ISE Dot1x configuration, PAP is not allowed

[naoki_Japan]

I wanna give the users registered in AD network access via ISE authentication through AD.

I have neatly registered AD on ISE.

however, the logs below appears all time and the authentication fails.

could you let me know the cause and resolution?

11001 Received RADIUS Access-Request
11017 RADIUS created a new session
11027 Detected Host Lookup UseCase (Service-Type = Call Check (10))
15049 Evaluating Policy Group
15008 Evaluating Service Selection Policy
15048 Queried PIP - DEVICE.Device Type
15048 Queried PIP - Radius.NAS-Port-Type
11034 Process Host Lookup is disabled. (Service-Type = Call Check (10) cannot be applied)
15024 PAP is not allowed
11003 Returned RADIUS Access-Reject

[Karsten Iwen]

For whatever reason, the switch port is doing MAB for the client instead of 802.1X. Look at the switch port why it is doing that.

[naoki_Japan]

thank you for your help

but, it is seemed that the switch is working correctly, judging on the log shown below

switch1#
*Sep 14 09:23:09.660: %DOT1X-5-FAIL: Switch 1 R0/0: sessmgrd: Authentication failed for client (??MAC address???) with reason (Timeout) on Interface Gi1/0/2 AuditSessionID 0A0A0AFE000000A7E39CA738
*Sep 14 09:23:09.662: %SESSION_MGR-5-FAIL: Switch 1 R0/0: sessmgrd: Authorization failed or unapplied for client (??MAC address???) on Interface GigabitEthernet1/0/2 AuditSessionID 0A0A0AFE000000A7E39CA738
switch1#