ISE 1.2.1 logs full of Identity/Endpoint ID of 00:00:00:00:00:03, authentication failed

After an upgrade to 1.2.1, I now see a lot of auth failed entries with an Identity/Endpoint ID of 00:00:00:00:00:03.
I dont see this MAC on the switch port of the NAS where ISE reports it.
Anybody know what this is and how to stop it from happening?
thanks

Answers are:
Its a HP ESXi server. 2x Win7 VM PC's run on this machine, each with a dedicated NIC.
I haven't, will shut the VM's and shut the ports and see what happens.
The auth session shows the MAC, but the switch MAC table doesn't
SW1-C3750X#show authentication sessions int gi 1/0/19
Interface MAC Address Method Domain Status Fg Session ID
Gi1/0/19 000c.2931.54f6 dot1x DATA Auth 0A0A01FE000000870EDF8C3B
Gi1/0/19 0000.0000.0003 N/A UNKNOWN Unauth 0A0A01FE000000B219576F86
SW1-C3750X#show mac address-table int gi 1/0/19
Mac Address Table
Vlan Mac Address Type Ports
100 000c.2931.54f6 STATIC Gi1/0/19
Thanks for replying.

Similar Messages

Error in db6conv failed due to transaction log full

Hi,
I have a huge problem with my production system.
I was executing db6conv v4.08 to convert a table to a new tablespace and it stopped due to a transaction log full.
Now I have this situation:
table soffcont1
db6conv: status: preliminary
I check the job db6conv_job_soffcont1 with status scheduled.
The problem is that when I want to execute this jobs it gives me an error:
Definition of job db6conv_job_soffcont1 is incomplete. Operation is not possible.
regards,
filipe vasconcelos

hi filipe,
i will follow up on this problem in you OSS message.
regards, frank

FINANTIAL DOCUMENTS MISSING --- ORACLE LOGS FULL

Hi Experts,
9 documents are missing and when they were saved the system showed the message "update has been stopped". This was because of the Oracle LOGS (full).
When Oracle problem was solved the documents were not found in SM13 to recovered.
Any clue?
On the other hand If a have finantial documents in QAS how can I put it on PRD?
Regards.

Hi,
Schedule your backups according to the full backup time.
Do a test of full backup and fine the time that it takes to complete the full backup. You can include "plus archivelog" if you want your archive logs to be backed up along with the full backup. This is most preferred as this makes restoration easy too.
If your full backup takes, say, 4 hrs to complete and if you schedule your full backup at 00 00 hrs on your scheduler, then schedule the archive backups after 04 00 hrs. This will solve your problems with missing archive backups.
>> "But from RMAN specialist I heard that this may cause problems with full backup. During full backup also archive logs are backed up (at the start and end) so there might be a problem with accessing the file that is used by another process. And this may cause problem with full backup - which we want to avoid especially."
This will throw out errors if your input to full backup consists "delete input" for your archived logs, else the process will not have any problem and succeed.
Also when one or more of backups run concurrently, "ORA-00230: operation disallowed: snapshot control file enqueue unavailable" error may occur but this is rare case.
Thank you!!

DB2 transaction log full

I am installing ECC6 for DB2 on RedHat AS4 platform. During import ABAP phase(running3, waiting1, completed15, total19), I have a strange error. System tell me that DB2 transaction log full. It seems unreasonable. System should know data volume during data import. I increased DB2 log file size when I got the error, and now, import ABAP is still in progress. Does anybody know why I got this error? Thanks so much.

