Windows 10 and ISE 2.1.0.474

[__Beth__]

Hello,

I was wondering if anyone has seen issues with Windows 10 and ISE 2.1.0.474.  We just upgraded ISE Tuesday night and are starting to roll out Windows 10 and am finding those devices cannot connect to wireless.  The error is:

12309 PEAP handshake failed

I found an article that indicates Windows 10 and an older version of ISE had issues:

https://support.microsoft.com/en-us/kb/3121002

If any more information is needed, please let me know. 

Any comments or advice would be appreciated. 

Thanks,

Beth

[__Beth__]

More info:

OpenSSLErrorMessage  SSL alert: code=0x228=552 ; source=local ; type=fatal ; message="handshake failure" 

OpenSSLErrorStack  139992965986048:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher:s3_srvr.c:1443:

[hslai · Accepted solution]

Please engage TAC on this. Why would Windows 10 attempt SSL3_GET_CLIENT_HELLO? Is registry modified on the Windows 10 to enforce older SSL/TLS protocols? Is this not Windows 10 version 1511?

Note that our product and support teams do not support any pre-release or insider builds but I am not aware of any issue in PEAP auth with ISE 2.1.

[__Beth__]

Thank you.  It is build 1511.  I have opened a ticket with TAC.  I will try to update this with the solution. 

[__Beth__]

It looks like the patch for this problem regressed in 2.1.  The engineer I am working with is contacting the developers.  In the meantime, this link provides a work around.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuw88770

[Ryan.Go]

Thanks for the link and workaround.

Is there any update on your TAC or has this issue been solved by a new release?

[__Beth__]

We had so many issues with this release, we ended up rolling back.  I need to revisit this at some point...