MS Switch Is Unable to Relay 802.1x to Cisco ISE

[fatanu]

Issue:

We have an endpoint with a PEAP Ethernet profile connected to port 5 on a Meraki switch. We have also configured the 802.1X access policy on the Meraki switch and applied it to port 5.

When testing the RADIUS server from the switch, it successfully reaches the ISE, and logs are visible in ISE.

The endpoint is sending EAPOL Start and EAPOL packets to the switch, but the switch is not relaying the RADIUS packets to ISE.

Additional Context:

At first I thought it was the windows supplicant issue (as I have read some people had issue with Windows 11). I configured dot1x on a cisco catalyst switch, and I connected the same system to it. It immediately got connected and i can see the log in ISE. Then I ruled out windows as the issue, and norrowed it down to Meraki switch issue. I did packet capture on the port on the meraki switch the system is connected and I can see the endpoint is starting EAPOL and sending EAP packet, the switch is not just relaying it to ISE.

I am having this issue with Meraki MS210 switch and as well as MS 225 switch. Raidus test from the switch to the ISE is visible from ISE logs but I am not see any logs for devices connected to ports that the access policy is applied to. Also, MAB is working on the port, but 802.1x is not working. Is there anything I am missing? This is driving me crazy. Please help out, this is a cry for help!!!

[Mloraditch]

I'm not sure if you have two accounts or a coworker but my reply here is a likely issue: https://community.meraki.com/t5/Switching/My-Switch-MS225-is-not-relying-the-EAP-radius-requests-to-...

[fatanu]

oh...its a colleague...we decided to post it differently, we have been stuck on this issue for days....thanks for the quick response

[fatanu]

That did not fix the issue....I still can't see log in ISE

[Mloraditch]

Try temporarily setting your policy to something other than multi domain and then 802.1x only to see if it works then. If it doesn't you might have an issue like @PhilipDAth mentioned. If it doesn't you might have an issue support needs to look at.

[alemabrahao]

You can review the required settings here:

https://community.cisco.com/t5/security-knowledge-base/how-to-integrate-meraki-networks-with-ise/ta-...

[PhilipDAth]

Are you doing certificate authentication?  If so, the packets might be bigger than the MTU and getting dropped.  If so, try adding Framed-MTU to ISE with a smaller value (e,g. 1300).

[fatanu]

No, I'm using PEAP with MSCHAPv2. It only showing attempting to authenticate without prompting to login. All I just need is a log in ISE, then I can say the switch is relaying the connection authentication attempt to ISE. But, ISE is not seeing anything, and when you do radius test from the switch to ISE, I can see the log. The two switches show it supports 802.1x so I'm wondering what the issue are. MAB is working, just 802.1x is what I am having issue with. Its weird two different switches MS210 and MS225 are having the same issue. 

[PhilipDAth]

It may simply be that your client is not attempting 802.1x.

[PhilipDAth]

If this is for Windows machines, have you enabled the "Wired AutoConfig" service?

[fatanu]

@PhilipDAth Yes, wired autoconfig is enabled. WHen this client is connected to another cisco switch (catalyst) not meraki, it is able to authenticate and connected. So, that ruled out that the issue is from the client. It is a Meraki issue. We have tried different options, single host, mult-domain, multi-auth etc....same issue.

[Mloraditch]

Have you tried those modes with 802.1x only instead of Hybrid? If that works and switching back to hybrid doesn't I'd be calling support and if it doesn't work at all in that mode I'd also be calling support. With your various tests with your Catalyst switches you have plenty of proof it should work and is down to something the Meraki isn't doing properly.

[PhilipDAth]

Does anything appear in the Meraki event switch log?

[fatanu]

only message like "802.1x Canned EAP Success" ...something like that. 

[fatanu]

I'm curious whether anyone has successfully gotten wired 802.1x to work on Meraki switches. Everything is working find with the wireless so far, but no single success yet for wired 802.1x. We are not doing anything with certificate , so EAP TLS is out of the picture. But we tried PEAP and TEAP no luck

[PhilipDAth]

I have done lots of wired 802.1x deployments using Meraki switches.  No issue.

All my deployments use Microsoft NPS.  I don't do MAB (no hybrid).  They all do certificate authentication (EAP-TLS).

[Mloraditch]

We have 5 or so larger (to me) installs, although we use EAP-TLS with ISE. We do use Hybrid. All working fine.

[fatanu]

Maybe Meraki switches does not support PEAP..because ours is PEAP MSCHAPv2, and I have tried with two different switch model, MS210 and MS225...same result. ISE is not getting log at all. Do you mind sharing your access policy config to see what we are doing differently. this is a real big issue and blocker to moving past this POC, so it's giving me sleepless night. what meraki switches have you configured it with? 

[Mloraditch]

If you are having sleepless nights I really urge you to get on the phone with support. We are all trying to help you, but they can actually see your network and access backend data that we cannot. I can tell you my primary access policy looks just like yours.

[PhilipDAth]

>Maybe Meraki switches does not support PEAP

Meraki has no knowledge of the internal authentication protocol in use.  That is between the switch and the RADIUS server.

[fatanu]

I said this because, Meraki is not even relaying the packet to ISE. It's just a weird issue, because there are no so many things to fill in the access policy page that I might have missed something. 

[PhilipDAth]

My deployments have mostly been on MS120s and MS225s.

[PhilipDAth]

Have you considered contracting in a Cisco partner to help you with this?  It might be quite quick for them to fix ...

[fatanu]

Not yet, still exploring if anyone had experienced the issue, that is why I posted it here for solution.

[ww]

Did you also make a packet capture on the same switch (uplink) port where the packet should leave to verify  there is no radius traffic send to the server

[fatanu]

I just did two packet captures use cases on the uplink:

1) When the endpoint connected to the port with 802.1x policy is attempting authentication. The packet capture shows it is not sending any radius access-request out the uplink. This confirms why the ISE is not showing any log.

2) When i did radius connectivity test on the policy from the switch to ISE. I can see radius access-request packet going out of the uplink. This confirms why I am getting logs in ISE. 

So ultimately it's a switch problem. I have done exact access policy configuration from their documentation, so I am not sure what else to do again. If anyone can share a working access policy config, I will appreciate it. Thanks!

[Mloraditch]

Please contact support. I realize this is frustrating but your policies look right. They usually answer within moments. You don't have to wait for an engineer like regular TAC.

[RaphaelL]

Also "increase access speed" is never a good idea. 

[fatanu]

Yes...I removed it.

[fatanu · Accepted solution]

Thank you everyone that responded to me and offered help. It was a bug in the firmware. I raised a case with Cisco support and got on a troubleshooting call with them. We rolled back the firmware from 17.1.4 to 16.9 and tested it, everything works fine and now the switch is relaying the radius request to the Radius server. The case has now been submitted to their development team and they can reproduce the scenario to test. For now, I will continue to use 16.9 which is working. Thanks everyone!

[CarolineS]

Thank you for the follow-up, @fatanu ! I'm going to mark your reply as the "solution" for the benefit of folks who visit this thread in the future.

Cheers!