ISE 1.2 not logging failed authentications on guest portal (CWA)

Hi there
I think this is a bug but wanted to check, if someone knows a good reason why failed authentication attemps with non-existing user account are not logged on ISE 1.2 (CWA).
The different cases:
Case 1: existing user / wrong password -> logged
Case 2: no user / any password -> logged
Case 3: no user / no password -> logged
Case 4: non-existing user / any password -> not logged
In my opinion this is a critical case to be logged because this could be an indicator of a DoS attack or a password penetration test.
Thanks in advance and best regards
Dominic

Hi vatullu
thanks man, you helped me a lot.
Regards
Dominic

Similar Messages

  • TMG not logging correct authentication

    Hello,
    I have rather a strange issue where I cant seem to find any logs on any of my servers including TMG. I can log in using AD credentials to various sites we have which rely on the same TMG servers and AD servers perfectly fine with all accounts. However when
    I have an account which the password is going to expire in a month (4 weeks) the users are unable to log in to the OWA site and get a message stating:
    "You could not be logged onto the Forefront TMG. Make sure that your domain name, user name, and password are correct, and then try again."
    However if I use the same credentials on one of the other sites the account works fine as the account is still active and has not yet expired. The users are in different physical locations and different OU's but on the same AD servers and TMG. The issue
    is not present with accounts which have had a recent password reset or are out of scope for a password expiration within a month. In other words if they have an expiry date longer than a month they can log in to OWA perfectly fine.
    The TMG will log traffic which is authenticated on OWA and I can see this on the IIS servers and DC's as well. However with the expiring account I see nothing on the TMG, IIS or DC's. The same thing happens if I fail authentication purposefully on a live
    account (one not expiring in the next 4 weeks). I am not sure where to go as I have no logs to look through so I cant see the issue to resolve it.The other sites which are working as published on the TMG as well which work find regardless of expiration date
    approaching.
    Does anyone else have this issue or any ideas on where to go?
    I hope this all makes sense.
    Thanks in advance
    James

    Hi,
    What's the version of your TMG? You could check the KB below.
    FIX: "You could not be logged on to Forefront TMG" error message when you try to log on to a published website after a domain name is not provided in the authentication settings for LDAP servers in the New Web Publishing Rule Wizard
    https://support.microsoft.com/kb/2579940?wa=wsignin1.0
    Best Regards,
    Joyce
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • ISE Guest portal CWA - Webauth exit button on Login Successful page not working (Safari and Chrome)

    Hello
    Has anyone else experienced the issue where this exit button works when IE is used to login to the ISE Guest portal, but not when Chrome is used. Same for Safari (from IPAD).
    Sent from Cisco Technical Support iPad App

    Google Chrome is not a fully supported browser  for use with the Administrative User Interface of the Identity Services Engine  (ISE), Version 1.1.3 and earlier.

  • ISE 1.1.1 - Guest Portal CWA - No username required, only AUP?

    We utilize a guest wireless NET that does not require a username/pass, rather, it only requires acceptance of the AUP. Is it possible to do this from ISE's CWA?
    Thanks, -b

    Do you have any links to describe these steps in detail? I have time today to build this out and test. At this point, in order to get to the "device registration" portal, I am still required to enter my username and password on the guest portal. I am not sure how to redirect directly to the device registration portal.
    Thanks,
    -b

  • Dynamic Authorization Failed - Posture with Guest Portal - ISE - WLC

    Hello everybody,
    I'm implementing a NAC solution based on Cisco ISE. Unfortunately, I'm facing a problem related to the CoA (Change of Authorization).
    The guest can authenticate successfully via portal and then he is redirected to the page of client provisioning.
    When he is compliant with the policy he gets access without any problem and this means that CoA works perfectly. The issue occurs when he has to remediate (download the file from ISE and install it). In this case, we need a change of authorization profile.
    The authentication logs show that the posture status changed from non-compliant to compliant but the users doesn't obtain access .
    Here are details :
    Authentication Details
    Source Timestamp
    2015-04-30 18:43:13.179
    Received Timestamp
    2015-04-30 18:43:13.18
    Policy Server
    ISE-CISCO
    Event
    5417 Dynamic Authorization failed
    Failure Reason
    11213 No response received from Network Access Device after sending a Dynamic Authorization request
    Resolution
    Check the connectivity between ISE and Network Access Device. Ensure that ISE is defined as Dynamic Authorization Client on Network Access Device and that CoA is supported on device.
    Root cause
    No response received from Network Access Device after sending a Dynamic Authorization request
    Username
    User Type
    Endpoint Id
    E0:9D:31:07:**:**
    Endpoint Profile
    IP Address
    Identity Store
    Identity Group
    Audit Session Id
    ca0019ac00000003ae674255
    Authentication Method
    Authentication Protocol
    Service Type
    Network Device
    WLC-1
    Device Type
    Location
    NAS IP Address
    172.25.0.202
    NAS Port Id
    NAS Port Type
    Authorization Profile
    Posture Status
    Compliant
    Security Group
    Response Time
    15002
    Other Attributes
    ConfigVersionId
    4
    RadiusPacketType
    CoARequest
    Event-Timestamp
    1430415778
    AcsSessionID
    50149c2f-08fb-4f9d-b1b5-f655e71d039f
    StepLatency
    3=15001
    Device IP Address
    172.25.0.202
    CiscoAVPair
    subscriber:command=reauthenticate
    audit-session-id
    ca0019ac00000003ae674255
    Session Events
    2015-04-30 18:43:13.18
    Dynamic Authorization failed
    2015-04-30 18:41:44.159
    Dynamic Authorization failed
    2015-04-30 18:35:42.64
    Guest Authentication Passed
    2015-04-30 18:34:39.214
    RADIUS Accounting start request

