topic Hi, in Network Access Control

MAB Authentication operation and its interaction with Authorization

bbriggs — Mon, 11 Mar 2019 07:28:48 GMT

We are using a default Wired_MAB configuration.

As I understand it a device tries to authenticate and as part of this the identity store i.e. the local internal identity store is queried.

If this is a new device it isn't in the Identity Store, however our new device seems to get added.

Is it the case that authentication proceeds after MAB with ISE continuing to Authorization Rules, if a device passes profiling it is added to the Identity Store and having been added, at THAT point authentication can now be successful?

It has always seemed odd to me that there does not seem to be a failure condition within Authentication for MAB devices, however if a device fails to profile i.e. Authorize, it also fails authentication.

Can someone clarify this?

Thanks

Hi,

Gagandeep Singh — Mon, 20 Feb 2017 21:00:23 GMT

Hi,

In MAB, authentication use Internal Endpoint where If user not found "CONTINUE"

It will move to authorization policy. MAC address gets added in ISE database as per profiled Endpoint.

Even if it doesn't match any profiling policy, it will become part of Unknown endpoint.

As per second query, it fails authentication because RADIUS has one packet for authentication and authorization. So even it passes authentication and failed in authorization, you will get failed authentication report.

Regards

Gagan

PS: rate helpful posts!!!!!

Please rate as correct if it

Gagandeep Singh — Mon, 20 Feb 2017 21:23:49 GMT

Please rate as correct if it helps!!!!

Also let me know if you have any concerns on this thread...

Regards

Gagan

Thanks for that. That's a

bbriggs — Wed, 22 Feb 2017 17:56:00 GMT

Thanks for that. That's a great help.

Your Welcome!!!!!

Gagandeep Singh — Wed, 22 Feb 2017 18:49:06 GMT

Your Welcome!!!!!

Re: Your Welcome!!!!!

JonMoss92624 — Thu, 16 Jul 2020 14:15:00 GMT

Hi, appreciate this is now an old thread but wondering if you can help me, i have the exact same query as above. I don't want the MAC address to be auto-populated into the inventory in the case where the device is unknown it should remain unknown and rejected. Any idea's how i can resolve this?

thanks