topic Re: Wired 802.1x Endpoint IP Issue in Network Access Control

Wired 802.1x Endpoint IP Issue

fatalXerror — Fri, 16 Oct 2020 15:33:48 GMT

Hi Guys,

I am doing a wired 802.1x via ISE 2.7 and I had a successful test however, one thing I noticed in my testing. In the RADIUS Live Logs, I can see that my endpoint is being successfully authenticated and authorized to the correct VLAN and my endpoint is able to get an IP address from the DHCP server however, in the RADIUS Live Logs and in the switchport (show auth session int), I cannot see the endpoint's IP address.

The switch is configured dhcp snooping, device sensor, and radius-server vsa attributes but still, the IP address is not showing in either the switchport or RADIUS Live Logs.

The topology is looks is something like this;

TOPOLOGY:

Endpoint <-> Access-Switch <-cascaded to-> Access-Switch <-> Core-Switch <-> WAN <-> DHCP

Thanks

Re: Wired 802.1x Endpoint IP Issue

MHM Cisco World — Fri, 16 Oct 2020 15:42:19 GMT

Radius come before the dhcp request.

so when endpoint connect to radius it not yet get IP address from dhcp server.

Re: Wired 802.1x Endpoint IP Issue

Andrii Oliinyk — Fri, 16 Oct 2020 17:03:59 GMT

did u check dhcp-parms are correctly received by the ISE? perhaps u need to add ISE as DHCP-relay in the SVI config

Re: Wired 802.1x Endpoint IP Issue

Aref Alsouqi — Fri, 16 Oct 2020 17:16:56 GMT

You need to enable IP device tracking on the switch. You can enable that with the command ip device-tracking. If you are on XE code, you need to create a device tracking policy and associate it to the ports.

Re: Wired 802.1x Endpoint IP Issue

Aref Alsouqi — Fri, 16 Oct 2020 17:22:42 GMT

Similar to this:

device-tracking tracking
device-tracking policy MY-TRACKING-POLICY
limit address-count 10
no protocol udp
tracking enable
interface GigabitEthernet1/0/x
device-tracking attach-policy MY-TRACKING-POLICY

Re: Wired 802.1x Endpoint IP Issue

fatalXerror — Sat, 17 Oct 2020 07:05:45 GMT

Hi @Aref Alsouqi , thanks for the feedback. I haven't tried this but let me check on this part.

Re: Wired 802.1x Endpoint IP Issue

fatalXerror — Sat, 17 Oct 2020 07:10:56 GMT

By the way, added information about the issue that I am encountering. When I check the DHCP snooping binding in the access switch, I cannot see any data in the binding table. I believe this is the reason why the RADIUS Live Logs is not showing the IP address of the authenticated endpoint. But why the dhcp snooping table is not populating?

Re: Wired 802.1x Endpoint IP Issue

Andrii Oliinyk — Sat, 17 Oct 2020 10:09:36 GMT

did u check the ip dhcp snooping is enabled globally & on the VLAN on the switch?

P.S. with regard to ip device tracking: in some past we had problem with profiling on the ISE even when there were DHCP-data previously collected by device-tracking sent to the ISE. we then configured ip helpers to ISE on the affected SVIs even thought is didnt make a lot of sense keeping in mind the needed data are already sent to ISE by the access switch. but this extra-addon resolved our problem.

P.P.S. there is another approach to apply device-tracking policy on the VLAN level (this is how it works by default if u didnt customize device-tracking):
EX:

device-tracking policy DEVICE_TRACKING
no protocol udp
tracking enable reachable-lifetime 120
vlan configuration 1-4094
device-tracking attach-policy DEVICE_TRACKING

Re: Wired 802.1x Endpoint IP Issue

Andrii Oliinyk — Sat, 17 Oct 2020 10:20:34 GMT

hi Aref

on the Cisco switches running .1x ip device tracking gets utilized automatically. No need to configure it explicitly except one needs tuning of it.
4500SW#sho inve | i 45
NAME: "Switch System", DESCR: "Cisco Systems, Inc. WS-C4507R+E 7 slot switch "
...

4500SW#sho run | i device tra
4500SW#sho ip device tra all | ex Gi|^$
Global IP Device Tracking for clients = Enabled
Global IP Device Tracking Probe Count = 3
Global IP Device Tracking Probe Interval = 30
Global IP Device Tracking Probe Delay Interval = 10
IP Device Tracking Probe Auto Source = Enabled
Probe source IP selection order: SVI,Zero Source
-----------------------------------------------------------------------------------------------
IP Address MAC Address Vlan Interface Probe-Timeout State Source
-----------------------------------------------------------------------------------------------
Total number interfaces enabled: 154
Enabled interfaces:
4500SW#

9300SW#sho inve | i 93
NAME: "c93xx Stack", DESCR: "c93xx Stack"

...

