Windows 10 device can't authenticate with ISE2.2

[Akaffou Aristide Akaffou]

Hello,

I am deploying ISE2.2, and I have a problem with windows 10 PC. 802.1x authentication failed. I have made some changes in PCs registry, I have added TLS1.2 in the registry but it still remain the same. I have no problem with windows 7 and 8.

Can you help me to solve this issue?

Best Regards,

Aristid

[Arne Bier]

Hi Astrid

Can you share the ISE authentication results on this forum so that we can see what happened?  There is no reason why Win10 should not work.  

And what registry settings did you change and why?

There is probably a TLS negotiation issue.

regards

Arne

[Akaffou Aristide Akaffou]

Hello Arne,

Thank you for your reply. I change the TlsVersion in a registry settings because the windows 10 PC does not respond to 802.1x authentication. It seems like there was no device.

After Change the TlsVersion, it seems like the NAC agent failed to communicate with the ise server.

Best regards,

Aristide AKAFFOU

[Marvin Rhoads]

Are you doing user authentication only with the Windows native supplicant or machine plus user (EAP chaining) with AnyConnect NAM?

[Akaffou Aristide Akaffou]

Hello,

I am doing user authentication only with the windows native supplicant.

Best Regards,

Aristide AKAFFOU

[Marvin Rhoads]

Then like Arne suggested, a look at the RADIUS live log detail for a failed authentication should either tell us exactly what the problem is or tell us where to probe a bit deeper.

Are you able to share an example?

[Akaffou Aristide Akaffou]

Hello,

When I made the command "show authentication session interface gigabitethernet x/x/x", it tells me that radius authentication is stopped and the PC use mab.

In the ISE server the message tells that "Clients stopped Responding" and the failure reason is "12937Supplicant stopped responding to ISE after sending it in the first inner EAP-MSCHAPv2 message"

"12940Supplicant stopped responding to ISE during conducting inner EAP-MSCHAPv2 method"

Best Regards,

Aristide AKAFFOU

[Marvin Rhoads]

I'm thinking if it moved on to the inner method that the outer method which uses TLS is OK. It sounds like one of the other settings in your native supplicant. If checking and comparing those with a working non-Windows 10 supplicant didn't work, I would troubleshoot by grabbing a packet capture during the failure and looking at what's going on at the protocol level.

Or you could just open a TAC case. 

[Bernard Lara]

Hi Aristid,

We're you able to get a fix to this, i just ran into the same issue today.

we have ISE 2.3 and I checked Cisco ISE 2.3 supports TLS versions 1.0, 1.1, and 1.2. 

Regards,

bernard

[ajc]

I suggest you to move into ISE 2.4. Based on my understanding, version 2.3 is a buggy one and has been deferred.

[Jason Kunst]

We have never deferred a release. However, ISE 2.2 was and now 2.4 is the recommended long term release

https://community.cisco.com/t5/security-blogs/announcing-the-quot-suggested-release-quot-status-of-ise-2-4/ba-p/3775587