topic Re: Setting up Remediation VLANs on the Network in Network Access Control

Setting up Remediation VLANs on the Network

eXpliciT — Wed, 09 Jan 2019 14:08:52 GMT

Our current network does not have remediation VLANs set up and the only way to get PCs authorized is to allow it on the network so technicians can posture it so it authenticates.

I'm trying to find guidance on how to set the remediation VLANs that if a device is not able to authenticate on the network, it will fall into the remediation VLAN which will grant it limited network access until we can get it on the domain.

Thanks!

Re: Setting up Remediation VLANs on the Network

TA_a — Wed, 09 Jan 2019 14:45:19 GMT

You could try configuring authentication event parameters at interface level.

authentication event fail action authorize vlan <Your remediation Vlan>
authentication event server dead action authorize vlan <Data Vlan>
authentication event no-response action authorize vlan <Guest Vlan>
authentication event server alive action reinitialize

Re: Setting up Remediation VLANs on the Network

Jason Kunst — Wed, 09 Jan 2019 16:12:43 GMT

When devices fail authentication using dot1x they fallback to MAB. There you can allow access to critical resources such as patching and remote help systems

Did you look at our wired guide under http://cs.co/ise-guides

Re: Setting up Remediation VLANs on the Network

owaishussain — Thu, 18 Mar 2021 11:00:29 GMT

Sorry, cant for the details .. We need to configure Remediation web server for the patches and Os updates. Can you provide a link ?

Re: Setting up Remediation VLANs on the Network

owaishussain — Thu, 18 Mar 2021 11:01:13 GMT

(cant find the details)

Re: Setting up Remediation VLANs on the Network

Marcelo Morais — Thu, 18 Mar 2021 12:03:09 GMT

Hi @owaishussain ,

please take a look at: ISE Posture Prescriptive Deployment Guide., search for Posture Remediation.

Hope this helps !!!