topic Re: pxGrid, EAPOL, and Session Directory information in Network Access Control

pxGrid, EAPOL, and Session Directory information

bricrock — Fri, 04 Aug 2017 19:36:50 GMT

My understanding is that Stealthwatch consumes Session Directory information from ISE via pxGrid to obtain IP Address, user name, and device information; however, in a wired dot1x environment where only EAPOL is allowed on unauthenticated ports, the endpoint doesn't have an IP address when the session begins. Thus, Stealthwatch seems to be missing the desired information for these connections.

Is my understanding correct or am I missing something? If I'm not, is there a way to work around this?

Thank you,

Brian

Re: pxGrid, EAPOL, and Session Directory information

hslai — Sat, 05 Aug 2017 20:15:29 GMT

If the endpoints have no IP addresses, then they would not be able to go anywhere. Thus, why would we need their info in StealthWatch?

Re: pxGrid, EAPOL, and Session Directory information

bricrock — Mon, 07 Aug 2017 13:10:20 GMT

Thanks, hslai; but the client receives an IP address only after successful EAP authentication. So the question is when/how does Session Directory information get updated?

Re: pxGrid, EAPOL, and Session Directory information

Timothy Abbott — Mon, 07 Aug 2017 15:24:53 GMT

If I'm not mistaken, it should be via RADIUS accounting.

Regards,

-Tim

Re: pxGrid, EAPOL, and Session Directory information

hslai — Mon, 07 Aug 2017 17:24:32 GMT

Tim is correct that NAD sends RADIUS interim accounting updates to notify ISE the client's IP has changed. For ISE 2.1+, we see such updates in the RADIUS accounting reports (CSCuz47260).