ISE , DHCP issue

Sasquatch_13 — Thu, 09 Mar 2023 07:50:56 GMT

Hi,

We are trying to configure ISE on 9300 switch (Access Switch) (ios-xe 17.03.05).But end device not getting ip from dhcp server which is on the core switch. I am sharing "show run" output. Can some one help me to find problem ?

Thanks in advance.

run
Building configuration...

Current configuration : 18193 bytes
!
! Last configuration change at 05:55:44 UTC Thu Mar 9 2023
!
version 17.3
service timestamps debug datetime msec
service timestamps log datetime msec
service call-home
platform punt-keepalive disable-kernel-core
!
hostname Temp-switch
!
!
vrf definition Mgmt-vrf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 9 $14$HPeC$uVWaXDOpjwY.UE$Y4Vn15XqQuKi7mEnt8HyZKNQ0LvXhdNuyjS3lBbKyF2
--More-- !
aaa new-model
!
!
aaa group server radius ISE_RADIUS
server-private 172.16.1.150 key cisco
!
aaa authentication dot1x default group ISE_RADIUS
aaa authorization network default group ISE_RADIUS
!
!
!
!
!
aaa server radius dynamic-author
client 172.16.1.150 server-key cisco
!
aaa session-id common
switch 1 provision c9300l-48t-4x
!
!
!
!
--More-- !
ip domain name **************
!
!
!
ip dhcp snooping
login on-success log
!
!
!
!
!
no device-tracking logging theft
device-tracking policy tst_ipdt
trusted-port
security-level inspect
no protocol udp
tracking enable
!
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
--More-- !
crypto pki trustpoint TP-self-signed-3541641957
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3541641957
revocation-check none
rsakeypair TP-self-signed-3541641957
!
crypto pki trustpoint TP-self-signed-760816128
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-760816128
revocation-check none
rsakeypair TP-self-signed-760816128
!
!
crypto pki certificate chain SLA-TrustPoint
certificate ca 01
30820321 30820209 A0030201 02020101 300D0609 2A864886 F70D0101 0B050030
32310E30 0C060355 040A1305 43697363 6F312030 1E060355 04031317 43697363
6F204C69 63656E73 696E6720 526F6F74 20434130 1E170D31 33303533 30313934
3834375A 170D3338 30353330 31393438 34375A30 32310E30 0C060355 040A1305
43697363 6F312030 1E060355 04031317 43697363 6F204C69 63656E73 696E6720
526F6F74 20434130 82012230 0D06092A 864886F7 0D010101 05000382 010F0030
82010A02 82010100 A6BCBD96 131E05F7 145EA72C 2CD686E6 17222EA1 F1EFF64D
--More-- CBB4C798 212AA147 C655D8D7 9471380D 8711441E 1AAF071A 9CAE6388 8A38E520
1C394D78 462EF239 C659F715 B98C0A59 5BBB5CBD 0CFEBEA3 700A8BF7 D8F256EE
4AA4E80D DB6FD1C9 60B1FD18 FFC69C96 6FA68957 A2617DE7 104FDC5F EA2956AC
7390A3EB 2B5436AD C847A2C5 DAB553EB 69A9A535 58E9F3E3 C0BD23CF 58BD7188
68E69491 20F320E7 948E71D7 AE3BCC84 F10684C7 4BC8E00F 539BA42B 42C68BB7
C7479096 B4CB2D62 EA2F505D C7B062A4 6811D95B E8250FC4 5D5D5FB8 8F27D191
C55F0D76 61F9A4CD 3D992327 A8BB03BD 4E6D7069 7CBADF8B DF5F4368 95135E44
DFC7C6CF 04DD7FD1 02030100 01A34230 40300E06 03551D0F 0101FF04 04030201
06300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 1449DC85
4B3D31E5 1B3E6A17 606AF333 3D3B4C73 E8300D06 092A8648 86F70D01 010B0500
03820101 00507F24 D3932A66 86025D9F E838AE5C 6D4DF6B0 49631C78 240DA905
604EDCDE FF4FED2B 77FC460E CD636FDB DD44681E 3A5673AB 9093D3B1 6C9E3D8B
D98987BF E40CBD9E 1AECA0C2 2189BB5C 8FA85686 CD98B646 5575B146 8DFC66A8
467A3DF4 4D565700 6ADF0F0D CF835015 3C04FF7C 21E878AC 11BA9CD2 55A9232C
7CA7B7E6 C1AF74F6 152E99B7 B1FCF9BB E973DE7F 5BDDEB86 C71E3B49 1765308B
5FB0DA06 B92AFE7F 494E8A9E 07B85737 F3A58BE1 1A48A229 C37C1E69 39F08678
80DDCD16 D6BACECA EEBC7CF9 8428787B 35202CDC 60E4616A B623CDBD 230E3AFB
418616A9 4093E049 4D10AB75 27E86F73 932E35B5 8862FDAE 0275156F 719BB2F0
D697DF7F 28
quit
crypto pki certificate chain TP-self-signed-3541641957
certificate self-signed 01
30820330 30820218 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
--More-- 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33353431 36343139 3537301E 170D3233 30333039 30343530
30305A17 0D333330 33303830 34353030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 35343136
34313935 37308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201
0A028201 0100F46E 02B7C366 37FFFBC7 27A35EA0 2E6C2A96 9258E0DB 7B0EA0B4
8E4311DA 45F07FFD CA142416 F799D4A5 ECDD814D 352DD9A0 3E823DF7 2B48F0D9
7005974D 3A3A9134 25447641 0B776660 8B24C10B F39AAEBD 74D3DF7A 0068B368
D4AC26DF EA1A5B79 CEE53A9B 8FB0545A 504AE767 445A1D0A 67FACE0A 42563C02
8F221B06 0A152F60 62FA3690 17AB997C 75B298D4 169BE6D2 82043170 5FE83DC3
20C81C7C 1796CB24 3AF9FB9C 25CFDBB1 A2B397E5 3619D56B F209B282 9903BC6F
19540FDF 5DFF3BDB 20453D72 252FDC5C BEDE1B95 28D5D8AB 4BC4F2ED CDA7A63A
60FCDDB4 757EF2C1 8910B8CC 20DB16BA 97EC4176 81F8836B 15A29BA4 018D7194
D7FD36B1 EE5B0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF
301F0603 551D2304 18301680 149EFC21 072D3BF5 184E0D31 0519C500 425248FD
EE301D06 03551D0E 04160414 9EFC2107 2D3BF518 4E0D3105 19C50042 5248FDEE
300D0609 2A864886 F70D0101 05050003 82010100 432C825D C86FA265 FCE977BB
3B51E5C6 78F4CB01 FDD28E89 2155DBC7 3D1811E7 304E2FCC 429EBA84 8EC83A90
