topic Re: After Insert "Access session closed", necessary to "shut no shut" the interface? in Network Access Control

After Insert "Access session closed", necessary to "shut no shut" the interface?

getaway51 — Wed, 30 Oct 2019 16:08:23 GMT

Hi,

Currently the port is running on monitor mode with " no access-session closed"

I can see the endpoint in ISE.

I insert a new command " access-session closed"

Do i need to "shut and no shut" the interface? or will it re-authenticate? any difference in ISE logs, sessions or Context visibility when change of mode?

Re: After Insert "Access session closed", necessary to "shut no shut" the interface?

howon — Fri, 01 Nov 2019 14:51:37 GMT

Best practice is to shut/no shut after the command as to clear any inconsistencies.

Re: After Insert "Access session closed", necessary to "shut no shut" the interface?

getaway51 — Sat, 02 Nov 2019 04:19:51 GMT

Hi,

Previously when configuring monitor mode, already "shut and no shut"

Now insert ""Access session closed"", need to do it again?

Re: After Insert "Access session closed", necessary to "shut no shut" the interface?

getaway51 — Wed, 06 Nov 2019 13:54:25 GMT

Hi,

It is very strange, after i insert "access session closed", it seems tht everythign was blocked after i "shut, no shut" the port.

Is there any other settings need to change?

The MAC address was already under correct Identity group. Anything tht I missed out probably?

Re: After Insert "Access session closed", necessary to "shut no shut" the interface?

hslai — Sat, 09 Nov 2019 17:07:48 GMT

If auth success in ISE and only blocked on the switch, likely the switch does not like some of the attributes sent down from ISE.

I would try simpler authz profile(s) if I were you.