topic ISE MAB issue in Network Access Control

ISE MAB issue

amrelquasaby — Mon, 11 Mar 2019 07:09:01 GMT

ISE MAB failure cause of missing of MAC

where does all those "no"

pieterh — Fri, 14 Oct 2016 07:39:11 GMT

where does all those "no" statements come from?????

no radius-server attribute 8 include-in-access-req
no radius-server attribute 25 access-request include
no radius-server dead-criteria time 120 tries 10

no radius-server key 0 P@ssw0rd
no radius-server host 10.255.255.13 auth-port 1812 acct-port 1813
no radius-server host 10.255.255.14 auth-port 1812 acct-port 1813
no radius-server host 10.255.255.13 test username ise_probe idle-time 30
no radius-server host 10.255.255.14 test username ise_probe idle-time 30

no radius-server vsa send accounting
no radius-server vsa send authentication

no ip radius source-interface vlan300

no dot1x system-auth-control

@pieterh

Ahmed — Fri, 14 Oct 2016 16:25:33 GMT

@pieterh

The No before commands is putted by accident.

Hello Amr,

Ahmed — Fri, 14 Oct 2016 16:27:48 GMT

Hello Amr,

it seems the identity source sequence which ISE match on it NOT include Internal Endpoints, please double check the identity source sequence which you used for Authenticating users including Internal Endpoints.

Ahmed,

amrelquasaby — Sun, 16 Oct 2016 12:34:28 GMT

Ahmed,

Kindly be informed that the authentication policy check for Internal Endpoints only, although the logs file check for All_User_ID_Stores, that is not found in the policy.

Ok, that's clear

pieterh — Mon, 17 Oct 2016 14:53:18 GMT

Ok, that's clear

back to the real issue.

your MAC-address is not recognized as MAC address

that's why the MAB rule is not activated, but the default rule

and the default rule checks all users identity stores, not the internal endpoints.

I'm missing some lines in the switch config:

radius-server attribute 31 mac format ietf

transforms the xxxx.xxxx.xxxx mac adrress to xx-xx-xx-xx-xx-xx format in the radius packet sent from switch to ISE

maybe this helps

radius-server attribute 31 mac format

To configure a nondefault MAC address format in the calling line ID (CLID) of a DHCP accounting packet, use the radius-server attribute 31 mac format command in global configuration mode. To revert to the default MAC address format, use the no form of this command.

radius-server attribute 31 mac format { default | ietf [ lower-case | upper-case ] | unformatted }

no radius-server attribute 31 mac format { default | ietf [ lower-case | upper-case ] | unformatted }

Syntax Description

default	Sets the MAC address format to the default format (for example, aaaa.bbbb.cccc).
ietf	Sets the IETF format for MAC addresses (for example, aa-aa-bb-bb-cc-cc).