    You can use LWA for this . he WLC redirects  the HTTP traffic to an internal or external server where the user is prompted to  authenticate. The WLC then fetches the credentials (sent back via an HTTP GET  request in the case of external server) and makes a RADIUS authentication. In  the case of a guest user, an external server (such as Identity Service Engine  (ISE) or NAC Guest Server (NGS)) is required as the portal provides features  such as device registering and self-provisioning.
    Refer to the following link for  configuration  example
    http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bead09.shtml

  • ISE Wired guest portal redirect even after authentication

    Hi
    I have configured both Wired and Wireless guest authentication via guest portal. Wireless is working fine, however the when trying with Wired, the redireciton page is keep getting even after user authenticated.
    I'm not seen the redirection authorization policy in my logs however I can see only the user authentication logs (successful). Attached is my configuration and logging output.
    Here is what I see on the interface
    ABQT-3FLR-ACC-01#sh authentication sessions interface gigabitEthernet 4/0/19
                Interface:  GigabitEthernet4/0/19
              MAC Address:  a0b3.ccca.2ab1
               IP Address:  10.1.3.16
                User-Name:  A0-B3-CC-CA-2A-B1
                   Status:  Authz Success
                   Domain:  DATA
           Oper host mode:  multi-auth
         Oper control dir:  both
            Authorized By:  Authentication Server
              Vlan Policy:  N/A
         URL Redirect ACL:  ACL-WEBAUTH-REDIRECT
             URL Redirect:  https://xxxx-TW-ISE-2.xxx.xxx.qa:8443/guestportal/gateway?sessionId=AC14011F000001571E52779F&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC14011F000001571E52779F
          Acct Session ID:  0x00000309
                   Handle:  0xE6000158
    Runnable methods list:
           Method   State
           dot1x    Failed over
           mab      Authc Success
    Here is the ACL
    Extended IP access list ACL-WEBAUTH-REDIRECT
        10 deny udp any any eq domain (1344 matches)
        20 deny ip any host 172.20.5.12 (8122 matches)
        30 deny ip any host 172.20.5.14
        40 permit tcp any any eq www (3124 matches)
        50 permit tcp any any eq 443 (202927 matches)
        60 permit tcp any any eq 8080 (114 matches)
        70 permit ip any any (8056 matches)

    Hi Mohannad,
    Thanks for your response.
    Actually the as per the configuration it should work, I'm still trying to find out what is what has gone wrong with this configuration. Infact I have tested with 3560 switch with the same config and it worked. only difference here is we used 2960S switch.
    We need to find out why the next Auth policy is not hitting once user is authenticated.
    Here is the port configuration and the authen status of the port.
    ABQT-3FLR-ACC-01#sh running-config interface gig4/0/19
    Building configuration...
    Current configuration : 427 bytes
    interface GigabitEthernet4/0/19
    switchport access vlan 103
    switchport mode access
    switchport voice vlan 135
    authentication event fail action next-method
    authentication host-mode multi-auth
    authentication order dot1x mab
    authentication priority dot1x mab webauth
    authentication port-control auto
    authentication violation restrict
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 10
    spanning-tree portfast
    end
    ABQT-3FLR-ACC-01#
    Mar 31 12:32:14.127: %AAA-3-BADSERVERTYPEERROR: Cannot process accounting server type tacacs+ (UNKNOWN)
    ABQT-3FLR-ACC-01#
    ABQT-3FLR-ACC-01#sh atuh
    ABQT-3FLR-ACC-01#sh atu
    ABQT-3FLR-ACC-01#sh authe
    ABQT-3FLR-ACC-01#sh authentication se
    ABQT-3FLR-ACC-01#sh authentication sessions in
    ABQT-3FLR-ACC-01#sh authentication sessions interface gi
    ABQT-3FLR-ACC-01#sh authentication sessions interface gigabitEthernet 4/0/19
                Interface:  GigabitEthernet4/0/19
              MAC Address:  0015.c5b4.fd4a
               IP Address:  10.1.3.23
                User-Name:  00-15-C5-B4-FD-4A
                   Status:  Authz Success
                   Domain:  DATA
           Oper host mode:  multi-auth
         Oper control dir:  both
            Authorized By:  Authentication Server
              Vlan Policy:  N/A
         URL Redirect ACL:  ACL-WEBAUTH-REDIRECT
             URL Redirect:  https://ABQ-TW-ISE-2.abq.gov.qa:8443/guestportal/gateway?sessionId=AC14011F0000018A32B4D906&action=cwa
          Session timeout:  N/A
             Idle timeout:  N/A
        Common Session ID:  AC14011F0000018A32B4D906
          Acct Session ID:  0x00000394
                   Handle:  0x3E00018B
    Runnable methods list:
           Method   State
           dot1x    Failed over
           mab      Authc Success

  • Cisco ISE guest portal redirect not working after successful authentiation and URL redirect.

