I previously posted an issue of getting Wired ISE and 802.1X working properly with Windows Native Supplicant. That issue was resolved and the deployment of Wired ISE is coming along nicely.
I now have a new issue that popped up recently...
- Components:
- Wired 802.1X
- ISE 3.2
- Windows native supplicant (Windows 11 22H2)
- TEAP (EAP-TLS) / EAP-Chaining
- Cisco Catalyst 9200 series switches
There is about 200+ users on Wired ISE right now. All 200+ are working just fine. I can see them authenticating in ISE and the EAP-Chaining is good (User and Machine successful).
On top of these 200 users, i have about 20 conference rooms. Each with identical settings as everyone else. The only difference here is these conference rooms all share a single windows domain account and just about everyone knows the password to this account. This is giving me issues. Of the 20 rooms, i have set up about 5 so far - and only 1 is working properly. All others fail EAP and end up authenticating over MAB. I checked certificates/chain/SAN (machine and user), TEAP settings, no Cisco Anyconnect installed, user is in domain security group, etc.
The switchport config is identical to all other user. The Live Logs show a couple different errors. The 2 that seem to appear the most are:
11515 Supplicant declined inner EAP method selected by Authentication Policy but did not proposed another one; inner EAP negotiation failed
5440 Endpoint abandoned EAP session and started new
I can upload the full live logs, switch config, auth policies, etc if anyone thinks it will help. But like i said all this works just fine on everyone else's account. And thought someone may have an idea just be the description.
TY!
