Hi,   Are using HP Thin Clients with Windows Embeded. At the moment we are trying authentication on switch ports. The thin clients are being authenticated with MAB. We have run in to an anoying issue where the client asks for DHCP and displays an error saying "no network access" before the authorization process is completed, and then about 15 seconds later it gets an IP and everything works.  The switchport is configured with an default VLAN that doesnt go anywhere and after successfull authorization the VLAN is changed to the client VLAN.  I have tried optimizing the configuration by changing order and priority so that MAB happens before dot1x. We dont have many policies in ISE so moving the rule for the clients up does not help much.   Is there anything else I can do on the switch or ISE that will optimize the authentication/authorization flow?   Regards Philip     ... View more

Hi,   I am a bit annoyed that ISE doesn't report what is wrong when it is unable to retrieve an AD group.  I have different branches in my AD tree, but ISE is only able to retrieve groups from one of them. For example it can find groups under domain/company/abc/123 but not domain/company/xyz/987 That is probably a permission problem on the ISE-object in AD. I will have the AD ppl look in to that.   What annoys me is that ISE doesn't give an error. It just say "0 Groups Retrieved" when I do the search and the AD connector Operations report say that everything is fine and successfull.    Is there a way to get ISE to report something like "The group you are searching for doesn't exist" or "you dont have permission to search in  domain/company/xyz/987"?   Regards Philip ... View more