Cisco ISE Guest Authentication Failed : 86020: Unknown exception

Hi,
I would like to check what may be causing the error message 86020:unknown exception for ise when guest user authenticates via wireless using CWA? I have also attached a screen capture of the error and after the authenitcation logs change to autheorization only succeed after a repeated trying. Based on user feedback for failed login, When guest user gets conected to wirless and login in to guest portal with credential after putting credential then its again redirect to same login page wihout successful login prompt; not too sure if there may be any settings that may be looked into and the reason for the unknown exception error?
Any suggestion/recommendation is appreciated.

Hi Tarik,
Not too sure if i understand on the static hostname for redirection; there are 2 PSNs for the deployment however they are acting as active/secondary for the wireless (This is done from the wlan on the wlc to set the primary/secondary radius server). From the guest redirection; it is always hitting the primary radius server defined on the wlan/wlc. The ise is running version 1.1.4 with patch 8 applied.
Not too sure if there may be any settings that may be looked into for the guest authentication/redirection and the reason for the unknown exception error?
Thanks.

Similar Messages

Cisco ISE and Authentication Failed VLAN

I am trying to setup ISE to assign a VLAN to unauthorized computers. I tried using "authentication event fail action authorize vlan 666" command but unfortunately I'm using multi-auth because we have users with bridged VMs and Cisco does not support it (http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/sw8021x.html#wp1454875).
Is there a way to make an Authorization/Authentication profile within ISE to assign the VLAN to failed devices?

You can set endpoint protection status to quarantine, and establish policies that assign different
authorization profiles, depending on the status of the endpoint.
Quarantine essentially moves an endpoint from its default VLAN to a specified Quarantine VLAN. The
The Quarantine VLAN must be previously defined by a network administrator and supported on the
same NAS as the endpoint. Unquarantine reverses the quarantine action, returning the endpoint to its
original VLAN.
The quarantine and unquarantine actions are performed as a result of established Authorization Rules
that are defined to check for EPSStatus
http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_eps.html#wp1219979

Cisco ISE Guest Login

Hi,
I have a weird problem; after a guest user account has been created on Cisco ise 1.1.4 patch 8; when the guest user is redirected to the ise guest portal; the first login is always unsuccessful. Upon entering the login credential and password correctly; the client would be redirected to the same login page. Upon retrying the process a few times; it would succeed after 2-3 times.
On the ise authentication; I see a guest authentication error; "Guest Authentication Failed : 86020: Unknown exception" with only a single step seen on the logs for troubleshooting "5431 Guest Authentication Failed"
I would like to check if anyone has seen such an issue/behaviour?
Any suggestions is appreciated.
Thanks.

No it doesn't, you can test the same , while editing the wireless SSID profile, opting authentication method as smart card other than PEAP/EAP.

Cisco ISE Guest Sponsor Portal Isssue

Dear all ,
We have insatalled 5 ise 3315 boxes IOS 1.0.4 in our network where in two of them are admin node , two of policy services and one is mnt node. We are using guest sponsor portal for wirless guest user where in we have integrated WLC 5508 with ise and using weblogin for guest users.
We have created open ssid in wlc and using external redirected url of ise for guest login page.
But when we create any guest user in sponsor login for guest user we faced following issue
1) When guest user gets conected to wirless and login in to guest portal with credential after putting credential then its again redirect to same login page
wihout successful login prompt.
Can we pompt successful login after guest login to guest portal or redirect to any other link like google.com so guest user will gets to know he is able to access internet now
2) We have creted time profile 8hours first login for guest user. When guest user gets connected while putting credential in to guest portal.
But we face issue after approximately every 20 mins guest gets disconnected from internet and guest again gets login page of guest portal and if we put same credential then its working but after approx 20 min interval user get disconnected from internet.
Can anyone help me to resolved above issue regading cisco ise guest sponsor portal
Thanks & Regards
Pranav Gade