80A5B155 DFA0080C 637A5BC8 16229369 ECD92701 85ADD85A CEEAB7CA 9E40720E
8F50C23E B5B8364F 6AF0B1EB F00A4DCA 0317ECA4 DE790148 F3F74AEF 62380E16
6E288CB2 6E647AF7 570633ED 11590ACE 8CF33B07 196D0BD9 04CEA802 21C5AC21
A94034EC C4948128 D1E01F85 C06FCF91 B716EB5D 353A12FB A6A7CFA8 50C372AE
D3D95D7F 31AF378A 462E5F34 9EDDDCCF FCC78F6D D5857986 5D6C1E39 FF823350
--More-- 0D3F3F18 1792789B A4EE9AE7 A8356EB1 9B389016 AD7EE175 6CD30C36 CE9E852B
8BDAAB9D B10E0C8B F0B210A9 5D95B0FD 5F4A5887
quit
crypto pki certificate chain TP-self-signed-760816128
!
license boot level network-essentials addon dna-essentials
!
!
diagnostic bootup level minimal
!
spanning-tree mode pvst
spanning-tree extend system-id
no spanning-tree vlan 28,31,41,76,210,996,998-999
memory free low-watermark processor 133114
!
username admin privilege 15 secret 9 $14$yBy5$FZx4hZBMOCrV8E$OyLLJE94tM9Kpy34fpLciuCzm2RUWlSkoNG/u1a7I3g
!
redundancy
mode sso
!
!
!
--More-- !
!
!
transceiver type all
monitoring
lldp run
!
!
class-map match-any system-cpp-police-ewlc-control
description EWLC Control
class-map match-any system-cpp-police-topology-control
description Topology control
class-map match-any system-cpp-police-sw-forward
description Sw forwarding, L2 LVX data packets, LOGGING, Transit Traffic
class-map match-any system-cpp-default
description EWLC Data, Inter FED Traffic
class-map match-any system-cpp-police-sys-data
description Openflow, Exception, EGR Exception, NFL Sampled Data, RPF Failed
class-map match-any system-cpp-police-punt-webauth
description Punt Webauth
class-map match-any system-cpp-police-l2lvx-control
description L2 LVX control packets
class-map match-any system-cpp-police-forus
--More-- description Forus Address resolution and Forus traffic
class-map match-any system-cpp-police-multicast-end-station
description MCAST END STATION
class-map match-any system-cpp-police-high-rate-app
description High Rate Applications
class-map match-any system-cpp-police-multicast
description MCAST Data
class-map match-any system-cpp-police-l2-control
description L2 control
class-map match-any system-cpp-police-dot1x-auth
description DOT1X Auth
class-map match-any system-cpp-police-data
description ICMP redirect, ICMP_GEN and BROADCAST
class-map match-any system-cpp-police-stackwise-virt-control
description Stackwise Virtual OOB
class-map match-any non-client-nrt-class
class-map match-any system-cpp-police-routing-control
description Routing control and Low Latency
class-map match-any system-cpp-police-protocol-snooping
description Protocol snooping
class-map match-any system-cpp-police-dhcp-snooping
description DHCP snooping
class-map match-any system-cpp-police-ios-routing
--More-- description L2 control, Topology control, Routing control, Low Latency
class-map match-any system-cpp-police-system-critical
description System Critical and Gold Pkt
class-map match-any system-cpp-police-ios-feature
description ICMPGEN,BROADCAST,ICMP,L2LVXCntrl,ProtoSnoop,PuntWebauth,MCASTData,Transit,DOT1XAuth,Swfwd,LOGGING,L2LVXData,ForusTraffic,ForusARP,McastEndStn,Openflow,Exception,EGRExcption,NflSampled,RpfFailed
!
policy-map system-cpp-policy
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
vrf forwarding Mgmt-vrf
no ip address
--More-- shutdown
negotiation auto
!
interface GigabitEthernet1/0/1
description ####
switchport access vlan 50
switchport mode access
switchport voice vlan 200
authentication host-mode multi-domain
authentication order mab
authentication priority mab
authentication port-control auto
authentication timer reauthenticate 7200
authentication timer inactivity 3600
mab
dot1x pae authenticator
spanning-tree portfast
!
interface GigabitEthernet1/0/2
description ##I##
switchport access vlan 50
switchport mode access
switchport voice vlan 200
--More-- authentication host-mode multi-domain
authentication order mab
authentication priority mab
authentication port-control auto
authentication timer reauthenticate 7200
authentication timer inactivity 3600
mab
dot1x pae authenticator
spanning-tree portfast
!
interface GigabitEthernet1/0/3
switchport mode trunk
!
interface GigabitEthernet1/0/4
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/5
--More-- switchport access vlan 50
switchport mode access
device-tracking attach-policy tst_ipdt
!
interface GigabitEthernet1/0/6
switchport access vlan 50
switchport mode access
!
interface GigabitEthernet1/0/7
switchport access vlan 50
switchport mode access
device-tracking attach-policy tst_ipdt
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/8
switchport access vlan 50
switchport mode access
!
interface GigabitEthernet1/0/9
--More-- switchport mode trunk
ip dhcp snooping trust
!
interface GigabitEthernet1/0/10
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/11
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/12
switchport access vlan 50
--More-- switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/13
switchport access vlan 22
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/14
switchport mode trunk
!
