topic Re: Allowing access if ISE is down in Wireless in Network Access Control

Allowing access if ISE is down in Wireless

EdouardZorrilla0939 — Fri, 30 Jul 2021 14:27:03 GMT

Greetings,

Could you advise how to set fail open in the 9800 WLC when ISE is down ?

Thanks,

Edouard.

Re: Allowing access if ISE is down in Wireless

Amine ZAKARIA — Fri, 30 Jul 2021 16:41:48 GMT

Hello,

You can create a Fallback SSID with Preshared-Key which is not used by RADIUS and disable it, until your ISE deployment goes down and enable it.

Re: Allowing access if ISE is down in Wireless

EdouardZorrilla0939 — Fri, 30 Jul 2021 19:18:04 GMT

Hi Amine,

But the supplicant has already been set to use the certificate. You mean to create a fallback SSID with PSK using a different name.

Please advise.

Re: Allowing access if ISE is down in Wireless

Amine ZAKARIA — Fri, 30 Jul 2021 19:21:19 GMT

Hello,

Yes of course with a different SSID Name.

Re: Allowing access if ISE is down in Wireless

thomas — Wed, 04 Aug 2021 17:49:42 GMT

"Fail Open" is generally a bad security practice for wireless networks. Better to let people use Guest services for internet access.

Best is to simply deploy a highly available ISE deployment so this doesn't happen.

Re: Allowing access if ISE is down in Wireless

EdouardZorrilla0939 — Wed, 04 Aug 2021 18:08:59 GMT

Thanks Thomas, Our design is ISE in HA mode and I wanted to know if was possible to failback from certificate-based authentication to PSK authentication in case both PSN are down.

I know it is possible in the wired scope, so I was wondering it was possible in the in wireless scope.

Thanks,

Re: Allowing access if ISE is down in Wireless

howon — Wed, 04 Aug 2021 18:29:17 GMT

This is fancier than what you may be looking for as it only brings up the SSID in case ISE is down. This is important as if you have the backup PSK SSID always up, the user may favor it instead of the main 802.1X SSID:

https://community.cisco.com/t5/wireless-mobility-documents/automated-backup-ssid-with-eem-on-catalyst-9800-wireless/ta-p/3743838