topic Re: CISCO ISE Closed Mode in Network Access Control

CISCO ISE Closed Mode

B!G•M0US€ — Thu, 31 Oct 2024 04:31:15 GMT

Does anyone have the experience to migrate from CISCO ISE Low Impact Mode to Closed Mode? Could you help share the lession learn of technical part from this?

Best regard,

Re: CISCO ISE Closed Mode

MHM Cisco World — Thu, 31 Oct 2024 06:39:52 GMT

1-remove authentication open and pre-auth ACL from SW ports

2-use VLAN instead of dACL in access-accept of ISE

that only the different

MHM

Re: CISCO ISE Closed Mode

B!G•M0US€ — Thu, 31 Oct 2024 06:56:09 GMT

Hello,

so overall no need to change configuration on ISE and client right? do change only switch configuration? one more if I using IBN 2.0. which command should apply to sw "no authentication open" or "access-session closed"?

Re: CISCO ISE Closed Mode

MHM Cisco World — Thu, 31 Oct 2024 07:09:35 GMT

no authc open <<- this command is not available if you use IBN2.0 I think
you need to use

access-session closed

also for more info check link below

https://www.wiresandwi.fi/blog/solid-config-cisco-ibns-2-0-802-1x-mab-switch-configuration-ios-xe

Re: CISCO ISE Closed Mode

wsteele@conres.com — Thu, 31 Oct 2024 17:04:17 GMT

Keep in mind the commands provided to put access ports in closed mode will only all EAP packets. You may want to create and test a Pre-Auth ACL before trying to role out closed mode in production.