Supplicant stopped responding to ISE

[hs08]

Anyone know how to fix error 'Supplicant stopped responding to ISE'? I try to increase 802.1x timer but not helping.

When we use EAP-TTLS is mandatory that ISE certificate should be apply in the endpoint?

Event	5411 Supplicant stopped responding to ISE
Failure Reason	12981 Supplicant stopped responding to ISE during EAP-TTLS tunnel establishment
Resolution	Verify that supplicant is configured properly to conduct a full EAP conversation with ISE. Verify that NAS is configured properly to transfer EAP messages to/from supplicant. Verify that supplicant or NAS does not have a short timeout for EAP conversation. Check the network that connects the Network Access Server to ISE.
Root cause	Supplicant stopped responding to ISE during EAP-TTLS tunnel establishment

[ahollifield]

Why are you using EAP-TTLS? TTLS is not encrypted. Yes you still need to trust the ISE EAP certificate on the endpoint.

[hs08]

hi @ahollifield 

The USE EAP Certificate should be installe din the machine is 2nd certificate in below picture?

[hs08]

Yes for now i want to test using EAP-TTLS and as i know we no need any certificate using EAP-TTLS since EAP-TTLS use username and password for credential, am i right?

[ahollifield]

Yes but not a great idea as far as security goes

[hs08]

Yes, just want to test the EAP-TTLS first and continue to EAP-TLS. So the error i facing now not because certificate issue. What next should i check?

[ahollifield]

Does the endpoint trust the ISE EAP server or no? That error log is unfortunately very vague. Is the client configured correctly? What is the access method? I'm still confused by you want to use EAP-TTLS at all? Why not use certificates?

https://cs.co/ise-berg#entra 

[hs08]

Thanks your concern regarding EAP-TLS

Here my configuration.

[ajc]

Are you using Windows 10/11 by any chance?. I have seen Microsoft enforced stricter rules regarding certificates so I am wondering if by missing the "checked box" of the Trusted CA that signed your ISE certificate then you are having those connectivity issues. AT LEAST, for EAP-TLS it is mandatory to have those ISE signed certificate CA checked in the Windows profile.

[hs08]

HI..

Yes i already download certificate from ISE and install the certificate into the workstation and use this certificate in EAP-TTLS.