Issue with Cisco ISE for wireless clients

[donnie]

Hi,

My current environment is configured for 802.1x using Cisco ISE and require machine cert and user cert authentication before a machine is authorised and assigned a vlan. Currently i notice my LAN with ISE works well and is very stable but my WLAN is rather unstable with ISE such that intermittently i don't see any machine cert authentication on my ISE logs when i boot up my machine. There are times where machine authentication with ISE would be able to work on the 1st boot up. Can anyone guide me how i can do a end to end tracking for my machine authentication that is done over wireless starting from the WLC? My WLC is AIR-CT3504. I have already ensured that the required 802.1x settings is already applied on my machine for both LAN and WLAN adaptor. Please advise. TIA!

[Mohammed al Baqari · Accepted solution]

WLC will just pass the EAP message over Radius to ISE. All tracking has to
be done from ISE. You can run diagnostic using endpoing mac address to see
all the handshaking in details on ISE.

[Mike.Cifelli · Accepted solution]

I assume your hosts are Windows based if you are doing machine and user cert authentication? If you are using NAM for eap-chaining purposes you can enable extended logging for the AnyConnect Client.

Open AnyConnect, make sure it is in focus

press this combo: left **bleep**+ left alt + L. no response

Right click the anyconnect icon in windows system tray. menu pops up

select extended logging so it has a check mark displayed. NAM will now log debug messages.

Then as mentioned by @Mohammed al Baqari you can run a tcp dump on your PSN.

[hslai]

I concur with Mohammed al Baqari and Mike.Cifelli.

You may also take a look at Data collection for troubleshooting 802.1X authentication and Collect Debugs From Wireless LAN Controller (WLC)