IBNS 2.0 two radius servers in policy

dawid.karol.bednarczyk — Tue, 26 Jun 2018 13:39:35 GMT

Hi,

Did somebody manage to use two radius servers in Policy for dot1x?

We are doing a migration of clients and ISE and it would be helpful to check both servers and act on first access-accept.

I am basing the idea on slides from Cisco Live Session:

https://clnv.s3.amazonaws.com/2015/anz/pdf/BRKSEC-2691.pdf

This would be Concurrent Authentication + Differentiated Authentication at the same time.

I tried different ideas but I did not manage to get it to work until now.

2 examples:

#####################

policy-map type control subscriber POLICY_Gi1/0/1

event session-started match-all

10 class always do-until-failure

10 authenticate using dot1x aaa authc-list RADIUS_NEW authz-list RADIUS_NEW priority 10

20 authenticate using dot1x aaa authc-list RADIUS_OLD authz-list RADIUS_OLD priority 15

event authentication-success match-all

10 class always do-until-failure

10 activate service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE

#####################

policy-map type control subscriber POLICY_Gi1/0/1

event session-started match-all

10 class always do-until-failure

10 authenticate using dot1x aaa authc-list RADIUS_NEW authz-list RADIUS_NEW priority 10

20 class always do-until-failure

10 authenticate using dot1x aaa authc-list RADIUS_OLD authz-list RADIUS_OLD priority 15

event authentication-success match-all

10 class always do-until-failure

10 activate service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE

I am wondering if this is possible at all.

Re: IBNS 2.0 two radius servers in policy

howon — Tue, 26 Jun 2018 23:42:24 GMT

It sounds creative, but not sure why one would need such setup even for migration. Differentiated Auth is for using different RADIUS server for MAB and 802.1X so would not apply to this use case and frankly I don't think you can have IOS check multiple RADIUS servers for 802.1X unless you are trying to load-balance request. Also, note that concurrent auth is not supported if using ISE as RADIUS server.

If you can elaborate on what you are trying to achieve at a higher level, we may be able to provide other options.

topic IBNS 2.0 two radius servers in policy in Network Access Control

IBNS 2.0 two radius servers in policy

Re: IBNS 2.0 two radius servers in policy