Enroll a Mgt port as dot1x supplicant (client) to AD

Zarra — Fri, 15 Nov 2019 15:30:27 GMT

Hi everybody

I'm building a lab to test the authentication methodes of all connected clients in our company (cameras, fire access points, PC, IP phones, APs., technical devices..etc) to our IP N/W. To do that I've a C3650-24 switch acting as authenticator on which I configured port24 as SPAN for wireshark, I've also a Cisco ISE as test Radius/ Tacacs as authentication server (with AD) and the Infoblox as DHCP/DNS servers. I try to test dot1x compatibility of client devices or for legacy ones fixed IP, the alternative MAB authentication methode.

Before testing real client devices, I've choosen a C3650s as generic test device and its Ethernet Management port on which I can give a static IP or DHCP reservation IP config and to simulate its authentication with dot1x or with its mac add (for MAB), all works fine with MAB except that I cannot install a dot1x certificat on that management port and I don't know if it's really possible to make it configured as a supplicant candidate to enroll for a dot1x certificate over the company's AD and ISE, any idea is very welcome

Re: Enroll a Mgt port as dot1x supplicant (client) to AD

Anurag Sharma — Sun, 17 Nov 2019 14:23:08 GMT

Hi @Zarra ,

You can try the NEAT configuration (highly complicated). But if you are simply doing a test for 802.1x and MAB, using a switch as a test device is really not the ideal candidate. Trust me.

Moreover, this is not a 'real-world scenario', even for your own customer.

You can use any PC, even the one you are using to logging into the switch 😛

topic Enroll a Mgt port as dot1x supplicant (client) to AD in Network Access Control

Enroll a Mgt port as dot1x supplicant (client) to AD

Re: Enroll a Mgt port as dot1x supplicant (client) to AD