Hello
there should be an SAPINST-Dialog similar to
"SAP System > Database Import"
where you can enter
Number of Parallel Jobs
In newer installations you started in "Default Mode" you need to review your summary dialog and mark the corresponding dialog for respecification.
Then you can specify your desired number of parallel Jobs
Best regards
Dirk

Staging server archive log full

Hi ,
i have encountered my staging server having archive log full which i do not understand.
i hope anyone can help clarify my doubts
Production server : oracle 10G , RedHat
Staging Server : oracle 10G , runnings on windows
source server : DB2
the staging server is simply a link between the Production server & db2
i am running my procedures on the production server which is getting db2's data via the staging server thru dblink
i have encountered the error : ORA-00257 : archiver error : connect internal only, until freed when i ran some recovery which involved some 20M to 40M records being loaded at the same time
what i do not understand is why would the Oracle running on windows have its archive log full when it's just a link betw the production and db2
pls advise
tks & rgds

Just go to the archivl log destination and delete some/all of the archive logs then I think the problem will be resolved.
OR
connect to RMAN then run
run {
allocate channel ch1 device type disk;
backup format '/u04/rman_backup/RMAN_ARCH_<%s:%t:%p>.bkp' archivelog all delete input;
It will take the backup of your all archivelog and then delete the archive logs from your current archive log directory.
Regards
Asif Kabir

Cisco ISE (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out)

Hi,
I have a setup ISE 1.1.1. Users are getting authenticate against AD. Everything is working fine except some users report disconnection. I see in the ISE that (Authentication failed: 24415 User authentication against Active Directory failed since user's account is locked out). Users are using Windows 7 OS.
Error is enclosed & here is the port configuration.
Port Configuration.
interface GigabitEthernet0/2
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30 interface GigabitEthernet0/2
switchport access vlan 120
switchport mode access
switchport voice vlan 121
authentication event fail action next-method
authentication event server dead action reinitialize vlan 120
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
mab
dot1x pae authenticator
dot1x timeout tx-period 60
spanning-tree portfast
ip dhcp snooping limit rate 30
Please help.

The error message means that Active Directory server Reject the authentication attempt
as for some reasons the user account got locked.I guess, You should ask your AD Team to check in the AD
Event Logs why did the user account got locked.
Under Even Viewers, You can find it out
Regards
Minakshi (Do rate the helpful posts)

ISE EAP Authentication fails

I've integrated a new ISE deployment, After a while I start getting the following error below, for wired users, it randomly fails on different users
The NAD I use is WS-C3650-48PD with the following 03.03.03SE cat3k_caa-universalk9 version,
All was working properly for one month, all of a sudden it has started to report such error
I tried to optimize the timers , but it's still the same
Also when I do clear authentication on the same user who has failed the authentication passed
Please advice
Event
5400 Authentication failed
Failure Reason
12953 Received EAP packet from the middle of conversation that contains a session on this PSN that does not exist
Resolution
Verify known NAD issues and published bugs. Verify NAD configuration. Turn debug log on DEBUG level to troubleshoot the problem.
Root cause
Session was not found on this PSN. Possible unexpected NAD behavior. Session belongs to this PSN according to hostname but may has already been reaped by timeout. This packet arrived too late.

IOS-XE has been very problematic. The version of code that you are running is not that old but I would recommend that you upgrade it. I have heard very positive feedback for v.3.7.0 but it is fairly new so if you want to be safe I would suggest running the 3.3.5.
Thank you for rating helpful posts!

ISE Voip phones: authentication failed against AD

the message is
2064 Authentication method is not supported by any applicable identity store(s): Authentication failed
the user is present on AD and testing user in ise is ok
the authentication rule to check in AD is created
policy servers are joined and in green status
if I create an internal user (just for testing) authentication is ok
my authentication sequence is:
mab
mab_ad
dot1x
dot1x_ad
those phones uses eap-md5
i guess there is something to check in AD, can someone help me to solve this?

yes that is true however it supports eap md5 against internal database strange thing...
it won't have been a bad thing if it had the ability to turn over the eap-md5 request in another format like ldap...
thank you!!

