doit1x Monitor Mode

Mikael Gustafsson — Mon, 11 Mar 2019 03:13:41 GMT

Hi,

I have a setup with a were I configured monitor mode on a switch with ISE as RADIUS server. This is for testing before a bigger deployment at a customer site.

Im using ISE 1.1.3, C2960 and IOS 15.0(2) and a laptop with Windows 7 Enterprise SP1.

The correct configuration with EAP-TLS and machin cert is working like it should but it is when I remove this and make the laptop fail that I get wierd results with monitor mode. I cant get DNS to work in dot1x monitor mode if the client fail authentication.

When the client fail dot1x and MAB it gets a IP with DHCP. I can ping but DNS/browsing is not working. If I put the AuthC back and the client authenticates DNS is working, or if I turn of dot1x on the client then DNS work as it should.

Anyone has seen this before and/or have some insight on how this should work?

I know this probably is a client/supplicant problem.

Port config:

interface GigabitEthernet0/2

description 802.1x port PC lab

switchport access vlan 8

switchport mode access

authentication host-mode multi-auth

authentication open

authentication port-control auto

authentication violation restrict

mab

dot1x pae authenticator

----------------------------------

sw#sh auth sess int gi0/2

Interface: GigabitEthernet0/2

MAC Address: 000d.9d90.c96d

IP Address: 192.168.50.30

User-Name: 000d9d90c96d

Status: Authz Failed

Domain: DATA

Oper host mode: multi-auth

Oper control dir: both

Session timeout: N/A

Idle timeout: N/A

Common Session ID: C0A8320900000CF4DC2FDA59

Acct Session ID: 0x00000D2A

Handle: 0xA0000CF5

Runnable methods list:

Method State

dot1x Failed over

mab Failed over

doit1x Monitor Mode

gschmitt.ngit — Tue, 30 Apr 2013 20:51:32 GMT

You need a configured ip access-group with the ACL of permit ip any any hardcoded on the interface.

doit1x Monitor Mode

askhuran — Tue, 30 Apr 2013 21:51:59 GMT

While checking the authenticating the sessions, please also verify all the dACLs which are enforced. This will help obtain more input and narrow down the problem. Please make sure that the Web-auth ACL has no errors

doit1x Monitor Mode

Octavian Szolga — Wed, 01 May 2013 07:49:01 GMT

Hi,

Please check if you configured Fallback to unauthorized network access under you Windows NIC dot1x settings.

If not, you won't get network access when dot1x fails.

topic doit1x Monitor Mode in Network Access Control

doit1x Monitor Mode

doit1x Monitor Mode

doit1x Monitor Mode

doit1x Monitor Mode