    Hi to all,
    I am having difficulties with an ISE deployment which I am scratching my head over and can't fathom out why this isn't working.
    I have an ISE 3315 doing a captive webportal for my guest users who are on an SSID.  The users are successfully redirected by the WLC to the following URL:https://x.x.x.x:8443/guestportal/Login.action?portalname=XXX_Guest_Portal
    Now when the user passes through the user authentication splash screen they get redirected to https://x.x.x.x:8443/guestportal/guest/redir.html and recieve the following error:
    Error: Resource not found.
    Resource: /guestportal/
    Does anyone have any ideas why the portal is doing this?
    Thanks
    Paul

    Hello,
    As you are not able to  get the guest portal, then you need to assure the following things:-
    1) Ensure that the  two  Cisco av-pairs that are configured on the  authorization profile should  exactly match the example below. (Note: Do  not replace the "IP" with the  actual Cisco ISE IP address.)
    –url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
    –url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also  defined on the access switch)
    2) Ensure that the URL redirection portion of the ACL have been  applied  to the session by entering the show epm session ip   command on the switch. (Where the session IP is the IP address  that is  passed to the client machine by the DHCP server.)
    Admission feature : DOT1X
    AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
    URL Redirect ACL : ACL-WEBAUTH-REDIRECT
    URL Redirect :
    https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
    0000A45A2444BFC2&action=cpp
    3) Ensure that the preposture assessment DACL that is enforced from  the  Cisco ISE authorization profile contains the following command  lines:
    remark Allow DHCP
    permit udp any eq bootpc any eq bootps
    remark Allow DNS
    permit udp any any eq domain
    remark ping
    permit icmp any any
    permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
    permit tcp any host 80.0.80.2 eq www --> Provides access to internet
    permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
    port
    permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8906 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    deny ip any any
    Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
    4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on  the switch as follows:
    ip access-list extended ACL-WEBAUTH-REDIRECT
    deny ip any host 80.0.80.2
    permit ip any any
    5) Ensure that the http and https servers are running on the switch:
    ip http server
    ip http secure-server
    6) Ensure that, if the client machine employs any kind of personal  firewall, it is disabled.
    7) Ensure that the client machine browser is not configured to use any  proxies.
    8) Verify connectivity between the client machine and the Cisco ISE IP  address.
    9) If Cisco ISE is deployed in a distributed environment, make sure  that  the client machines are aware of the Policy Service ISE node FQDN.
    10) Ensure that the Cisco ISE FQDN is resolved and reachable from the  client machine.
    11) Or you need to do re-image again.

  • ISE Guest Portal - Error Resource not found

    Hello,
    When I create a guest user through the sponsor portal, then try to login with this guest user through the Guest Portal, after I press login button, the following error message occurs and do not know what to do to solve.
    Error: Resource not found.
    Resource: /guestportal/
    None of the messages on the forum about it helped me to solve the problem.
    I am using ISE 1.1.3.124 and this is a new re-image appliance.
    Can anyone help?                  

    Hello,
    As you are not able to  get the guest portal, then you need to assure the following things:-
    1) Ensure that the  two  Cisco av-pairs that are configured on the authorization profile should  exactly match the example below. (Note: Do not replace the "IP" with the  actual Cisco ISE IP address.)
    –url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
    –url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also  defined on the access switch)
    2) Ensure that the URL redirection portion of the ACL have been applied  to the session by entering the show epm session ip   command on the switch. (Where the session IP is the IP address that is  passed to the client machine by the DHCP server.)
    Admission feature : DOT1X
    AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
    URL Redirect ACL : ACL-WEBAUTH-REDIRECT
    URL Redirect :
    https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
    0000A45A2444BFC2&action=cpp
    3) Ensure that the preposture assessment DACL that is enforced from the  Cisco ISE authorization profile contains the following command lines:
    remark Allow DHCP
    permit udp any eq bootpc any eq bootps
    remark Allow DNS
    permit udp any any eq domain
    remark ping
    permit icmp any any
    permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
    permit tcp any host 80.0.80.2 eq www --> Provides access to internet
    permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
    port
    permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8905 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    permit udp any host 80.0.80.2 eq 8906 --> This is for posture
    communication between NAC agent and ISE (Swiss ports)
    deny ip any any
    Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
    4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on  the switch as follows:
    ip access-list extended ACL-WEBAUTH-REDIRECT
    deny ip any host 80.0.80.2
    permit ip any any
    5) Ensure that the http and https servers are running on the switch:
    ip http server
    ip http secure-server
    6) Ensure that, if the client machine employs any kind of personal  firewall, it is disabled.
    7) Ensure that the client machine browser is not configured to use any  proxies.
    8) Verify connectivity between the client machine and the Cisco ISE IP  address.
    9) If Cisco ISE is deployed in a distributed environment, make sure that  the client machines are aware of the Policy Service ISE node FQDN.
    10) Ensure that the Cisco ISE FQDN is resolved and reachable from the  client machine.
    11) Or you need to do re-image again.

  • ISE 1.2.1 AD machine authent fails

    We put ISE into bypass mode due to the 2012 R2 issue and after upgrading to 1.2.1 in ISE, and taking it out of bypass. i am seeing machines fail due to either "supplicant stopped responding" or it fails saying not found in Identity Stores. The only thing that fixes it is an auth open on the port. at first they would report the MAC as the username instead of the Machine name. Now i see them reporting the machine name correctly but with a fail message of "supplicant stopped responding". TAC has said its a local machine problem or GPO but nothing has changed on either one of those, the only change was ISE. I did as he suggested, stop/started wired auto config, no change, also downloaded some hotfixes from MS for various EAP issues, no change.
    What ever info you need, let me know. i know this is a huge area to try to troubleshoot.