Pranav your answers are inline,
1) When guest user gets conected to wirless and login in to guest portal with credential after putting credential then its again redirect to same login page
wihout successful login prompt. When you are using CWA (central web authentication) there is no way we can redirect users using the redirect-url because this will always redirect users for every time they initiate a web request. There is no other coa feature that will remove this condition since they have already been authenticated. Here is a guide that explains the user experience when using central web auth -
http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_guest_pol.html#wp1296954
Can we pompt successful login after guest login to guest portal or redirect to any other link like google.com so guest user will gets to know he is able to access internet now No this is not possible, you can change the verbage and force the AUP to be displayed informing users that they can retry their web request after hitting the accept button.
Here is the documented experience once users go through the guest process -
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080ba6514.shtml#final
2) We have creted time profile 8hours first login for guest user. When guest user gets connected while putting credential in to guest portal.
But we face issue after approximately every 20 mins guest gets disconnected from internet and guest again gets login page of guest portal and if we put same credential then its working but after approx 20 min interval user get disconnected from internet. Check the advanced timer on your SSID as you may be hitting the session timeout on the WLC. Please disable this option and let the COA feature in ISE expire user sessions on the controller.
Thanks,
Tarik Admani
*Please rate helpful posts*

Cisco ISE guest portal redirect not working after successful authentiation and URL redirect.

Hi to all,
I am having difficulties with an ISE deployment which I am scratching my head over and can't fathom out why this isn't working.
I have an ISE 3315 doing a captive webportal for my guest users who are on an SSID. The users are successfully redirected by the WLC to the following URL:https://x.x.x.x:8443/guestportal/Login.action?portalname=XXX_Guest_Portal
Now when the user passes through the user authentication splash screen they get redirected to https://x.x.x.x:8443/guestportal/guest/redir.html and recieve the following error:
Error: Resource not found.
Resource: /guestportal/
Does anyone have any ideas why the portal is doing this?
Thanks
Paul

Hello,
As you are not able to get the guest portal, then you need to assure the following things:-
1) Ensure that the two Cisco av-pairs that are configured on the authorization profile should exactly match the example below. (Note: Do not replace the "IP" with the actual Cisco ISE IP address.)
–url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
–url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also defined on the access switch)
2) Ensure that the URL redirection portion of the ACL have been applied to the session by entering the show epm session ip command on the switch. (Where the session IP is the IP address that is passed to the client machine by the DHCP server.)
Admission feature : DOT1X
AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
URL Redirect ACL : ACL-WEBAUTH-REDIRECT
URL Redirect :
https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
0000A45A2444BFC2&action=cpp
3) Ensure that the preposture assessment DACL that is enforced from the Cisco ISE authorization profile contains the following command lines:
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
remark ping
permit icmp any any
permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
permit tcp any host 80.0.80.2 eq www --> Provides access to internet
permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
port
permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8906 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
deny ip any any
Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on the switch as follows:
ip access-list extended ACL-WEBAUTH-REDIRECT
deny ip any host 80.0.80.2
permit ip any any
5) Ensure that the http and https servers are running on the switch:
ip http server
ip http secure-server
6) Ensure that, if the client machine employs any kind of personal firewall, it is disabled.
7) Ensure that the client machine browser is not configured to use any proxies.
8) Verify connectivity between the client machine and the Cisco ISE IP address.
9) If Cisco ISE is deployed in a distributed environment, make sure that the client machines are aware of the Policy Service ISE node FQDN.
10) Ensure that the Cisco ISE FQDN is resolved and reachable from the client machine.
11) Or you need to do re-image again.