OBIA 7.9.5 EBS Integration Not Logged On nQSError 43001 Authentication Fail

Hi,
I'm attempting to get Oracle Business Intelligence Applications 7.9.5 / OBIEE 10.1.3.3.2 integrated into the eBusiness Suite 11.5.10.2 per Metalink Note 552735.1. At the moment not an action link, just menu option to SA Administrator.
I've run into and worked around a number of problems with the Initialization block variables setup in OracleBIAnalyticsApps.rpd and now no longer get errors in the NQServer.log after disabling Initialization Blocks for Siebel/Peoplesoft and disabling 2 EBS specific Init blocks that were erroring; 'Inventory Organizations' and 'Ledgers' I'll fix those later.
However, now I get an error in the sawlog0.log file as follows:
File: project/webodbcaccess/odbcconnectionimpl.cpp Line: 371
Properties: ConnId-6,6;ThreadID-1145072560
Location:
saw.odbc.connection.open
saw.connectionPool.getConnection
saw.threadPool
saw.threads
Odbc driver returned an error (SQLDriverConnectW).
State: 08004. Code: 10018. NQODBC [SQL_STATE: 08004|http://forums.oracle.com/forums/] [nQSError: 10018|http://forums.oracle.com/forums/] Access for the requested connection is refused.
[nQSError: 43001|http://forums.oracle.com/forums/] Authentication failed for in repository Star: invalid user/password. (08004)
Type: Error
Severity: 42
Time: Wed Dec 3 07:13:16 2008
File: project/webconnect/connection.cpp Line: 276
Properties: ThreadID-1145072560
Location:
saw.connectionPool.getConnection
saw.threadPool
saw.threads
Authentication Failure.
Odbc driver returned an error (SQLDriverConnectW).
Can anyone point me in the right direction here?
Thanks,
Gareth

The strange thing is both Gareth and I have configured OBIA/OBIEE on a Linux server and local authentication works fine. Once we enable external EBS authentication, we get the error listed above.
Does anyone who has done the OBIA EBS integration with OBIEE running on Linux have an example of the odbc.ini file. It appears that even though we have reconfigured OracleBIAnalyticsApps.rpd to use OCI everywhere, that there is still some hard coded ODBC references for external authentication.
We are configuring instanceconfig.xml as directed:
Integrating Oracle Business Intelligence Applications with Oracle E-Business Suite
https://metalink2.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=552735.1
Configuring InstanceConfig.xml for External Authentication
1. Modify the instanceconfig.xml file for the Oracle BI Presentation Services as shown below:
<?xml version="1.0"?>
<WebConfig>
<ServerInstance>
<CatalogPath>c:\temp\default</CatalogPath>
<DSN>AnalyticsWeb</DSN>
<Auth>
<ExternalLogon enabled="true">
<ParamList>
<Param name="NQ_SESSION.ICX_SESSION_COOKIE"
source="cookie"
nameInSource="EBSAppsDatabaseSID"/>
<Param name="NQ_SESSION.ACF"
source="url"
nameInSource="ACF"/>
</ParamList>
</ExternalLogon>
</Auth>

</ServerInstance>
</WebConfig>
2. The nameInSource for the cookie should be the same as the Oracle E-Business Suite application database SID name. To verify the name of the cookie, using Firefox, check the name of the cookie created under the us.oracle.com domain (or the domain where your Oracle E-Business Suite Application server is running). Please note that the cookie name is case sensitive.

Cisco ISE authentication failed because client reject certificate

Hi Experts,
I am a newbie in ISE and having problem in my first step in authentication. Please help.
I am trying to deploy a standalone Cisco ISE 1.1.2 with WLC using 802.1x authentication. The user authentication configured to be checked to ISE's internal user database for early deployment. But when the user try to authenticate, they failed with error message in ISE :
Authentication failed : 12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
I've generate a certificate for ISE using Windows Server CA and replace ISE's self-signed certificate with the new certificate but authentication still failed with the same error message. Must I generate a certificate for WLC also? Please help me in solving this problem.
Regards,
Ratna

