topic Re: Reauthentication Timer in Network Access Control

Reauthentication Timer

Jason Weids — Fri, 15 Feb 2019 11:07:05 GMT

Hello,

Why do devices that are unknown or that have no authorization policy constantly try to reauth every minute? Surely once they have failed & denied access a few times then you don't want them constantly sending radius requests. Is there a way to change the reauth timer so it only reauth when the port transitions to "up connected"?

Jason

Re: Reauthentication Timer

paul — Fri, 15 Feb 2019 13:35:37 GMT

Unless you are doing a complete whitelisted setup, you really shouldn't be denying access to the network. Every device should have an authorization policy applied. The default policy should be a Limited Access policy with a DACL applied to allow access to the PSNs and DNS. DNS is there to allow redirection to a portal if you want.

Re: Reauthentication Timer

Mike.Cifelli — Fri, 15 Feb 2019 13:45:06 GMT

If you are not using an ISE authorization policy result that pushes reauthentication timer then the fallback will be whatever you have configured on the host port.
dot1x reauthentication
dot1x timeout reauth-period (seconds)
Those commands will enable periodic re-authentication and set the number of seconds between re-authentication attempts.

HTH!

Re: Reauthentication Timer

hslai — Sat, 16 Feb 2019 21:16:49 GMT

I agree with paul.

dot1x timeout quiet-period seems what you asked for.

Re: Reauthentication Timer

Jason Weids — Mon, 18 Feb 2019 09:37:49 GMT

We are whitelisting. Nothing should be allowed to connect to the wired network in our environment unless it is a "known/trusted" device. The devices we are seeing which are not authorised are filling our live radius logs & it is these I want to limit.

Re: Reauthentication Timer

Jason Weids — Mon, 18 Feb 2019 09:41:10 GMT

I probably should have mentioned we are doing MAB authentication not dot1x

Re: Reauthentication Timer

Jason Weids — Mon, 18 Feb 2019 09:42:52 GMT

Can you do this with MAB authentication?

Re: Reauthentication Timer

paul — Mon, 18 Feb 2019 13:36:18 GMT

Even in a whitelisted setup I would still not deny as the last rule in the wired MAB policy set. Allow the connection and put a DACL on to limit access to the ISE PSNs and maybe other security products to allow a device not whitelisted to be profiled/scanned to gather information about it.

Re: Reauthentication Timer

Jason Weids — Fri, 01 Mar 2019 10:24:42 GMT

That really helpfull, That might be what you would do but in our environment we only allow authorised devices on the wired network.