topic ISE support on third party switch doing 802.1x authc on interfac in Network Access Control

ISE support on third party switch doing 802.1x authc on interface

yong khang NG — Mon, 11 Mar 2019 03:31:27 GMT

Hi all,

Have few question on how ISE support on third party LAN switch, if the requirement is doing 802.1X based flexauth.

Refer to the diagram i attached; 01 topology.png

Concern 1: if the 3com switch with 802.1X feature, but still without the full feature to support FlexAuth, policy encforcement, DACL etc. In this kind of situation, will user still able to authenticate (using method PEAP-MSCHAP v2), but authorization just grant with permit any any?

Concern 2: In this case, can i assume i authenticated the 3com switch using MAB? But this will cause endpoint with no 802.1X, am i right?

Concern 3: cisco switch C4507-E, loaded with IOS version Cat4500e-UNIVERSALK9-M, version 03.04 and Supervisor Engine :WS-X45-SUP7-E, is this platform is supported in Cisco TrusctSEC?

Please advice, million thanks

Noel

ISE support on third party switch doing 802.1x authc on interfac

Jatin Katyal — Sat, 08 Jun 2013 09:49:25 GMT

Yes users will be able to authenticate. With MAB you can not use peap because it uses PAP as a authentication type and it is used for devices who doesn't understand 802.1x.

looks like it is supported but with few limitation

The following guidelines and limitations apply to configuring Cisco TrustSec SGT and SGACL on Catalyst WS-X45-SUP7-E/SUP7L-E and WS-C4500X-32 switches:

http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/appb_cat4k.html

Jatin Katyal
- Do rate helpful posts -

ISE support on third party switch doing 802.1x authc on interfac

yong khang NG — Sat, 08 Jun 2013 09:54:51 GMT

Cool Jatin

First and foremost, thanks for the replies.

The third party LAN switch model mention is 3Com® Baseline Switch 2948-SFP Plus. After reviewing the user manual, it seems like a L2 LAN switch.

Acutally, my business requirement can be either:

a. optimum, the switch support FlexAuth (open mode, then evolve to low impact mode)

b. due to switch limitation capabilities, as long as it can do 802.1X authentication

after review the documentation, i still found out some of the configuration that look like unable to configure on the 3COM switch.

example

a. configure RADIUS setting

ip radius source-interface

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

radius-server attribute 25 access-request include

b. identity setting on switch port, to support FlexAuth

mab

authentication host-mode multi-auth

authentication order

c. policy enforcement

radius-server-vsa send authenticaiton

radius-server-vsa send accounting

d. Change of Authorization (COA), the most crucial

aaa server radius dynamic-author

e. dACL apply to the port after authentication, based on authorization profile.

So, to hit the baseline, i guess it can do 802.1X authentication but not with FlexAuth feature.

For the C4507, thanks for the info.

million thanks

Noel