topic Re: Switch config for ports with dot1x and MAB at same time - auth ord in Network Access Control

Switch config for ports with dot1x and MAB at same time - auth order

babalao — Thu, 02 May 2024 01:03:35 GMT

Hello,

I almost always see this command as best practice authentication order dot1x mab , but sometimes I see this as best practice authentication order mab dot1x.

The priority is always this: authentication priority dot1x mab

-when I have PC (dot1x) and IP Phone (MAB) on the same port what do you recommend?

-Why would I use one orden over the other?

-And what do you guys use normally in these situations? what is your real world experience?

Thank you very much

Regards

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Rob Ingram — Thu, 02 May 2024 07:16:44 GMT

@babalao I traditionally use the defaults, 802.1X first before MAB. This works well in scenarios where a PC is plugged in behind a Phone. Ensure the authentication timers settings are not excessive as this can cause DHCP to timeout on some MAB devices. https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

This guide covers explains the different order/priority scenarios and the points to consider when changing the order/priority. https://www.cisco.com/c/dam/en/us/support/docs/ios-nx-os-software/identity-based-networking-service/flexible_authentication.pdf

Re: Switch config for ports with dot1x and MAB at same time - auth ord

balaji.bandi — Thu, 02 May 2024 07:25:36 GMT

Best practice i suggesting using as below - since if you use MAB that is not secure at all - if dot1x fails then use MAB for non supplicant supported devices.

The priority is always this: authentication priority dot1x mab

Re: Switch config for ports with dot1x and MAB at same time - auth ord

MHM Cisco World — Thu, 02 May 2024 07:28:30 GMT

the different is
order dot1x mab <<- this not common in cisco doc. and the steps are
SW will try dot1x if failed then it try MAB, it is old fallback MAB auth

order mab dot1x <<- this list in flexAut cisco feature and it is New and the steps are
SW will detect any MAC and send to raduis and check auth with MAC, here the MAC must not list in radius, if this auth is failed then the SW start dot1x

why cisco use order auth order mab dot1x ?

because there is some device like printer request DHCP in first frame to SW if SW use first dot1x then try auth with MAB there is chance that this SW will not get IP.

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Shivesh Mishra — Fri, 17 Jan 2025 12:38:18 GMT

Hello,

I'm looking forward to expert advice here.

Currently we've configured switch ports for MAB based authentication. And we're planning to move to dot1x.

As part of testing whenever we're changing the "authentication order" and "authentication priority" to dot1x from MAB (current setup) and generating a new authentication session the switchport goes into drop state.

When doing sh mac addresses int gi0/x

We can see Mac address and port status as "drop".

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Aref Alsouqi — Sat, 18 Jan 2025 14:00:29 GMT

Could you please try to shutdown the port, change the configs, and then unshut it?

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Shivesh Mishra — Mon, 20 Jan 2025 12:52:33 GMT

Hello,

Thanks for the suggestions.

Tried it but still the same problem. Port goes into drop state.

Re: Switch config for ports with dot1x and MAB at same time - auth ord

MHM Cisco World — Mon, 20 Jan 2025 13:00:30 GMT

Make new post please

MHM

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Aref Alsouqi — Mon, 20 Jan 2025 18:30:31 GMT

You're welcome. What device type are you trying to authenticate/authorize via dot1x? a PC or a phone? also, could you please share your sanitized configs from the RADIUS server and the switch port for review?

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Shivesh Mishra — Wed, 22 Jan 2025 13:35:22 GMT

Hello,

We're trying to authenticate windows PCs via dot1x. Supplicant is already configured on system end.

Below is the port configuration :

interface GigabitEthernet0/19

switchport access vlan xxx

switchport mode access

switchport voice vlan zzz

switchport port-security maximum 2

authentication event server dead action authorize vlan xxx

authentication event server alive action reinitialize

authentication host-mode multi-host

authentication order mab

authentication priority mab

authentication port-control auto

authentication periodic

authentication timer reauthenticate 43200

authentication timer inactivity 3600

mab

snmp trap mac-notification change added

snmp trap mac-notification change removed

dotlx pae authenticator

dotlx timeout server-timeout 30

dotlx timeout tx-period 10

dotlx max-req 3

dotlx max-reauth-req 10

spanning-tree portfast edge

spanning-tree bpduguard enable

On Radius Server we've kept a simple straight config for testing purpose only as below -

EAP-Type : TLS (Accept)

Supplicant is configured accordingly on the system end.

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Aref Alsouqi — Wed, 22 Jan 2025 16:57:20 GMT

Could you please try to remove the command "switchport port-security maximum 2" and also replace the "authentication host-mode multi-host" with "authentication host-mode multi-auth"?

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Shivesh Mishra — Thu, 23 Jan 2025 12:01:16 GMT

Hello Aref,

Tried above suggestion, but still the same problem. Switchport goes into dropped state.

Re: Switch config for ports with dot1x and MAB at same time - auth ord

Aref Alsouqi — Sat, 25 Jan 2025 12:45:46 GMT

Hello Shivesh. Not really sure, I would think maybe the switch software is hitting some bugs, I don't know. I would try to look into the switch software release notes, and upgrade it to the latest recommended release.