Wireless with ISE, the process stop

[naoki_Japan]

I wanna introduce the combination of machine authentication and dot1X with ISE via AD using wireless and wired.

To do that, I separated authorization rule into two parts "almost like" below.(off courser, I use Wired or Wireless dot1X with Authentication field)

1 AD_LOGIN_COMPUTER

if  AD:External group  equals AD/Users/Domains Computers  and

   Radius:NAS-Port-Type Equal Ethernet ※(Wireless - IEE802.11 )

 ......

 then

  .....

2. AD_LOGIN_USERS

if  AD:External group  equals AD/Users/Domains Users  and

   Radius:NAS-Port-Type Equal Ethernet ※(Wireless - IEE802.11 )

   Network Access: WasMachineAuthenticated Equals True

then Permit all

As for wired users, they are successfully authenticated with the order, machine authentication → user authentication. 

However, for wireless users, they are authenticated only with machine authentication. I do not know why user authentication process is not processed.

Is there anyone teach me the solutions?

[Mike.Cifelli · Accepted solution]

However, for wireless users, they are authenticated only with machine authentication. I do not know why user authentication process is not processed.

-Please share additional information so the community can better assist.  The following items are things to share/consider:

--A Radius live log from successful wired and failed wireless session.

--Type of supplicant being used? Version of ISE?

--I would generate a DART bundle from troubled wireless client unable to properly onboard as expected and parse logs.

[naoki_Japan]

As I re-confirmed the setting of wireless PC, I found my mistake.

Thank you for your support!

[Dustin Anderson · Accepted solution]

You would need to check the 802.1x settings for wireless. We use similar for wireless PCs and get machine when they are not logged in and user when logged in, but 802.1x needs to be set to user or computer, not just computer.

[naoki_Japan]

As you advised, I re-checked the setting of devices and found miss-configuration on my PC.

Thank you for big help