Explicit EAP failure

Question

Explicit EAP failure

Poorna Kumar 5

Hi Team,

We are facing an issue on some of our endpoints where the Windows Event Viewer shows an explicit eap failure message, and the network adapter gets suspended for 600 seconds. On Cisco ISE, we are also observing a duplicate session found message for the same endpoints.

Is anyone else experiencing similar issues in your environment after the recent Windows 11 update?

ise 3.3 p7 windows 11 above 26100 and switch model 2960x cisco

If anyone knows what this explicit eap failure received event means please explain and if we disable it want is the impact?

0 comments

1 answer

Your answer

Answer 1

Domic Vo 22,435 Independent Advisor

Dear Poorna Kumar,

The “explicit EAP failure received” message in Windows Event Viewer, followed by a 600-second network adapter suspension, is often triggered by failed 802.1X authentication attempts—commonly due to certificate validation delays or session duplication on Cisco ISE. The “duplicate session found” message on ISE 3.3 P7 further supports this, as it suggests the endpoint is attempting to re-authenticate while an active session still exists.

This issue has been observed in environments running Windows 11 builds above 26100, particularly when using PKI-based EAP-TLS with Cisco switches like the 2960X. It may be related to how Windows handles certificate renewal or session persistence post-update.

Disabling EAP failure detection or suppressing related events could reduce false positives but may also compromise authentication integrity and delay detection of genuine access issues. We recommend reviewing your ISE session timeout settings and validating certificate chains to ensure compatibility with the updated Windows client behavior.

If my answer is useful for you, please hit "ACCEPT THE ANSWER" to support me.

Thank you so much!!

Best regards,

Domic Vo.

Poorna Kumar 5 Reputation points

2025-10-30T11:29:31.2933333+00:00

Hi Domic,

Thanks for your response. We are using TEAP for authentication with EAP-MSCHAPv2 and machine authentication for the client. For server verification, the RADIUS server shares its certificate.

Could you please help me understand when the next authentication request is initiated from the Windows endpoint? Is it completely based on the switch (NAD) reauthentication timer, or does the endpoint initiate it by default?

I would really appreciate it if you could share any relevant documentation regarding this behavior.
Poorna Kumar 5 Reputation points

2025-11-05T12:12:50.78+00:00

Hi Domic,

Can you please share any document regarding this issue and also i observed in other endpoints the same duplicate session is observed in ISE but still the endpoint is able to send a eapol start after a event wired 802.1x authentication was restarted and the restart reason:onex user held timedout.So why here the adapter is not suspened for the endpoint.So is it driver or endpoint issue or something different.
Marc L 0 Reputation points

2025-12-03T08:18:06.37+00:00

It may be related to how Windows handles certificate renewal or session persistence post-update.

Very much so. We have observed (mis)behaviour of Windows 11's s 802.1X supplicant in the form that - once session lifetime is expired - it does not react to a switch's EAP-Request/Identity packet. The switch then retries, and eventually declares 802.1X failed and puts the switchport in whatever state the given NAC policy on the switch dictates.

Only when bouncing the switchport, the 802.1X supplicant starts off fresh, with an EAPOL Start request to the switch.

Share via

Explicit EAP failure

1 answer

Your answer