ISE 2.0  WLC: 8.1.131 Is the following normal behavior? dot1x enabled on 2700i ap, ap connected to port configured with dot1x   step 1 event PAC Provisioned authC: ok --> success authZ: ok authZ result: <> result access reject eap-fast, eap-mschapv2 innermethod Cisco Identity Services Engine 11001 Received RADIUS Access-Request   11017 RADIUS created a new session   15049 Evaluating Policy Group   15008 Evaluating Service Selection Policy   15048 Queried PIP - Normalised Radius.RadiusFlowType   15048 Queried PIP - Radius.NAS-Port-Type   15048 Queried PIP - Radius.Service-Type   15004 Matched rule - Wired dot1x   11507 Extracted EAP-Response/Identity   12100 Prepared EAP-Request proposing EAP-FAST with challenge   12625 Valid EAP-Key-Name attribute received   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12102 Extracted EAP-Response containing EAP-FAST challenge-response and accepting EAP-FAST as negotiated   12800 Extracted first TLS record; TLS handshake started   12805 Extracted TLS ClientHello message   12806 Prepared TLS ServerHello message   12808 Prepared TLS ServerKeyExchange message   12810 Prepared TLS ServerDone message   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   12812 Extracted TLS ClientKeyExchange message   12813 Extracted TLS CertificateVerify message   12804 Extracted TLS Finished message   12801 Prepared TLS ChangeCipherSpec message   12802 Prepared TLS Finished message   12816 TLS handshake succeeded   12131 EAP-FAST built anonymous tunnel for purpose of PAC provisioning   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   12125 EAP-FAST inner method started   11521 Prepared EAP-Request/Identity for inner EAP method   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   11522 Extracted EAP-Response/Identity for inner EAP method   11806 Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   11808 Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated   15041 Evaluating Identity Policy   15048 Queried PIP - Radius.User-Name   15006 Matched Default Rule   15013 Selected Identity Source - < AD>   24430 Authenticating user against Active Directory - < AD>   24325 Resolving identity - <user>   24313 Search for matching accounts at join point - <AD>   24319 Single matching account found in forest - < AD>   24323 Identity resolution detected single matching account   24343 RPC Logon request succeeded - user@ < AD>   24402 User authentication against Active Directory succeeded - < AD>   22037 Authentication Passed   11824 EAP-MSCHAP authentication attempt passed   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   11810 Extracted EAP-Response for inner method containing MSCHAP challenge-response   11814 Inner EAP-MSCHAP authentication succeeded   11519 Prepared EAP-Success for inner EAP method   12128 EAP-FAST inner method finished successfully   12966 Sent EAP Intermediate Result TLV indicating success   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   12126 EAP-FAST cryptobinding verification passed   12200 Approved EAP-FAST client Tunnel PAC request   24423 ISE has not been able to confirm previous successful machine authentication   15036 Evaluating Authorization Policy   15048 Queried PIP - Radius.NAS-Port-Type   15048 Queried PIP - DEVICE.Device Type   24432 Looking up user in Active Directory - < AD>   24355 LDAP fetch succeeded - <AD>   24416 User's Groups retrieval from Active Directory succeeded - < AD>   15048 Queried PIP - < AD> .ExternalGroups   15048 Queried PIP - Radius.Called-Station-ID   15048 Queried PIP - CERTIFICATE.Issuer - Organization   15048 Queried PIP - EndPoints.EndPointPolicy   15004 Matched rule - AP   15016 Selected Authorization Profile -   12964 Sent EAP Result TLV indicating success   12169 Successfully finished EAP-FAST tunnel PAC provisioning/update   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   11401 Prepared RADIUS Access-Reject after the successful in-band PAC provisioning   11504 Prepared EAP-Failure   11003 Returned RADIUS Access-Reject Next step2 event authentication succeeded authC: ok --> success authZ: ok authZ result: ok result access accept Cisco Identity Services Engine 11001 Received RADIUS Access-Request   11017 RADIUS created a new session   15049 Evaluating Policy Group   15008 Evaluating Service Selection Policy   15048 Queried PIP - Normalised Radius.RadiusFlowType   15048 Queried PIP - Radius.NAS-Port-Type   15048 Queried PIP - Radius.Service-Type   15004 Matched rule - Wired dot1x   11507 Extracted EAP-Response/Identity   12100 Prepared EAP-Request proposing EAP-FAST with challenge   12625 Valid EAP-Key-Name attribute received   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12102 Extracted EAP-Response containing EAP-FAST challenge-response and accepting EAP-FAST as negotiated   12800 Extracted first TLS record; TLS handshake started   12175 Received Tunnel PAC   12805 Extracted TLS ClientHello message   12806 Prepared TLS ServerHello message   12801 Prepared TLS ChangeCipherSpec message   12802 Prepared TLS Finished message   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   12804 Extracted TLS Finished message   12816 TLS handshake succeeded   12132 EAP-FAST built PAC-based tunnel for purpose of authentication   12125 EAP-FAST inner method started   11806 Prepared EAP-Request for inner method proposing EAP-MSCHAP with challenge   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   11808 Extracted EAP-Response containing EAP-MSCHAP challenge-response for inner method and accepting EAP-MSCHAP as negotiated   15041 Evaluating