We've had an issue when implementing a new CISCO ISE RADIUS server, in which our supplicant devices are struggling to authenticate a connection. They use an SSL3 protocol to authenticate the connection, which is rejected by the Cisco server which is TLS1.1.
The error we got originally was this one:
- ‘Client didn’t provide suitable ciphers’ ‘Check that the supplicant and ISE have intersection in configured cipher lists. If the supplicant is configured to use only cipher groups that are disabled in ISE security configuration (like SHA1 or 3DES ciphers) consider upgrading the supplicant to use more secure ciphers. As the last option consider allowing less secure ciphers in ISE while doing this can cause essential security weaknesses and is not recommended’
This was fixed by adding a special kernel to the supplicant device, which added the complete openSSL package (v:1.0.0d)
This seemed to mean that the handshake wase made, but we got a new connection error after this:
- 11510 Supplicant declined EAP method selected by Authentication Policy but did not propose another one; EAP negotiation failed. Resolution - Ensure that the supplicant is correctly configured. Verify that supplicant has at least one EAP method configured.
- Root cause - In previous EAP message ISE started an EAP method selected by Authentication Policy. Supplicant declined this EAP method by sending EAP NAK message but did not propose another EAP method that it is ready to conduct. Owing to this, EAP-negotiation failed.
Do you know how I can solve this error?