Certificate-Based User Authentication via Supplicant Failing
Symptoms or
Issue
User authentication is failing on the client machine, and the user is receiving a
“RADIUS Access-Reject” form of message.
Conditions (This issue occurs with authentication protocols that require certificate validation.)
Possible Authentications report failure reasons:
• “Authentication failed: 11514 Unexpectedly received empty TLS message;
treating as a rejection by the client”
• “Authentication failed: 12153 EAP-FAST failed SSL/TLS handshake because
the client rejected the Cisco ISE local-certificate”
Click the magnifying glass icon from Authentications to display the following output
in the Authentication Report:
• 12305 Prepared EAP-Request with another PEAP challenge
• 11006 Returned RADIUS Access-Challenge
• 11001 Received RADIUS Access-Request
• 11018 RADIUS is reusing an existing session
• 12304 Extracted EAP-Response containing PEAP challenge-response
• 11514 Unexpectedly received empty TLS message; treating as a rejection by the
client
• 12512 Treat the unexpected TLS acknowledge message as a rejection from the
client
• 11504 Prepared EAP-Failure
• 11003 Returned RADIUS Access-Reject
• 11006 Returned RADIUS Access-Challenge
• 11001 Received RADIUS Access-Request
• 11018 RADIUS is re-using an existing session
• 12104 Extracted EAP-Response containing EAP-FAST challenge-response
• 12815 Extracted TLS Alert message
• 12153 EAP-FAST failed SSL/TLS handshake because the client rejected the
Cisco ISE local-certificate
• 11504 Prepared EAP-Failure
• 11003 Returned RADIUS Access-Reject
Note This is an indication that the client does not have or does not trust the Cisco
ISE certificates.
Possible Causes The supplicant or client machine is not accepting the certificate from Cisco ISE.
The client machine is configured to validate the server certificate, but is not
configured to trust the Cisco ISE certificate.
Resolution The client machine must accept the Cisco ISE certificate to enable authentication.

Cisco ISE authentication failed for Win XP SP3

Hello,
I have some trouble this Win XP wired Client authentication. With Win7 everything works well.
ISE 1.2 (patch 4)
Switch: 2960 / 2960S (15.0.(2)SE2)
Authentication details:
Event:
5400 Authentication failed:
Failure Reason
11514 Unexpectedly received empty TLS message; treating as a rejection by the client
Resolution
Ensure that the client's supplicant does not have any known compatibility issues and that it is properly configured. Also ensure that the ISE server certificate is trusted by the client, by configuring the supplicant with the CA certificate that signed the ISE server certificate. It is strongly recommended to not disable the server certificate validation on the client!
Root cause While trying to negotiate a TLS handshake with the client, ISE expected to receive a non-empty TLS message or TLS alert message, but instead received an empty TLS message. This could be due to an inconformity in the implementation of the protocol between ISE and the supplicant. For example, it is a known issue that the XP supplicant sends an empty TLS message instead of a non-empty TLS alert message. It might also involve the supplicant not trusting the ISE server certificate for some reason. ISE treated the unexpected message as a sign that the client rejected the tunnel establishment.
I try to disable validate server certificates on Win XP Clients, but it won´t work for me.
Add ISE self-sign certificate to clients trusted root certification authorities and enable validate server certificates also won´t work.
Any idea?
thanks

The ISE use a self-signed certificate. I add this self-signed certificate to the clients "trusted root certification authorities", enable validate server certificates at the eap properties and select the added certificate from the trust list. But if I uncheck validate server certificates, I see the same error message as well.
Are there any differences between xp client config and win7 client config?
thanks,

Strange log entries (authentication fail) wth Home...

