5/16/2023 Cisco Identity Services Engine

Steps
Overview

11001 Received RADIUS Access-Request

5434 Endpoint conducted several failed authentications of
Event
the same scenario 11017 RADIUS created a new session
15049 Evaluating Policy Group
Username DF\avasquez
15008 Evaluating Service Selection Policy
Endpoint Id 78:AF:08:6B:83:16
15048 Queried PIP
Endpoint Profile 11507 Extracted EAP-Response/Identity
Prepared EAP-Request proposing EA
Authentication Policy Wireless - Dot1X 12500
challenge
Authorization Policy Wireless - Dot1X 12625 Valid EAP-Key-Name attribute receiv
11006 Returned RADIUS Access-Challenge
Authorization Result
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing sess
Authentication Details Extracted EAP-Response/NAK reque
12301
instead
Source Timestamp 2023-05-16 11:03:05.919
12300 Prepared EAP-Request proposing P
Received Timestamp 2023-05-16 11:03:05.919 12625 Valid EAP-Key-Name attribute receiv
11006 Returned RADIUS Access-Challenge
Policy Server isedfgye01
11001 Received RADIUS Access-Request
5434 Endpoint conducted several failed authentications of the
Event 11018 RADIUS is re-using an existing sess
same scenario
Extracted EAP-Response containing
12302
12511 Unexpectedly received TLS alert message; treating as a response and accepting PEAP as ne
Failure Reason
rejection by the client
12318 Successfully negotiated PEAP versio
Ensure that the ISE server certificate is trusted by the client, by 12800 Extracted first TLS record; TLS hand
configuring the supplicant with the CA certificate that signed
Resolution 12805 Extracted TLS ClientHello message
the ISE server certificate. It is strongly recommended to not
disable the server certificate validation on the client! 12806 Prepared TLS ServerHello message
12807 Prepared TLS Certificate message
While trying to negotiate a TLS handshake with the client, ISE
received an unexpected TLS alert message. This might be due 12808 Prepared TLS ServerKeyExchange m
Root cause to the supplicant not trusting the ISE server certificate for some
12810 Prepared TLS ServerDone message
reason. ISE treated the unexpected message as a sign that the
client rejected the tunnel establishment. 12305 Prepared EAP-Request with another
11006 Returned RADIUS Access-Challenge
Username DF\avasquez
11001 Received RADIUS Access-Request
Endpoint Id 78:AF:08:6B:83:16
11018 RADIUS is re-using an existing sess
Audit Session Id 05D0A8C00000520C254C23FE Extracted EAP-Response containing
12304
response
Authentication Method dot1x
12305 Prepared EAP-Request with another
Authentication Protocol PEAP 11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
Service Type Framed
11018 RADIUS is re-using an existing sess
Network Device WLCSRV
Extracted EAP-Response containing
12304
response
Device Type All Device Types#Wireless_1
12305 Prepared EAP-Request with another
Location All Locations#DATAFAST#GUAYAQUIL
11006 Returned RADIUS Access-Challenge
NAS IPv4 Address 192.168.208.5 11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing sess
NAS Port Id capwap_9000001d
Extracted EAP-Response containing
12304
NAS Port Type Wireless - IEEE 802.11 response
12318 Successfully negotiated PEAP versio
Response Time 36 milliseconds
12810 Prepared TLS ServerDone message
12812 Extracted TLS ClientKeyExchange m

https://192.168.1.60/admin/liveAuthenticationDetail.do 1/3
5/16/2023 Cisco Identity Services Engine
Other Attributes 12803 Extracted TLS ChangeCipherSpec m
12804 Extracted TLS Finished message
ConfigVersionId 11
12801 Prepared TLS ChangeCipherSpec m
Device Port 59319 12802 Prepared TLS Finished message

DestinationPort 1812 12816 TLS handshake succeeded

12310 PEAP full handshake finished succes
RadiusPacketType AccessRequest
Tunnel build with local server certific
12832
UserName DF\avasquez or it has already expired
12305 Prepared EAP-Request with another
Protocol Radius
11006 Returned RADIUS Access-Challenge
NAS-IP-Address 192.168.208.5 11001 Received RADIUS Access-Request

NAS-Port 30013 11018 RADIUS is re-using an existing sess

Extracted EAP-Response containing
Framed-MTU 1005 12304
response

37CPMSessionID=05D0A8C00000520C254C23FE;38Session Unexpectedly received TLS alert me

State 12511
ID=isedfgye01/472688405/2756984; rejection by the client
61025 Open secure connection with TLS pe
undefined-186 00:0f:ac:04
11504 Prepared EAP-Failure
undefined-187 00:0f:ac:04 11003 Returned RADIUS Access-Reject

undefined-188 00:0f:ac:01 Endpoint conducted several failed au

5434
same scenario
Airespace-Wlan-Id 3

IsEndpointInRejectMode false

NetworkDeviceProfileName Cisco

NetworkDeviceProfileId 403ea8fc-7a27-41c3-80bb-27964031a08d

IsThirdPartyDeviceFlow false

RadiusFlowType Wireless802_1x

SSID 1c-fc-17-98-69-20:DF-EMPLEADOS

AcsSessionID isedfgye01/472688405/2756984

CPMSessionID 05D0A8C00000520C254C23FE

EndPointMACAddress 78-AF-08-6B-83-16

ISEPolicySetName Wireless - Dot1X

StepData 4= Normalised Radius.RadiusFlowType

TLSCipher ECDHE-RSA-AES256-GCM-SHA384

TLSVersion TLSv1.2

DTLSSupport Unknown

Model Name VIRTUAL-WLC

Network Device Profile Cisco

Location Location#All Locations#DATAFAST#GUAYAQUIL

Device Type Device Type#All Device Types#Wireless_1

Called-Station-ID 1c-fc-17-98-69-20:DF-EMPLEADOS

CiscoAVPair service-type=Framed

audit-session-id 05D0A8C00000520C254C23FE

method dot1x

client-iif-id 2634028925

https://192.168.1.60/admin/liveAuthenticationDetail.do 2/3
5/16/2023 Cisco Identity Services Engine

vlan-id 210

cisco-wlan-ssid DF-EMPLEADOS

wlan-profile-name DF-EMPLEADOS

Result

RadiusPacketType AccessReject

Session Events

https://192.168.1.60/admin/liveAuthenticationDetail.do 3/3