topic Re: ISE Pre-Auth ACL vs No Pre-Auth ACL in Network Access Control

ISE Pre-Auth ACL vs No Pre-Auth ACL

zsmithtek — Fri, 22 Nov 2019 15:00:16 GMT

A quick question about Pre-Auth ACLs.

I'm currently deploying ISE 2.4 for wired 802.1x/MAB. I do NOT have 'authentication open' on the switchports. I do have a monitor mode MAB policy to permit access on the default authZ rule for now until I get all my profile's identified and whatnot. I will deploy TrustSec after i get the profiling process completed.

My question is this. If I do NOT have a pre-auth ACL does this mean the clients have NO access or ALL access while authenticating? I have 802.1x/MAB priority and order on the switchports. Is the Pre-Auth ACL a must-have? What are use-cases to have/not have one and the access results of the clients because of the ACL existing/not-existing.

Thanks for your help.

Re: ISE Pre-Auth ACL vs No Pre-Auth ACL

Karsten Iwen — Sun, 24 Nov 2019 11:30:29 GMT

Without "authentication open" you are running "closed mode" and the switchport will only allow EAP packets and no user-packets. You need the ACL if you want to operate your switchports in "low-impact-mode" which is quite likely that you want it. But you would not start with it from the beginning. You typically begin with monitor-mode ("authentication open", no Pre-Auth-ACL and the ISE does not send any ACL to the switch) and move later to low-impact-mode ("authentication open", Pre-Auth-ACL and the ISE replaces the ACL with the right one depending on the device/user).

Re: ISE Pre-Auth ACL vs No Pre-Auth ACL

Jason Kunst — Mon, 25 Nov 2019 15:35:45 GMT

please check out wired guide https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515