topic Re: 802.1x and MAB authentication using a Workgroup in Network Access Control

802.1x and MAB authentication using a Workgroup

latenaite2011 — Fri, 21 Feb 2020 18:57:32 GMT

Just wondering what is the best way to test 802.1x and MAB authentication using a workgroup without an AD or certificate environment.

Re: 802.1x and MAB authentication using a Workgroup

Arne Bier — Wed, 06 Jun 2018 05:56:58 GMT

you can fake this with a clever lab setup - all the tools are available in open source. Have a look at my 3 part series of how to do this

Rapid prototyping ISE Policies without any real networking hardware (part 1)

Rapid prototyping ISE Policies without any real networking hardware (part 2)

Rapid prototyping ISE Policies without any real networking hardware (part 3)

I use this all the time to test EAP-EAP, EAP-TLS, PAP/ASCII auth

Re: 802.1x and MAB authentication using a Workgroup

latenaite2011 — Wed, 06 Jun 2018 16:09:45 GMT

Hi Arne,

Excellent.

I will try all that you have suggested.

I do have a Cisco Catalyst switch, a Windows 7 (just not an AD or
Certificate server) so was wondering also if there is a
quick to match on the Windows Workstation (non-domain) attribute to just
create an authentication and authorization policy to make things work.

Thank you!

Re: 802.1x and MAB authentication using a Workgroup

Arne Bier — Wed, 06 Jun 2018 22:17:30 GMT

well you could always create local identities (accounts) on ISE and then authenticate against those. Not sure what you mean exactly by matching on workgroup attributes? Maybe an example (I am not a Microsoft jockey ;-> )

Re: 802.1x and MAB authentication using a Workgroup

latenaite2011 — Thu, 07 Jun 2018 00:58:45 GMT

Hi Anre,

I am good with this. Thank you for the reply.

I was able to test your radclient tool and works fine. Thank you!

I was able to get MAB authentication working on a laptop that was
configured part of a Endpoint group and was trying to test with a different
laptop newly plugged in. I wasn't able to connect, which is fail, but the
"show authen session" fails that is it Authz Failed (see below), but I
don't see the Mab authentication ( I have made sure that 802.1x is
disabled).

Port 7 is configured similar to the one that was working. So why wouldn't
it show mab for method?

Secondly, I was testing port 2/0/6 again and had disconnected the cable for
a different test and thought I would try connect, now that computer can't
connect and don't get authen successful. I noticed that the mac address of
that computer is not under the Endpoint Group that I added it to (which
matched the policy that I created it for). Why would a mac address get
deleted from a Identity Group under Work Centers, Device Admin - Identity
Groups - Endpoint Identity Groups - Workgroup..

Gi2/0/7 0026.b99f.09b5 N/A DATA Authz Failed
C0A8015D000001E20C2BCE18

Does the mac address get deleted every time a computer disconnects?

So what would happen to we manually add a mac address to a Whitelist
EndPoint Identity group and that gets deleted if the computer is
disconnected, we have to add it back everytime?

Re: 802.1x and MAB authentication using a Workgroup

Arne Bier — Thu, 07 Jun 2018 01:25:22 GMT

Although I understand the theory of MAB, I don't have much experience with wired switches at the moment. I mostly deal with MAB in the context of wireless guest.

If you are using profiling then perhaps the endpoint gets moved from one Endpoint Identity Group to another. I don't use profiling so I wouldn't know. When I have placed a MAC address in an Endpoint Identity Group then it has always remained there, unless I deleted it via the Context Visibility page, or if I deleted a Sponsored Guest Account via the Sponsor Portal (and that is then the expected behaviour).

Re: 802.1x and MAB authentication using a Workgroup

latenaite2011 — Thu, 07 Jun 2018 02:19:45 GMT

Hi Arne,

Yes, looks like it was because of me deleting the endpoint from the Context
Visibility.

That is how I tested with dot1x too so have to see how to go about being
able to test this again under 802.1x if the mac has
been provided.

thank you!