ISE Guest Authentication only with email address

Hi,
I want to know is there an option to use ONLY the email address as an authentication credential for Guest user authentication using Guest Protal and this should be done only with Self Registration not with Sponsored accounts.
Appreciate if someone has done this and advise us how to achieve this.?
thanks

The exact scenario explained above is unachievable , however a little different from that can be achieved , see below
New Features in Cisco ISE Version 1.2.0.899—Cumulative Patch 2
Support for Guest Self-Registration Based on Email Domain Whitelist
You can allow guests to create their own accounts by enabling the self-service feature by choosing: Administration > Web Portal Management > Settings > Guest > Multi-Portal Configurations > Operations > Guest users should be allowed to do self service. When you enable this feature, the account credentials display on the screen, and they are also emailed to the email address used to create the account.
You can restrict this feature by limiting guests' ability to create their own accounts based on their email domain. By creating an email domain whitelist, you can ensure that only guest users with email accounts on those domains can create guest accounts.
To prevent the account credentials from displaying on the screen, you must create a custom portal when using an email domain whitelist. These steps provide an overview:
1. Create a custom portal, following these guidelines:
–Add a required email field and an acceptable use policy (AUP) page to the Self-Registration html file. See the "Sample Code for Sponsor and Guest Portal Customizations" appendix in the Cisco Identity Services Engine User Guide, Release 1.2 for a sample file.
–Add text to refer users to their email for their login credentials on the Self-Registration Results html file. See the "Sample Code for Sponsor and Guest Portal Customizations" appendix in the Cisco Identity Services Engine User Guide, Release 1.2 for a sample file.
–Map the Login file to the Self-Registration page. See the "Mapping HTML Files to Guest Portal Pages" section in the Cisco Identity Services Engine User Guide, Release 1.2 for detailed instructions.
2. Configure the SMTP server to support notifications (Administration > System > Settings > SMTP Server).
3. Specify the default e-mail address from which to send all guest notifications. (Administration > System > Settings > SMTP Server and choose Use Default email address).
4. Create the email domain whitelist. See the "Restricting Self-Registration Based on Email Domain" section.
5. Customize the self-registration credentials email message. See the "Customizing the Self-Registration Credentials Email" section.
6. Customize the self-registration failure message. See the "Customizing the Self-Registration Failure Message" section

Cisco ISE Guest portal

Dears,
I want to configurate guest portal(Central Web authentication) for wireless client on Cisco ISE. I confuse that:
Must i configure redirect ACL in switch? If yes which access-group or which interface i applied this redirect ACL?
I read that must be create redirect ACL in WLC.

I also do my configuration form these guide. In this guide write that:
reate the Authorization Profile
On the ISE, the authorization profile must be created. Then, the authentication and authorization policies are configured. The WLC should already be configured as a network device.
In the authorization profile, enter the name of the ACL created earlier on the WLC.
Click Policy, and then click Policy Elements.
Click Results.
Expand Authorization, and then click Authorization profile.
Click the Add button in order to create a new authorization profile for central webauth.
In the Name field, enter a name for the profile. This example uses WLC_CWA.
Choose ACCESS_ACCEPT from the Access Type drop-down list.
Check the Web Redirection check box, and choose Centralized Web Auth from the drop-down list.
In the ACL field, enter the name of the ACL on the switch that defines the traffic to be redirected. This examples usescwa_redirect.
this confuse me.

Cisco ISE guests and Ironport

Hi All,
I'm currently writing a HLD for a Cisco ISE rollout in my organization, and I've come across sort-of-an-issue:
I'm planning on getting the guests in through the ISE Guest portal, but I also want to push them through an authenticated proxy(for accounting purposes) instead of a transparent one... however, I can't seem to find a way to somehow integrate Ironport and ISE in order to achieve some sort of an SSO, to avoid users having to enter their credentials twice(guest portal and ironport)- has anyone got a working solution for this?
Any constructive input appreciated!
Thanks!

Thanks for the swift responses and suggestions!
I'll most certainly have a look at the proposals...
However, I still want the guest users to go through the S370, as it's not only for accounting purposes, but I want them to authenticate, since it would make tracing and pinning events to a person way easier - that's the main reason why I'm trying to find a solution that might act like an SSO. The business side stated that signing in twice(ISE guest portal, then proxy) is unacceptable. I know that there's no direct integration between ISE and Ironport at the moment, and I am going to put in a feature request for that, but for the time being, I am really keen on getting this to work somehow...
BTW - I'm currently using a virtualised ISE, release 1.1.4., And I've got the 3395's on order...

