10/2/22, 19:53 Cisco Identity Services Engine

Steps
Overview
  11001 Received RADIUS Access-Request - ETAPA
Event 5200 Authentication succeeded
  11017 RADIUS created a new session - host/ET-SOP
Username userlight,host/ET-SOPORTE2020.etapa.net.ec   15049 Evaluating Policy Group - etapa.net.ec

  15008 Evaluating Service Selection Policy - etapa.net

Endpoint Id 00:25:AB:A0:5A:98

  11507 Extracted EAP-Response/Identity

Endpoint Profile Unknown   12100 Prepared EAP-Request proposing EAP-FAST w

Authentication Policy Red Cableada con 802.1x >> Default   12625 Valid EAP-Key-Name attribute received - ETAP

  11006 Returned RADIUS Access-Challenge

Authorization Policy Red Cableada con 802.1x >> AuthorizacionUsuarios_Dominio__EAPChanin
  11001 Received RADIUS Access-Request

Authorization Result Permite_acceso_dominio   11018 RADIUS is re-using an existing session

Extracted EAP-Response containing EAP-FAS

  12102
accepting EAP-FAST as negotiated

  12800 Extracted first TLS record; TLS handshake star

Authentication Details
  12805 Extracted TLS ClientHello message

Source Timestamp 2022-02-10 19:45:56.902   12806 Prepared TLS ServerHello message

  12807 Prepared TLS Certificate message

Received Timestamp 2022-02-10 19:45:56.903
  12808 Prepared TLS ServerKeyExchange message
Policy Server falco2   12809 Prepared TLS CertificateRequest message

  12105 Prepared EAP-Request with another EAP-FAS

Event 5200 Authentication succeeded
  11006 Returned RADIUS Access-Challenge
Username userlight,host/ET-SOPORTE2020.etapa.net.ec   11001 Received RADIUS Access-Request

Endpoint Id 00:25:AB:A0:5A:98   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

Calling Station Id 00-25-AB-A0-5A-98
  12105 Prepared EAP-Request with another EAP-FAS

Endpoint Profile Unknown   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

IPv4 Address 192.168.67.28
  11018 RADIUS is re-using an existing session
Authentication Identity Store ETAPA   12104 Extracted EAP-Response containing EAP-FAS

  12105 Prepared EAP-Request with another EAP-FAS

Identity Group Unknown
  11006 Returned RADIUS Access-Challenge
Audit Session Id 5E16A8C000000027E63CA830
  11001 Received RADIUS Access-Request

Authentication Method dot1x   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

Authentication Protocol EAP-FAST (EAP-MSCHAPv2,EAP-TLS)
  12105 Prepared EAP-Request with another EAP-FAS
Service Type Framed   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

Network Device SwPaseoCanarisCore
  11018 RADIUS is re-using an existing session
Device Type All Device Types#prueba   12104 Extracted EAP-Response containing EAP-FAS

Location All Locations   12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge
NAS IPv4 Address 192.168.25.214
  11001 Received RADIUS Access-Request

NAS Port Id GigabitEthernet1/0/11   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

NAS Port Type Ethernet
  12105 Prepared EAP-Request with another EAP-FAS
Authorization Profile Permite_acceso_dominio   11006 Returned RADIUS Access-Challenge
  11001 Received RADIUS Access-Request
Response Time 3 milliseconds
  11018 RADIUS is re-using an existing session
  12104 Extracted EAP-Response containing EAP-FAS

  12811 Extracted TLS Certificate message containing c

Other Attributes   12812 Extracted TLS ClientKeyExchange message

  12813 Extracted TLS CertificateVerify message

ConfigVersionId 75   12804 Extracted TLS Finished message

DestinationPort 1645   12801 Prepared TLS ChangeCipherSpec message

  12802 Prepared TLS Finished message
Protocol Radius
  12816 TLS handshake succeeded

NAS-Port 50111 Client certificate was requested but not receive

  12207
Will renegotiate and request client certificate in
Framed-MTU 1468   12226 Started renegotiated TLS handshake

  12105 Prepared EAP-Request with another EAP-FAS

37CPMSessionID=5E16A8C000000027E63CA830;31SessionID=falco2/43391
State
1386/4549;   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