    Will need some more info:
    1. What type of authentication are you performing? (EAP-PEAP, EAP-TLS, etc?)
    2. Can you post screen shots with the supplicant's configuration
    3. Screen shots of the failed authentication detailed screen
    4. Screen shot or export of your authentication/authorization rules
    5. What is the status of ISE's connection to AD? I have seen it go to joined but disconnected after upgrade
    Thank you for rating helpful posts!

  • Can not log into server computer with any accounts - "You are unable to login to the user account "abcdefg" at this time. Logging in to the account failed because an error occurred."

    I have a Mac mini running the latest version of OS X and Server. Been running fine and flawlessly. However, I had a strange problem with the iCloud preferences panel crashing when I tried to access it, so I rebooted. Now I can not log into the system with any accounts. My master admin account (along with all the others) gives me the error:
    You are unable to login to the user account "abcdefg" at this time. Logging in to the account failed because an error occurred."
    I am able to see the server from other macs and I can log into it using the same account, but it only shows me a few of the shared folders I have access to but NOT to my main directories.
    Rebooting into Command-R and doing a disk utility, I try and repair permission on that drive and get a bunch of errors like:
    ACL found but not expected on Users
    Repaired "Users"
    ACL found but not expected on Users/.localized
    Repaired "Users/.localized"
    ACL found but not expected on Users/Shared
    Repaired "Users/shared"
    ACL found but not expected on Users/Shared/.localized
    Repaired "Users/Shared/.localized"
    Permissions repair complete.
    But rebooting is no joy...same problem. Any idea what is going on or how to repair it? Should I do a time machine restore? Complete new OS X install? Any idea what is causing this or how to salvage it?

    Got everything to re-install and it worked fine...for a few hours. Then I came in to find ALL of my network users deleted. Just GONE. Then found out the Open Directory was trashed and was unable to open, recover or restore from a backup. Looks like I may have a bad drive here.
    I installed a new drive in the system, re-installed and so far (for a couple of hours anyway) the system seems to be working and stable.

  • ISE wireless web authentication for guest management not redirecting

    Hi forumers'
    I face the problem that after connecting to the wireless guest network, it won't redirect me to the ISE guest portal . This happen on my iPhone. The iPhone is running on iOS 5.0.1
    Whilst on workstation it's working well.
    attach the snapshot of what happen on the iPhone.
    Any clue to torubleshoot? Thanks
    Noel

    Hi
    I still fail whilst i testing on my iPhone.
    I'm not using ISE self-signed certificate, i create CSR and signed by root CA server. So once i try to connect it won't prompt me the "accept ceritficate"
    My WLC local auth certificate verdor certificate is signed by the same root CA server as well.
    So i test on desktop to run safari broswer, it able to redirect to ISE guest portal.
    Can please suggest more troubleshooting guide?
    Thanks
    This is how the outcome for the safari broswer
    Noel

  • Safari for Windows will not log into IIS sites with Windows Authentication

    Safari for Windows will not log into IIS sites with Windows Authentication enabled. The IIS log has thousands of login attempts from Safari that result in 401 errors.
    I disable Windows Authentication on IIS and it works fine. The problem with that is that my Windows clients stop working properly with seemless logins when I disable this.
    The expected behavior is that Safari will work with basic authentication when NTLM does not work. That would result in a password prompt followed by a successful login instead of Safari stopping at "Loading" while hammering the IIS logs.
    It does this on all machines that I have tried.
    Any ideas or is this a bug?

    I noticed that as well. I have to wonder if it's due to not making note of the the different end of line characters between Mac OS X and Windows in code.

  • ISE Alarm at Failed Authentications per User

    Hi there!
    Is there a way to define an alarm for Failed authentications in a given time for a specific user in ISE 1.3?
    We have an alarm like this defined in ACS 5.3 but I can't find it in the ISE.
    Here is a picture of the definition in ACS:
    Can anyone help?

    Yes we can configure ISE alarms and send email notification as well

  • ISE v1.1 NAD 6500 failed to decrypt Key......