Identity Policy   15048 Queried PIP - Radius.User-Name   15006 Matched Default Rule   15013 Selected Identity Source - < AD>   24430 Authenticating user against Active Directory - < AD>   24325 Resolving identity - <user>   24313 Search for matching accounts at join point - < AD>   24319 Single matching account found in forest - < AD>   24323 Identity resolution detected single matching account   24343 RPC Logon request succeeded - user@ < AD>   24402 User authentication against Active Directory succeeded - < AD>   22037 Authentication Passed   11824 EAP-MSCHAP authentication attempt passed   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   11810 Extracted EAP-Response for inner method containing MSCHAP challenge-response   11814 Inner EAP-MSCHAP authentication succeeded   11519 Prepared EAP-Success for inner EAP method   12128 EAP-FAST inner method finished successfully   12964 Sent EAP Result TLV indicating success   12105 Prepared EAP-Request with another EAP-FAST challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12104 Extracted EAP-Response containing EAP-FAST challenge-response   12126 EAP-FAST cryptobinding verification passed   12106 EAP-FAST authentication phase finished successfully   11503 Prepared EAP-Success   24423 ISE has not been able to confirm previous successful machine authentication   15036 Evaluating Authorization Policy   15048 Queried PIP - Radius.NAS-Port-Type   15048 Queried PIP - DEVICE.Device Type   24432 Looking up user in Active Directory - < AD>   24355 LDAP fetch succeeded - < AD>   24416 User's Groups retrieval from Active Directory succeeded - < AD>   15048 Queried PIP - < AD> .ExternalGroups   15048 Queried PIP - Radius.Called-Station-ID   15048 Queried PIP - CERTIFICATE.Issuer - Organization   15048 Queried PIP - DEVICE.Location   15004 Matched rule - AP   15016 Selected Authorization Profile - AP   11002 Returned RADIUS Access-Accept Immediately after access accept - session terminate, re-authentication with eap-md5 as inner method which isn't supported by AD --> authZ fail step 3 -30000 Steps   11001 Received RADIUS Access-Request   11017 RADIUS created a new session   15049 Evaluating Policy Group   15008 Evaluating Service Selection Policy   15048 Queried PIP - Normalised Radius.RadiusFlowType   15048 Queried PIP - Radius.NAS-Port-Type   15048 Queried PIP - Radius.Service-Type   15004 Matched rule - Wired dot1x   11507 Extracted EAP-Response/Identity   12100 Prepared EAP-Request proposing EAP-FAST with challenge   12625 Valid EAP-Key-Name attribute received   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12001 Extracted EAP-Response/NAK requesting to use EAP-MD5 instead   12000 Prepared EAP-Request proposing EAP-MD5 with challenge   11006 Returned RADIUS Access-Challenge   11001 Received RADIUS Access-Request   11018 RADIUS is re-using an existing session   12002 Extracted EAP-Response containing EAP-MD5 challenge-response and accepting EAP-MD5 as negotiated   15041 Evaluating Identity Policy   15048 Queried PIP - Radius.User-Name   15006 Matched Default Rule   15013 Selected Identity Source - <AD>   22043 Current Identity Store does not support the authentication method; Skipping it - <AD>   22064 Authentication method is not supported by any applicable identity store(s)   22058 The advanced option that is configured for an unknown user is used   22061 The 'Reject' advanced option is configured in case of a failed authentication request   12006 EAP-MD5 authentication failed   11504 Prepared EAP-Failure   11003 Returned RADIUS Access-Reject // <![CDATA[ var djConfig = { appConfigUrl: "/admin/js/config/xmp-configuration.json", //isDebug: true, //debugAtAllCosts: true, locale: 'en-us', parseOnLoad: true }; // ]]> // <![CDATA[ var djConfig = { appConfigUrl: "/admin/js/config/xmp-configuration.json", //isDebug: true, //debugAtAllCosts: true, locale: 'en-us', parseOnLoad: true }; // ]]> // <![CDATA[ var djConfig = { appConfigUrl: "/admin/js/config/xmp-configuration.json", //isDebug: true, //debugAtAllCosts: true, locale: 'en-us', parseOnLoad: true }; // ]]> ... View more

Currently I'm unable to receive an IP via dynamic vlan assignment on a flexconnect ap. WLC:  8.1.131.0 AP: 2700i Client gets authorized by ISE and receives a vlan based on AD group membership. Unfortunately the client doesn't receive an IP. WLAN advanced flexconnect enable AAA override: yes NAC state: Radius NAC wireless - flexconnectgroup wlan vlan mapping: <dummy vlan> acl mapping:  AAA VLAN ACL Mapping  vlan A  vlan B When I receive dynamic vlan A from ISE, I don't receive an IP. If I do wlan vlan mapping: A --> then I receive IP from the scope. (AAA override seems not be working) When I check on the AP I notice that this settings are well inherited from the flexconnect group Group level VLAN ACL Mappin vlan A vlan B Maybe strange - but when I log on the AP and do a show run - I see there are subinterfaces (Gig0.) for the native vlan and the wlan-vlan mapping, but not for the vlan-acl mapping. Normal? Update: If I create vlan acl mapping for every other random vlan - the interface is created at the access point?  GigabitEthernet0.57 unassigned YES unset up up GigabitEthernet0.140 unassigned YES unset up up GigabitEthernet0.459 unassigned YES unset up up GigabitEthernet0.544 unassigned YES unset up up GigabitEthernet0.566 unassigned YES unset up up GigabitEthernet0.999 unassigned YES unset up up Vlan A, B are not created on the acces point,- that's why it's not working I suppose. I'm wondering why this vlans are not created. ... View more