topic Start with reading the in Network Access Control

Flexible Authentication Order, Priority Cisco ISE

prashant dwivedi — Mon, 11 Mar 2019 07:26:02 GMT

Can someone out here please explain the meaning of below

interface <interface_number>

authentication order mab dot1x

authentication priority dot1x mab

what is the real-time use of order and priority commands ?

Is it mandatory to have priority command ?

Please give some real-life exmaples

Start with reading the

Karsten Iwen — Fri, 03 Feb 2017 07:11:34 GMT

Start with reading the following document. It will give you some good examples:

Flexible Authentication Order, Priority, and Failed Authentication

Here is my understanding , if

prashant dwivedi — Mon, 06 Feb 2017 05:58:55 GMT

Here is my understanding , if someone would like to comment and confim if this is correct

Use case 1 :

authentication order mab dot1x

authentication priority dot1x mab

Result- first client will do MAB ( if this passed ) then will do the dot1x. If MAB auth failed then also do the dot1x. Negative side of this is that each and every device has to go through MAB process- overhead on ISE . if DOT1x is not successful it will get the policy as configured for MAB.

Use Case 2-

authentication order mab dot1x

authentication priority mab Dot1x

MAB failed , it will go to Dot1x

MAB passed- it will not go to DOT1x.

Use Case 3-

authentication order dot1x mab

authentication priority mab Dot1x

End-point will do Dot1x, will only go to MAB if DOT1x Fails.

Re: Here is my understanding , if

louis0001 — Sat, 20 Oct 2018 08:47:39 GMT

Could anyone confirm that if:

order mab dot1x

priority dot1x mab

then a dot1x client will start up as mab but immediately be switched to dot1x upon sending an eapol frame?

ie it doesn't have to fail the mab process to progress to dot1x and therefore the mab process won't fail due to the dot1x being sucessful?

Re: Here is my understanding , if

hslai — Sat, 27 Oct 2018 03:50:01 GMT

Yes.

Re: Here is my understanding , if

Panos Bouras — Tue, 30 Oct 2018 20:12:30 GMT

It depends on the policies, I prefer to do the dot1x first and if fails then do MAB.
If you have MAB policies that can "overlap" with dot1x policies then it might cause issues, e.g. MAB policy for workstation onboarding.
In most cases dot1x first works better for me.