topic Re: ISE Authentication for Network Devices in Network Access Control

ISE Authentication for Network Devices

Fenix12585 — Wed, 14 Sep 2022 18:23:26 GMT

We currently use ISE to manage 802.1x and limited mab authentication of endpoints on the network.

Is it possible to authenticate network devices as well?

For example we apply authentication configs to sw2.
Then connect sw2 to sw1.
Sw1 will not allow port access if SW2 does not authenticate itself with ise.

Re: ISE Authentication for Network Devices

ahollifield — Thu, 15 Sep 2022 09:12:12 GMT

Yes, preferably with TACACS+. Are you talking about daisy chained switches or Device Administration?

Re: ISE Authentication for Network Devices

Fenix12585 — Thu, 15 Sep 2022 11:26:00 GMT

specifically daisy chained switches.

We are pretty heavy with tacacs+ also so that wouldn't necessarily be a huge overhaul to implement. I was not aware tacacs+ could be used for more than device administration.

Re: ISE Authentication for Network Devices

Ambuj M — Thu, 15 Sep 2022 11:29:42 GMT

I don’t think that would work, at least I haven’t tried, to make a device authenticate there is the port config and supplicant 802.1X config. In your case you are talking about configuring uplink trunk port for 802.1X authentication and then SW1 as supplicant…and it won’t work most likely because 802.1X protocol is supported on both Layer 2 static-access ports and Layer 3 routed ports, but it is not supported on Trunk port—If you try to enable 802.1X on a trunk port, an error message will appear.

Re: ISE Authentication for Network Devices

ahollifield — Thu, 15 Sep 2022 11:43:26 GMT

It can't. I thought you were talking logging into the device itself. The setup you describe will not work with a trunk port as @Ambuj M mentioned? What is your use-case? Why do you want 802.1X on links between switches?

Re: ISE Authentication for Network Devices

Fenix12585 — Mon, 26 Sep 2022 19:30:35 GMT

gotcha... thank you.

Re: ISE Authentication for Network Devices

Fenix12585 — Mon, 26 Sep 2022 19:32:47 GMT

we have some switches that can't be easily secured properly, so it would be nice to have the everything authenticate through 802.1x. Also flex connect WAPs would be amazing to have better authenticated.