I'm not sure when it happened, but my clients cannot connect to the network anymore.
PEAP with username / password works fine, but not EAP-TLS where certificates only are used.
This goes for both wired and wireless clients.
Initially, I thought that this could have something to do with the upgrade from ISE v3.1 to v3.2, but I installed a new v3.1 OVA and restored an older config, and the problem is still there.
The only things the supplicants (Windows 10 computers) have in common is the ISE server and that they are running the latest version of the Windows 10 OS.
I wouldn't put it past Microsoft that they have done something stupid in their latest patches, though.
I've had this problem before, but I fixed by either adjust MTU or replace the certificate chains on both ISE and computers.
But not this time, so I'm at a loss
Anyone else experienced something similar lately
The errors goes like this:
5411 Supplicant stopped responding to ISE
Failure Reason
12935 Supplicant stopped responding to ISE during EAP-TLS certificate exchange
Resolution
Verify that supplicant is configured properly to conduct a full EAP conversation with ISE.
Verify that NAS is configured properly to transfer EAP messages to/from supplicant.
Verify that supplicant or NAS does not have a short timeout for EAP conversation.
Check the network that connects the Network Access Server to ISE.
Verify that ISE local server certificate is trusted on supplicant.
Verify that supplicant has a properly configured user/machine certificate.
Root cause Supplicant stopped responding to ISE during EAP-TLS certificate exchange
The steps goes like this:
Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
11117 Generated a new session ID
15049 Evaluating Policy Group
15008 Evaluating Service Selection Policy
15048 Queried PIP - Normalised Radius.RadiusFlowType
11507 Extracted EAP-Response/Identity
12500 Prepared EAP-Request proposing EAP-TLS with challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12502 Extracted EAP-Response containing EAP-TLS challenge-response and accepting EAP-TLS as negotiated
12800 Extracted first TLS record; TLS handshake started
12545 Client requested EAP-TLS session ticket
12542 The EAP-TLS session ticket received from supplicant while the stateless session resume is disabled. Performing full authentication
12805 Extracted TLS ClientHello message
12806 Prepared TLS ServerHello message
12807 Prepared TLS Certificate message
12808 Prepared TLS ServerKeyExchange message
12809 Prepared TLS CertificateRequest message
12810 Prepared TLS ServerDone message
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
12935 Supplicant stopped responding to ISE during EAP-TLS certificate exchange ( [step latency=120001 ms] Step latency=120001 ms)
61025 Open secure connection with TLS peer
5411 Supplicant stopped responding to ISE
Thanks.
