IBNS 2.0 Config Check

Dan — Fri, 21 Feb 2020 19:00:37 GMT

I am testing changing our switch config over from old style to new IBNS 2.0. I have it working but was hoping someone could check it for me and see if i'm on the right track and help me with a couple of things:

service policy:

policy-map type control subscriber DOT1X_AND_MAB
 event session-started match-all
  10 class always do-until-failure
   10 authenticate using dot1x priority 10
   20 authenticate using mab priority 20
 event authentication-failure match-first
  5 class DOT1X-FAILED do-until-failure
   10 terminate dot1x
   20 authenticate using mab priority 20
  10 class DOT1X-NO-RESP do-until-failure
   10 terminate dot1x
   20 authenticate using mab priority 20
  30 class MAB-FAILED do-until-failure
   10 terminate mab
   20 authentication-restart 60
  40 class always do-until-failure
   10 terminate dot1x
   20 terminate mab
   30 authentication-restart 60
  50 class AAA-SVR-DOWN-AUTHD-HOST do-until-failure
   10 pause reauthentication
 event agent-found match-all
  10 class always do-until-failure
   10 terminate mab
   20 authenticate using dot1x priority 10
 event aaa-available match-all
  10 class AAA-SVR-DOWN-AUTHD-HOST do-until-failure
   10 resume reauthentication
 event violation match-all
  10 class always do-until-failure
   10 restrict

class-map type control subscriber match-all AAA-SVR-DOWN-AUTHD-HOST
match result-type aaa-timeout
match authorization-status authorized


class-map type control subscriber match-all MAB-FAILED
match method mab
match result-type method mab authoritative

class-map type control subscriber match-all DOT1X-FAILED
match method dot1x
match result-type method dot1x authoritative

class-map type control subscriber match-all DOT1X-NO-RESP
match method dot1x
match result-type method dot1x agent-not-found

interface config:

template Dot1x-Port

 dot1x pae authenticator
 switchport access vlan 1xx
 switchport mode access
 switchport voice vlan 1xx
 mab
 access-session closed
 access-session port-control auto
 access-session host-mode multi-auth
 authentication periodic
 authentication timer reauthenticate server
 service-policy type control subscriber DOT1X_AND_MAB
 description - Dot1x -

This works ok but I'm having trouble figuring out how to authorize the voice vlan if the AAA server goes down but I DON'T want to authorize anything else or enable the critical VLAN with ACL (we are working in closed mode) - i still need the 'critical' voice VLAN to be the same as it is now. I can see there is this config:

10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
   30 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
   40 authorize

But will this authorize all the ports and any devices on any other VLAN as well?

topic IBNS 2.0 Config Check in Network Access Control

IBNS 2.0 Config Check