topic Re: Authorization Issue with 802.1x in Network Access Control

Authorization Issue with 802.1x

citestsco — Wed, 18 May 2022 10:31:16 GMT

Hi ,

Recently we have connected our switch to a nac with dot1x .

We have implemented all the best practice of cisco to connect the switch to our radius server .

The clients authenticating successfully but as for the authorization side we are facing a problem.

Once the client is authenticated and authorized we cannot implement any authorization step.

Which means from the radius we cannot procedure an action which related to authorization such as:

Reauthenticate

Vlan assignment

filter-id

Any of this does not being applied to the session of the client but the client status is "Authz success"

At debug we can see that the authorization details are being sent from the radius but not being applied to the switch.

Although when we perform an CoA action ( no matter which kind of CoA) we receive:

COA: Illegal authenticator in COA from X.X.X.X

Please help , there is some logs from the switch while i've procedure a debug on:

debug aaa pod

debug aaa authorization

debug aaa coa

debug radius

Re: Authorization Issue with 802.1x

Flavio Miranda — Wed, 18 May 2022 10:41:51 GMT

Which switch model and version and which radius server and version do you have? This can be a misconfig or incompatibility.

Re: Authorization Issue with 802.1x

MHM Cisco World — Wed, 18 May 2022 11:38:27 GMT

Can we see one port config

Also you mention there is debug can we see it

Re: Authorization Issue with 802.1x

Arne Bier — Fri, 20 May 2022 05:58:37 GMT

Hi @citestsco

regarding the CoA failing, it sounds as if the switch's RADIUS config is either incomplete or the shared secret in the switch's Dynamic Authorization config section is wrong. if you have two ISE PSN's, then you must enter each ISE node's IP address as a client, and also ensure that the RADIUS shared secret is the same as defined in ISE for that switch's IP address

aaa server radius dynamic-author
 client 10.x.x.x server-key 0 RADIUS_SHARED_SECRET
 client 10.x.x.y server-key 0 RADIUS_SHARED_SECRET