NAC Order MAB DOT1x

NetwkChris — Wed, 08 Aug 2018 14:51:00 GMT

Hello,

I am experiencing an issue with my network that certain PC's have trouble with authentication. What is happening is that the device authenticates with dot1x first, but then after the 1 hr timer forces the device to re-athenticate. Which causes the device to re-authenticate into MAB, it is put it into the vlan that was created for imaging. The device before it goes to the end-user was imaged using MAB first. Then the customer plugs it in and it authenticates via dot1x, but after the re-authentication timer expires it goes into MAB, and doesnt return to dot1x like it is supposed to, so it can get into the data vlan.

Has anyone had this issue before?

Here is my port config:

description NAC
shut
switchport mode access
mtu 9000
ip device tracking maximum 0
no cdp enable
authentication event fail action next-method
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication control-direction in
authentication host-mode multi-domain
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate 3599
authentication violation replace
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 10
storm-control broadcast include multicast
storm-control broadcast level 2.00
storm-control action trap
spanning-tree portfast edge
spanning-tree bpduguard enable
ip verify source vlan dhcp-snooping
no shut
end

Re: NAC Order MAB DOT1x

howon — Wed, 08 Aug 2018 15:20:54 GMT

Yes, that is expected behavior. If you want to change the behavior so reauth performs 802.1X instead of MAB, please see setting up VSA with Authorization profile part on this document: Top Ten mis-configured Cisco IOS Switch settings for ISE integration

Re: NAC Order MAB DOT1x

NetwkChris — Wed, 08 Aug 2018 20:18:24 GMT

Thanks for the quick reply! I did some testing and added this to the NAC RADIUS server and got it working.

topic Re: NAC Order MAB DOT1x in Network Access Control

NAC Order MAB DOT1x

Re: NAC Order MAB DOT1x

Re: NAC Order MAB DOT1x