IPhone stop sending certificate to server in EAP exchange

[Aleksandr Pashko]

Hello everyone

We encountered a problem connecting client devices to the Wi-Fi SSID, which authorizes users through an external Cisco ISE server. Only iphones and ipads connect to it. Once we noticed that some device stops connecting.
Turning Wi-Fi on / off, rebooting the device and other manipulations with it do not help. Performance is restored only if you "forget the network" and reconnect. The problem was noticed on IOS 15.6.1, 16.1.2, 16.2, 16.3.

After troubleshooting we found that the  problem on the stage of EAP exchange - between Apple mobile deviecs. There's a successfull answer on the left and the failed on the right of the screenshot

For some reasons the device after some time in response to an Identity request  from server stops sending a certificate, and sends  "Close Notify" instead of it. And we can see nothing in the Live Logs on the Cisco ISE's side.

[MHM Cisco World]

check the above line 
there is fragment 
so in one hops between the client and Server some hope is fragment and it some times pass and other time it failed 
if your use MPLS then check the MTU you use. 

[Aleksandr Pashko]

thank you for the answer, 

We're not using the MPLS in out network, and the ISE node and WLC in the same network

You want me to increase the MTU? where exactly you need to check and, if necessary, increase the MTU if it is really necessary?

[MHM Cisco World]

ISE and WLC in same network but are the AP/client in same one ?

[Aleksandr Pashko]

ISQ and WLC on the same network, but AP's and clients in the different 

[Rich R]

Those are TLS fragments which is expected for an 1877 byte segment.  And that's the one that's working anyway so clearly not a problem.

Regarding the original problem:
- Either you've found an iOS bug which only Apple can fix for you
- Or ISE is sending something that's triggering the device to close the TLS connection so the packets before that need to be inspected closely.  Check things like your certs - have all your nodes been fully updated with matching certs and full cert chain for example? Also in this regard fragmentation could be an issue - if ISE is not using TLS fragmentation and trying to send large IP packets which then require IP fragmentation in the network - we occasionally see problems with this particularly on the TLS server cert packets which always exceed MTU.  We always recommend customers to make sure they implement TLS fragmentation.

This article is quite old but have a look: https://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/118634-technote-eap-00.html
Get packet captures on both ends and pay attention to what's happening on both ends before the failure.

[Aleksandr Pashko]

Thank you for the answer, let me check it

[Aleksandr Pashko]

Maybe it helps here're the screenshots of Server Hello of successfull and failed EAP exchange , I can't see any differenses - both of them are fragmented, on both of them suggests the same server certificate keychain with the same common name

[Rich R]

Then I'm inclined to think it's an Apple bug ...
I'd open a TAC case for it - make sure TAC agree it's an Apple fault (in case it's something we missed) then try to get them to raise it with Apple unless you have an existing relationship with Apple through which you can raise it directly.

[Aleksandr Pashko]

You mean it can be Apple bug for different devices (iPhone and iPad)  with different iOS versions (5.6.1, 16.1.2, 16.2, 16.3)?