I was idly checking the event log on my Homehub 3B and noticed something odd (to me) under the GUI category. An extract from the log reads...
12:51:50,26 July. HTTP User admin login from 192.168.1.64 successfully.
12:28:26,26 July. HTTP User Basic login from 192.168.1.64 successfully.
13:51:09,25 July. HTTP authentication Fail from 118.113.54.xx
14:36:57,23 July. HTTP authentication Fail from 121.229.212.xxx
14:40:16,22 July. HTTP authentication Fail from 118.114.109.xxx
The successful logins are from myself, on the local network, i.e. http://bthomehub.home/ but what are those Fail messages? A quick check using a port-probing tool http://.grc.com/ shows that all my ports are stealthed so how can anyone be accessing the router and getting as far a receiving an authentification failure response?
Im not alarmed, particulalry, but just intensely curious. Anyone any ideas?

I was idly checking the event log on my Homehub 3B and noticed something odd (to me) under the GUI category. An extract from the log reads...
12:51:50,26 July. HTTP User admin login from 192.168.1.64 successfully.
12:28:26,26 July. HTTP User Basic login from 192.168.1.64 successfully.
13:51:09,25 July. HTTP authentication Fail from 118.113.54.xx
14:36:57,23 July. HTTP authentication Fail from 121.229.212.xxx
14:40:16,22 July. HTTP authentication Fail from 118.114.109.xxx
The successful logins are from myself, on the local network, i.e. http://bthomehub.home/ but what are those Fail messages? A quick check using a port-probing tool http://.grc.com/ shows that all my ports are stealthed so how can anyone be accessing the router and getting as far a receiving an authentification failure response?
Im not alarmed, particulalry, but just intensely curious. Anyone any ideas?

Everytime i log in to my youtube app on my ipod touch it says authentication failed incorrect password or username

everytime i log in to the youtube app on my ipod touch it says authentication failed incorrect password or username i even restored my ipod but it still didnt work

- Reset the iPod. Nothing will be lost
Reset iPod touch: Hold down the On/Off button and the Home button at the same time for at
least ten seconds, until the Apple logo appears.
- Power off and then back on the router.
- Reset networks settings: Settings>General>Reset>Reset Network Settings

Server log having multiple Kerberos Authentication failed events

I my windows server log i can see so many Kerberos Authentication failure Events, Could you please explain why this is happening and how to resolve this?

Hello Friend,
here is the log
Time of Day
Name
Source Country
Destination IP
Destination Country
Destination Port
Event Count
2014-12-10 09
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
2
2014-12-10 08
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
6
2014-12-10 08
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
2
2014-12-10 08
4771: Kerberos Pre-authentication Failed
N/A
Not Reported
N/A
Not Reported
2
2014-12-10 07
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
14
2014-12-10 07
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
1
2014-12-10 06
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
12
2014-12-10 06
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
2
2014-12-10 05
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
16
2014-12-10 05
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
1
2014-12-10 04
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
22
2014-12-10 03
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
8
2014-12-10 03
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
1
2014-12-10 02
4624: An Account Was Successfully Logged On
N/A
0.0.0.0
N/A
Not Reported
11
2014-12-10 02
4768: A Kerberos Authentication Ticket (tgt) Was Requested
N/A
Not Reported
N/A
Not Reported
4

Cannot access the Inbound Refinery Logs, authentication failed.

I installed the Inbound Refinery as a proxied server on the same computer of Content Server.
When I login Inbound Refinery using 'sysadmin' and try to access the "Logs-Refinery Logs", the authentication dialog appears.
I am sure that I input the right password for user sysadmin here, but the authentication dialog jumps out again and again until the authentication failed.
Who can tell me how to solve this problem? Your help will be very appreciated.

Hi
Well that is not possible since the logs are native to IBR and to access them you need to provide the refadmin access itself. But the other IBR access are with sysadmin since it is added as a proxy server to existing CS instance.
Srinath

ISE 1.2.1 logs full of Identity/Endpoint ID of 00:00:00:00:00:03, authentication failed

Similar Messages

Maybe you are looking for