topic ISE denies MAB authentication after restart in Network Access Control

ISE denies MAB authentication after restart

TheUser27 — Fri, 12 Jul 2024 10:27:04 GMT

Hi everyone,

we have an issue with an ISE deployment for a customer and Cisco TAC is currently unable to help us...

The customer is using 4 virtual ISE nodes with 2x PAN/Mnt and 2x PSN on Version 3.2 Patch 5.

After an update or simple restart of the primary PSN (first on the switches) the switches do a failover to the second PSN as they should. But when the primary PSN is started again there is a small time frame where the PSN is accepting RADIUS requests again and is marked as alive but rejects our MAB request since the endpoint isn't found in the internal database. On the next reauthentication the request is accepted.

So the PSN node is answering radius request even when the internal MAB database isn't available yet after rebooting. This causes devices that get reauthenticated to receive a wrong vlan which causes outages for our customer.

Has anyone seen this before and has a solution for this problem? Cisco TAC told us to modify the dead-timer on the switch or block access to this node till it's full up again but thats not really a solution for the problem.

Thanks in advance!

Re: ISE denies MAB authentication after restart

Mark Elsen — Fri, 12 Jul 2024 10:54:32 GMT

>...Cisco TAC told us to modify the dead-timer on the switch or block access to this node till it's full up again but thats not really a solution for the problem.
I can assume that the blocking access solution is not feasible , but what's wrong with the dead-timer option ?

Re: ISE denies MAB authentication after restart

TheUser27 — Mon, 15 Jul 2024 14:46:56 GMT

Hi marce1000. Thanks for your reply.

Of course it's an option and we already have 5 Minutes configured but we don't want to extend the dead-timer to an unreasonable value. If we increase the timer to 10 minutes and ISE needs 9.5 Minutes to reboot we'll experience the same issue.

If we increase the dead-timer even further it could be a problem when upgrading/rebooting the nodes and we need to wait for the dead-timer to end.

Also the automate-tester marks the ise alive even when ise isn't completely ready...

Re: ISE denies MAB authentication after restart

MHM Cisco World — Mon, 15 Jul 2024 14:54:04 GMT

For me what I think is happened is

User is auth via mab in one ise

And other ise is auth via mab and guest policy set.

The policy set must config with order and with conditions to eliminate this case

Guest auth use mab as first authc and it add unknown mac to internal db of ise

Mab authc use known mac to authc.

That why the ise re-authc mab device with authz wrong vlan

MHM

Re: ISE denies MAB authentication after restart

TheUser27 — Thu, 18 Jul 2024 12:04:36 GMT

Hi,

sorry but i don't really understand your response. Both PSN Nodes are in the same deployment and the MAC is present in the internal Database and assigned to the correct groups. There is only one MAB ruleset for internal devices and no "guest authentication".

The nodes responds with "AuthenticationResult=UnknownUser" for some time after reload. And works fine after some minutes.

Thanks in advance!

Re: ISE denies MAB authentication after restart

MHM Cisco World — Thu, 18 Jul 2024 12:10:03 GMT

there is
1-Wireless Guest Authc which use two authc
A- first MAB with unknownUser add to specific group
B- portal
2-Wired MAB
which need user add to internal ISE

I think the wired MAB is auth via guest Authc not via Wired MAB
you need to separate wireless than wired

are you use wireless Guest ?

MHM

Re: ISE denies MAB authentication after restart

TheUser27 — Wed, 23 Oct 2024 09:09:36 GMT

The Issue was accepted by cisco as a bug:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm42629

TAC told us that the following Versions will include the fix:
ISE 3.2 Patch 8
ISE 3.3 Patch 5