topic Re-authentication force dot1X in Network Access Control

Re-authentication force dot1X

victguti — Thu, 20 Sep 2018 09:31:07 GMT

Hello,

I have a switch port configured to authenticate with order first MAB and then dot1X. The priority has been setup in the opposite way, first dot1X then MAB. I would like to re-authenticate devices (phones in this case) but it seems when I run "clear dot1x int ..." or "clear authentication sessions int ..." the switch is not sending the EAP-Request/Identity and MAB occurs after running them.

Is there any command to force the switch to use dot1X send the EAP-Request/Identity to the endpoint? Unfortunately, I cannot change the switch port configuration and shut/no shut is not allowed either.

Thanks and regards,

Víctor.

Re: Re-authentication force dot1X

paul — Thu, 20 Sep 2018 12:39:10 GMT

I believe that is the downside of doing mab first, which is something I never do. When you do MAB first you are forcing the connecting device to initiate Dot1x which some devices like Macs are only responders. In addition, as you are seeing you may have issues during reauthentication.

Re: Re-authentication force dot1X

howon — Thu, 20 Sep 2018 19:20:03 GMT

You can force reauthentcation using 802.1X by adding Cisco VSA:termination-action-modifier=1 to the authorization profile along with the reauthentication parameters even when the ordering dictates MAB first. Please see '802.1X and MAB ordering section' of the following document for more information:

https://community.cisco.com/t5/security-documents/top-ten-mis-configured-cisco-ios-switch-settings-for-ise/ta-p/3643912#toc-hId--1759816418