topic Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern in Network Access Control

Configure Radius on Cisco 9300 to Allow Hosts to Access the Internet

candidolevy — Wed, 10 May 2023 09:25:13 GMT

I upgraded cisco switch 2960x to 9300 and copied all configurations from 2960x to 9300 and I didn't have any syntax errors, however the hosts cannot be authenticated by ISE when they try to access the Internet. On the intranet everything is fine.

I ask for your support in resolving this problem.

I want the hosts to access the internet

Best regards

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

Rob Ingram — Wed, 10 May 2023 09:30:06 GMT

@candidolevy can you see any log entries on ISE Live Logs?

Please provide your switch configuration and the ouput of the following commands:-

show authentication session
show dot1x
show dot1x statistics
show aaa server

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

MHM Cisco World — Wed, 10 May 2023 10:05:13 GMT

Does ISE use dynamic vlan?

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 10:59:20 GMT

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 11:05:06 GMT

Hello,

ISE is not using a dynamic vlan

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

MHM Cisco World — Wed, 10 May 2023 11:06:08 GMT

please share the interface config
and the show ACL you apply to interface

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 11:27:27 GMT

Hello,

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

MHM Cisco World — Wed, 10 May 2023 11:45:01 GMT

voice + data vlan

But you use multi-auth

You need to config multi-domian

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 12:00:33 GMT

Ok Sir.

Let me see the result

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 12:13:15 GMT

Hello @MHM Cisco World,

I still don't have internet access

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

MHM Cisco World — Wed, 10 May 2023 12:22:06 GMT

Shut no shut the interface' to re-authz the host

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

thomas — Wed, 10 May 2023 12:44:07 GMT

See for the kind of information we need to help you troubleshoot. These are the basic things that would help anyone including TAC troubleshoot your problem.

And rather than pictures of your configuration, a regular copy and paste would easier to read.

We have best practice IOS switch configurations documented in for your reference. That will get 802.1X and MAB working for your endpoints' authentication and authorization.

Since the ACL you have applied is permit ip any any, traffic control to the internet is a route/switch problem. Can your switch ping 1.1.1.1? If not, you have a routing problem that has nothing to do with ISE or 802.1X.

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

MHM Cisco World — Wed, 10 May 2023 13:33:28 GMT

waiting your reply
thanks

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 13:56:40 GMT

Hello Mr. @MHM Cisco World

I was at a meeting scheduled at the last minute.

Pardon me.

But even after restarting the interface, I still have no internet access

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 14:14:15 GMT

Hello Mr. @thomas

Thanks for your help.

It cannot be a routing problem, because the hosts that are connected to the Cisco 2960x can access the internet and the cisco 9300 is connected to the cisco 2960x.

I believe the problem is in the syntax configuration of the cisco 9300, because the same config work fine on the cisco 2960x.

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

MHM Cisco World — Wed, 10 May 2023 14:20:34 GMT

show ip access-list interface X <<-

I need to see the acl after success Authz

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 14:34:18 GMT

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

davidgfriedman — Wed, 10 May 2023 14:37:32 GMT

I'd like to know what IOS you're running because "show ip access-list interface gi1/0/XX" type commands have given me no output (no lines, just next enable prompt, immediately) since we received Cisco 9200's / 9300's, etc. to replace our older model switches. I miss that command. I need to run "show auth sessions int gi1/0/XX" then do a "show ip access-list XACSACLx-......" type command to see the rough IP Access list that would apply to that session on that port. If there was a DACL error, it won't show the DACL as applied under show auth sessions. If there is no IP Address learned, it won't show the DACL as applied under show auth sessions. I've got nothing I can run, that gives me any output, for a 2+ years now on that platform, which would show me the applied DACLs on the port.

Regards,
David

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

Rob Ingram — Wed, 10 May 2023 14:41:12 GMT

@candidolevy from your screenshots it is clear the session is authenticated and authorised by ISE fine, the only thing that stands out is there is no IPv4 Address in the output of the authenticated session - is device tracking enabled? Refer to the device tracking section here.

Have you tried not applying the DACL to the authorised session, to rule out a problem with the syntax of the DACL?

What happens if you connect and endpoint to an interface configured in vlan 503 without the 802.1X configuration, can it access the internet?

Re: Configure Radius on Cisco 9300 to Allow Hosts to Access the Intern

candidolevy — Wed, 10 May 2023 14:49:30 GMT

But I can Boot this