topic Re: Unauthorized devices authentication (RADIUS) in Network Access Control

Unauthorized devices authentication (RADIUS)

Teayuu — Thu, 07 Mar 2019 14:24:01 GMT

Hello,

I'm working on a windows radius server, and a cisco switch 2960X.

Is it possible to put the switchport as errdisable after the authentication fail ?

I tried to configure the port security but it does not see the authentication fail as an security violation.

So even when the authentication fail, it will still put the switchport on vlan1.

Thank you for your attention.

Re: Unauthorized devices authentication (RADIUS)

Mark Elsen — Thu, 07 Mar 2019 16:25:05 GMT

- In general this is not the intended purpose of ISE as this has more fundamental consequences for the device and it's network connection. You may want to look into schemes such as CoA, to isolate devices on quarantine VLAN's (that's only an example).

Re: Unauthorized devices authentication (RADIUS)

Teayuu — Mon, 11 Mar 2019 09:45:34 GMT

Thank you for your anwser.

Do you know if it's possible to configure the access reject so it can be seen as a security violation ?

Re: Unauthorized devices authentication (RADIUS)

Mike.Cifelli — Mon, 11 Mar 2019 18:18:24 GMT

Is it possible to put the switchport as errdisable after the authentication fail ?

Not that I am aware of. If there is a way hopefully someone else will chime in.

What you are looking for can be accomplished via this under your port configs:
#authentication event fail action authorize vlan ##

HTH!