topic mab not kicking in in Network Access Control https://community.cisco.com/t5/network-access-control/mab-not-kicking-in/m-p/2028542#M184538 <P>Hi Security Experts,</P><P></P><P>We are facing an issue where a video conference unit (tandberg) failed to authenticate for several days. On further checking, we found that the MAB method was not tried at all. Unit was failing with dot1x. We have authentication order/priority as dot1x, mab. On clearing authentication session, when dot1x failed, I could see mab starting and unit could authenticate fine. Please see below:</P><P></P><P>Problem</P><P>++++++</P><P></P><P>sw#sh authentication sessions interface fa0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Interface:&nbsp; FastEthernet0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MAC Address:&nbsp; 0050.6002.5f0c</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address:&nbsp; Unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; User-Name:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Status:&nbsp; Authz Failed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Domain:&nbsp; DATA</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Policy:&nbsp; Should Secure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Status:&nbsp; Unsecure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Oper host mode:&nbsp; multi-domain</P><P>&nbsp;&nbsp;&nbsp;&nbsp; Oper control dir:&nbsp; in</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Session timeout:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Idle timeout:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp; Common Session ID:&nbsp; 0AF0C5040000FE2E098EC881</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Acct Session ID:&nbsp; 0x00010F61</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Handle:&nbsp; 0x85000EFC</P><P></P><P>Runnable methods list:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Method&nbsp;&nbsp; State</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dot1x&nbsp;&nbsp;&nbsp; Authc Failed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN style="color: #ff0000;">mab&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Not run</SPAN></P><P></P><P>After clearing auth session,</P><P></P><P>After clearing the session, now it is properly failing over to MAB.</P><P>+++++++++++++++++++</P><P></P><P>sw#sh authentication sessions interface fa0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Interface:&nbsp; FastEthernet0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MAC Address:&nbsp; 0050.6002.5f0c</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address:&nbsp; Unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; User-Name:&nbsp; 00-50-60-02-5F-0C</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Status:&nbsp; Authz Success</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Domain:&nbsp; DATA</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Policy:&nbsp; Should Secure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Status:&nbsp; Unsecure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Oper host mode:&nbsp; multi-domain</P><P>&nbsp;&nbsp;&nbsp;&nbsp; Oper control dir:&nbsp; in</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Authorized By:&nbsp; Authentication Server</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vlan Group:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Session timeout:&nbsp; 43200s (local), Remaining: 43185s</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Timeout action:&nbsp; Reauthenticate</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Idle timeout:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp; Common Session ID:&nbsp; 0AF0C5040000FE410991A09C</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Acct Session ID:&nbsp; 0x00010F7A</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Handle:&nbsp; 0x3B000F0F</P><P></P><P>Runnable methods list:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Method&nbsp;&nbsp; State</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dot1x&nbsp;&nbsp;&nbsp; Failed over</P><P> <SPAN style="color: #00ff00;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mab&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Authc Success</SPAN></P><P></P><P>We are running c3560-ipservicesk9-mz.122-55.SE4 on WS-C3560-48PS switch.</P> Mon, 11 Mar 2019 02:42:20 GMT Kashish_Patel 2019-03-11T02:42:20Z mab not kicking in https://community.cisco.com/t5/network-access-control/mab-not-kicking-in/m-p/2028542#M184538 <P>Hi Security Experts,</P><P></P><P>We are facing an issue where a video conference unit (tandberg) failed to authenticate for several days. On further checking, we found that the MAB method was not tried at all. Unit was failing with dot1x. We have authentication order/priority as dot1x, mab. On clearing authentication session, when dot1x failed, I could see mab starting and unit could authenticate fine. Please see below:</P><P></P><P>Problem</P><P>++++++</P><P></P><P>sw#sh authentication sessions interface fa0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Interface:&nbsp; FastEthernet0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MAC Address:&nbsp; 0050.6002.5f0c</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address:&nbsp; Unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; User-Name:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Status:&nbsp; Authz Failed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Domain:&nbsp; DATA</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Policy:&nbsp; Should Secure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Status:&nbsp; Unsecure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Oper host mode:&nbsp; multi-domain</P><P>&nbsp;&nbsp;&nbsp;&nbsp; Oper control dir:&nbsp; in</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Session timeout:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Idle timeout:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp; Common Session ID:&nbsp; 0AF0C5040000FE2E098EC881</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Acct Session ID:&nbsp; 0x00010F61</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Handle:&nbsp; 0x85000EFC</P><P></P><P>Runnable methods list:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Method&nbsp;&nbsp; State</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dot1x&nbsp;&nbsp;&nbsp; Authc Failed</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <SPAN style="color: #ff0000;">mab&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Not run</SPAN></P><P></P><P>After clearing auth session,</P><P></P><P>After clearing the session, now it is properly failing over to MAB.</P><P>+++++++++++++++++++</P><P></P><P>sw#sh authentication sessions interface fa0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Interface:&nbsp; FastEthernet0/21</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MAC Address:&nbsp; 0050.6002.5f0c</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IP Address:&nbsp; Unknown</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; User-Name:&nbsp; 00-50-60-02-5F-0C</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Status:&nbsp; Authz Success</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Domain:&nbsp; DATA</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Policy:&nbsp; Should Secure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Security Status:&nbsp; Unsecure</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Oper host mode:&nbsp; multi-domain</P><P>&nbsp;&nbsp;&nbsp;&nbsp; Oper control dir:&nbsp; in</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Authorized By:&nbsp; Authentication Server</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Vlan Group:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Session timeout:&nbsp; 43200s (local), Remaining: 43185s</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Timeout action:&nbsp; Reauthenticate</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Idle timeout:&nbsp; N/A</P><P>&nbsp;&nbsp;&nbsp; Common Session ID:&nbsp; 0AF0C5040000FE410991A09C</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Acct Session ID:&nbsp; 0x00010F7A</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Handle:&nbsp; 0x3B000F0F</P><P></P><P>Runnable methods list:</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Method&nbsp;&nbsp; State</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; dot1x&nbsp;&nbsp;&nbsp; Failed over</P><P> <SPAN style="color: #00ff00;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; mab&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Authc Success</SPAN></P><P></P><P>We are running c3560-ipservicesk9-mz.122-55.SE4 on WS-C3560-48PS switch.</P> Mon, 11 Mar 2019 02:42:20 GMT https://community.cisco.com/t5/network-access-control/mab-not-kicking-in/m-p/2028542#M184538 Kashish_Patel 2019-03-11T02:42:20Z mab not kicking in https://community.cisco.com/t5/network-access-control/mab-not-kicking-in/m-p/2028543#M184545 <HTML><HEAD></HEAD><BODY><P>Hello Kashish-</P><P></P><P>Can you:</P><P>1. Post the full switchport config</P><P>2. Make and model of the switch</P><P>3. Version of code running on the switch</P></BODY></HTML> Wed, 31 Oct 2012 01:26:18 GMT https://community.cisco.com/t5/network-access-control/mab-not-kicking-in/m-p/2028543#M184545 nspasov 2012-10-31T01:26:18Z