topic Re: 802.1X Monitor Mode Still Enforcing in Network Access Control

802.1X Monitor Mode Still Enforcing

jasond — Fri, 13 May 2022 13:53:06 GMT

Working on rolling out 802.1x and want to initially configure monitor mode to troubleshoot before changing to low impact or closed mode. Before adding the interface configuration my test interface allowed connectivity. Now that monitor mode configuration was added, the workstation cannot get connected. I was expecting them to be able to get connected even if the ISE logs showed that it failed. Is that not the expected behavior of monitor mode? Below is the interface config:

interface GigabitEthernet1/0/40

description ISE-TestPort-MonitorMode

switchport access vlan 13

switchport mode access

switchport voice vlan 166

ip device tracking maximum 65535

srr-queue bandwidth share 1 30 35 5

priority-queue out

mls qos trust dscp

dot1x timeout tx-period 7

dot1x max-reauth-req 3

auto qos trust dscp

source template Port-Dot1x-Default

spanning-tree portfast edge

end

Derived configuration : 675 bytes

interface GigabitEthernet1/0/40

description ISE-TestPort-MonitorMode

subscriber aging probe

switchport access vlan 13

switchport mode access

switchport nonegotiate

switchport voice vlan 166

ip device tracking maximum 65535

srr-queue bandwidth share 1 30 35 5

priority-queue out

authentication periodic

authentication timer reauthenticate server

access-session host-mode multi-domain

access-session port-control auto

mab

mls qos trust dscp

dot1x pae authenticator

dot1x timeout tx-period 7

dot1x max-reauth-req 3

auto qos trust dscp

spanning-tree portfast edge

service-policy type control subscriber Dot1x-Default

ip dhcp snooping limit rate 100

end

Re: 802.1X Monitor Mode Still Enforcing

MHM Cisco World — Fri, 13 May 2022 14:06:50 GMT

authentication OPEN <- this command missing

Re: 802.1X Monitor Mode Still Enforcing

MHM Cisco World — Fri, 13 May 2022 14:07:11 GMT

https://www.lookingpoint.com/blog/cisco-ise-wired-802.1x-deployment-monitormode

Re: 802.1X Monitor Mode Still Enforcing

Greg Gibbs — Sun, 15 May 2022 22:24:10 GMT

The switchport configuration is not enough information to provide any meaningful assistance. Depending on your switch version, 'open auth' could be the default. We would need more information on your versions, policy map configuration, live logs, switchport session status details, etc.

Please see How to Ask the Community for Help.

I would suggest checking your configuration and policies against the ISE Secure Wired Access Prescriptive Deployment Guide