8021x authentication issue

[yukler]

My company has been plagued by an issue that we can’t seem to get to the bottom of. Users connecting to our wireless network are getting “can’t connect to this network”. We have a 5508 as the wlc and ISE as our radius servers. My laptop would intermittently fail but it was resolved when I changed the WLAN configuration so that it only authenticates with one of the ISE servers. We also confirmed it consistently failed with the other ISE server on the WLAN. At that point we thought our job was to figure out why one of the ISE servers doesn’t work but now we are finding that some of the surface pros are consistently getting the error message I would intermittently get before. None of this is making sense so any thoughts or advice would be appreciated.

[Flavio Miranda]

Hi @yukler 

 Can you share the Radius statistic  information from the WLC ?

MONITOR> Statistics > Radius Serer>  On each Radius server click in statistics  and share the information please. 

Would be more helpful if you first clear the statistics and share the information some time before that.

[eglinsky2012]

Is ISE in a multi-node deployment? If so, check the certificates for each PSN and ensure each PSN is using the same certificate for EAP. I just updated the EAP cert in my deployment, but there was 1 node that the new EAP cert didn’t take on because its hostname conflicted with that of the cert that that PSN was using for admin. So, that node was still presenting the old, expired cert, which didn’t come to light until after the old cert actually expired (I switched to the new cert a couple days beforehand). 

[Rich R]

And make sure software is up to date on WLC - most likely 8.5.182.11 (below).

On the laptops make sure the drivers are totally up to date - especially Intel drivers:
https://www.intel.com/content/www/us/en/download/19351/windows-10-and-windows-11-wi-fi-drivers-for-intel-wireless-adapters.html
The earlier versions had numerous major bugs in them especially affecting 802.1x

[Jonatan Jonasson]

@yukler - while all the responses in this thread are good to look at, looking at the logs of both ISE and a client that fails is often the best start to scope down the problem.

In ISE, you go to: Operations -> Radius -> Live Logs, and show the details for one of the failed wifi authentications.

The first focus should be the "Failure Reason", in most cases it's the best indicator.
And/or review the authentication flow on the right, to see at what point it is failing.

In most cases you should be able to narrow  it down if this is an issue between WLC and ISE, or if this is a certificate issue, or a policy issue, etc, just by looking at those logs.

Another log that can be equally important, is the client log.
On a Microsoft Windows laptop, in the event viewer you can go to: Applications and Services Logs -> Microsoft -> Windows -> WLAN-AutoConfig, and view the "Operational" log.

If the issue is related to the client not being able to correctly validate the ISE server certificates, apart from the ISE log you should be able to see that clearly in the WLAN-AutConfig Operational log on the laptop.

If you find these logs and would be able to share with use the "Failure Reason" from the ISE log, the community might be quicker on isolating down to potential issues.