    Hello everyone ,
    I´ve implemented 2 Cisco ISE v1.1 in HA to run MAB and 802.x Authentication / Authorization. Using Local ISE DB and Active Directory as an External Identity Source for wireless and wired users and devices. This was working fine 2 weeks ago after finishing installation.
    My NAD devices are a Core SW 6500 for wired users (there are no access SW, just the Core for the whole network, its a small office) and a WLC 2405 for Wireless Users.
    Here is the network topology:
    DNSs are fully resolvable forward and reverse zone and  ISEs, AD, WLC and SW Core are synched with the same NTP server.
    As I mentioned Authentication and Authorization were working fine. Two weekends ago there was an electrical outage in the office. When the ISEs servers came up, the trust relationship between AD and ISEs was broken and so was HA replication. I did some troubleshoot to delete and install new certificates from AD into both ISEs and build again the HA configuration. I finally got the ISEs working fine again.
    This last weekend, another electrical outage occurs in the office (client is working with a temporary plant and is already warned about electrical damages not covered by warranty) and the ISE servers came up in the same condition again, no trust relationship with AD (Domain Controller). So I fix this again by deleting and installing new certificates into ISE. The problem is that for some reason the NAD 6500 is not authenticating to the ISE. I´m receiving the following debug messages in the SW:
    Sep 12 17:41:00.222: RADIUS(00000000): Request timed out
    Sep 12 17:41:00.222: RADIUS: Retransmit to (172.16.3.5:1812,1813) for id 1645/165
    Sep 12 17:41:00.222: RADIUS(00000000): Started 5 sec timeout
    Sep 12 17:41:00.226: RADIUS: Received from id 1645/165 172.16.3.5:1812, Access-Reject, len 20
    Sep 12 17:41:00.226: RADIUS:  authenticator 00 D5 B6 0B C9 49 83 81 - 87 17 23 82 2B 6A CB C7
    Sep 12 17:41:00.226: RADIUS: response-authenticator decrypt fail, pak len 20
    Sep 12 17:41:00.226: RADIUS: packet dump: 03A5001400D5B60BC9498381871723822B6ACBC7
    Sep 12 17:41:00.226: RADIUS: expected digest: BFAB772B5BA4B134F46E13A21F722317
    Sep 12 17:41:00.226: RADIUS: response authen: 00D5B60BC9498381871723822B6ACBC7
    Sep 12 17:41:00.226: RADIUS: request  authen: 41EAE3A7DAEE6332CE646436F949C5A1
    Sep 12 17:41:00.226: RADIUS: Response (165) failed decrypt
    Sep 12 17:41:05.110: RADIUS(00000000): Request timed out
    Sep 12 17:41:05.110: RADIUS: Retransmit to (172.16.3.5:1812,1813) for id 1645/165
    Sep 12 17:41:05.110: RADIUS(00000000): Started 5 sec timeout
    Sep 12 17:41:05.114: RADIUS: Received from id 1645/165 172.16.3.5:1812, Access-Reject, len 20
    Sep 12 17:41:05.114: RADIUS:  authenticator 00 D5 B6 0B C9 49 83 81 - 87 17 23 82 2B 6A CB C7
    Sep 12 17:41:05.114: RADIUS: response-authenticator decrypt fail, pak len 20
    Sep 12 17:41:05.114: RADIUS: packet dump: 03A5001400D5B60BC9498381871723822B6ACBC7
    Sep 12 17:41:05.114: RADIUS: expected digest: BFAB772B5BA4B134F46E13A21F722317
    Sep 12 17:41:05.114: RADIUS: response authen: 00D5B60BC9498381871723822B6ACBC7
    Sep 12 17:41:05.114: RADIUS: request  authen: 41EAE3A7DAEE6332CE646436F949C5A1
    Sep 12 17:41:05.114: RADIUS: Response (165) failed decrypt
    Sep 12 17:41:10.438: RADIUS(00000000): Request timed out
    Sep 12 17:41:10.438: RADIUS: No response from (172.16.3.5:1812,1813) for id 1645/165
    Sep 12 17:41:10.438: RADIUS/DECODE: parse response no app start; FAIL
    Sep 12 17:41:10.438: RADIUS/DECODE: parse response; FAIL
    Sep 12 17:41:13.682: %MAB-5-FAIL: Authentication failed for client (a44c.11ca.eadf) on Interface Gi1/29
    Sep 12 17:41:13.682: %AUTHMGR-7-RESULT: Authentication result 'server dead' from 'mab' for client (a44c.11ca.eadf) on Interface Gi1/29
    Sep 12 17:41:13.682: %AUTHMGR-5-FAIL: Authorization failed for client (a44c.11ca.eadf) on Interface Gi1/29
    Sep 12 17:41:00.222: RADIUS(00000000): Request timed out
    I have deleted and created again the 6500 NAD in the ISE, and configured againd the Radius-Key in the 6500 making sure they are exactly the same. But I keep receiving the same errors.
    I have already reviewed the following links:
    http://www.cisco.com/en/US/docs/wireless/access_point/12.3_7_JA/configuration/guide/s37err.html
    http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_logging.html#wp1061989
    http://puck.nether.net/pipermail/cisco-nas/2004-May/000686.html
    And the troubleshooting section from the Cisco Identity Services Engine User Guide, Release 1.0.4
    Everything points me that the Radius Key between ISE and the 6500SW is wrong, but I´ve configured it again twice and typed it letter by letter slowly to avoid any typos.
    ISE version: 1.1.0.665
    ADE OS: 2
    Active Directory: Windows 2008 R2 Standard
    6500 SW Config:
    Building configuration...
    Current configuration : 65413 bytes
    ! Last configuration change at 12:22:42 MXVeran Tue Jul 31 2012 by ho1a
    ! NVRAM config last updated at 22:21:11 MXVeran Mon Jul 30 2012 by ho1a
    version 15.0
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    service compress-config
    service counters max age 5
    boot-start-marker
    boot system flash bootdisk:
    boot-end-marker
    logging buffered 64000
    enable secret 5 $1$QoxK$w6sZJ66pXDMLS1lGPp3KR.
    username ho1a privilege 15 secret 5 $1$DYMo$O8BQi2u.emzdCFfNMxCTd.
    username test-radius password 7 14141B180F0B7B7977
    aaa new-model
    aaa authentication login Tr3s41ia.2012 local
    aaa authentication dot1x default group radius
    aaa authorization exec default local
    aaa authorization network default group radius
    aaa authorization auth-proxy default group radius
    aaa accounting update periodic 5
    aaa accounting dot1x default start-stop group radius
    aaa accounting system default start-stop group radius
    aaa server radius dynamic-author
    client 172.16.3.5 server-key 7 110A1016141D5A5E57
    aaa session-id common
    platform ip cef load-sharing ip-only
    platform rate-limit layer2 port-security pkt 300 burst 10
    clock timezone MXInv -6
    clock summer-time MXVerano recurring
    authentication critical recovery delay 1000
    interface GigabitEthernet8/1
    switchport
    switchport access vlan 2
    switchport mode access
    ip access-group ACL_ISE_Default in
    authentication host-mode multi-auth
    authentication open
    authentication order mab dot1x
    authentication priority dot1x mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    mab
    dot1x pae authenticator
    spanning-tree portfast edge
    ip default-gateway 172.16.3.2
    ip forward-protocol nd
    ip http server
    ip http secure-server
    ip route 0.0.0.0 0.0.0.0 172.16.3.2
    ip radius source-interface Vlan3 vrf default
    logging origin-id ip
    logging source-interface Vlan3
    logging host 172.16.3.5 transport udp port 20514
    snmp-server group Tr3s41ia.2012aes v3 priv
    snmp-server group Tr3s41ia.2012md5 v3 auth
    snmp-server community public RO
    snmp-server community tresaliarw RW
    snmp-server community tresaliaro RO
    snmp-server trap-source Vlan3
    snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
    snmp-server enable traps memory bufferpeak
    no snmp-server enable traps entity-sensor threshold
    snmp-server enable traps cpu threshold
    snmp-server enable traps vtp
    snmp-server enable traps flash insertion removal
    snmp-server enable traps mac-notification move change
    snmp-server enable traps errdisable
    snmp-server host 172.16.3.4 version 3 priv Tr3s41ia.2012aes
    snmp-server host 172.16.3.4 version 3 auth Tr3s41ia.2012md5
    snmp-server host 172.16.3.5 version 2c tresaliaro
    radius-server attribute 6 on-for-login-auth
    radius-server attribute 8 include-in-access-req
    radius-server attribute 25 access-request include
    radius-server dead-criteria time 30 tries 3
    radius-server host 172.16.3.5 auth-port 1812 acct-port 1813 test username test-radius key 7 104D000A061843595F
    radius-server vsa send accounting
    radius-server vsa send authentication
    control-plane
    service-policy input policy-default-autocopp
    line con 0
    logging synchronous
    login authentication Tr3s41ia.2012
    line aux 0
    line vty 0 4
    login authentication defaulTr3s41ia.2012
    transport input ssh
    line vty 5 1509
    login authentication defaulTr3s41ia.2012
    transport input ssh
    ntp clock-period 17179836
    ntp peer 172.16.4.9
    no event manager policy Mandatory.go_switchbus.tcl type system
    end
    Additionaly, I´m getting the following screen when accesing the Stand-by server via https:
    I´m thinking that there might be some problems with the CA Certificates installed on ISEs, or some corrupted data due to the 2 sudden restarts.
    Any help, hint or direction will be really appreciated.
    Thanks in advanced for your time. Best Regards.

