topic Re: 802.1x Device Authentiction with ISE in Network Access Control

802.1x Device Authentiction with ISE

Netmart — Sun, 06 Feb 2022 21:40:55 GMT

Hello,

I am wondering, whether the following interface config would allow access of phone and workstation to network, meaning do they get successfully authenticated via ISE:

Interface Te1/12

description ISE dot1x Port

switchport access vlan 10

switchport mode access

switchport voice vlan20

device-tracking attach-policy IPDT_MAX_3

authentication periodic

authentication timer reauthenticate server

access-session host-mode multi-domain

access-session port-control auto

snmp trap mac-notification change added

snmp trap mac-notification change removed

dot1x pae authenticator

dot1x timeout tx-period 7

dot1x mac-reauth-req 3

Spanning-tree portfast

service-policy type control subscriber POLICY_Te1/12

Thank you for your advice.

Re: 802.1x Device Authentiction with ISE

Amine ZAKARIA — Mon, 07 Feb 2022 04:32:38 GMT

Hello @Netmart ,

Can you share what is inside the service policy POLICY_Te1/12 ?

Re: 802.1x Device Authentiction with ISE

Mike.Cifelli — Mon, 07 Feb 2022 12:37:48 GMT

I am wondering, whether the following interface config would allow access of phone and workstation to network

-You are attempting to operate with the correct mode: access-session host-mode multi-domain = Specifies that only one client per domain (DATA or VOICE) can be authenticated at a time. However, you will need to test because we cant see what is in the service policy attached to interface.

Re: 802.1x Device Authentiction with ISE

Arne Bier — Wed, 09 Feb 2022 23:02:41 GMT

The switch port config shown will only process 802.1X frames (EAPOL). If any attached devices do not have a supplicant, then they won't be authorized onto either DATA or VOICE Domain. If you need to process non-supplicant devices, then also add the MAB command to the interface.

Re: 802.1x Device Authentiction with ISE

Netmart — Thu, 10 Feb 2022 05:35:09 GMT

Thank you Arne, yes, agree, the key is that they a device needs to have the supplicant installed. The alternative is MAB. However, isn't it also possible to install a temporary web-based client through posture/provisioning /remediation provided that the client is non-compliant?

Regards,

Netmart

Re: 802.1x Device Authentiction with ISE

Netmart — Thu, 10 Feb 2022 05:38:50 GMT

Hi Mike,

Thank you for clarification.

Only the wording is still a bit confusing to me.

"only one client per DATA or VOICE domain can be authenticated at a time.

Meaning only a PC OR phone can run at a time on the port

Only one PC AND Phone can run per time at a port?

Regards,

Martin

Re: 802.1x Device Authentiction with ISE

Arne Bier — Thu, 10 Feb 2022 09:09:00 GMT

multi-domain is one of a variety of security mechanism that limits the number of MAC addresses that will be learned on that interface. In this case, multi-domain means,

1 MAC address in the DATA domain

1 MAC address in the VOICE domain

If you were to violate that by assigning the phone to a VLAN in the DATA domain, and then also attaching a PC to the phone's data port, then the switch will err-disable the port because now you'll have 2 MAC addresses in the DATA domain. Or, more commonly, if you attach a small hub or switch to the phone, thinking you can hook a few devices up ... it won't work.

The are other options like multi-host, etc. - you can google it

Re: 802.1x Device Authentiction with ISE

Arne Bier — Thu, 10 Feb 2022 09:14:16 GMT

If a client doesn't have a supplicant, then it will never speak EAPOL (EAP over LAN). This is a layer 2 protocol. You either have it or you don't. If you don't, then the switch will accept "normal" traffic when mab is enabled on that port. Switch sends MAC address to ISE to authorize and if successful then the port is authorized and then it's business as usual (DHCP etc.). What the client then does with a web based client etc. all runs while the port is in MAB auth'd mode. And you can do whatever compliance checks you need/like. If the client is found to be non-compliant then you can reauth it and stick the device into another VLAN. Problem with VLAN switching in that scenario (where the PC already has an IP address via DHCP) is that you'd probably need to bounce the port to force the client to perform DHCP again.

Re: 802.1x Device Authentiction with ISE

Netmart — Thu, 10 Feb 2022 18:02:01 GMT

Thank you for clearing this up..

The figure below actually actually illustrating your findings.

By default, 802.1x only EAP is allowed, Authentication Open all ports allowed, or if no supplicant [no EAPOL] MAB is the alternative.