Showing results for 
Search instead for 
Did you mean: 
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.


Wireless Test Users being asked to authenticate to new ACS

Hi All,

I am nearing the final stages of an ACS Ver 5.3 deployment and everything is working as it should with the exception of our test wireless users.

Thus far I have:

Configured an "Identity store sequence" that consists of :

-acs internal db

-External radius server

This is called "VPNSequence"

I have also configured an Identity store sequence of :



This is called "Wireless Sequence"

I then configured the identity section of the "default network access" service.

I put a condition that will match the vpn access (for example "if network device belongs to the network device group called "VPN concentrators".  The identity store used will be the sequence I created above ("VPNSequence").

I then created a second rule (for point 2) that will match wireless access (if network device belongs to WLC group for example) and that will use the sequence "WirelessSequence" as identity store.

I then created a Certification Authorisation Profile and applied it to the Wireless Sequence.

I then tested an XP laptop on a Test_WLAN wireless network that authenticates using the new ACS device - when it attempts to logon I get a message on the laptop stating that I have to "Click here to process your logon information ...". When I click on this it asks me to re-enter my AD password. (This occurs even when I remove the Certification Authorsiation Profile from the Wireless Sequence" described above. If I enter my credentials I connect no problem.

However, this is not ideal for a smooth transition from ACS 3.3 to ACS 5.3 for our Wireless End Users (numbering in the hundreds). They will no doubt bombard our helpdesk when this prompt appears for their wireless connectivity.

Is there anyway I can configure the ACS so that they make a transparent connection without the need to re-enter credentials?

Any help would be much appreciated - please let me know if you require further information.

Kind regards,


Cisco Employee

Wireless Test Users being asked to authenticate to new ACS


From your description it appears that you are using password based authentication -- PEAP, EAP-FAST. The certificate authentication profile is only required for EAP-TLS. Although it being there would not cause any issues.

For getting prompted on the laptops to enter the credentials, ensure that when you click on "configure" next to "secure password mschap v2"

the checkbox next to "Automatically use my windows credentials for login" is selected (not shown in this figure)