    Hello Tarik, thanks for your response,
    I´ll go ahead and remove and configure again the complete radius configuration on the SW and let you know what happens, if this doesn´t work I´m thinking that re-installing the ISE server might be the solution. It´s was working fine after the fresh install.
    I use the command "test aaa group radius username password new-code" to test SW communication to ISE and here is the debug output from the SW:
    Sep 12 20:42:59.713: RADIUS/ENCODE(00000000):Orig. component type = INVALID
    Sep 12 20:42:59.713: RADIUS(00000000): Config NAS IP: 172.16.3.1
    Sep 12 20:42:59.713: RADIUS(00000000): sending
    Sep 12 20:42:59.713: RADIUS(00000000): Send Access-Request to 172.16.3.5:1812 id 1645/93, len 56
    Sep 12 20:42:59.713: RADIUS:  authenticator 24 52 30 41 B7 06 74 CE - C7 4B 7B FF 87 88 F7 23
    Sep 12 20:42:59.713: RADIUS:  User-Password       [2]   18  *
    Sep 12 20:42:59.713: RADIUS:  User-Name           [1]   6   test
    Sep 12 20:42:59.713: RADIUS:  Service-Type        [6]   6   Login                     [1]
    Sep 12 20:42:59.713: RADIUS:  NAS-IP-Address      [4]   6   172.16.3.1               
    Sep 12 20:42:59.713: RADIUS(00000000): Started 5 sec timeout
    Sep 12 20:43:14.485: RADIUS(00000000): Started 5 sec timeout
    Sep 12 20:43:14.489: RADIUS: Received from id 1645/93 172.16.3.5:1812, Access-Reject, len 20
    Sep 12 20:43:14.489: RADIUS:  authenticator B2 89 18 4B F5 D8 D6 67 - 85 4D 1E C3 DE C9 06 85
    Sep 12 20:43:14.489: RADIUS: response-authenticator decrypt fail, pak len 20
    Sep 12 20:43:14.489: RADIUS: packet dump: 035D0014B289184BF5D8D667854D1EC3DEC90685
    Sep 12 20:43:14.489: RADIUS: expected digest: EDB6C64ADA12BCD81CD21C3EF28CDB27
    Sep 12 20:43:14.489: RADIUS: response authen: B289184BF5D8D667854D1EC3DEC90685
    Sep 12 20:43:14.489: RADIUS: request  authen: 24523041B70674CEC74B7BFF8788F723
    Sep 12 20:43:14.489: RADIUS: Response (93) failed decryptUser rejected
    And here are the results from the Operations/Authentications Tabe from ISE:
    There are no other SWs in the network, just the Core. I cannot test Wireless Authentication since the AccessPoint Switchport is also controlled by ISE and is not Authenticated right now. I can Authenticate the Active Directory Users using NTRadPing tool as a test and its succesful. AD and 6500 SW are using the same Radius key to communicate with ISE. Here is the AD usert Authentication:
    So I´ll proceed to re-configure the SW for Radius server and let you know if this is the solution.
    Thanks in advanced for your time and comments.

