topic Re: ISE Node Failure & Pre-Auth ACL in Network Access Control

ISE Node Failure & Pre-Auth ACL

rmujeeb81 — Mon, 11 Mar 2019 03:37:36 GMT

Hi All,

I would like to know that, what should be the best practice configuration for following points,

1) Network access for end users/devices if both ISE nodes become unreachable ? how we can make sure that full network access should be granted if both ISE nodes become unavailable.

2) What is the best practice for pre-auth ACL configuration if IP Phones are also in the network ?

Here is the port configuration and pre-auth ACL which I am using in my network,

Interface Fa0/1

switchport access vlan 30

switchport mode access

switchport voice vlan 40

ip access-group ISE-ACL-DEFAULT in

authentication event fail action authorize vlan 30

authentication event server dead action authorize vlan 30

authentication event server alive action reinitialize

authentication host-mode multi-domain

authentication open

authentication order dot1x mab

authentication priority dot1x mab

authentication port-control auto

authentication periodic

authentication timer reauthenticate server

authentication violation protect

mab

dot1x pae authenticator

dot1x timeout tx-period 5

*****************************************

ip access-list extended ISE-ACL-DEFAULT

remark DHCP

permit udp any eq bootpc any eq bootps

remark DNS and Domain Controllers

permit ip any host 172.22.35.11

permit ip any host 172.22.35.12

remark Ping

permit icmp any any

remark PXE / TFTP

permit udp any any eq tftp

remark Deny All

deny ip any any log

Thanks & Regards,

Mujeeb

Re: ISE Node Failure & Pre-Auth ACL

Karsten Iwen — Mon, 08 Jul 2013 12:01:09 GMT

1) for that you have a "critical auth vlan" that you can assign in case that no RADIUS-server is available. You already have that in your config.

authentication event server dead action authorize vlan XXX

2) My default-acl is typically not that permissive as yours:

ip access-list extended PORT-DEFAULT-ACL

! allow DHCP

permit udp any eq bootpc any bootps

! allow dns to DNS-server

permit udp any host 10.10.10.1 eq 53

permit udp any host 10.10.10.2 eq 53

! PING is fine

permit icmp any any echo

! PXE is ok

permit udp any any eq tftp

with your ACL, an unauthenticated user already has full access to your domain-controller which is far too much in my opinion.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ISE Node Failure & Pre-Auth ACL

Eduardo Aliaga — Tue, 09 Jul 2013 03:42:29 GMT

Hello

About question 1, since you're using "authentication host-mode multi-domain" then "authentication event server dead action authorize vlan X" is the way to go.

But if you are using "authentication host-mode multi-auth" then you should use "authentication event server dead action reinitialize vlan X"

About question 2 it's not mandatory to use pre-auth ACL. My current deployment have IP phones , since I use radius profiling and CDP then ISE can detect and authorize the IP phones even though the switch blocks all packets. That' why I don't need pre-auth ACLs.

Please rate if this helps.

ISE Node Failure & Pre-Auth ACL

rmujeeb81 — Tue, 09 Jul 2013 10:00:57 GMT

Hi,

I am using following configuration on the ports,

Interface Fa0/1

switchport access vlan 30

switchport mode access

switchport voice vlan 40

ip access-group ISE-ACL-DEFAULT in

authentication event fail action authorize vlan 30 ----> What would be the behaviour due to this command ?

authentication event server dead action authorize vlan 30 ---> So in case if ISE nodes are unavailable then this port will be in VLAN 30 which is the actual VLAN ?

authentication event server alive action reinitialize ---> This command will re-initialize the authentication process if ISE nodes becomes available ?

authentication host-mode multi-domain

authentication open

authentication order dot1x mab

authentication priority dot1x mab

authentication port-control auto

authentication periodic

authentication timer reauthenticate server

authentication violation protect

mab

dot1x pae authenticator

dot1x timeout tx-period 5

Since I am using following ACL on the ports then user will have network access according to following ACL in case ISE nodes are unavailable ??

ip access-list extended ISE-ACL-DEFAULT

remark DHCP

permit udp any eq bootpc any eq bootps

remark DNS and Domain Controllers

permit ip any host 172.22.35.11

permit ip any host 172.22.35.12

remark Ping

permit icmp any any

remark PXE / TFTP

permit udp any any eq tftp

remark Deny All

deny ip any any log

Thanks

ISE Node Failure & Pre-Auth ACL

Jatin Katyal — Tue, 09 Jul 2013 11:34:57 GMT

See replies inline:

authentication event fail action authorize vlan 30----> What would be the behaviour due to this command ?

If the supplicant fails authentication, the port is moved to a restricted VLAN, and an EAP success message is sent to the supplicant because it is not notified of the actual authentication failure. If the EAP success message is not sent, the supplicant tries to authenticate every 60 seconds (the default) by sending an EAP-start message.

authentication event server dead action authorize vlan 30 ---> So in case if ISE nodes are unavailable then this port will be in VLAN 30 which is the actual VLAN ?

