12511 suddenly received alert TLS; treat it as a rejection by the customer

ISE Version: 1.2.0.899 (running in VMware)

WLC: 5508 worm 7.6.100.0

I have a created WLAN using the dot1x authentication. The WLAN points at ISE for RADIUS AAA. I can't get any windows computer connect (7, 8 or 8.1 tested), but android, ios, and osx are all able to connect. I have a 3rd cert of party (GoDaddy) installed in my local store at ISE, which is valid and not expired. I do not understand why windows machines fail.

I'm migrating to this new ISE server and my old ISE server has the same configuration (AFAIK) for this WLAN key and it works for all devices, including windows. The difference is that it is on a different domain (the reason for migration is we've changed areas).

Here the ISE error:

Event: 5400 authentication failed

Reason for the failure: 12511 suddenly received alert TLS; treat it as a rejection by the customer

Resolution: Ensure that the ISE server certificate is approved by the customer, by configuring the supplicant with the CA that signed the certificate of ISE server. It is strongly recommended that you not turn off the server on the client certificate validation!

Root cause: while trying to negotiate a TLS negotiation with the customer, ISE has received an unexpected alert message of TLS. This could be due to begging her not to trust the certificate of the ISE server for some reason any. ISE has processed the unexpected message as a sign that the client has rejected the creation of tunnel.

Here is the error WLC:

Authentication failure AAA for UserName:Domain\User user Type: USER WLAN

Here's the windows event viewer error:

Source: Microsoft-Windows-security-auditing
Event ID: 5632

Description:
A request has been made to authenticate on a wireless network.

Object:
Security ID: NULL
Account name: user
Account domain: domain

Network information:
Name (SSID): IT-Test

Additional information:
Reason code: Eap explicit received failed (0 x 50005)
Error code: 0 x 80420014
EAP reason code: 0 x 80420100
EAP Root Cause string: user certificate failed\nThe of network authentication required for the network was not found on this computer.

EAP error code: 0 x 80420014

On the ISE server that works, you are presented with a window asking you to connect or terminate based on the certificate is not validated. I don't know why that is not happening with this new ISE server, it fails just without inviting the user to connect or terminate. Two certificates are of GoDaddy.

A difference between the certificates, is the former has a cert that was generated through ISE and the new server has a generic cert imported.

In any case, I hope this is enough information to understand the issue. I appreciate the time everyone takes to help me with this problem. I install a copy of the WLAN so that I can test the need and not have to wait for a maintenance window.

Some endpoint devices (Windows OS) have problems with generic cert when CN contains * (start) as wildcard
>
> PEAP authentication fails due to "12511 received unexpectedly alert TLS; treat it as a rejection by the customer.
>

> Conditions:
> what contains the wildcard certificate * (start) as a wildcard in the CN
>
> Workaround:
>
> create generic with * (start)
> for example CN = aaa.cisco.com

Tags: Cisco Security

Similar Questions

Maybe you are looking for

  • Get rid of the unwanted addresses in Mail

    When you enter the mail address, assume that the app gives you 3 options for the address of this person in semi-automatic mode. If you want more E-mail to give you 2 of those in a semiautomatic way, how can we get rid of them? I thought that the answ

  • Portege R830 - use of fingerprinting as part of Windows 8

    I have big problems with two drivers Toshiba on my Portege R830 computer in Win 8 Pro 64 bit upgrade. I did a clean update on a reformatted hard drive, then went to install display drivers and that totally crashed my machine out. When I put in my IDs

  • Well, what missing am me? Print the report

    Troubleshooting problem printer today, I had the opportunity to open the Panel front of the "Print Report.vi" (report generation toolkit).  There's nothing there!  'Error' both cases 'no error' just pass the ref report through without pressing on it,

  • Error code 80248015 «windows cannot verify the new updates__»

    I can't update automatically and this ha made my useless antivirus and Messenger.  I searched your site for the troublesooting, nothing helps, can you help me?

  • I would like to delete a second administrator of my computer.

    I tried to set up another user on my computer, but I accidentally put in place another administrator.  How can I get rid of the second administrator name?