topic Re: Authentication open vs authentication order mab | dot1x in Network Access Control

Authentication open vs authentication order mab | dot1x

Ibrahim Jamil — Fri, 21 Feb 2020 18:42:52 GMT

Hello Freinds

is okay inder the interface connected to Dot1xPC and MAB PC to use authentication open , instead of

authentication order mab for MAB PC

authentication order dot1x for Dot1xPC

thanks

Re: Authentication open vs authentication order mab | dot1x

Ben Walters — Wed, 03 Jan 2018 13:19:17 GMT

Both dot1x and MAB are methods of authentication for a port, whereas authentication open provides no authentication for a port, it allows all traffic through if a host is authenticated successfully or not.

It is used when setting up dot1x configurations in monitor mode. You could have both dot1x/MAB authentication and authentication open to log authentication details but allow a user access even if they fail authentication.

The authentication order commands only specify which method of authentication to try first between mab, dot1x and webauth. If you are looking at a dot1x setup the authentication order commands don't provide authentication, it would be the mab and dot1x pae authenticator interface commands.

Re: Authentication open vs authentication order mab | dot1x

andre.ortega — Wed, 03 Jan 2018 13:20:06 GMT

Hi Ibrahim,
those options are not opposite, they are complementary.
However, it is importante to notice that with authentication open you should use an ACL at interfaces to controll what can and what cant be accessed.
Look for ISE low impact mode.

Re: Authentication open vs authentication order mab | dot1x

Ibrahim Jamil — Wed, 03 Jan 2018 14:57:48 GMT

Hello freinds

thanks for explaning

so the below is for better operation

so in the port conncted to mab pc , the authentication order is mab

while port connected to dot1xpc , authentication order must be dot1x

thanks all

Re: Authentication open vs authentication order mab | dot1x

andre.ortega — Wed, 03 Jan 2018 15:29:10 GMT

Not necessary. You can configure all of the interfaces as:

authentication order mab dot1x
authentication priority dot1x mab

Re: Authentication open vs authentication order mab | dot1x

Octavian Szolga — Tue, 09 Jan 2018 13:27:03 GMT

Hi,

Please take into account that authentication open is useful only if the authentication/authorization fails.

There is a common misconception that if you have authentication open your hosts can't be affected by any ISE policy change.

Still, even if you have authentication open but ISE sends a dACL with deny any or places you to a specific (blackhole) VLAN that authorization will apply.

Same applies if your last rule (before deny) is guest portal. Everyone will be trapped in the guest portal authorization rule, and the authentication open command would be useless.

Authentication open is great only if your hosts that are not authenticated match a deny rule. (in this case in the authorization policy)

Thanks,

Octavian

Re: Authentication open vs authentication order mab | dot1x

shamax_1983 — Fri, 26 Apr 2019 03:46:34 GMT

This is very true. Indeed a big misconception that no Cisco doc clarifies anywhere.

Re: Authentication open vs authentication order mab | dot1x

getaway51 — Thu, 10 Oct 2019 15:41:51 GMT

Hi,

1)Under monitor mode, If there is no dACL(no deny), will there be still blocking of MAB or 802.1x devices? considering authorization policy doesn't goes through (due to missing the device MAC address in Identity group)

IF there is a blocking, who and how it works?

2)Furthermore, how to ensure there is no blocking when runnning monitor mode?

3)I also heard tht there could be no blocking even during "closed mode". How possible is this?

Re: Authentication open vs authentication order mab | dot1x

K_L — Fri, 10 Jan 2020 18:14:35 GMT

For the most part devices will still attempt to authenticate MAB or 802.1x. But with monitor-mode, there will normally be a default dACL that allows all traffic at the end of the authorization policy. So devices will try to authenticate first, but even if they fail they are allowed through. If you added a default policy to your low-impact or closed policy set that also permits all traffic, then the behavior would be the same as monitor-mode (depending on the other rules in the authorization policy).

Re: Authentication open vs authentication order mab | dot1x

getaway51 — Mon, 13 Jan 2020 02:30:31 GMT

Any config example how the typical config involving "default dACL" will looks like for monitor & closed mode?

And how can i confirm those "default dACL" rules in Authorization policy?

Re: Authentication open vs authentication order mab | dot1x

getaway51 — Mon, 13 Jan 2020 02:34:05 GMT

Hi,

Thanks so much for yr given scenario.

Can you give some config examples based on 1) and 2) as compared to typical config(all allow or deny?).

1)Still, even if you have authentication open but ISE sends a dACL with deny any or places you to a specific (blackhole) VLAN that authorization will apply.

2)Same applies if your last rule (before deny) is guest portal. Everyone will be trapped in the guest portal authorization rule, and the authentication open command would be useless.

But can I say, rule in the end shld be "all-deny" supposedly?

Re: Authentication open vs authentication order mab | dot1x

hslai — Wed, 15 Jan 2020 01:54:58 GMT

Please review the info at ISE Secure Wired Access Prescriptive Deployment Guide