topic Take a look at the in Network Access Control

Cisco ISE & 3750 Switch MAB configuration Issue

Martin Konov — Mon, 11 Mar 2019 02:59:15 GMT

Hi,

I am writting in response to MAB issue which I noticed a few days ago and I am still not able to undestand what exactly happend. First of all I would like to say that I configured MAB authentication and according to the MAC the ISE configure a VLAN. All worked well: the test computer can change VLAN based on its MAC. The problem appear when I cut the connection to ISE server. Accourding to configuration the switch authorize the new device to VLAN 11 (critical VLAN) That is fine ! When the ISE server is up again I had a configuration which should reauthorize all ports assign in critical VLAN. But why that is not happend ??? It looks as the switch didn't notice that the RADIUS (ISE) was up and working again.

Here is the test switch configuration :

interface FastEthernet0/22

switchport access vlan 10

switchport mode access

authentication event fail action next-method

authentication event server dead action authorize vlan 11

authentication event server alive action reinitialize

authentication order mab dot1x

authentication priority mab dot1x

authentication port-control auto

authentication periodic

authentication violation restrict

mab

dot1x pae authenticator

spanning-tree portfast

spanning-tree bpduguard enable

snmp-server community ISE-Test RO

snmp-server community ISE-Test1 RW

snmp-server trap-source FastEthernet0/24

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

radius-server attribute 25 access-request include

radius-server dead-criteria time 5 tries 3

radius-server host 192.168.98.10 auth-port 1812 acct-port 1813 key cisco123

radius-server vsa send accounting

radius-server vsa send authentication

Thank you in advanced! I hope that this issue might be intersting!

Martin

Cisco ISE & 3750 Switch MAB configuration Issue

nspasov — Sun, 20 Jan 2013 00:31:34 GMT

Martin-

What version of code are you running on your switch? Also, can you confirm that the ISE nodes are showing up when you issue "show aaa serers"

Cisco ISE & 3750 Switch MAB configuration Issue

manjeets — Wed, 17 Jul 2013 13:48:12 GMT

Kindly review the below link:

http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf

Re: Cisco ISE & 3750 Switch MAB configuration Issue

Shaoqin Li — Wed, 17 Jul 2013 16:17:59 GMT

is sw sending radius probe?

Sent from Cisco Technical Support iPad App

Cisco ISE & 3750 Switch MAB configuration Issue

Venkatesh Attuluri — Thu, 18 Jul 2013 10:46:57 GMT

"Ensure the Cisco IOS release on the switch is equal to or more recent than Cisco

IOS Release 12.2.(53)SE."

Re: Cisco ISE & 3750 Switch MAB configuration Issue

Martin Konov — Thu, 18 Jul 2013 18:43:02 GMT

Hi Venkatesh,

I would like to confirm that the switch version is more than 12.2(53)SE I think that used version was 12.2(55)SE.

Re: Cisco ISE & 3750 Switch MAB configuration Issue

Martin Konov — Thu, 18 Jul 2013 18:53:47 GMT

Hi Neno,

Version : 12.2(55)SE

I am not using that command but I think that the switch noticed ISE is up bacause when I connect the other (second) end device (on a different switch port ) it is authorized and all work well but the current one which is put in the critical VLAN is still there. It can change this state when the reauthentication timer expired and reauthenticate.

Cisco ISE & 3750 Switch MAB configuration Issue

Martin Konov — Thu, 18 Jul 2013 18:56:24 GMT

I am not sure how can I check that.

Cisco ISE & 3750 Switch MAB configuration Issue

Jatin Katyal — Fri, 19 Jul 2013 00:06:11 GMT

Could you please provide the debugs to investigate this issue.

You need to run the following debugs

debug dot1x all

debug aaa authen

debug radius

duplicate the issue at will (if it's possible) and share the outputs.

~BR
Jatin Katyal

**Do rate helpful posts**

Cisco ISE & 3750 Switch MAB configuration Issue

Martin Konov — Wed, 24 Jul 2013 14:01:27 GMT

Hi,

I represent the issue again. The all Switch session is attached the debug otput is there too.

Regards,

Martin

Cisco ISE & 3750 Switch MAB configuration Issue

nspasov — Fri, 26 Jul 2013 19:18:42 GMT

Can you confirm that you have the following syntax in your NAD:

aaa server radius dynamic-author

client 192.168.98.10 server-key AAA_Secret

Also, it would be nice to have the complete aaa/radius config. If esear post your whole config here.

Last but not the elast, you can try moving to 15.x code. I had issues in the past with 12.x code and 802.1x

Cisco ISE & 3750 Switch MAB configuration Issue

Martin Konov — Sat, 27 Jul 2013 16:11:21 GMT

Hi Neno,

As I mentioned in my previous post to Jatin I represent the same case and all session (including running config) is attached to the discussion.

According your quiestion : aaa server radius dynamic-author is there but now the ISE servers IP is different.

If you wish you can review the configuration, debug output and some other commands output in the attached document. The issue is the same.

Regards,

Martin

Can anyone even confirm that

AJAZ NAWAZ — Mon, 24 Nov 2014 16:35:27 GMT

Can anyone even confirm that ISE is supported on 3750 platform, and to be more specific C3750V2

Thank you

Take a look at the

nspasov — Mon, 24 Nov 2014 18:50:33 GMT

Take a look at the compatibility matrix for ISE:

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/compatibility/ise_sdt.html

The 3750v is not specifically listed but it is supported under the 3750 family. However, if you are getting new switches, I would highly recommend that you go with the 3850s.

Thank you for rating helpful posts!