topic Re: 802.1x assignment issue and domain issue in Network Access Control

802.1x assignment issue and domain issue

vanness629 — Mon, 10 Jul 2023 01:51:38 GMT

Dear Expert

I'm using windows server nps and using c2960 in a lab,

I have a laptop connected to the port and auth success.

but the port keeps jumping to the voice domain, even I use the 802.1x to assign the VLAN for the port, it still remains on the default VLAN, it means vlan1.

I get stuck and have no idea what the reason is or what the mistake is.

Kindly help me to review the config and the information

Interface: GigabitEthernet1/0/43
MAC Address: 00e0.4d68.111b
IPv6 Address: Unknown
IPv4 Address: 192.168.111.202
User-Name: ownlab\cheong
Status: Authorized
Domain: VOICE
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Restart timeout: N/A
Periodic Acct timeout: N/A
Session Uptime: 1850s
Common Session ID: C0A8850B000000340FC0E5E8
Acct Session ID: 0x00000026
Handle: 0xD900000E
Current Policy: POLICY_Gi1/0/43

Local Policies:
Service Template: DEFAULT_LINKSEC_POLICY_SHOULD_SECURE (priority 150)

Server Policies:
Vlan Group: Vlan: 310

Method status list:
Method State

dot1x Authc Success

B11_1960_Working_Table#sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 00e0.4d68.111B STATIC Gi1/0/43
310 00e0.4d68.111B STATIC Gi1/0/43
Total Mac Addresses for this criterion: 2
B11_1960_Working_Table#sh vlan

VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Gi1/0/5, Gi1/0/6, Gi1/0/7, Gi1/0/8, Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13, Gi1/0/14, Gi1/0/15, Gi1/0/16, Gi1/0/17, Gi1/0/18, Gi1/0/19
Gi1/0/20, Gi1/0/21, Gi1/0/22, Gi1/0/23, Gi1/0/24, Gi1/0/25, Gi1/0/26, Gi1/0/27, Gi1/0/28, Gi1/0/29, Gi1/0/30, Gi1/0/31, Gi1/0/32, Gi1/0/33, Gi1/0/34
Gi1/0/35, Gi1/0/36, Gi1/0/37, Gi1/0/38, Gi1/0/39, Gi1/0/40, Gi1/0/41, Gi1/0/42, Gi1/0/43, Gi1/0/44, Gi1/0/45, Gi1/0/46, Gi1/0/47, Gi1/0/49, Gi1/0/50
Gi1/0/51, Gi1/0/52
61 CCCCC active
67 Wwwww active Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4
100 voice active Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4, Gi1/0/5, Gi1/0/6, Gi1/0/7, Gi1/0/8, Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13, Gi1/0/14, Gi1/0/15, Gi1/0/16
Gi1/0/17, Gi1/0/18, Gi1/0/19, Gi1/0/20, Gi1/0/21, Gi1/0/22, Gi1/0/23, Gi1/0/24, Gi1/0/25, Gi1/0/26, Gi1/0/27, Gi1/0/28, Gi1/0/29, Gi1/0/30, Gi1/0/31
Gi1/0/32, Gi1/0/33, Gi1/0/34, Gi1/0/35, Gi1/0/36, Gi1/0/37, Gi1/0/38, Gi1/0/39, Gi1/0/40, Gi1/0/41, Gi1/0/42, Gi1/0/44, Gi1/0/46, Gi1/0/47, Gi1/0/49
Gi1/0/50, Gi1/0/51, Gi1/0/52
310 Workstations-ETH active Gi1/0/43
320 Workstations-WIFI active
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1 enet 100001 1500 - - - - - 0 0
61 enet 100061 1500 - - - - - 0 0
67 enet 100067 1500 - - - - - 0 0
100 enet 100100 1500 - - - - - 0 0
310 enet 100310 1500 - - - - - 0 0
320 enet 100320 1500 - - - - - 0 0
1002 fddi 101002 1500 - - - - - 0 0
1003 tr 101003 1500 - - - - - 0 0
1004 fdnet 101004 1500 - - - ieee - 0 0
1005 trnet 101005 1500 - - - ibm - 0 0

Remote SPAN VLANs
------------------------------------------------------------------------------

Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------

Re: 802.1x assignment issue and domain issue

Flavio Miranda — Fri, 07 Jul 2023 11:57:51 GMT

Hi @vanness629

Can you share the command "show run int GigabitEthernet1/0/43" ?

Re: 802.1x assignment issue and domain issue

Aref Alsouqi — Fri, 07 Jul 2023 14:47:48 GMT

What phone this PC is connected to?

Re: 802.1x assignment issue and domain issue

vanness629 — Mon, 10 Jul 2023 01:49:07 GMT

Hello Flavio.

!
interface GigabitEthernet1/0/43
switchport mode access
switchport voice vlan 100
authentication event no-response action authorize vlan 99
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
mab
mls qos trust dscp
dot1x pae authenticator
spanning-tree portfast edge
end

here is the configuration of the port.

