Hello,
Can someone please help me with understanding this log message.
vent 5434 Endpoint conducted several failed authentications of the same scenario
Username anonymous
Endpoint Id E8:D8:D1:40:36:8B
Endpoint Profile
Authentication Policy Wired >> TCRA Dot1x
Authorization Policy Wired
Authorization Result
Authentication Details
Source Timestamp 2020-10-05 11:19:49.04
Received Timestamp 2020-10-05 11:19:49.04
Policy Server TCRA-ISE-PAN
Event 5434 Endpoint conducted several failed authentications of the same scenario
Failure Reason 12117 EAP-FAST inner method finished with failure
Resolution Verify that the client supplied the correct credentials, such as username and password. Verify that the client's supplicant is properly configured to use an inner method protocol that is supported by ISE. Check the previous 'Steps' in the Log for this EAP-MD5 conversation for any message that might hint why the inner method failed.
Root cause EAP-FAST inner method finished with failure.
Username anonymous
Endpoint Id E8:D8:D1:40:36:8B
Authentication Identity Store Guest Users
Audit Session Id 0AC8D06400000027155F8377
Authentication Method dot1x
Authentication Protocol EAP-FAST (EAP-MSCHAPv2)
Service Type Framed
Network Device Test
Device Type All Device Types#Wired
Location All Locations#TCRA-HQ
NAS IPv4 Address 10.200.208.100
NAS Port Id GigabitEthernet1/0/10
NAS Port Type Ethernet
Response Time 1 milliseconds
Other Attributes
ConfigVersionId 74
Device Port 1645
DestinationPort 1812
RadiusPacketType AccessRequest
UserName test
Protocol Radius
NAS-IP-Address 10.200.208.100
NAS-Port 50110
Framed-MTU 1500
State 37CPMSessionID=0AC8D06400000027155F8377;36SessionID=TCRA-ISE-PAN/391268742/257;
IsEndpointInRejectMode false
NetworkDeviceProfileName Cisco
NetworkDeviceProfileId b0699505-3150-4215-a80e-6753d45bf56c
IsThirdPartyDeviceFlow false
RadiusFlowType Wired802_1x
SSID 3C-41-0E-F2-25-0A
AcsSessionID TCRA-ISE-PAN/391268742/257
SelectedAuthenticationIdentityStores Guest Users
IdentityPolicyMatchedRule TCRA Dot1x
CPMSessionID 0AC8D06400000027155F8377
EndPointMACAddress E8-D8-D1-40-36-8B
EapChainingResult No chaining
ISEPolicySetName Wired
IdentitySelectionMatchedRule TCRA Dot1x
StepData 4= Normalised Radius.RadiusFlowType
StepData 5= DEVICE.Device Type
StepData 84=Guest Users
TLSCipher ECDHE-RSA-AES256-GCM-SHA384
TLSVersion TLSv1.2
DTLSSupport Unknown
Network Device Profile Cisco
Location Location#All Locations#TCRA-HQ
Device Type Device Type#All Device Types#Wired
IPSEC IPSEC#Is IPSEC Device#No
Called-Station-ID 3C:41:0E:F2:25:0A
CiscoAVPair service-type=Framed
audit-session-id 0AC8D06400000027155F8377
method dot1x
Result
RadiusPacketType Drop
AuthenticationResult Error
Session Events
Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
15049 Evaluating Policy Group
15008 Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
11507 Extracted EAP-Response/Identity
12500 Prepared EAP-Request proposing EAP-TLS with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12101 Extracted EAP-Response/NAK requesting to use EAP-FAST instead
12100 Prepared EAP-Request proposing EAP-FAST with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12102 Extracted EAP-Response containing EAP-FAST challenge-response and accepting EAP-FAST as negotiated
12800 Extracted first TLS record; TLS handshake started
12805 Extracted TLS ClientHello message
12806 Prepared TLS ServerHello message
12807 Prepared TLS Certificate message
12808 Prepared TLS ServerKeyExchange message
12810 Prepared TLS ServerDone message
12811 Extracted TLS Certificate message containing client certificate
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12812 Extracted TLS ClientKeyExchange message
12813 Extracted TLS CertificateVerify message
12804 Extracted TLS Finished message
12801 Prepared TLS ChangeCipherSpec message
12802 Prepared TLS Finished message
12816 TLS handshake succeeded
12149 EAP-FAST built authenticated tunnel for purpose of PAC provisioning
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
12125 EAP-FAST inner method started
11521 Prepared EAP-Request/Identity for inner EAP method
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
11522 Extracted EAP-Response/Identity for inner EAP method
11806 Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge
12105 Prepared EAP-Request with another EAP-FAST challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12104 Extracted EAP-Response containing EAP-FAST challenge-response
11808 Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated
15041 Evaluating Identity Policy
15013 Selected Identity Source - Guest Users
24631 Looking up User in Internal Guests IDStore
22059 The advanced option that is configured for process failure is used
22062 The 'Drop' advanced option is configured in case of a failed authentication request
12117 EAP-FAST inner method finished with failure
5434 Endpoint conducted several failed authentications of the same scenario
