New Wireless location EAP-TLS wireless doesn't work but PEAP does.

[joeharb]

We have deployed a new site and are having issues with the EAP-TLS.  We use the same profiles for each of our locations and there is no difference between this location and others.  PEAP authentications are working without issue but EAP-TLS (profile that works at other locations) ISE shows the Supplicant abandoned the session and started a new one.  I have a TAC case started but we have not made any progress.  Wired EAP-TLS works as well.  The setup and WLAN's are the same across all locations, I have a good capture and a bad capture and it appears the difference is the supplicant never provides the certificate for authentication. 

Any suggestions would be appreciated. 

See attached screenshots:

Thanks,

Joe

[Haydn Andrews]

Few questions:

• Same WLC at each location or new WLC?
• PEAP from same SSID is working?
• Has a working device from one location been tested at the non working location?
• Which supplicant are you using? The OS one, or a 3rd party. 

[joeharb]

Yes to all your questions and using native windows 10 supplicant.

[Haydn Andrews]

Ensure that the WLAN AutoConfig service is started on the client

[joeharb]

WLAN Autoconfig is set to Automatic and is in a Running state.

[ammahend]

Your print shot points to supplicant issue, client cert is sent once the server cert is validated, in failed case it’s not being sent, make sure the CA that signed server cert is in trusted certificate store of client, Try disabling server cert check in supplicant config, Try reprovisioning client with eap-tls again … to start with. 

[joeharb]

Any suggestions, TAC can't figure it out and we are still struggling.

Thanks,

Joe

[ammahend]

EAP-TLS is a standard protocol, based on your printshot last I saw was client was not sending certificate, is it still stuck at the same stage or any additional progress is made, if you are stuck at the same stage and all configuration is correctly verified by TAC then upgrade adapter firmware, try anyconnect supplicant, try different wireless adapter...

[MHM Cisco World]

Client Cert. is not available in Host when connect to WLC/AP

[joeharb]

We are still in the same state, same user can plug directly into the switch located at the site and they authenticate successfully.  TAC has said it is a fragmentation issue.  Would that fragmentation not occur on the LAN side as well?

Thanks,

Joe

[MHM Cisco World]

Yes one reason is the fragment of Server Cert., and hence the client can not defragment the Cert.
can you check the MTU between AP and WLC?

[Rich R]

Yep that's what I was about to suggest.  CAPWAP encapsulation imposes additional limits on the packet size so my bet is also on fragmentation somewhere.  There must be something different in your transport between the AP and WLC at this site (what is between them?).  Have you configured the recommended TCP MSS adjust value of 1250?  For that matter what model of WLC are you using and what version of software?

[joeharb]

Update:

We have sent a 3802 to the location and EAP-TLS is working as expected.  I have sent this information to Cisco but not sure if anyone else has noticed anything similiar.

Thanks,

Joe

[Rich R]

> We have sent a 3802 to the location and EAP-TLS is working as expected

Implying that where it's not working is on a different model of AP? So which model does not work?  And you're sure the config of both APs is identical?  What version of software are you using?

[joeharb]

The original AP's are 9120's.  We are using Tags for the AP's via a Regex Filter, so if the AP name starts with "Alpha" it inherits the same policy.  WLC is running 17.06.01.  I might have spoke to soon as it appears that when the client needed to reauthenticate (1800 seconds) they are now unable to authenticate again.  From ISE I see the authentication coming from the switch not the WLC, which is different than the previous passed authentications.  I am not sure I have noticed this in the past.

Please see attached screenshot.

This shows the end user attempting to connect but the failed ones are coming from 10.64.0.2 (switch) and the interface that the AP is connected to gi1/0/14.  The ones that show 10.31.6.131 work find and that is the address of the WLC.

Thanks,

Joe