NetworkDeviceProfileId b0699505-3150-4215-a80e-6753d45bf56c

https://192.168.16.65/admin/liveAuthenticationDetail.do?CallingStationId=00:25:AB:A0:5A:98&repeat=0 1/6
10/2/22, 19:53 Cisco Identity Services Engine
  11018 RADIUS is re-using an existing session
IsThirdPartyDeviceFlow false
  12104 Extracted EAP-Response containing EAP-FAS
AcsSessionID falco2/433911386/4549
  12805 Extracted TLS ClientHello message

UseCase Eap Chaining   12806 Prepared TLS ServerHello message

  12807 Prepared TLS Certificate message

NACRadiusUserName userlight
  12808 Prepared TLS ServerKeyExchange message
NACRadiusUserName host/ET-SOPORTE2020.etapa.net.ec   12809 Prepared TLS CertificateRequest message
  12105 Prepared EAP-Request with another EAP-FAS
SelectedAuthenticationIdentityStores ETAPA
  11006 Returned RADIUS Access-Challenge
SelectedAuthenticationIdentityStores CERTIFICATE_ETAPA_CN   11001 Received RADIUS Access-Request

AuthenticationStatus AuthenticationPassed   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS
IdentityPolicyMatchedRule Default
  12105 Prepared EAP-Request with another EAP-FAS

AuthorizationPolicyMatchedRule AuthorizacionUsuarios_Dominio__EAPChanin   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

Serial Number 17 00 00 28 A0 83 DB 80 2F A2 CB DB E4 00 01 00 00 28 A0
  11018 RADIUS is re-using an existing session
Subject - Common Name ET-SOPORTE2020.etapa.net.ec   12104 Extracted EAP-Response containing EAP-FAS
  12105 Prepared EAP-Request with another EAP-FAS
Subject Alternative Name ET-SOPORTE2020.etapa.net.ec
  11006 Returned RADIUS Access-Challenge
IssuedPacInfo Issued PAC type=Tunnel V1A with expiration time: Wed May 11 19:45:56 2022
  11001 Received RADIUS Access-Request

CPMSessionID 5E16A8C000000027E63CA830   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

EndPointMACAddress 00-25-AB-A0-5A-98
  12105 Prepared EAP-Request with another EAP-FAS
EapChainingResult User and machine both succeeded   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

ISEPolicySetName Red Cableada con 802.1x
  11018 RADIUS is re-using an existing session
IdentitySelectionMatchedRule Default   12104 Extracted EAP-Response containing EAP-FAS

AD-User-Resolved-Identities userlight@etapa.net.ec   12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge

AD-User-Candidate-Identities userlight@etapa.net.ec
  11001 Received RADIUS Access-Request

AD-User-Join-Point ETAPA.NET.EC   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

AD-Host-Resolved-Identities
AD-Host-Candidate-Identities
AD-Host-Join-Point
MachineAuthenticationIdentityStore
ET-SOPORTE2020$@etapa.net.ec
  12105 Prepared EAP-Request with another EAP-FAS
ET-SOPORTE2020$@etapa.net.ec   11006 Returned RADIUS Access-Challenge
  11001 Received RADIUS Access-Request
ETAPA.NET.EC
  11018 RADIUS is re-using an existing session
ETAPA
  12104 Extracted EAP-Response containing EAP-FAS

CN=Usuario Prueba Light,OU=Usuarios   12811 Extracted TLS Certificate message containing c

AD-User-Resolved-DNs
general,OU=Usuarios,OU=Empresa,DC=etapa,DC=net,DC=ec
  12812 Extracted TLS ClientKeyExchange message

CN=ET-SOPORTE2020,OU=Pruebas   12813 Extracted TLS CertificateVerify message

AD-Host-Resolved-DNs
Navegadores,OU=Equipos,OU=Empresa,DC=etapa,DC=net,DC=ec
  12804 Extracted TLS Finished message

