topic Re: ISE Posture with Non-compatible switches like Cisco 2950 in Network Access Control

ISE Posture with Non-compatible switches like Cisco 2950

lsin — Wed, 30 Aug 2017 09:43:00 GMT

Team,

I would like to find out following is possible for ISE posture with non-compatible switch like 2950:

Setup:

ISE 2.3
Non-compatible switch Cisco 2950

Goal:

Achieve posture checking on endpoint

Suggest Solution:

Implement AnyConnect on Endpoint for 802.1x and Posture checking
Use port denounce to move endpoint to quarantine VLAN for non-compliance endpoint
I am not sure if this is part of SNMP CoA. If not, is it possible to use SNMP CoA as well to achieve similar goal

Regards,

Leslie

Re: ISE Posture with Non-compatible switches like Cisco 2950

Craig Hyps — Wed, 30 Aug 2017 13:14:16 GMT

SNMP CoA does not work on most Cisco switches due to CSCvb48180 [ENH ISE SNMP support for cisco switches]. This is being addressed in ISE 2.4

/Craig

Re: ISE Posture with Non-compatible switches like Cisco 2950

lsin — Wed, 30 Aug 2017 14:20:56 GMT

Thanks Craig for the info. I am not familiar with SNMP CoA and as you've mentioned that 2950 does not support SNMP CoA, but is it possible to use SNMP to shut and no shut or to debounce the switch port if connected device does not meet the posture compliance requirement?

Regards,

Leslie

Re: ISE Posture with Non-compatible switches like Cisco 2950

lsin — Wed, 30 Aug 2017 14:28:44 GMT

Hi Crag,

Reason for denounce is to change the VLAN due to failure of posture requirements.

Regards,

Leslie

Re: ISE Posture with Non-compatible switches like Cisco 2950

Craig Hyps — Wed, 30 Aug 2017 14:48:52 GMT

Review bug id. It is specific to SNMP CoA which is used for purpose of bouncing port (shut/no shut) in absence of RADIUS CoA, or specific SNMP command that is able to perform port bounce or reauth.

Re: ISE Posture with Non-compatible switches like Cisco 2950

lsin — Wed, 30 Aug 2017 17:12:33 GMT

Noted and thanks.

Regards,

Leslie

Re: ISE Posture with Non-compatible switches like Cisco 2950

hasitha siriwardhana — Sat, 03 Mar 2018 06:05:40 GMT

Hi All,

We have tested with ISE 2.4 beta with SNMP COA with 2950G, After posture status get compliant ISE is sending a SNMP COA request to the port.

But the posture flow start from begining after the SNMP shut/no shut happens on the swith port. So it keep happens

May be due to session ID changes? Any clue?

regards

hasitha

Re: ISE Posture with Non-compatible switches like Cisco 2950

Jason Kunst — Sat, 03 Mar 2018 08:07:34 GMT

Are you on the latest beta build?

Re: ISE Posture with Non-compatible switches like Cisco 2950

hasitha siriwardhana — Sat, 03 Mar 2018 08:34:51 GMT

Yeah.. We are on the latest build, downloaded one week back.

SNMP COA is happening,but port shut/no shut giving the ISE to think as new request.

Seems the account ID changes with all the request.

So posture checking keep happening.

In the ISE settings posture lease have configured like this.Since the sessions ID change create as new auth request

Perform posture assessment every time a user connects to the network

I changed it using posture assement every day. It stopped that. But that creates a new issue.

Even the non compliant device moves to compliant stage after remidiation,still it's on the old rule.

regards

hasitha

Re: ISE Posture with Non-compatible switches like Cisco 2950

Jason Kunst — Sat, 03 Mar 2018 08:39:22 GMT

Seems like it would be compliant if you only require 1x a day

I am inquiring when it’s expected

Re: ISE Posture with Non-compatible switches like Cisco 2950

hasitha siriwardhana — Sat, 03 Mar 2018 08:49:52 GMT

I think Our issue is ISE SNMP COA shut/No Shut creates new auth request from the switch with different sessions, may be due to a bug.