  • ISE 1.1 EAP-TLS User Authentication in Multiforest

    Hello,
    we are currently evaluating the ISE 1.1 in a multiforest environment and we have problems to authenticate users which based in other domains (domain2) then the ISE (domain) is based.
    This is the setup:
    In domain1 is a MSFT CA with OCSP, DC and ISE
    In domain2 is a DC and the users
    there is a two way trust between the domains.
    This is my authentication scenario:
    1. agent connect to a wireless network (ok)
    2. client exchanges certificate information with ISE (ok)
    3. ISE exchanges certificate status with CA (ok)
    4. ISE extracts the subject Alternative Name from the certificate [email protected] (ok)
    5. ISE queries Active Directory store for the user  [email protected] (not ok fails with  22056 Subject not found)
    in the log i can see the other forest (domain2) is not even queried to retrieve user data only domain1.
    I could query the other domain during AD setup and was able to add groups from the other domain bet i could retrieve attributes of the user in domain2.
    Any Ideas?
    Regards
    Alex
    Extract from Log File
    DEBUG <fd:34 CAPIGetObjectByName > daemon.ipcclient2 executing request 'CAPIGetObjectByName' in thread 2951601040
    DIAG  <fd:34 CAPIGetObjectByName > daemon.ipcclient2 doCAPIGetObjectByName: category=Person
    [email protected]
    options=2
    DEBUG <fd:34 CAPIGetObjectByName > dns.findsrv FindSrvFromDns(0): _kerberos._tcp.domain2.ch
    DEBUG <fd:34 CAPIGetObjectByName > base.adagent.domaininfo rejecting domain domain2.ch.  Blocked, not in DNS or our domain list
    DEBUG <fd:34 CAPIGetObjectByName > base.adagent findObject ADNames:
    [email protected]#012name
    [email protected]
    type=SAM domain=domain1.LAN#012
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(
    [email protected]
    )), attrs 7e638646 (cacheOps=40f, GC=0)
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper age 6, expire age 60, cutoff time 0, refresh 15, negative=true, cacheOps 40f
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper.ad Cache expired 96fe94aa2a7249bca2f59766075e7859, CN=SearchMark,CN=CENTRIFY MARKER,DC=domain1,DC=LAN
    DIAG  <fd:34 CAPIGetObjectByName > base.bind.ldap 10.0.128.10:389 search base="DC=domain1,DC=lan" filter="(&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(
    [email protected]
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search: refresh list returns 0 objects
    DEBUG <fd:34 CAPIGetObjectByName > base.cache Cache store <GUID=96fe94aa2a7249bca2f59766075e7859>;CN=SearchMark,CN=CENTRIFY MARKER,DC=domain1,DC=LAN : update indexes No
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(
    [email protected]
    )), attrs e4a3aa15 (cacheOps=40f, GC=1)
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper age 6, expire age 3600, cutoff time 0, refresh 15, negative=true, cacheOps 40f
    DIAG  <fd:34 CAPIGetObjectByName > base.bind.ldap 10.0.128.9:3268 search base="" filter="(&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(
    [email protected]
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search: refresh list returns 0 objects
    DEBUG <fd:34 CAPIGetObjectByName > base.cache Cache store <GUID=7c68c59bc09f4775a14d6a7f521e491c>;CN=SearchMark,CN=CENTRIFY MARKER,DC=$ : update indexes No
    DEBUG <fd:34 CAPIGetObjectByName > base.adagent findObject: NotFound:[email protected] Category:user
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache making negative response for Person userPrincipalName="
    [email protected]
    " (GC=0)
    DEBUG <fd:34 CAPIGetObjectByName > base.cache Cache store <GUID=972f489502d74f49afdef7f38206e909>;CN=CENTRIFY NEGATIVE RESPONSE,CN=Person,DC=domain1,DC=LAN : update indexes Yes
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper
    '[email protected]'
    is not a canonical name
    DEBUG <fd:34 CAPIGetObjectByName > daemon.ipcclient2 request 'CAPIGetObjectByName' complete DEBUG <fd:34 CAPIGetObjectByName > daemon.ipcclient2 executing request 'CAPIGetObjectByName' in thread 2951601040
    DIAG  <fd:34 CAPIGetObjectByName > daemon.ipcclient2 doCAPIGetObjectByName: category=Person [email protected] options=2
    DEBUG <fd:34 CAPIGetObjectByName > dns.findsrv FindSrvFromDns(0): _kerberos._tcp.domain2.ch
    DEBUG <fd:34 CAPIGetObjectByName > base.adagent.domaininfo rejecting domain domain2.ch.  Blocked, not in DNS or our domain list
    DEBUG <fd:34 CAPIGetObjectByName > base.adagent findObject ADNames: [email protected]#012name: [email protected] type=SAM domain=domain1.LAN#012
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))([email protected])), attrs 7e638646 (cacheOps=40f, GC=0)
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper age 6, expire age 60, cutoff time 0, refresh 15, negative=true, cacheOps 40f
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper.ad Cache expired 96fe94aa2a7249bca2f59766075e7859, CN=SearchMark,CN=CENTRIFY MARKER,DC=domain1,DC=LAN
    DIAG  <fd:34 CAPIGetObjectByName > base.bind.ldap 10.0.128.10:389 search base="DC=domain1,DC=lan" filter="(&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))([email protected]))"
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search: refresh list returns 0 objects
    DEBUG <fd:34 CAPIGetObjectByName > base.cache Cache store <GUID=96fe94aa2a7249bca2f59766075e7859>;CN=SearchMark,CN=CENTRIFY MARKER,DC=domain1,DC=LAN : update indexes No
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))([email protected])), attrs e4a3aa15 (cacheOps=40f, GC=1)
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper age 6, expire age 3600, cutoff time 0, refresh 15, negative=true, cacheOps 40f
    DIAG  <fd:34 CAPIGetObjectByName > base.bind.ldap 10.0.128.9:3268 search base="" filter="(&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))([email protected]))"
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache ADCB::search: refresh list returns 0 objects
    DEBUG <fd:34 CAPIGetObjectByName > base.cache Cache store <GUID=7c68c59bc09f4775a14d6a7f521e491c>;CN=SearchMark,CN=CENTRIFY MARKER,DC=$ : update indexes No
    DEBUG <fd:34 CAPIGetObjectByName > base.adagent findObject: NotFound:[email protected] Category:user
    DEBUG <fd:34 CAPIGetObjectByName > base.bind.cache making negative response for Person userPrincipalName="[email protected]" (GC=0)
    DEBUG <fd:34 CAPIGetObjectByName > base.cache Cache store <GUID=972f489502d74f49afdef7f38206e909>;CN=CENTRIFY NEGATIVE RESPONSE,CN=Person,DC=domain1,DC=LAN : update indexes Yes
    DEBUG <fd:34 CAPIGetObjectByName > base.objecthelper '[email protected]' is not a canonical name
    DEBUG <fd:34 CAPIGetObjectByName > daemon.ipcclient2 request 'CAPIGetObjectByName' complete

