topic Re: Endpoint authenticated but no access to network in Network Access Control

Endpoint authenticated but no access to network

kostasthedelegate — Tue, 03 Aug 2021 09:41:49 GMT

Hello,

I have ISE 2.6

In a c2960 I have several endpoints successfully authenticated and working.

But two of them do not have access to the network, while the show as authenticated in ISE and in the switch.

If I do an authentication open to the port it is working ,but when I remove the command it is the same again.

Any ideas?

Thanks and regards,

Konstantinos

Re: Endpoint authenticated but no access to network

balaji.bandi — Tue, 03 Aug 2021 09:47:18 GMT

But two of them do not have access to the network

what about others ? what is the difference between these TWO vs other working ? need more information here.

Re: Endpoint authenticated but no access to network

kostasthedelegate — Tue, 03 Aug 2021 09:48:44 GMT

There are no differences

They are pc's with ip phones

Re: Endpoint authenticated but no access to network

balaji.bandi — Tue, 03 Aug 2021 11:17:52 GMT

i go down the road see - port config and profiles ? - changing to different port still same issue ?

can you post working port vs not working port ?

Re: Endpoint authenticated but no access to network

MHM Cisco World — Tue, 03 Aug 2021 11:18:06 GMT

there are three mode of 802.1x
1-monitor mode "auth open" the vlan is assign according to what you config in "access vlan or voice vlan"
so if that is mode then the ISE will work only as monitor.
2-Other mode is closed mode which mean if the port pass auth then the vlan assign to it is control from the ISE which send the vlan-id to SW which assign it automatic.

Re: Endpoint authenticated but no access to network

thomas — Wed, 04 Aug 2021 18:20:52 GMT

You have not provided any helpful troubleshooting information.

Please see How to Ask The Community for Help

Re: Endpoint authenticated but no access to network

kostasthedelegate — Fri, 06 Aug 2021 08:06:43 GMT

Hello

I arranged to change the port and see how that goes

The config of the ports are all the same.

Any other test possible you can think of?

Regards,

Konstantinos

Re: Endpoint authenticated but no access to network

Mike.Cifelli — Fri, 06 Aug 2021 12:46:09 GMT

Please share port config + relevant debugs so the community can better assist.

debug aaa authentication

debug radius

debug dot1x all

Re: Endpoint authenticated but no access to network

kostasthedelegate — Sat, 07 Aug 2021 08:22:15 GMT

Thank you Mike,

Once I have the config I will post it

Re: Endpoint authenticated but no access to network

kostasthedelegate — Mon, 09 Aug 2021 08:45:35 GMT

Hello,

This is the port config

!
interface GigabitEthernet0/xx
switchport access vlan a
switchport mode access
switchport voice vlan b
authentication event fail action next-method
authentication event server dead action reinitialize vlan a
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
dot1x max-reauth-req 3
spanning-tree portfast edge
!
interface GigabitEthernet0/vv
description NACOFS DUE TO PROBLEM
switchport access vlan a
switchport mode access
switchport voice vlan b
authentication event fail action next-method
authentication event server dead action reinitialize vlan a
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
dot1x max-reauth-req 3
spanning-tree portfast edge
!

The first one works fine the second has the problem

Re: Endpoint authenticated but no access to network

kostasthedelegate — Wed, 11 Aug 2021 08:43:12 GMT

I took the debugs

The error I can see is that

Aug 10 14:15:06.826 EEDST: %DOT1X-5-FAIL: Authentication failed for client (001e.f727.7719) on Interface Gi0/26 AuditSessionID 00000000000005ED28137D77
Aug 10 14:15:06.826 EEDST: dot1x-packet:[001e.f727.7719, Gi0/26] Dot1x did not receive any key data
Aug 10 14:15:06.826 EEDST: dot1x-ev:[001e.f727.7719, Gi0/26] Processing client delete for hdl 0x0F0007FF sent by Auth Mgr
Aug 10 14:15:06.827 EEDST: dot1x-ev:[001e.f727.7719, Gi0/26] 001e.f727.7719: sending canned failure due to method termination
Aug 10 14:15:06.827 EEDST: dot1x-ev:[001e.f727.7719, Gi0/26] Sending EAPOL packet

What this "Dot1x did not receive any key data" means and why is it happening?

Re: Endpoint authenticated but no access to network

MHM Cisco World — Wed, 11 Aug 2021 12:36:27 GMT

just try remove the command line mab from the config.
because you already config mab with order and priority.

Re: Endpoint authenticated but no access to network

Greg Gibbs — Wed, 11 Aug 2021 22:51:56 GMT

This could mean that the endpoint is not responding to the EAPOL sent by the switch. The only way to confirm that would be to mirror the switchport and do a packet capture to see what communication is happening between the switch and endpoint.

If the endpoint is not responding to the EAPOL, you will need to investigate the endpoint.

What is the exact model of 2960 you have? If it is not one of the End of Support models, you would be best contacting TAC to help troubleshoot.

Re: Endpoint authenticated but no access to network

kostasthedelegate — Thu, 12 Aug 2021 05:34:49 GMT

Hello

I changed the port of the endpoint on the switch and it worked fine

Switch Ports Model SW Version SW Image

------ ----- ----- ---------- ----------

* 1 52 WS-C2960L-48PS-LL 15.2(7)E0a C2960L-UNIVERSALK9-M

This is the switch

It makes me wonder because the issue is only with two ports of the switch the other work fine.

I have asked to test a pc in the faulty port to see what happens

Re: Endpoint authenticated but no access to network

Greg Gibbs — Fri, 13 Aug 2021 03:01:19 GMT

If the issue follows the switchports and the same endpoints work fine in other ports (with the exact same config), it's entirely possible there's problem with the switchport or ASIC. If the switch is under an active support contract, it would be best opening a TAC case.