AD-User-DNS-Domain etapa.net.ec   12801 Prepared TLS ChangeCipherSpec message

  12802 Prepared TLS Finished message
AD-Host-DNS-Domain etapa.net.ec
  12226 Started renegotiated TLS handshake
AD-Groups-Names etapa.net.ec/Users/Usuarios del dominio Client certificate was requested but not receive
  12205
continue with inner method.
AD-User-NetBios-Name ETAPA-NET   12149 EAP-FAST built authenticated tunnel for purpos

AD-Host-NetBios-Name ETAPA-NET   12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge
IsMachineIdentity true
  11001 Received RADIUS Access-Request

UserAccountControl 512   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

AD-Host-SamAccount-Name ET-SOPORTE2020$
  12209 Starting EAP chaining
AD-User-SamAccount-Name userlight   12218 Selected identity type 'User'

  12125 EAP-FAST inner method started

AD-Host-Qualified-Name ET-SOPORTE2020$@etapa.net.ec
  11521 Prepared EAP-Request/Identity for inner EAP m
AD-User-Qualified-Name userlight@etapa.net.ec
  12105 Prepared EAP-Request with another EAP-FAS

TLSCipher ECDHE-RSA-AES256-GCM-SHA384   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

TLSVersion TLSv1.2
  11018 RADIUS is re-using an existing session
DTLSSupport Unknown   12104 Extracted EAP-Response containing EAP-FAS

  12212 Identity type provided by client is equal to reque

Subject CN=ET-SOPORTE2020.etapa.net.ec
  11522 Extracted EAP-Response/Identity for inner EAP
Subject Alternative Name - DNS ET-SOPORTE2020.etapa.net.ec Prepared EAP-Request for inner method propo
  11806
challenge
Issuer CN=ETAPA-CA 2,DC=etapa,DC=net,DC=ec
  12105 Prepared EAP-Request with another EAP-FAS

https://192.168.16.65/admin/liveAuthenticationDetail.do?CallingStationId=00:25:AB:A0:5A:98&repeat=0 2/6
10/2/22, 19:53 Cisco Identity Services Engine
Issuer - Common Name ETAPA-CA 2   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

Issuer - Domain Component etapa
  11018 RADIUS is re-using an existing session

Issuer - Domain Component net   12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response containing EAP-MSC

Issuer - Domain Component ec   11808
inner method and accepting EAP-MSCHAP as

  15041 Evaluating Identity Policy

Key Usage 0
  22072 Selected identity source sequence - CERT_AD
Key Usage 2
  15013 Selected Identity Source - ETAPA

Extended Key Usage - Name 129   24430 Authenticating user against Active Directory - E

  24325 Resolving identity - userlight

Extended Key Usage - Name
Extended Key Usage - OID
Extended Key Usage - OID
Template Name
130
  24313 Search for matching accounts at join point - eta
1.3.6.1.5.5.7.3.1   24319 Single matching account found in forest - etapa
  24323 Identity resolution detected single matching acc
1.3.6.1.5.5.7.3.2
  24343 RPC Logon request succeeded - userlight@eta
Machine   24402 User authentication against Active Directory su

Days to Expiry 278   22037 Authentication Passed

  11824 EAP-MSCHAP authentication attempt passed
AKI db:bd:4b:12:29:62:db:ac:e0:89:49:91:34:97:76:e8:d9:56:0d:07
  12105 Prepared EAP-Request with another EAP-FAS

HostIdentityGroup Endpoint Identity Groups:Unknown   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

Network Device Profile Cisco
  11018 RADIUS is re-using an existing session
Location Location#All Locations   12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response for inner method con

Device Type Device Type#All Device Types#prueba   11810
response

IPSEC IPSEC#Is IPSEC Device#No   11814 Inner EAP-MSCHAP authentication succeeded

  11519 Prepared EAP-Success for inner EAP method

ExternalGroups S-1-5-21-1388574562-5326870-3725689430-513
  12128 EAP-FAST inner method finished successfully
ExternalGroups S-1-5-21-1388574562-5326870-3725689430-515   12966 Sent EAP Intermediate Result TLV indicating s