    Tarik,
    from the ISE cli i can nslookup domain2.lan and i get this result
    nos-ch-wbn-ise1/admin# nslookup domain2.lan
    Trying "domain2.lan"
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57373
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 16, AUTHORITY: 0, ADDITIONAL: 5
    ;; QUESTION SECTION:
    ;domain2.lan.              IN      ANY
    ;; ANSWER SECTION:
    domain2.lan.       600     IN      A       192.168.68.21
    domain2.lan.       600     IN      A       172.28.1.3
    domain2.lan.       600     IN      A       172.28.1.2
    domain2.lan.       600     IN      A       192.168.68.20
    domain2.lan.       3600    IN      NS      labdc01.lab.lan.
    domain2.lan.       3600    IN      NS      labdc02.lab.lan.
    domain2.lan.       3600    IN      NS      labex01.lab.lan.
    domain2.lan.       3600    IN      NS      bsdehepdc01.domain2.lan.
    domain2.lan.       3600    IN      NS      bsdehepfs01.domain2.lan.
    domain2.lan.       3600    IN      NS      mordor.softlink.ch.
    domain2.lan.       3600    IN      NS      shire.softlink.ch.
    domain2.lan.       3600    IN      NS      labex02.lab.lan.
    domain2.lan.       3600    IN      NS      icm60.icm60domain.lan.
    domain2.lan.       3600    IN      NS      bsfs02.domain2.lan.
    domain2.lan.       3600    IN      NS      bsfs03.domain2.lan.
    domain2.lan.       3600    IN      SOA     bsfs02.domain2.lan. admin.domain2.lan. 217091 900 600 86400 3600
    ;; ADDITIONAL SECTION:
    labdc01.lab.lan.        3600    IN      A       172.28.2.196
    bsdehepdc01.domain2.lan. 311 IN    A       192.168.68.20
    bsdehepfs01.domain2.lan. 2771 IN   A       192.168.68.21
    bsfs02.domain2.lan. 1649   IN      A       172.28.1.2
    bsfs03.domain2.lan. 595    IN      A       172.28.1.3
    So i assume dns is working fine.
    Do i have to see the GC of the trusted domain as well in the ISE Active Directory Configuration ?
    thanks & regards
    Alex

Maybe you are looking for

  • Null but not null Document on UNIX - URGENT

    Hi, I hope someone can help me. I am using a simple DOMParser to read an xml file in. Now once I have this object I want to parse values out of it. Now on Windows this works fine. On UNIX I am getting something wierd. For instance: If I call: if(theD

  • Problem with serial number reinstalling Acrobat

    I purchased CS6 a few month ago, including Photoshop, Acrobat etc., which used to work fine. A few days ago, I had to reinstall Acrobat (starting with my CD Rom). Since then, Photoshop etc. work normally, but Acrobat keeps on asking me for my serial

  • Dell GX790 Imaging Problem

    We are running Zenworks 10.2 and have not updated due to having over 1200 pc`s on the system and cannot afford to have connection issues as this is our main method of imaging and remote access support. However we may now need to look into updates as

  • Will be the NVIDIA GeForce 620M graphic card be compatible with any of Adobe Premiere series?

    Recently I adquired the GeForce 620M graphic card, trying to resolve a problem with my Adobe Premiere Pro CS4 software (Premiere suddenly stopped working, and the only problem was the graphic card, the NVIDIA GeForce 210 series I used to have). In or

  • Has anybody used the WInterface for "on top" functionality successfully?

    Dear Everyone, This is a question for anybody who has used the WInterface classes and .dll file. I have downloaded the WInterface.zip file and have extracted it. I have also used the provided classes (particularly WInterface.java) and placed the .dll