topic ISE Reauthentication + MAB in Network Access Control

ISE Reauthentication + MAB

fatalXerror — Fri, 05 Jul 2024 12:31:29 GMT

Hi All,

I want to set my ISE reauth timer every 30 minutes for my wired connection, where can I set this?
Also, what is the packet size of this reauth packet?

Thanks

Re: ISE Reauthentication + MAB

MHM Cisco World — Fri, 05 Jul 2024 12:41:00 GMT

I want to set my ISE reauth timer every 30 minutes for my wired connection, where can I set this?
wired meaning SW so you can config reauth timer in SW under port

authentication timer reauthenticate {server or SW reauth timer}

server meaning ISE send reauth timer with request accept
reauth timer this meaning you can direct enter the timer in SW

MHM

Re: ISE Reauthentication + MAB

Rob Ingram — Fri, 05 Jul 2024 12:46:33 GMT

@fatalXerror you can statically configure the reauthentication timer under the interface with the command authentication timer reauthenticate <value>.

Or use the command authentication timer reauthenticate server and push down the timer from ISE, in the Authorization profile select "Reauthentication" checkbox and enter the value in seconds.

I do not know the packet size of a reauth packet without taking a packet capture.

Re: ISE Reauthentication + MAB

Karsten Iwen — Fri, 05 Jul 2024 14:18:04 GMT

There is no "reauth packet". The process of doing a reauthentication is the same as the initial one with a flow of possibly multiple packets. With you mentioning MAB, it is likely one access-request followed by one access-accept. For 802.1X it can be a flow of many (larger) packets when also certificate information is exchanged.