MAB Failing Even Though Authc is Successful

jupoole — Mon, 25 Sep 2017 23:37:11 GMT

ACS/IBNS Teams,

Customer is saying they cannot get mab working on a 3750 but the same host works on a 3560 if moved. Basically, it shows Authc successful but the port state still shows as unauthorized.

I have attached the logs. Any ideas? My next step is to also post to the ISE support community. However, this is ACS as the server today.

Re: MAB Failing Even Though Authc is Successful

bfruits — Tue, 26 Sep 2017 12:35:47 GMT

Hi Justin,

I'd first suggest that you try taking the comments ( ! ) out of your dACL contents. Older platforms in particular can have problems with dACL lines that are not true access control entries.

The logs may stop short but my assumption is that you are getting AuthC success and AuthZ failure on the switch - meaning the switch is not able to apply the authorization instructions sent by ACS. AuthZ failure should be shown in normal logging levels, but you could also try debugging EPM to determine if the dACL is being applied.

These commands may also help with troubleshooting:

show ip access-list #ACSACL#-IP-LM-PERMIT-ALL-57217a63

show ip access-list g1/0/2

Hope this helps,

-Fruits

topic Re: MAB Failing Even Though Authc is Successful in Network Access Control

MAB Failing Even Though Authc is Successful

Re: MAB Failing Even Though Authc is Successful