topic NAD config for 802.1x/MAB with ISE in Network Access Control

NAD config for 802.1x/MAB with ISE

babalao — Thu, 25 Apr 2024 21:11:49 GMT

Hello,

I have seen in several places this commands as best practice.

Are they still needed/helpful ?

-epm logging
-logging host <ISE_IP_address_x> transport udp port 20514
-epm access-control open or access-session acl default passthrough

-device classifier

thank you

regards

Re: NAD config for 802.1x/MAB with ISE

Arne Bier — Thu, 25 Apr 2024 23:41:51 GMT

Hello

-epm logging

Not required - legacy troubleshooting thing for very early ISE releases.

-logging host <ISE_IP_address_x> transport udp port 20514

Nope - that was a very early ISE requirement - but ISE will not enrich its Live Logs with the SYSLOGs of Network Devices.

-epm access-control open or access-session acl default passthrough

Not required - legacy troubleshooting thing for very early ISE releases.

-device classifier

Nope - You only need the IOS Device-Sensor these days. IOS Device Classifier is a handy mechanism to decode the MAC OUI Prefixes into something more human readable. But it's not needed for NAC or for ISE.

There is an old thread that explains some of the history too.

Re: NAD config for 802.1x/MAB with ISE

babalao — Fri, 26 Apr 2024 14:02:17 GMT

Hello,

thanks for the reply.

Is there a current switch config guide for best practices by Cisco?

Thank you.

Re: NAD config for 802.1x/MAB with ISE

Aref Alsouqi — Fri, 26 Apr 2024 15:00:57 GMT

I would recommend these two links to start with:

Switch Configuration for ISE dot1x — Networking fun (network-node.com)

Cisco ISE NAD Configuration Templates – Cisco ISE Tips, Tricks, and Lessons Learned (ise-support.com)