topic Hi again! in Network Access Control

ISE 1.3 issue with Catalyst 4500E (12.54)

Capricorn — Mon, 11 Mar 2019 07:15:17 GMT

Hi!

I am new to ISE world.

I have different Authorization policy based on computer and user. Once the computer start it will assign to vlan based on its security group membership. If a user login to same computer then second Authorization clicks in IP is assigned from Vlan based on user security group.

It works on 2900 series switch but the same thing doesn't work on Catalyst 4500E (12.54). I have matched the config for Dot1x on both switches and the look fine.

The issue is that on Catalyst 4500 the second authorization doesnt work. Only the first policy that is for computer authentication works.

Any suggestion on this?

Thanks

Capricorn

Hello Capricorn-

nspasov — Tue, 29 Nov 2016 17:56:54 GMT

Hello Capricorn-

My guess is that you are hitting a bug with the version of code that you are running on the 4500. Can you provide the following info:

- Exact chassis model (Obtain from show ver)

- Exact version code (Obtain from show ver)

- Output from from the following command: show authentication session interface interface_name_number

- Configuration of the affected port

Thank you for rating helpful posts!

Thanks Neno for looking into

Capricorn — Tue, 06 Dec 2016 09:28:05 GMT

Thanks Neno for looking into this. Please see below.

WS-C4506-E

cat4500e-ipbasek9-mz.122-54.SG1.bin

description ISE
switchport access vlan 550
switchport mode access
switchport voice vlan 300
ip access-group ACL-DEFAULT in
authentication event fail action next-method
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 5
dot1x max-reauth-req 1
spanning-tree portfast
spanning-tree guard root

--------

show authentication sessions interface gigabitEthernet 3/31
Interface: GigabitEthernet3/31
MAC Address: a0b3.cc23.xxxx
IP Address: 10.2.7.227
User-Name: host/testcomputer.mydomain.com
Status: Authz Success
Domain: DATA
Oper host mode: multi-domain
Oper control dir: both
Authorized By: Authentication Server
Vlan Policy: 109
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0AF4DC0C0000003D8153AA91
Acct Session ID: 0x00005255
Handle: 0xA300003E

Runnable methods list:
Method State
dot1x Authc Success
mab Not run

Hi again!

Capricorn — Wed, 14 Dec 2016 12:05:39 GMT

Hi again!

Anyone can look into this?

Thanks

Sorry about that. I thought I

nspasov — Thu, 15 Dec 2016 23:25:09 GMT

Sorry about that. I thought I replied to the thread but I guess I missed it 😕

So, based on what you have provided I see two things that look strange:

1. The username provided in the session is a name of a computer not actual user. Thus, it appears that the user auth is not even seen by the switch/ise

2. In the port config you have a pre-auth ACL (ACL-DEFAULT) but I don't see a dACL in the authorization policy. So my question here is: Are you returning a dACL with your authorization policy? If not, I would suggest doing that as you need a dACL to replace the pre-auth ACL. Otherwise, the pre-auth ACL remains on the port even after successful authentication/authorization. You can quickly test this by pushing a "permit ip any any" with both authorization profiles.

Thank you for rating helpful posts!

Hi!

Capricorn — Fri, 16 Dec 2016 10:46:30 GMT

Hi!

Thanks for looking into it.

Everything works fine if I have a computer connected to Catalyst 2960G ( Version 12.2(44)SE6) and it doesnt work if I connected the same computer to WS-C4506-E.

To me it looks ok from ISE as it works for 2960G. What you say?

Thanks

So the reason I suggest you

nspasov — Sat, 17 Dec 2016 21:39:41 GMT

So the reason I suggest you try the dACL is because the behavior of the default Pre-Auth ACL changed between versions and switch family. I had a link that described this but cannot find it now.

I would definitely configure and push a dACL and see if that fixes the problem.

Thank you for rating helpful posts!

Hi!

Capricorn — Thu, 22 Dec 2016 13:13:33 GMT

Hi!

We are already pushing DACL to it.

I can see the DACL is coming down to switch.

Thanks

If you are pushing a dACL

nspasov — Fri, 23 Dec 2016 19:49:30 GMT

If you are pushing a dACL then I would expect to see " ACS ACL:your_dACL_name" in the output from "show authentication session..." I did not see that in the output that you provided. To test this further, you can issue "show ip access-list interface interface_name" after the session has completed.

Thank you for rating helpful posts!

I get this. show ip access

Capricorn — Thu, 12 Jan 2017 13:34:06 GMT

I get this. show ip access-lists interface gigabitEthernet 3/31

permit ip any any (30 estimate matches)