interface GigabitEthernet1/0/15
switchport access vlan 50
switchport mode access
authentication order mab
--More-- authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/16
description $$system-cdpo$$
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/17
description ####
switchport access vlan 50
switchport mode access
switchport voice vlan 200
authentication host-mode multi-domain
authentication order mab
authentication priority mab
--More-- authentication port-control auto
authentication timer reauthenticate 7200
authentication timer inactivity 3600
mab
dot1x pae authenticator
spanning-tree portfast
!
interface GigabitEthernet1/0/18
switchport access vlan 50
switchport mode access
!
interface GigabitEthernet1/0/19
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/20
switchport access vlan 50
switchport mode access
--More-- authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/21
description ###
switchport access vlan 22
switchport mode access
switchport voice vlan 200
authentication host-mode multi-domain
authentication order mab
authentication priority mab
authentication port-control auto
authentication timer reauthenticate 7200
authentication timer inactivity 3600
mab
dot1x pae authenticator
spanning-tree portfast
!
interface GigabitEthernet1/0/22
switchport access vlan 50
--More-- switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/23
switchport access vlan 50
switchport mode access
!
interface GigabitEthernet1/0/24
description ####Connected to SW_placement_1(0.33) ####
switchport mode trunk
ip dhcp snooping trust
!
interface GigabitEthernet1/0/25
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
--More-- dot1x pae authenticator
!
interface GigabitEthernet1/0/26
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/27
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/28
switchport access vlan 50
switchport mode access
--More-- authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/29
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/30
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
--More-- !
interface GigabitEthernet1/0/31
switchport access vlan 50
switchport mode access
!
interface GigabitEthernet1/0/32
switchport access vlan 22
switchport mode access
authentication order mab
authentication priority mab
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/33
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/34
--More-- switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/35
description ####
switchport access vlan 50
switchport mode access
duplex full
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/36
description #
switchport access vlan 50
switchport mode access
--More-- authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/37
switchport access vlan 50
switchport mode access
!
interface GigabitEthernet1/0/38
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/39
switchport access vlan 50
switchport mode access
!
--More-- interface GigabitEthernet1/0/40
switchport access vlan 6
switchport mode access
!
interface GigabitEthernet1/0/41
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
!
interface GigabitEthernet1/0/42
switchport mode trunk
!
interface GigabitEthernet1/0/43
switchport access vlan 50
switchport mode access
authentication order mab
authentication priority mab
authentication port-control auto
mab
--More-- dot1x pae authenticator
!
interface GigabitEthernet1/0/44
description #_Temp_SW
switchport mode trunk
ip dhcp snooping trust
!
interface GigabitEthernet1/0/45
description #_Temp_SW
switchport mode trunk
ip dhcp snooping trust
!
interface GigabitEthernet1/0/46
switchport access vlan 6
switchport mode access
!
interface GigabitEthernet1/0/47
description ### Connected to ###
switchport mode trunk
!
interface GigabitEthernet1/0/48
description ### Connected to ###
switchport mode trunk
--More-- ip dhcp snooping trust
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface AppGigabitEthernet1/0/1
!
interface Vlan1
ip address 172.16.0.100 255.255.255.128
!
interface Vlan142
no ip address
shutdown
!
ip default-gateway 172.16.0.1
ip forward-protocol nd
ip http server
ip http secure-server
--More-- !
ip access-list extended redirect
10 deny ip any host 172.16.1.150
20 permit tcp any any eq www
30 permit tcp any any eq 443
ip access-list extended webAuthList
10 permit ip any any
!
ip radius source-interface Vlan1
!
snmp-server community *** RO
snmp-server community *** RW
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
!
!
control-plane
service-policy input system-cpp-policy
!
!
line con 0
--More-- stopbits 1
line vty 0 4
password ***
transport input all
line vty 5 31
transport input ssh
!
call-home
! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
profile "CiscoTAC-1"
active
destination transport-method http
!
!
!
!
!
!
end
--More--
Temp-switch#sh ver
Cisco IOS XE Software, Version 17.03.05
Cisco IOS Software [Amsterdam], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 17.3.5, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2022 by Cisco Systems, Inc.