  12105 Prepared EAP-Request with another EAP-FAS

RADIUS Username anonymous
  11006 Returned RADIUS Access-Challenge
Device IP Address 192.168.25.214   11001 Received RADIUS Access-Request

Called-Station-ID 6C:71:0D:BF:A8:0B   11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

service-type=Framed,

audit-session-id=5E16A8C000000027E63CA830,
  12126 EAP-FAST cryptobinding verification passed
CiscoAVPair method=dot1x,
  12200 Approved EAP-FAST client Tunnel PAC reques
client-iif-id=397568742,

vlan-id=60   12219 Selected identity type 'Machine'

  12125 EAP-FAST inner method started

  11521 Prepared EAP-Request/Identity for inner EAP m

  12105 Prepared EAP-Request with another EAP-FAS

Result   11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

User-Name userlight
  11018 RADIUS is re-using an existing session
Class CACS:5E16A8C000000027E63CA830:falco2/433911386/4549   12104 Extracted EAP-Response containing EAP-FAS
  12212 Identity type provided by client is equal to reque
Tunnel-Type (tag=1) VLAN
  11522 Extracted EAP-Response/Identity for inner EAP
Tunnel-Medium-Type (tag=1) 802
Prepared EAP-Request for inner method propo
  11806
challenge
Tunnel-Private-Group-ID (tag=1) 60
  12105 Prepared EAP-Request with another EAP-FAS
2b:bd:35:b7:53:f4:f2:69:a5:23:73:b7:5a:2d:ae:99:66:36:c0:a2:81:d4:78:6d:dd:91:b   11006 Returned RADIUS Access-Challenge
EAP-Key-Name 0:6b:95:b2:95:a3:55:8d:56:0f:31:4c:89:9f:9d:57:72:c9:fe:b3:5e:10:14:dd:49:81:26:
14:52:19:8a:71:e4:ca:87:ce:be:23:05   11001 Received RADIUS Access-Request
  11018 RADIUS is re-using an existing session
ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-ACL_usuarios_dominio-
cisco-av-pair   12104 Extracted EAP-Response containing EAP-FAS
5cd97ce6
Extracted EAP-Response/NAK for inner metho
  12523
MS-MPPE-Send-Key **** instead

  12522 Prepared EAP-Request for inner method propo

MS-MPPE-Recv-Key ****
  12625 Valid EAP-Key-Name attribute received
LicenseTypes Base license consumed   12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request
  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response containing EAP-TLS
  12524
method and accepting EAP-TLS as negotiated

  12800 Extracted first TLS record; TLS handshake star

  12805 Extracted TLS ClientHello message
  12806 Prepared TLS ServerHello message

https://192.168.16.65/admin/liveAuthenticationDetail.do?CallingStationId=00:25:AB:A0:5A:98&repeat=0 3/6
10/2/22, 19:53 Cisco Identity Services Engine
  12807 Prepared TLS Certificate message
  12808 Prepared TLS ServerKeyExchange message

  12809 Prepared TLS CertificateRequest message

  12527 Prepared EAP-Request for inner method with a

  12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge
  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS
Extracted EAP-Response for inner method con
  12526
response
  12527 Prepared EAP-Request for inner method with a
  12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request
  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response for inner method con
  12526
response

  12527 Prepared EAP-Request for inner method with a

  12105 Prepared EAP-Request with another EAP-FAS
  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response for inner method con
  12526
response
  12527 Prepared EAP-Request for inner method with a

  12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session
  12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response for inner method con

  12526
response
  12527 Prepared EAP-Request for inner method with a

  12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge
  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS
Extracted EAP-Response for inner method con
  12526
response
  12527 Prepared EAP-Request for inner method with a
  12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request
  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

  12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request
  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

  12105 Prepared EAP-Request with another EAP-FAS
  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

  12105 Prepared EAP-Request with another EAP-FAS
  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session
  12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response for inner method con

