topic Re: Bypass all endpoints in case all ISE Nodes completely down in Network Access Control

Bypass all endpoints in case all ISE Nodes completely down

Da ICS16 — Wed, 03 Jan 2024 04:40:32 GMT

Dear Community,

We have 3 deployment Nodes

- PAN

- Secondary Node

- PxGride Node

We use switch cisco model 9200 which supporting critical vlan.

In case all ISE Nodes completely down how to bypass new endpoints session and existing session still alive and able access to internal systems and internet.

We concern with endpoints that start new session after all ISE Nodes are down.

Does Critical vlan can do it on switch level?

Do we have another solution to on ISE or else?

Thanks,

Re: Bypass all endpoints in case all ISE Nodes completely down

Mark Elsen — Wed, 03 Jan 2024 07:35:42 GMT

- This is not a realistic requirement ; the ISE will never be down on a realistic environment , except for 'global' networking calamities,

Re: Bypass all endpoints in case all ISE Nodes completely down

Rob Ingram — Wed, 03 Jan 2024 08:51:57 GMT

@Da ICS16 Inaccessible Bypass or Critical Authentication will maintain existing authenticated sessions and authorise new sessions into a Critical VLAN if all AAA servers are down.

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

https://integratingit.wordpress.com/2020/12/02/802-1x-critical-authentication/

Re: Bypass all endpoints in case all ISE Nodes completely down

MHM Cisco World — Wed, 03 Jan 2024 14:21:07 GMT

If you use aaa event server dead authz vlan (critical) then any new endpoint will auth and authz get vlan critical

And if you want to make endpoint to reauthz when server life again

Commands you need are two

authentication event server dead action authorize vlan (critical)
 authentication event server alive action reinitialize

All this config in SW per interface

MHM

Re: Bypass all endpoints in case all ISE Nodes completely down

thomas — Thu, 04 Jan 2024 21:16:06 GMT

See :