Re: ISE , DHCP issue

MHM Cisco World — Thu, 09 Mar 2023 11:04:31 GMT

there are three mode of Dot1
monitor mode
low-impact mode <<- this can solve your issue with DHCP and ISE
close mode <<- this what you use now make issue with DHCP request

Re: ISE , DHCP issue

Sasquatch_13 — Thu, 09 Mar 2023 11:18:49 GMT

is there any thing related to configuration on switch?

Re: ISE , DHCP issue

MHM Cisco World — Thu, 09 Mar 2023 11:49:14 GMT

Yes all config must done in SW.
For example, Low-Impact Mode may be used to give any host attaching to the network the ability to use Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and perhaps get to the Internet, all while blocking access to internal resources. When a device connected to that same switchport passes authentication, a downloadable ACL (dACL) is applied that will permit all traffic (see image below).

https://guides.co/g/cisco-trustsec-phased-deployment-overview/11102

I will share the config you need here.

Re: ISE , DHCP issue

andrewswanson — Thu, 09 Mar 2023 23:05:50 GMT

Hi - have you tried disabling option 82 insertion with "no ip dhcp snooping information option"?

hth

Andy

Re: ISE , DHCP issue

EHNET — Thu, 09 Mar 2023 23:38:58 GMT

You need an ACL to permit dhcp traffic and use it on the interface

something like:

Extended IP access list ACL-DEFAULT
10 permit udp any eq bootpc any eq bootps
20 permit udp any any eq domain
30 permit icmp any any
40 deny ip any any

Re: ISE , DHCP issue

hslai — Sun, 12 Mar 2023 06:33:25 GMT

@Sasquatch_13 I would suggest making sure DHCP is working without 802.1X/MAB configured on the access interfaces. If it works after disabling DHCP snooping, then this Operate and Troubleshoot DHCP Snooping on Catalyst 9000 Switches might help.

Re: ISE , DHCP issue

mitchp75 — Mon, 13 Mar 2023 23:38:25 GMT

You're missing 'ip dhcp snooping trust' on int gi1/0/47, the problem could also be on the upstream switch... perhaps vlans aren't allowed on the trunk port. Also don't use vlan 1 for management, thats a bad idea.

topic Re: ISE , DHCP issue in Network Access Control

ISE , DHCP issue

Re: ISE , DHCP issue

Re: ISE , DHCP issue

Re: ISE , DHCP issue

Re: ISE , DHCP issue

Re: ISE , DHCP issue

Re: ISE , DHCP issue

Re: ISE , DHCP issue

Re: ISE , DHCP issue