topic MAB commands on the 9200 switch interface?? in Network Access Control

MAB commands on the 9200 switch interface??

JustTakeTheFirstStep — Mon, 14 Oct 2024 10:55:44 GMT

SW1#sh run | s aaa
aaa new-model
aaa group server radius ise
server name ise_10.10.10.10
ip radius source-interface Vlan974
aaa authentication dot1x default group ise
aaa authorization network default group ise local
aaa accounting dot1x default start-stop group ise
aaa server radius dynamic-author
client 10.10.10.10 server-key 7 002C1E01175A59565D750D
aaa session-id common

SW1(config)#int g1/0/1
SW1(config-if)#authen?
% Unrecognized command

SW1(config-if)#mab?
% Unrecognized command

SW1#show inven

NAME: "Switch 1", DESCR: "C9200L-48P-4X"
PID: C9200L-48P-4X , VID: V02

Re: MAB commands on the 9200 switch interface??

M02@rt37 — Mon, 14 Oct 2024 12:04:20 GMT

Hello @JustTakeTheFirstStep

Make sure those ports are actually set as Access Ports before configuring the dot1x.

Aslo, ensure that dot1 is enable in global:

dot1x system-auth-control

Re: MAB commands on the 9200 switch interface??

MHM Cisco World — Mon, 14 Oct 2024 12:17:15 GMT

dot1x pae authenticator

Add this then check command

MHM

Re: MAB commands on the 9200 switch interface??

Aref Alsouqi — Mon, 14 Oct 2024 12:31:31 GMT

As M02@rt37 mentioned, the port you are trying to configure dot1x on it might not be configured as an access port. You can factory reset it with the command "default int g1/0/1". Also please take a look at this link for more details:

Switch Configuration for ISE dot1x — Networking fun (network-node.com)

Re: MAB commands on the 9200 switch interface??

JustTakeTheFirstStep — Tue, 15 Oct 2024 08:28:45 GMT

SW1#sh run | i dot1x
dot1x system-auth-control

SW1(config)#int g1/0/1
SW1(config-if)#authen?
% Unrecognized command

SW1(config-if)#mab?
% Unrecognized command

Re: MAB commands on the 9200 switch interface??

JustTakeTheFirstStep — Tue, 15 Oct 2024 08:30:38 GMT

SW1#dot1x ?
test Test 802.1x capabilities

SW1#conf t
Enter configuration commands, one per line. End with CNTL/Z.

SW1(config)#dot1x ?
auth-fail
credentials
critical
guest-vlan
logging
supplicant
system-auth-control
test

Re: MAB commands on the 9200 switch interface??

JustTakeTheFirstStep — Tue, 15 Oct 2024 08:31:51 GMT

HMSGA_POE_SW1(config)#default int g1/0/1
Interface GigabitEthernet1/0/1 set to default configuration

HMSGA_POE_SW1(config)#int g1/0/1
HMSGA_POE_SW1(config-if)#auth?
% Unrecognized command

HMSGA_POE_SW1(config-if)#mab?
% Unrecognized command

Re: MAB commands on the 9200 switch interface??

Rob Ingram — Tue, 15 Oct 2024 08:38:24 GMT

@JustTakeTheFirstStep if you cannot configure "authentication" commands under the interface, you could be running IBNS 2.0 and therefore the commands would now be "access-session", run the command "authentication display config-mode" to determine if the current configuration mode is "new-style".

Refer to the guides for more IBNS 2.0 information

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ibns/configuration/15-e/ibns-15-e-book/ibns-cntrl-pol.html

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-x-series-switches/207193-Configure-IBNS-2-0-for-Single-Host-and-M.html

Re: MAB commands on the 9200 switch interface??

JustTakeTheFirstStep — Tue, 15 Oct 2024 10:51:06 GMT

SW1#authentication display config-mode
Current configuration mode is legacy

SW1#authentication display new-style

SW1#wr
Building configuration...
[OK]
SW1#reload
Proceed with reload? [confirm]

SW1#authentication display config-mode
Current configuration mode is new-style

HMSGA_POE_SW1(config)#int g1/0/1
SW1(config-if)#authen?
% Unrecognized command
SW1(config-if)#mab?
% Unrecognized command

Re: MAB commands on the 9200 switch interface??

Aref Alsouqi — Tue, 15 Oct 2024 11:11:44 GMT

Could you please share the output of the command "sh int status | i 1/0/1_" for review?

RE: MAB commands on the 9200 switch interface??

JustTakeTheFirstStep — Tue, 22 Oct 2024 11:33:49 GMT

@Aref Alsouqi @Rob Ingram @MHM Cisco World M02@rt37

Entering the "switchport mode access" command on an interface activates the MAB command.

Thank you for your interest in my writing.

SW1#sh run int g1/0/1
interface GigabitEthernet1/0/1
switchport mode access
end

SW1(config)#int g1/0/1
SW1(config-if)#mab?
mab

SW1#sh run int g1/0/1
interface GigabitEthernet1/0/1
end

SW1(config)#int g1/0/1
SW1(config-if)#mab?
% Unrecognized command

RE: MAB commands on the 9200 switch interface??

Aref Alsouqi — Tue, 22 Oct 2024 11:50:57 GMT

That was what we referred to in the previous posts as access port : D. Let us know if you still need any further help on this.