ISE not confirmed locally previous successful machine authentication

[naoki_Japan]

I see the logs like below on ISE .

I turn on machine authentication, and AD is correctly working with ISE using PEAP.

however, as shown, the machine authentication can not be processed.

so the attribute "Network access> WasMahineAuthenticated " is meaningless.

could you tell me how can I handle this issue?

24715

ISE has not confirmed locally previous successful machine authentication for user in Active Directory

[nspasov]

The "WasMachineAuthenticated" attribute deals with MAR (Machine Access Restriction). What exactly are you trying to accomplish and how is your supplicant configured?

Thank you for rating helpful posts!

[naoki_Japan]

Thank you for reaction.

I am trying to configure PEAP with machine authentication.

it is what I want that when an employee boot the PC, the PC name registered in AD is checked ,and then, if it is successfully proceeded,

, he is asked to enter the user name and password, and finally ISE checks the username and password via AD and give the network access to the employee.

The supplicant PC is set up with dot1.X using username

Also, the switch, Authenticator , is configured to authenticate user with the order, dot1x and mab.

I have confirmed that the user authentication is dealt successfully, but it seems the machine authentication process is not active although I set up ISE to do so. 

[nspasov · Accepted solution]

If you are trying to do PEAP with machine authentication then your supplicant needs to be set to perform computer authentication. If you are trying to do machine+user authentication then MAR is one way to do it but not ideal as it comes with many challenges:

https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/116516-problemsolution-technology-00.html

Thank you for rating helpful posts!

[naoki_Japan]

I re-confirmed the setting of devices and found out that my AD was not treated as root CA in the client PC.

After Certification of AD was installed in client pc as root ca, this problem was solved.

thank you for your help at the bottom of heart.

[nspasov]

Awesome! Glad your issue was resolved

[naoki_Japan]

thank you for your kind support!