So new auth request makes the posture agent to keep running posture check status.So it makes the loop.

yeah ...please

Regards

hasitha

Re: ISE Posture with Non-compatible switches like Cisco 2950

hslai — Mon, 05 Mar 2018 00:35:24 GMT

CSCvb48180 is still being worked on. You are correct that the session stitching having some issues.

Re: ISE Posture with Non-compatible switches like Cisco 2950

Craig Hyps — Mon, 05 Mar 2018 03:12:54 GMT

I believe you will find the solution to be to configure the device as vendor "Other". You can duplicate existing Cisco profile, but change vendor to non-Cisco. The reason being is that session stitching logic is specific to 3rd-party NADs.

Please note that this community is not for answering questions on beta builds. Please use the beta support alias for pre-release code.

Craig

Re: ISE Posture with Non-compatible switches like Cisco 2950

hasitha siriwardhana — Mon, 05 Mar 2018 07:07:22 GMT

Hi Chyps,

It worked, the posture scan checking as a loop has stopped. Now it only check twice.Any ideas why it check twice?

But still 2950G switches we have seen the NAS port -ID as zero. So it sends SNMP COA for port 0.Not for the correct port.

Regards

Hasitha

Re: ISE Posture with Non-compatible switches like Cisco 2950

Craig Hyps — Mon, 05 Mar 2018 13:33:36 GMT

That issue is due to selecting vendor type as Cisco. If set vendor to value Other, then NAS-Port should get set correctly. Alternatively, you could use the NAS-Port-Id which I also used in testing. However, you will need Regex to capture the proper interface name. I was planning on writing a guide later this spring to highlight some of these use cases, but understand you are trying to config now.

I have notified engineering team of the inconsistencies. Realize that session stitching is typically not required or desirable for most Cisco switches that support RADIUS CoA, and that most/all 3rd-party switches do not support CoA Reauth, which is why current logic does not perform this function when vendor set to "Cisco".

Re: ISE Posture with Non-compatible switches like Cisco 2950

hasitha siriwardhana — Mon, 05 Mar 2018 14:02:08 GMT

Hi Chyps,

But still SNMP COA wasn't working as expected ,because it's not able detect the port correctly.

We cant use this currently - 1.3.6.1.2.1.2.2.1.7.$port

The Nas port shows as 50002 and SNMP COA send to port 0. It wasnt able to send the $port SNMP COA.

	15054	Sending SNMP set : - 1.3.6.1.2.1.2.2.1.7.0 = 2
	15054	Sending SNMP set : - 1.3.6.1.2.1.2.2.1.7.0 = 1

Can you help us on fixing this

regards

hasitha

Re: ISE Posture with Non-compatible switches like Cisco 2950

Craig Hyps — Mon, 05 Mar 2018 14:24:02 GMT

Please post/email copy of your NAD Profile as well as Live Log details on value of NAS-Port and NAS-Port-Id sent by switch.

Re: ISE Posture with Non-compatible switches like Cisco 2950

hasitha siriwardhana — Mon, 05 Mar 2018 14:33:57 GMT

I have attached the requested files

Re: ISE Posture with Non-compatible switches like Cisco 2950

Craig Hyps — Mon, 05 Mar 2018 15:34:09 GMT

Note that 3rd-file is same as first.

Since the switch itself is sending value of NAS-Port-Id = 0, there is not much ISE can do with this value. I know in later IOS releases there are options to set this manipulate the value for this attribute, but may not have option to change in cat2950 12.1.x code.

The alternative is NAS-Port. There is a separate issue where value is not same as interface index. We are looking at a workaround, but cannot discuss in public forum. I suggest work with Cisco account team regarding potential enhancements and continue any further discussion related to beta code in beta support forum.

Re: ISE Posture with Non-compatible switches like Cisco 2950

hasitha siriwardhana — Mon, 05 Mar 2018 16:34:37 GMT

May be Switch doesn’t send Nas-Port-ID , So ISE is putting it as 0 value.

It send NAS port with a 50002 value and SNMP COA port bounce not working due to this.

Hope we can have a work around soon.Thank you again..