Windows 10 machine PEAP-TLS authentication fails unless I do a full disconnct/reconnect

[rcullum]

Have a strange problem. Customer is rolling out new Windows 10 desktops using dot1x wired machine PEAP-TLS auth. Machine authenticates first time its connected to the network. However, if the machine is rebooted, it won't authenticate again. It keeps failing but after about 20mins it will eventually authenticate OK. However, if I shutdown the switchport or physically disconnect/reconnect, the desktop authenticates straight away.

[Colby LeMaire]

Turn off Radius suppression (Administration->System->Settings->Protocols->Radius).  Or if this is in production, you can bypass suppression for just this MAC address by clicking on the little target icon next to the MAC address in Live Logs and select to bypass suppression.  That will allow you to see everything coming from the client.  Go to the Radius Live Logs and filter on the Endpoint MAC address of a machine you can use to recreate.  Recreate the issue.  Then see what things ISE is seeing from that machine.  Packet capture using a SPAN port while the machine reboots will help a lot too.  You can also check the Event Viewer logs on the machine to see if there are issues with the network drivers or problems with GPO's being applied properly.

[rcullum · Accepted solution]

The issue was finally found to be with the client machines having more than one host certificate that could be used for authentication. Customer had pushed out additional host certs signed by another internal CA that ISE did not trust. Also, they had not tied down their supplicant to use a particular host cert.