802.1X EAP-TLS

[AbelBurgos5029]

Hello everyone,

I am currently in the process of rolling out Dot1x in a small classified network. The network has the following:

(12) Windows 10 Machines using native supplicant software

(1) Cisco C9300 acting as the authenticator

(1) Cisco ISE acting as the authentication Server using AD for credentials

I configured certificate auto-enrollment for machines and users in the AD and it is working fine; all machines as well as users are able to get their certificate to authenticate with EAP-TLS. Everything was working fine until I had to switch around 3 machines to different switchports. Out of the 3 machines that I switched around only 1 can still authenticate. The others two no longer can.

I am thinking this might have something to do with the mac address-table, DHCP or something like that. Anyone have had this issue before? Any help will be appreciated!

Thanks

Abel

[balaji.bandi]

what you see logs on the switch and ISE.

[AbelBurgos5029]

I will take a look at the ISE and Switch logs tomorrow and post it here. Currently stucked home with the Snow Storm (NY).

[AbelBurgos5029]

Hello,

I reviewed the ISE logs and the workstation is being rejected with the reason that "the workstation abandoned the EAP session and started a new one." Any idea on why does this happen?

Thanks

[Marvin Rhoads]

That issue is most often due to supplicant configuration issues. It can be difficult to troubleshot due to there being so many potential variables on endpoint configurations. I'd start with verifying the various settings under the supplicant configuration (security tab of the network adapter properties). You didn't mention how you pushed out the configurations - was it via GPO or manually set them?

[AbelBurgos5029]

Marvin,

The supplicant configurations are pushed via GPO. So the workstation having the issues has the same configuration as the rest of the machines. 

[Marvin Rhoads]

GPO should standardize the supplicant config.

Is it a wired or wireless adapter? I have seen driver issues with wireless sometimes cause this. Less often is that the case with wired.

[fasease22680]

Unity Connection has a "Route from subsequent routing rule" choice that can be used for this sort of "snow day" function (i.E. Everybody calling in hears a message after which the decisionlink that is routed to where it'd have long past commonly after that.