I am facing problem with my MAB Policy. Device ISE 2.2 Switch 2960   Problem:Not able to authenticate IP phone using MAB Below the MAB debug: May 31 13:03:06.261: %ILPOWER-5-IEEE_DISCONNECT: Interface Gi1/0/13: PD removed May 31 13:03:06.800: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/13, changed state to down May 31 13:03:07.534: %ILPOWER-7-DETECT: Interface Gi1/0/13: Power Device detected: IEEE PD May 31 13:03:07.799: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to down May 31 13:03:08.698: %ILPOWER-5-POWER_GRANTED: Interface Gi1/0/13: Power granted May 31 13:03:12.078: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/13, changed state to up May 31 13:03:13.081: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/13, changed state to up May 31 13:03:16.233: %DOT1X-5-FAIL: Authentication failed for client (Unknown MAC) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:16.233: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (Unknown MAC) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:16.233: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (Unknown MAC) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:16.233: mab-ev(Gi1/0/13): Received MAB context create from AuthMgr May 31 13:03:16.233: mab-ev(Gi1/0/13): Created MAB client context 0xA5000032 May 31 13:03:16.233: mab : initial state mab_initialize has enter May 31 13:03:16.237: mab-sm(Gi1/0/13): Received event 'MAB_START' on handle 0xA5000032 May 31 13:03:16.237: mab : during state mab_initialize, got event 4(mabStart) May 31 13:03:16.237: @@@ mab : mab_initialize -> mab_acquiring May 31 13:03:24.993: mab-ev: Received NEW MAC (64a0.e7f6.7e44) for 0xA5000032 May 31 13:03:24.993: %AUTHMGR-5-START: Starting 'mab' for client (64a0.e7f6.7e44) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:24.996: mab-sm(Gi1/0/13): Received event 'MAB_AVAILABLE' on handle 0xA5000032 May 31 13:03:24.996: mab : during state mab_acquiring, got event 7(mabAvailable) May 31 13:03:24.996: @@@ mab : mab_acquiring -> mab_authorizing May 31 13:03:24.996: mab-ev(Gi1/0/13): Sending create new context event to EAP from MAB for 0xA5000032 (64a0.e7f6.7e44) May 31 13:03:24.996: mab-ev: formatted mac = 64a0e7f67e44 May 31 13:03:24.996: mab-ev: created mab pseudo dot1x profile dot1x_mac_auth_64a0.e7f6.7e44 May 31 13:03:24.996: mab-ev(Gi1/0/13): Starting MAC-AUTH-BYPASS for 0xA5000032 (64a0.e7f6.7e44) May 31 13:03:24.996: mab-ev: Invalid EVT 9 from EAP May 31 13:03:24.996: mab-ev: Invalid EVT 9 from EAP May 31 13:03:25.000: mab-ev(Gi1/0/13): MAB received an Access-Reject for 0xA5000032 (64a0.e7f6.7e44) May 31 13:03:25.003: %MAB-5-FAIL: Authentication failed for client (64a0.e7f6.7e44) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:25.003: mab-sm(Gi1/0/13): Received event 'MAB_RESULT' on handle 0xA5000032 May 31 13:03:25.003: mab : during state mab_authorizing, got event 5(mabResult) May 31 13:03:25.003: @@@ mab : mab_authorizing -> mab_terminate May 31 13:03:25.003: mab-ev(Gi1/0/13): Deleted credentials profile for 0xA5000032 (dot1x_mac_auth_64a0.e7f6.7e44) May 31 13:03:25.003: mab-ev(Gi1/0/13): Sending event (2) to AuthMGR for 64a0.e7f6.7e44 May 31 13:03:25.003: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'mab' for client (64a0.e7f6.7e44) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:25.003: %AUTHMGR-7-FAILOVER: Failing over from 'mab' for client (64a0.e7f6.7e44) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:25.003: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (64a0.e7f6.7e44) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:25.003: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (64a0.e7f6.7e44) on Interface Gi1/0/13 AuditSessionID 0A0A761E00000058006B213E May 31 13:03:25.003: mab-sm(Gi1/0/13): Received event 'MAB_DELETE' on handle 0xA5000032 May 31 13:03:25.003: mab-ev(Gi1/0/13): Received ABORT event from Auth Mgr for 0xA5000032 (64a0.e7f6.7e44) May 31 13:03:25.003: mab-ev(Gi1/0/13): Deleted credentials profile for 0xA5000032 (dot1x_mac_auth_64a0.e7f6.7e44) May 31 13:03:25.003: mab-ev: Freed MAB client context   TEST-SW#sh authentication sessions interface gi1/0/1 Interface: GigabitEthernet1/0/13 MAC Address: 64a0.e7f6.7e44 IP Address: 10.10.114.118 User-Name: 64a0e7f67e44 Status: Authz Failed Domain: DATA Oper host mode: multi-auth Oper control dir: both Session timeout: N/A Idle timeout: N/A Common Session ID: 0A0A761E00000058006B213E Acct Session ID: 0x0000005E Handle: 0x77000059 Runnable methods list: Method State dot1x Failed over mab Failed over   Switch Configuration: aaa new-model ! aaa authentication login console local aaa authentication login vty local aaa authentication enable default enable aaa authentication dot1x default group ST-RADIUS aaa authorization exec default local aaa authorization exec vty local aaa authorization network default group ST-RADIUS aaa authorization auth-proxy default group ST-RADIUS aaa accounting update periodic 5 aaa accounting auth-proxy default start-stop group ST-RADIUS aaa accounting dot1x default start-stop group ST-RADIUS ! ip domain-name <domain-name> ip name-server <ip> ip device tracking ! dot1x system-auth-control spanning-tree mode pvst spanning-tree extend system-id ! interface FastEthernet0 no ip address shutdown ! interface GigabitEthernet1/0/1 switchport access vlan 117 switchport mode access switchport voice vlan 114 authentication event fail action next-method authentication host-mode multi-auth authentication open authentication order dot1x mab authentication priority dot1x mab authentication port-control auto mab snmp trap mac-notification change added snmp trap mac-notification change removed spanning-tree portfast ! interface GigabitEthernet1/0/2 switchport access vlan 117 switchport mode access switchport voice vlan 114 authentication event fail action next-method authentication host-mode multi-auth authentication open authentication order dot1x mab authentication priority dot1x mab authentication port-control auto mab  snmp trap mac-notification change added snmp trap mac-notification change removed spanning-tree portfast !  ommited ! logging source-interface Vlan118 logging host <ip>  transport udp port 20514 ! snmp-server community public RO snmp-server enable traps snmp linkdown linkup snmp-server enable traps mac-notification change move threshold snmp-server host <ip>  version 2c mac-notification snmp-server host <ip> version 2c public mac-notification ! radius-server attribute 6 on-for-login-auth radius-server attribute 6 support-multiple radius-server attribute 8 include-in-access-req radius-server attribute 25 access-request include radius-server dead-criteria tries 3 radius-server deadtime 30 radius-server vsa send accounting radius-server vsa send authentication ! radius server ST-ISE address ipv4 10.10.118.230 auth-port 1812 acct-port 1813 key C1sc0234 ! line con 0 line vty 5 15 ! ntp server <ip> end ================= ISE has its default Policy for MAB and dot1x. Dot1x is working fine and able to authenticate domain computers but MAB for Cisco IP Phones 6921, 2907 having issues.   Is there any problem with my configurations?   thanks       ... View more

Current Setup: LDAP as Identity stores for both domain computers and users. PEAP-TLS or EAP-TLS as authentication method   Below the configuration of the computer LAN:     Only below the available method for authentication:     I tried the first method ( Smart Card or other Certificate) but getting prompt " need certificate" on the test computer. Take note that  I have the root cert of the server and also the CSR from ISE  binded with the server. In short, i have all the required certificate on the ISE.   When I used the 2nd method, I getting below error:   I have successfully integrated the ISE to LDAP as I able to fetch the groups from the LDAP and used in the Policy.   Why ISE not able to locate my username?  Is there compatibility between LDAP and the authentication that I have used?   I cant used the AD as I am not able to fetch the groups/users from AD that's why we used LDAP. Its already a couple of days looking for exact setup but always found most of them using AD as Identity Store.   All I need is same setup, LDAP as server and what needs to configure on the computer LAN connection,   Thank you in advance.     ... View more