Many thanks

Re: 802.1x assignment issue and domain issue

vanness629 — Mon, 10 Jul 2023 01:48:43 GMT

I just using a normal laptop with windows 10

THANK YOU

Re: 802.1x assignment issue and domain issue

MHM Cisco World — Mon, 10 Jul 2023 07:54:32 GMT

You use VLAN group in 802.1x ?
show auth session interface x/x <<- share this

Re: 802.1x assignment issue and domain issue

Aref Alsouqi — Mon, 10 Jul 2023 08:18:26 GMT

If you don't have any phone connected to that port, could you please change the host mode on the switch port from multi-domain to multi-auth for testing and let us know if that works.

Re: 802.1x assignment issue and domain issue

vanness629 — Mon, 10 Jul 2023 08:25:00 GMT

Hello,

here is the result about "sh auth sessions int gig 1/0/43 detail"

Local Policies:
Service Template: DEFAULT_LINKSEC_POLICY_SHOULD_SECURE (priority 150)

Server Policies:
Vlan Group: Vlan: 310

Method status list:
Method State

dot1x Authc Success

Re: 802.1x assignment issue and domain issue

vanness629 — Mon, 10 Jul 2023 08:28:51 GMT

Hi Aref,

Sorry, I misunderstood, I will use the Avaya phone and connect the PC to the Phone in most cases.

I am still in my own lab to try the VLAN assignment by 802.1x currently, and the phone connective is not trying yet.

thank you

Re: 802.1x assignment issue and domain issue

MHM Cisco World — Mon, 10 Jul 2023 08:43:41 GMT

summary there are two issue
port assign to two VLAN (check show mac address )
this as WORKAROUND be solve by assign VLAN 310 to port
switchport access vlan 310

for domain, I think the issue is not config in SW it issue in AAA, you push voice VLAN attribute from Server to SW for DATA domain dynamic assignment VLAN.

Re: 802.1x assignment issue and domain issue

Aref Alsouqi — Mon, 10 Jul 2023 09:08:54 GMT

No worries. Does that phone support CDP? if not and if it does support LLDP instead then I think you would need to enable LLDP on that switch port as I think in this case the phone would need to rely on one of those protocols to know which is the voice VLAN ID and put only that in the voice domain.

Re: 802.1x assignment issue and domain issue

vanness629 — Mon, 10 Jul 2023 09:41:23 GMT

Hi Mhm,

I want to manage the vlan by the radius server instead of config the port one by one, this is the reason why I try the configuration.

about the domain issue, I will do some testing.

Re: 802.1x assignment issue and domain issue

MHM Cisco World — Mon, 10 Jul 2023 09:47:20 GMT

I want to manage the vlan by the radius server instead of config the port one by one, this is the reason why I try the configuration.

that why I mention it workaround not solution.
NOW

authc is success and authz is success,

B11_1960_Working_Table#sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 00e0.4d68.111B STATIC Gi1/0/43
310 00e0.4d68.111B STATIC Gi1/0/43

clear mac table for interface and see if VLAN1 (default) will add ir not after Authz success ?
NOTE:- share the show mac add int gig 1/0/43 after clear mac

Re: 802.1x assignment issue and domain issue

vanness629 — Tue, 11 Jul 2023 04:03:50 GMT

as I check, our phone support the CDP, the phone is working fine with the voice vlan auto detect. I create the user base on the phone's Mac address in order to authenticate with the radius server, it work fine.

Re: 802.1x assignment issue and domain issue

vanness629 — Tue, 11 Jul 2023 04:21:34 GMT

B11_1960_Working_Table#clear mac address-table dy
B11_1960_Working_Table#clear mac address-table dynamic ?
address address keyword
interface interface keyword
vlan vlan keyword
<cr>

B11_1960_Working_Table#clear mac address-table dynamic int gig 1/0/43
B11_1960_Working_Table#clear mac address-table dynamic int gig 1/0/43
B11_1960_Working_Table#sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 00e0.4d68.000c STATIC Gi1/0/43
310 00e0.4d68.000c STATIC Gi1/0/43
Total Mac Addresses for this criterion: 2
B11_1960_Working_Table#clear mac address-table dynamic int gig 1/0/43
B11_1960_Working_Table#clear mac address-table dynamic int gig 1/0/43
B11_1960_Working_Table#sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 00e0.4d68.000c STATIC Gi1/0/43
310 00e0.4d68.000c STATIC Gi1/0/43
Total Mac Addresses for this criterion: 2
B11_1960_Working_Table#

I have tried, I bet it was because the Mac address type is static so I cannot clear the Mac address table.

about the domain value, I have checked my radius that is currently in production, and the new radius and the configuration are the same, that's I really confused about which side has an issue(switch or radius), since if this value is not correct, as I understand it will affect the VLAN assignment by the radius.

below is my aaa configuration

aaa new-model
!
!
aaa group server radius switch-auth
server name switch-auth1
server name switch-auth2
!
aaa authentication login default group switch-auth local
aaa authentication dot1x default group switch-auth
aaa authorization console
aaa authorization exec default group switch-auth local if-authenticated
aaa authorization network default group switch-auth
aaa accounting dot1x default start-stop group switch-auth

radius server switch-auth2
address ipv4 192.168.111.139 auth-port 1812 acct-port 1813
timeout 2
retransmit 1
key 7 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!
radius server switch-auth1
address ipv4 192.168.111.196 auth-port 1812 acct-port 1813
timeout 2
retransmit 1
key 7 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Re: 802.1x assignment issue and domain issue

Aref Alsouqi — Tue, 11 Jul 2023 07:31:19 GMT

Just wondering, maybe the NPS policy is returning a wrong attribute for the traffic matching the user session, how your NPS policy look like?