The above command is used to configure a port to send both new and existing hosts to the critical VLAN when the RADIUS server is unavailable. Use this command for ports in multiple authentication (multiauth) mode or if the voice domain of the port is in MDA mode.

authentication event server alive action reinitialize ---> This command will re-initialize the authentication process if ISE nodes becomes available ?

This can be used to reinitialize an authorized Auth Manager session when a previously unreachable authentication, authorization, and accounting server becomes available.

Hope it helps.

~BR
Jatin Katyal

**Do rate helpful posts**

ISE Node Failure & Pre-Auth ACL

rmujeeb81 — Thu, 11 Jul 2013 08:05:04 GMT

Hi,

So I should remove following command from ports as we don't have critical VLAN in our setup ?

authentication event fail action authorize vlan 30

Kindly note that vlan 30 is the actual data vlan.

**********************

For the "authentication event fail action authorize vlan 30" command port will have vlan 30 if ISE node become unreachable but we have following ACL on all ports so users will get very limited access,

ip access-list extended ISE-ACL-DEFAULT

remark DHCP

permit udp any eq bootpc any eq bootps

remark DNS and Domain Controllers

permit ip any host 172.22.35.11

permit ip any host 172.22.35.12

remark Ping

permit icmp any any

remark PXE / TFTP

permit udp any any eq tftp

remark Deny All

deny ip any any log

So, should I modify this ACL or completely remove ?

Thanks & Regards,

Mujeeb

ISE Node Failure & Pre-Auth ACL

rmujeeb81 — Sat, 13 Jul 2013 18:16:42 GMT

Dear All,

Kindly guide on the queries which I posted in the latest response.

Thanks

ISE Node Failure & Pre-Auth ACL

Jatin Katyal — Sat, 13 Jul 2013 19:06:49 GMT

I guess you wanted to talk about this command

authentication event server dead action authorize vlan 30

However, you mentioned the below mentioned command in you last post

authentication event fail action authorize vlan 30

If you've not configured critical vlan then you can remove this command:

authentication event server dead action authorize vlan 30 because this actually enables the critical auth (aka inaccessible AuthenticationBypass) feature on the port. With this feature enabled, If an IEEE 802.1x authentication fails because the AAA server is unavailable, the switch can be configured to allow clients access to a special VLAN (sometimes called the "Critical VLAN") that provides configurable access to the network. The Critical VLAN can be any VLAN except for the voice VLAN.

~BR
Jatin Katyal

**Do rate helpful posts**

Hello, We have an issue with

GERALD LECAILLIER — Wed, 06 Aug 2014 09:59:04 GMT

Hello,

We have an issue with the "authentication event server alive action reinitialize".

- The critical auth (if server dead) works fine > the users move to vlan 43

- authentication event server alive action reinitialize: when the ISE is back to alive, the 802.1X process is reinitialized, the users get their Vlan and Dacl (dynamic vlan et acl). The problem is that it seems they dont make an IP DHCP request, and they cant communicate in their Vlan - if we unplug/plug cable (or shut/no shut) the port, the process works fine, and they get an ip address.

interface FastEthernet0/12

description Port-NAC
switchport access vlan 43
switchport mode access
authentication event fail action next-method
authentication event server dead action authorize vlan 43
authentication event server alive action reinitialize
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication violation replace
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout quiet-period 5
dot1x timeout tx-period 2
dot1x timeout supp-timeout 2
dot1x max-req 1
macro description Port-NAC
spanning-tree portfast
spanning-tree bpduguard enable
end

Port with DEAD server > see the screenshot

Reintialize > see the screenshot / we will notice the Vlan and Dacl are OK / but no IP ADDRESS.

If you have an idea...

Thanks

Hello Karsten,please, in your

andre.ortega — Wed, 11 Feb 2015 22:38:41 GMT

Hello Karsten,

please, in your enviroment, without the access to domain controller before authentication, what happens when an user try to access a computer for first time?

Do you use Anyconnect NAM as supplicant?

Regards.

Hello there,I got the same

andre.ortega — Thu, 12 Feb 2015 12:56:16 GMT

Hello there,
I got the same doubt.
I can use authentication event server dead action authorize vlan XX, but If I am using pre authentication ACL the access will be limited, isn't it?
Regards.

It is not a big risk if the

Peter Koltl — Sun, 15 Feb 2015 18:15:51 GMT

It is not a big risk if the default port ACL seems too permissive as long as you make sure ISE authorization rules assign a proper dynamic ACL by all means.

Absolutely! Such a

bikespace — Tue, 12 May 2015 06:44:30 GMT

Absolutely! Such a disappointing solution. You'll notice this question is skirted around. You can use EEM scripts to add lines to the pre auth acl but it really feels like a bodge. Obviously you'll have to remove these lines too. Feature request needed to be able to specify an acl which will be applied when critical vlan is applied. Cisco need to start listening and start thinking.