Windows 8 and 10 authentication failed

[Akaffou Aristide Akaffou]

Hi,

I have authentication problem with windows 8 and 10 clients in ISE 2.2.

Windows 8 and windows 10 clients can not have access to the network at the first authentication. We must lockout and unlock to have access to the network. I used external identity store which is Active Directory.

I have made ISE 2.2 downgrade to ISE 2.1 and ISE 2.2 upgrade to ISE 2.3, but I am still have the same issue.  I have contacted tac but they told me it is a windows issue but I am not sure about it because wiindows 8 and 10 clients works in other offices.

Please can you help me?

Best Regards,

Aristide AKAFFOU

[marce1000]

- what's in the live logs, then,for the first auth attempt from the particular windows server

- for ise2.2. upgrade to the latest patch level

- >TAC says it's a windows issue : well if they say that, then they must earn their money and and also explain to you what the windows issue is (nice to ask!)

M. 

[Akaffou Aristide Akaffou]

Hi marce1000,

In live logs, we have error 5411: supplicant stop responding.

Now I don't think it is an upgrade issue. We used all the version.

Tac don't say anymore to help to resolve the issue.

Best Regards

[marce1000]

  - Then you need to look at possible issues concerning the supplicant; 1) which software-vendor is it ? 2) is it certfied to be compatible with  cisco-ise+win8-10 ? 3) are there any patches for it , possibly helping to resove this issue? 4) Can you contact the supplicant software-vendor and report this issue ?

M.

[Akaffou Aristide Akaffou]

Hi,

I have configured windows 10 and 8 clients for authentification and I used Cisco NAC agent and cisco anyconnect network access manager.

Can you please tell me more about windows supplicant?

Best Regards,

Aristide

[marce1000]

 - I am only talking about the Cisco NAC Agent then; same reasoning applies; isthe version you are using compatible with win8 or win10 (check release notes, version info and or contact CISCO).

M.

[Akaffou Aristide Akaffou]

Thanks for your reply.

In the release they use Cisco NAC agent version 4.9.5.8, 4.9.5.7, 4.9.5.6. But I used NAC agent version 4.9.5.10. Do you think this is a issue?

Best Regards,

Aristide

[marce1000]

 - It think the only way to find out, is to remove the existing agent from a windows-test-host; install one of those working releases and check if it works (then).

M.

[Akaffou Aristide Akaffou]

Hello,

Thanks marce, I made all of this changes about cisco nac agent version, and i have made also windows 10 update, but I encountered the same issue. 

Best Regards,

Aristide AKAFFOU

[marce1000]

 - Check your windows  hosts's eventlog (app, system,...)  ; look for errors (if any) concerning the supplicant (software) around the timeframe, that ISE says in the live-logs, that it is no longer responding

M.

[Akaffou Aristide Akaffou]

Hi,

You can see in attached the windows live logs about the issue.

Best regards,

Aristide 

[marce1000]

 - I am worried about the NTP error ; time sync is crucial also for do1x and ise. Make sure the windows host has a valid and working/usable NTP source.

M.

[Akaffou Aristide Akaffou]

Hi marce,

So I have to configure ntp server for the windows clients?

[Rob Ingram · Accepted solution]

Yes, it's important that a windows computer's time is in sync, for instance you'll be using certificates and if you time/date is incorrect on the windows client you won't be able to validate the certificate. You need to resolve those Windows errors before attempting 802.1x authentication.

Are you in dot1x closed mode? The error messages you provided indicated that the computer cannot communicate with the domain.

[Akaffou Aristide Akaffou]

Hi RJI,

Thanks for your reply. I am not in closed mode.

Best regards,

Aristide