topic ISE Integration queries with Catalyst Switch in Network Access Control

ISE Integration queries with Catalyst Switch

hashimwajid1 — Thu, 25 Sep 2025 07:35:33 GMT

Hi,

I've below queries regarding ISE integration with Catalyst Switch (9300 etc.) for AAA and 802.1x

1- is it true that we can use Catalyst dedicated OOB management port for AAA/TACACS only

2- but we cannot use catalyst dedicated OOB Management interface for 802.1x as its required in-band SVI to communicate with ISE due to port authentication required to check default VRF. (Please correct me)

Re: ISE Integration queries with Catalyst Switch

Rob Ingram — Thu, 25 Sep 2025 07:42:29 GMT

@hashimwajid1 you can use the mgmt port for AAA communication (RADIUS and TACACS), as long as routing is setup to allow the communication. The user ports configured with 802.1X don't need to be in the same VRF as the RADIUS source interface, as it's the switches source interface that communicates with RADIUS for authentication.

https://community.cisco.com/t5/network-access-control/radius-over-vrf/td-p/4106242

Re: ISE Integration queries with Catalyst Switch

hashimwajid1 — Thu, 25 Sep 2025 08:05:53 GMT

Thanks for Answer,

its mean even if I just assign IP to OOB Mgmt. Interface, that will be more then enough to handle 802.1x/MAB and Device admin traffic? no in-band SVI

Re: ISE Integration queries with Catalyst Switch

Rob Ingram — Thu, 25 Sep 2025 08:25:44 GMT

@hashimwajid1 Yes, the mgmt interface is enough to do the RADIUS/TACACS authentications. You do need to do more than just assign IP address to the mgmt interface though, you need the routing and connectivity in place etc.

Re: ISE Integration queries with Catalyst Switch

Arne Bier — Fri, 26 Sep 2025 06:13:36 GMT

Apart from all the usual routing stuff you need, when involving a VRF in management processes such as RADIUS, TACACS, NTP, DNS, etc. requires careful configuration to always quote the VRF in all of these cases. One case that always catches me out is the RADIUS CoA on Catalysts - e.g.

aaa server radius dynamic-author client 172.16.0.100 vrf Mgmt-vrf server-key .....

and

aaa group server radius dnac-client-radius-group server name dnac-radius_172.16.0.100 ip radius source-interface Vlan6 ip vrf forwarding Mgmt-vrf