  12526
response
ISE will continue to CRL verification if it is confi
  12571
certificate for ET-SOPORTE2020.etapa.net.ec

https://192.168.16.65/admin/liveAuthenticationDetail.do?CallingStationId=00:25:AB:A0:5A:98&repeat=0 4/6
10/2/22, 19:53 Cisco Identity Services Engine
ISE will continue to CRL verification if it is confi
  12571
certificate for ETAPA-CA 2

  12811 Extracted TLS Certificate message containing c

  12812 Extracted TLS ClientKeyExchange message
  12813 Extracted TLS CertificateVerify message

  12804 Extracted TLS Finished message

  12801 Prepared TLS ChangeCipherSpec message
  12802 Prepared TLS Finished message

  12816 TLS handshake succeeded

  12509 EAP-TLS full handshake finished successfully

  12527 Prepared EAP-Request for inner method with a

  12105 Prepared EAP-Request with another EAP-FAS
  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session
  12104 Extracted EAP-Response containing EAP-FAS

Extracted EAP-Response for inner method con

  12526
response
  61025 Open secure connection with TLS peer

  15041 Evaluating Identity Policy

  22072 Selected identity source sequence - CERT_AD
  22070 Identity name is taken from certificate attribute

  15013 Selected Identity Source - ETAPA

  24433 Looking up machine in Active Directory - ETAPA

  24325 Resolving identity - ET-SOPORTE2020.etapa.n

  24313 Search for matching accounts at join point - eta
  24319 Single matching account found in forest - etapa

  24323 Identity resolution detected single matching acc

  24700 Identity resolution by certificate succeeded - ET
  22037 Authentication Passed

  12528 Inner EAP-TLS authentication succeeded

  11519 Prepared EAP-Success for inner EAP method

  12128 EAP-FAST inner method finished successfully

  12966 Sent EAP Intermediate Result TLV indicating s
  12105 Prepared EAP-Request with another EAP-FAS

  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request
  11018 RADIUS is re-using an existing session

  12104 Extracted EAP-Response containing EAP-FAS

  12126 EAP-FAST cryptobinding verification passed

  12167 Authorization PAC can be provided only with Tu

  12229 No valid PAC requests on provisioning
  12967 Sent EAP Intermediate Result TLV indicating fa

  15036 Evaluating Authorization Policy

User name change detected for the session. At
  11055
removed from the cache

Looking up user in Active Directory - userlight,h

  24432
SOPORTE2020.etapa.net.ec
  24325 Resolving identity
  24313 Search for matching accounts at join point

  24319 Single matching account found in forest

  24323 Identity resolution detected single matching acc

  24355 LDAP fetch succeeded

  24416 User's Groups retrieval from Active Directory su
Looking up machine in Active Directory - userlig
  24433
SOPORTE2020.etapa.net.ec

  24325 Resolving identity

  24313 Search for matching accounts at join point

  24319 Single matching account found in forest

  24323 Identity resolution detected single matching acc
  24355 LDAP fetch succeeded

  24435 Machine Groups retrieval from Active Directory

  15048 Queried PIP - ETAPA.ExternalGroups
  15048 Queried PIP - Network Access.EapChainingRe

  15048 Queried PIP - Normalised Radius.RadiusFlowT

  15016 Selected Authorization Profile - Permite_acceso

  11022 Added the dACL specified in the Authorization

https://192.168.16.65/admin/liveAuthenticationDetail.do?CallingStationId=00:25:AB:A0:5A:98&repeat=0 5/6
10/2/22, 19:53 Cisco Identity Services Engine
  12964 Sent EAP Result TLV indicating success

  12169 Successfully finished EAP-FAST tunnel PAC pr

  12105 Prepared EAP-Request with another EAP-FAS
  11006 Returned RADIUS Access-Challenge

  11001 Received RADIUS Access-Request

  11018 RADIUS is re-using an existing session
  12104 Extracted EAP-Response containing EAP-FAS

  12651 Accept client on authenticated provisioning

  12107 EAP-FAST provisioning phase finished success

  11503 Prepared EAP-Success

  11002 Returned RADIUS Access-Accept

https://192.168.16.65/admin/liveAuthenticationDetail.do?CallingStationId=00:25:AB:A0:5A:98&repeat=0 6/6