topic Re: Re-Authenticate End hosts after ISE failure in Network Access Control

Re-Authenticate End hosts after ISE failure

ShaunGreen — Fri, 17 Apr 2020 18:40:35 GMT

Dear All,

We are using IBNS 2.0 with dot1x and mab.

Everything so far is working in our testing and when we simulate an ISE failure the Critical service template allows the end hosts access to the network.

When the ISE server comes back online, the dot1x hosts re-authenticate and pickup their correct policy sets.

But the MAB (profiled) devices stay in the Critical state.

Does anyone know the best procedure to automatically re-authenticate these devices once the ISE server is back online?

Thanks in advance.

Re: Re-Authenticate End hosts after ISE failure

poongarg — Sun, 19 Apr 2020 00:28:47 GMT

Please attach the "sh tech" output from the switch.

Re: Re-Authenticate End hosts after ISE failure

ShaunGreen — Mon, 20 Apr 2020 07:05:43 GMT

Hi, Thanks for your interest.

To give some more information, I closed down the ISE application on Friday evening. Everything failed over using the 'Critical' service template (screen shot below).

When the Radius servers are back online, the dot1x hosts re-autenticate, but the MAB profiled devices are still staying on the Critical service template.

We could manually carry out a COA from ISE for these hosts, but I'm wondering if there is a way to configure re-authentication once the ISE is up and running without manual intervention?

Code is 16.9.4

Re: Re-Authenticate End hosts after ISE failure

Damien Miller — Mon, 20 Apr 2020 15:34:17 GMT

It appears you may be missing policy required to resume authentication once AAA comes back online, you need to exit critical auth. If you follow Hari's secure wired access prescriptive guide you can see how this could be done.
https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

ex.
"event aaa-available match-all
10 class IN_CRITICAL_AUTH do-until-failure
10 clear-session
20 class NOT_IN_CRITICAL_AUTH do-until-failure
10 resume reauthentication"

Re: Re-Authenticate End hosts after ISE failure

ShaunGreen — Fri, 24 Apr 2020 07:34:38 GMT

Hi Damien,

Thanks for you assistance, it took me a while to test this and to be honest, IBNS2.0 is a bit tricky to get your head around after being used to the 'old' ways....but it now looks to be working well.

Thanks again.