topic Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica in Network Access Control

ISE Allow MAB for endpoints which had successful Dot1.x authentication

JonatanSitter — Tue, 05 Dec 2023 10:11:42 GMT

Hello everybody,

I'm looking into how to allow MAB for endpoints which had successful 802.1x authentication.

Is there a way to update some endpoint attribute based on a successful 802.1x authentication which then gets used whenever the client (for whatever reason) goes through MAB?

On another NAC solution you can set the endpoint to known through after an authentication.

How would I do that in ISE?

Thanks in advance!

Jonatan

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

Mark Elsen — Tue, 05 Dec 2023 10:53:32 GMT

>...I'm looking into how to allow MAB for endpoints which had successful 802.1x authentication.
Inconsistent requirement , 802.1x supersedes MAB

>...s there a way to update some endpoint attribute based on a successful 802.1x authentication which then gets used whenever the client (for whatever reason) goes through MAB?
- The client doesn't go to anything ; what the client does is determined by the NAC (ISE) infrastructure (only)

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

JonatanSitter — Tue, 05 Dec 2023 11:18:26 GMT

Thanks for the helpful response.

I know that 802.1x supersedes MAB. But as you might know, sometimes an endpoint fails to authenticate over 802.1x.
At that point the switch allows for MAB. I want ISE to authenticate/authorize an endpoint over MAB only if there has been a successful 802.1x authentication for example the day before.

We should be able to set endpoint attributes in the authorization process. Not only send radius attributes to the switch but also add custom attributes to the endpoint database.

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

MHM Cisco World — Tue, 05 Dec 2023 11:24:08 GMT

First config ISE as MAB and as 802.1x

Then config your SW with

802.1x flexible auth

Where order and priority make big rule in make end point auth both or one of mab/802.1x

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

MHM Cisco World — Tue, 05 Dec 2023 11:25:17 GMT

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.cisco.com/c/dam/en/us/support/docs/ios-nx-os-software/identity-based-networking-service/flexible_authentication.pdf&ved=2ahUKEwjJ9dHSl_iCAxXCVvEDHd3mBx4QFnoECBAQAQ&usg=AOvVaw3z5i9twAwNga4buBNcHYyk

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

Charlie Moreton — Tue, 05 Dec 2023 14:56:23 GMT

If 802.1x fails for whatever reason, do you really want to allow access? What if the device is stolen? The thief now has access to your network. Just because another solution allows an insecure workaround it should not be the norm.

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

JonatanSitter — Tue, 05 Dec 2023 15:04:49 GMT

What about PXE boot for example? In that case the PC/Laptop does not respond to 802.1x and needs to fall back to MAB. I want to only allow that if it has previously authenticated successfully and not just for any pxe device.

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

Charlie Moreton — Tue, 05 Dec 2023 15:09:38 GMT

Move the endpoint MAC address to a PXE Endpoint Identity Group and reference that in your Authorization Policy

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

JonatanSitter — Tue, 05 Dec 2023 15:12:25 GMT

Can that be done automatically?
i.e. if authenticated successfully -> endpoint gets assigned a certain endpoint identity group which later can be referenced in MAB authz policy.

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

Charlie Moreton — Tue, 05 Dec 2023 15:20:56 GMT

It can be, it depends on how you have your profiling and/or EIGs set up as to how you would determine which EIG the endpoints are assigned

Re: ISE Allow MAB for endpoints which had successful Dot1.x authentica

JonatanSitter — Wed, 06 Dec 2023 12:13:14 GMT

Could you maybe give me some hints, what to look for?