Microsoft KB articles and found below information.

https://social.technet.microsoft.com/Forums/windowsserver/en-US/1f7cf5b7-b2cd-4c30-91a4-102cca13610f/8021x-user-auth-authenication-fails-after-reboot-logoff-or-hibernation?forum=w7itpronetworking

User is able to logon to Windows but receives a "Authentication Failed" message. The user receives this message due to a re-logon, hibernation, or even a total reboot.

Workaround: User must disable/enable network adapter, change a network adapter setting (any setting, just as long as something changes that's non-trivial to the setup of course), or disconnect/reconnect the Ethernet cable from the adapter. Any one of these events triggers a ReAuth and it successfully connects them and they stay connected until a hibernation, logout, or reboot.
You can also check the event logs on Windows client.

DOT1X switch commands meaning

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/commmand/reference/3750cr/cli1.html

Switch Configuration Required to Support Cisco ISE Functions

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_sw_cnfg.html#wp1059672

Regards

Gagan

ps: rate if it helps!!!!!

[Matthew Martin]

Hey Gagandeep, thanks again for the reply, and for searching around for that. Much appreciated!

That sounds like almost exactly what we are experiencing. But, we setup ISE and the clients to do Machine Authentication and not User Auth, do you think this make a difference? I noticed in the articles they mention the issue is caused when User authentication is being used with 802.1x.

I'm going to include some screenshots of the Windows native supplicant. Not sure if that is were the issue is lying or not but wanted to show what those settings are.

Also, I'm going to have to double check this, but I believe when we see the AnyConnect client showing "Compliant" and the ISE Server showing them getting the "Unknown" authorization profile, if you run "show auth sess int GiX/XX" for the device in question's port on our 4510R+E which is configured for ISE, it shows the PC as Authenticated for dot1x.

Thanks Again,
Matt

[Matthew Martin]

Let me know if my most recent question below should be asked in a new Post? Wasn't sure if it was too far off the original topic or not..?

Thanks,

Matt