Cisco ISE Guest portal - smart card login

Does anyone know if Cisco ISE support smart card login to the guest portal page?

No it doesn't, you can test the same , while editing the wireless SSID profile, opting authentication method as smart card other than PEAP/EAP.

Cisco ISE Guest Portal - DNS Issue - External Zone

Hello,
I have a customer that has the following sceanrio :
In a wireless deployment and a Cisco ISE 1.1.3 deployment with CWA, when the wireless guest receives the redictect URL from ISE (URL to access the ISE Guest Portal), this URL is based on the ISE DNS name, not on its IP address; so, the PC can't resolve this via DNS name since there is no DNS in the External zone (for guets) or by using the ISP DNS servers addresses provided by the DHCP server, and, so, it can't access the Guest Portal at all ;
I know that in trying to manually code the IP address - this does not work (ie in the CWA Authorization profile, the equivalent URL redirect via the CISCO av-pair as follows :
cisco-av-pair=url-redirect=https://10.10.10.10:8443/guestportal/gateway?sessionId=sessionIdValue&action=cwa, )
since the sessionIdValue variable is not replaced by its real value when sent to the wireless client)
My question is : Has this issue been addressed in version Cisco ISE 1.2 - has anyone tried it if has been addressed? If not in Cisco 1.2 - does anyone know iof this feature will become available?
Thank-you in advance for your replies.
Robert C.

Robert,
Manual assignment has been made available in ISE 1.2 release.
M.

Cisco ISE 1.3 failed to authenticate wireless endpoint

Dear all,
I recently have a big problem of my ISE after upgraded from version 1.2 to 1.3, the original plan is follow for wireless laptop authenticate to our network.
There are 2 SSID, REG and INT, when the user and laptop first time use the WIFI, they need to request a user certificate from CA, and they need to login to the REG SSID with AD username and password. The Wireless controller 2504 will pass the packet to ISE, the use will use 802.1x authen method with PEAP to request for cert. if the authentication successful, the user need to open a web browser and the NSP page of ISE will shown up for user to register, and the CA will generate the user cert to user. Then the SSID will switch to INT and using EAP/TLS to authenticate the user cert with the CA.
That was fine when working in ISE 1.2. However, after upgrade to 1.3 because of the proxy setting in 1.3 allow to input username and password which our proxy server required and cannot be changed. Under 1.3 the authentication failed even in the first step of authentication policy of ISE, the policy will check if the laptop using 802.1x and login by AD account, then it will pass to authorization policy. But when I check the log, there is always have the error message 5411 Supplicant stopped responding to ISE , 12930 Supplicant stopped responding to ISE after sending it the first PEAP message , 5440 Endpoint abandoned EAP session and started new
I have search long time in the Internet but without any help, appreciate if any expert can help me. I have also upload the debug message from our ISE for reference.
Thank you
Best Regards,
Terry Chow

Hi Terry,
Just wondering if you got an answer to your problem?
I am deploying a new solution with ISE 1.3 and I was having a similar problem with my wireless users when I tried to enable it last night
Cheers,
John

Cisco ISE User Authentication Certificates for Wired and Wirless Users (BYOD)

Can any one tell me from where we can purchase User Authentication Certificates for Wired and Wireless Users (BYOD) for Cisco ISE. Also Confirm what certificates we required for the purpose.
Please suggest the Website form where we can purchase and ipmort in Cisco ISE certificate Section.
Thanks.

