topic Re: ISE Posture on Windows machine with KVM in Network Access Control

ISE Posture on Windows machine with Hyper-V

atapiafl@cisco.com — Thu, 28 Jul 2016 22:03:42 GMT

Hello team,

I have a customer that has windows machines. When they activate KVM Hyper-V VM, it is like the network card/adapter of the machine deactivates (something like virtual switch comes in). So it is impossible to have Posture on that machine....

Do we have any kind of solution for this kind of scenarios?

Thanks!

Alex

Re: ISE Posture on Windows machine with KVM

hslai — Fri, 29 Jul 2016 05:05:56 GMT

Assuming KVM means keyboard, video, and mouse, I do not think we are supporting such at the moment, so I would suggest you to discuss it with ISE PM team.

Re: ISE Posture on Windows machine with KVM

atapiafl@cisco.com — Fri, 29 Jul 2016 18:09:19 GMT

Thanks.

My customer's scenario is like this:

There are some users who use virtual machines with Hyper-V (not KVM sorry for that mistake). They cant authenticate using 802.1x because there is more than one MAC address trying to register in the same port.

is there any way we can solve that scenario?

Thanks!

Re: ISE Posture on Windows machine with KVM

hslai — Mon, 01 Aug 2016 13:57:59 GMT

As long as the network interface of each Hyper-V VM has one and only one IPv4 MAC address and the Cisco switch interface configured in multi-auth mode, then we should be able to see each VM as its own endpoint and posture accordingly. I think you might need to check with the switch platform teams and see any scale limits.

Re: ISE Posture on Windows machine with Hyper-V

umahar — Tue, 02 Aug 2016 06:06:12 GMT

We also faced the same issue few days back although kept it aside for now.

We are hosting a virtual mobile emulator in Hyper-V in some machines. The issue we faced was that even the host machine lost connectivity when these machines were moved to multi-auth environment.

Re: ISE Posture on Windows machine with Hyper-V

atapiafl@cisco.com — Tue, 02 Aug 2016 14:20:58 GMT

Thanks Utkarsh,

How is your scenario? to what switch are you connecting your host machine? are the VM's in the host machine in L2 each one with its own IP address? Are you making posture on that environment?

Re: ISE Posture on Windows machine with Hyper-V

umahar — Wed, 03 Aug 2016 05:46:14 GMT

Alex,

I believe the issue is not with Posture but with dot1x support in Hyper-V.

It is most likely that the Hyper-V is dropping EAP packets which are layer 2 frames sent to a multicast MAC address from the host machine.

This is a known issue and Microsoft seems to have acknowledged it.

I have not seen this issue for hosts behind a vSwitch though.

Check below links

https://social.technet.microsoft.com/forums/windows/en-US/341cbe70-3fa7-4991-a7e4-4f1af63df4d0/windows-8-hyperv-8021x-eapol-request-missing

https://windowsserver.uservoice.com/forums/295050-virtualization/suggestions/8619418-let-hyper-v-virtual-switch-forward-802-1x-authenti