Re: 802.1x assignment issue and domain issue

vanness629 — Tue, 11 Jul 2023 07:38:59 GMT

To everyone,

I just make a trial

I change the authentication host-mode mutli domain -> authentication host-mode multi-host.

if work perfectly.

Workstation vlan can be assigned based on my radius attributes

Phone can be assigned the correct VLAN base on the radius

Domain assign correctly to "Data"

but still had some strange information

Interface Identifier Method Domain Status Fg Session ID
-----------------------------------------------------------------------------
Gi1/0/43 00e0.4d68.000c dot1x DATA Auth C0A8850B0000006723D6A962

Key to Session Events Blocked Status Flags:

A - Applying Policy (multi-line status for details)
D - Awaiting Deletion
F - Final Removal in progress
I - Awaiting IIF ID allocation
N - Waiting for AAA to come up
P - Pushed Session
R - Removing User Profile (multi-line status for details)
U - Applying User Profile (multi-line status for details)
X - Unknown Blocker

Runnable methods list:
Handle Priority Name
8 0 dot1xSupp
7 5 dot1x
19 10 mab
17 15 webauth

B11_1960_Working_Tab(config-if)#do sh mac add int
% Ambiguous command: "do sh mac add int"
B11_1960_Working_Tab(config-if)#do sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
310 00e0.4d68.000c STATIC Gi1/0/43
Total Mac Addresses for this criterion: 1
B11_1960_Working_Tab(config-if)#

the phone mac address didn't show up inf the mac address table..

Re: 802.1x assignment issue and domain issue

Aref Alsouqi — Tue, 11 Jul 2023 08:01:22 GMT

You shouldn't use multi-host if you want both the phone and the PC to be authenticated because in multi-host only the first connected device would need to authenticate, all the subsequent devices will just be granted access to the network without any authentication. Not sure why the phone MAC doesn't show up on the switch port, but I would recommend trying to change the mode from multi-host to multi-auth and see if that works.

Re: 802.1x assignment issue and domain issue

vanness629 — Tue, 11 Jul 2023 08:07:25 GMT

I just figured out the issue, if I put the phone only, it will not have any authentication process...but the port will remain something connected already.. (even mac address table)

I also try to enable LLDP globally to see if the phone will have response.

Re: 802.1x assignment issue and domain issue

vanness629 — Tue, 11 Jul 2023 08:23:49 GMT

I have change the authentication host mode to multi-auth

if running, if I put the PC connected to the phone, the authentication method for the phone will auto-swag from mab to dot1x... and drop the PC... I also remove the

authentication order and authentication priority on the port.

#do sh auth sessions int gig 1/0/43

Interface Identifier Method Domain Status Fg Session ID
-----------------------------------------------------------------------------
Gi1/0/43 24d9.2140.1b84 mab VOICE Auth C0A8850B00000076240096B8

Key to Session Events Blocked Status Flags:

Runnable methods list:
Handle Priority Name
8 0 dot1xSupp
7 5 dot1x
19 10 mab
17 15 webauth

B11_1960_Working_Tab(config-if)#do sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 24d9.2140.1b84 STATIC Gi1/0/43
100 24d9.2140.1b84 STATIC Gi1/0/43
Total Mac Addresses for this criterion: 2
B11_1960_Working_Tab(config-if)#do sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 24d9.2140.1b84 STATIC Gi1/0/43
100 24d9.2140.1b84 STATIC Gi1/0/43
Total Mac Addresses for this criterion: 2
B11_1960_Working_Tab(config-if)#
B11_1960_Working_Tab(config-if)#
B11_1960_Working_Tab(config-if)#do sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
100 24d9.2140.1b84 STATIC Gi1/0/43
Total Mac Addresses for this criterion: 1
B11_1960_Working_Tab(config-if)#do sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 00e0.4d68.000c STATIC Gi1/0/43
310 00e0.4d68.000c STATIC Gi1/0/43
310 24d9.2140.1b84 DYNAMIC Drop
Total Mac Addresses for this criterion: 3
B11_1960_Working_Tab(config-if)#do sh mac add int gig 1/0/43
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
1 00e0.4d68.000c STATIC Gi1/0/43
310 00e0.4d68.000c STATIC Gi1/0/43
310 24d9.2140.1b84 DYNAMIC Drop
Total Mac Addresses for this criterion: 3
B11_1960_Working_Tab(config-if)#
B11_1960_Working_Tab(config-if)#
B11_1960_Working_Tab(config-if)#do sh auth sessions int gig 1/0/43

Key to Session Events Blocked Status Flags:

Runnable methods list:
Handle Priority Name
8 0 dot1xSupp
7 5 dot1x
19 10 mab
17 15 webauth