9300SW#sho run | i device tra

9300SW#sho device-tracking database | count Gi
Number of lines which match regexp = 10

Re: Wired 802.1x Endpoint IP Issue

fatalXerror — Sat, 17 Oct 2020 10:49:59 GMT

Hi @Andrii Oliinyk , yes i double confirmed that the dhcp snooping is enabled in the switch and as well in the user vlan.

You mean I need to put the dhcp helper address in the L3 switch where my L2 switch is connected? I now remember also similar before that I configured a dhcp helper address but that time I was using ClearPass. Thanks for this.

Re: Wired 802.1x Endpoint IP Issue

Andrii Oliinyk — Sat, 17 Oct 2020 13:10:02 GMT

i'm quite surprised u dont have dhcp-snoopi binding db containing something. may be there were no dhcp activities from the endpoints attached to the switch? what does "sho device-trac data" output?

Re: Wired 802.1x Endpoint IP Issue

fatalXerror — Sat, 17 Oct 2020 15:01:55 GMT

Hi @Andrii Oliinyk , i double checked it that the endpoint is set to acquire IP from DHCP and I confirmed also that it can after a successful authc/authz in ISE, the endpoint was able to got an IP but still the dhcp snooping DB in the access-switch does not have any data.

Re: Wired 802.1x Endpoint IP Issue

Andrii Oliinyk — Sat, 17 Oct 2020 15:22:32 GMT

what about "sho device-tra data | i <e/p_MAC>"? what about Attributes tab in ISE/Visability about this MAC?
do u have DHCP-snooping turned on the core switch - do u have any relevant data there?

ultimately what is the output of "sho ip dhcp snoo" on the access-switch?

Re: Wired 802.1x Endpoint IP Issue

Aref Alsouqi — Sun, 18 Oct 2020 15:19:09 GMT

Maybe that is dependent on the platform or maybe on the very last releases? with many deployments we do, we have to go enable it manually, so not really sure if that is platform or release specific.

IP helper would only help to feed ISE with DHCP attributes related to the endpoints, and that will be mainly used for profiling. But I think IP device tracking does not feed ISE with anything, it is mainly used to populate its database with the interfaces, MAC addresses and IP addresses of the connected endpoints. IP device tracking is essential to be enabled on all the endpoint interfaces when it comes to dot1x, it is responsible to populate the endpoint IP address on the authentication session, without it, we would see unknown IP address. It is also essential when it comes to dACLs, it allows the switches to swap the any keyword with the actual endpoint IP address, without that, dACLs would not work.

Regarding DHCP snooping issue, I would recommend to verify if the issue would be related to option-82. That might be enabled, depending on the design, to prevent the DHCP snooping database population.

Re: Wired 802.1x Endpoint IP Issue

Andrii Oliinyk — Mon, 19 Oct 2020 19:35:44 GMT

DHCP-data previously collected by device-tracking r sent to the ISE within accounting messages.

Re: Wired 802.1x Endpoint IP Issue

Arne Bier — Mon, 19 Oct 2020 20:35:49 GMT

I have problems with DHCP snooping all the time, because there are so many moving parts. I have a checklist now to ensure that I don't forget anything. I think the commands are universal, but I deal with Cat9300 (IOS-XE 16.12.x) mostly these days.

Enable it globally: ip dhcp snooping
Configure the VLANs that you want to snoopon: ip dhcp snooping vlan 1-4094
Disable the information option (works in my case): no ip dhcp snooping information option
Trust the uplinks: int gig blah / ip dhcp snooping trust
On the access-ports (optional): ip dhcp snooping limit rate 15

SW-1#show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
E8:E0:B7:DF:60:65   10.68.33.200     611451      dhcp-snooping   33    GigabitEthernet1/0/1
E8:E0:B7:DF:60:65   10.68.50.21      644474      dhcp-snooping   50    GigabitEthernet1/0/2
A4:88:73:89:E8:A8   10.68.42.21      604628      dhcp-snooping   42    GigabitEthernet1/0/48
E8:E0:B7:DF:60:65   192.168.183.21   32294       dhcp-snooping   183   GigabitEthernet1/0/4

I mostly use this to populate the Device Sensor - and I follow the steps as per the Wired Prescriptive Guide

Re: Wired 802.1x Endpoint IP Issue

Aref Alsouqi — Mon, 19 Oct 2020 23:00:14 GMT

Maybe you are referring to device sensor, not device tracking. Device sensor collected details are sent to ISE through RADIUS accounting messages, but as far as I know, that is not the case with device tracking.

Re: Wired 802.1x Endpoint IP Issue

Peter Koltl — Thu, 22 Oct 2020 21:22:32 GMT

Can you see the client IPv4 address in

show access-session int Gi1/0/x detail

output?