Dear Mohana,
Thanks for your reply, Can you please confirm me in regards EAP-TLS certificate, which authorities you recomend if i go to Go dadday or very Sign to buy it and then import in ISE.
Looking forward for your reply.
Regards,
Muhammad Imran Shaikh
Resident Engineer, IT Network Section - PPL
Mobile : 0092-312-288-1010
LinkedIn : pk.linkedin.com/pub/muhammad-imran-shaikh/10/471/b47/

Cisco ISE and authentication for 802.1x printer

Hello
What is the best practice to authenticate a 802.1x printer in Cisco ISE?
The printer can store a certificate for authentication and support EAP-TLS.
Thanks for answer.
Marco

EAP-TLS is the way to go. It is way way way more secure than MAB and profiling. However, the question is "How much of a hassle is it going to be to put a certificate on each printer?" Moreover, "What methods do I have (if any) to renew those certificates when they expire?" If have to manually generate a CSR and install a cert on each printer then it can quickly become an administrative overhead nightmare. With that being said, you can use MAB and profiling but just make sure that you lock down the access that those printers get. For instance, do they need access to the internet? Do they need access to anything else but the print server and/or open to all IPs access but only on the printing ports.
I hope this puts you in the right direction!
Thank you for rating helpful posts!

ISE EAP Authentication fails

I've integrated a new ISE deployment, After a while I start getting the following error below, for wired users, it randomly fails on different users
The NAD I use is WS-C3650-48PD with the following 03.03.03SE cat3k_caa-universalk9 version,
All was working properly for one month, all of a sudden it has started to report such error
I tried to optimize the timers , but it's still the same
Also when I do clear authentication on the same user who has failed the authentication passed
Please advice
Event
5400 Authentication failed
Failure Reason
12953 Received EAP packet from the middle of conversation that contains a session on this PSN that does not exist
Resolution
Verify known NAD issues and published bugs. Verify NAD configuration. Turn debug log on DEBUG level to troubleshoot the problem.
Root cause
Session was not found on this PSN. Possible unexpected NAD behavior. Session belongs to this PSN according to hostname but may has already been reaped by timeout. This packet arrived too late.

IOS-XE has been very problematic. The version of code that you are running is not that old but I would recommend that you upgrade it. I have heard very positive feedback for v.3.7.0 but it is fairly new so if you want to be safe I would suggest running the 3.3.5.
Thank you for rating helpful posts!

Cisco ISE - Guest Access With Google Chrome

We've implemented the self provisioning guest portal/Guest SSID and it seems to work great for internet explorer, if a user uses Google Chrome to go through the setup the password is generated, they login and accept the terms and conditions, but then they get hung up on the WLC URL and then have to start self provisioning again.
Any ideas?

Please check the below browser requirements :
Supported Operating Systems and Browsers for Sponsor, Guest, and My Devices Portals
These Cisco ISE portals support the following operating system and browser combinations. These portals require that you have cookies enabled in your web browser.
Table 8 Supported Operating Systems and Browsers
Supported Operating System Browser Versions
Google Android 1 4.0.4, 4.0.3, 4.0, 3.2.1, 3.2, 2.3.6, 2.3.3, 2.2.1, 2.2
•Native browser
Apple iOS 6, 5.1, 5.0.1, 5.0
•Safari 5, 6
Apple Mac OS X 10.5, 10.6, 10.7, 10.8
•Mozilla Firefox 3.6, 4, 5, 9
•Safari 4, 5, 6
•Google Chrome 11
Microsoft Windows 82
•Microsoft IE 10
Microsoft Windows 73
•Microsoft IE 9
•Mozilla Firefox 3.6, 5, 9
•Google Chrome 11
Microsoft Windows Vista, Microsoft Windows XP
•Microsoft IE 6, 7, 8
•Mozilla Firefox 3.6, 9
•Google Chrome 5
Red Hat Enterprise Linux (RHEL) 5
•Mozilla Firefox 3.6, 4, 5, 9
•Google Chrome 11
Ubuntu
•Mozilla Firefox 3.6, 9

Cisco ISE Guest Authentication Failed : 86020: Unknown exception

Similar Messages

Maybe you are looking for