topic Re: Problem with MAB authentication on IOL switch with ISE in Network Access Control

Problem with MAB authentication on IOL switch with ISE

anfeldendani1996 — Thu, 02 Oct 2025 10:09:28 GMT

Hello,

I'm trying to configure MAB authentication using Cisco ISE and a switch, but I'm running into an issue:

When I do not configure MAB on the switch, the MAC address of the client shows up normally in the MAC address table.
When I enable the MAB configuration, the switch does not receive any MAC address from the client (it shows 0000.0000.0000), even though the MAB process is running.

Additional info:

mab config

results :

Switch version:

Cisco IOS Software, Solaris Software (I86BI_LINUXL2-ADVENTERPRISEK9-M), Experimental Version 15.1(20140814:053243) [mmen 112]
When using 802.1X, authentication works correctly.

It seems like MAB is not learning or passing the client MAC address properly

Has anyone faced this issue before? Is it a known limitation/bug of this IOL image?
Any workaround to test MAB in a lab environment?

Thanks in advance.

Re: Problem with MAB authentication on IOL switch with ISE

balaji.bandi — Thu, 02 Oct 2025 11:38:17 GMT

have you tried vIOSL2 ? or Cat9K image.

Re: Problem with MAB authentication on IOL switch with ISE

anfeldendani1996 — Thu, 02 Oct 2025 15:05:44 GMT

hello ,

thank you for the suggesting ,

I'im using pnetlab , and i don't have access to the CLI , so i can't upload images

Re: Problem with MAB authentication on IOL switch with ISE

balaji.bandi — Thu, 02 Oct 2025 15:24:07 GMT

i used pnetlab - IOL have some versions have Limitations

i tried below version as per my notes it works for me

SW4#show version
Cisco IOS Software, Linux Software (I86BI_LINUXL2-ADVENTERPRISEK9-M), Version 15.2(CML_NIGHTLY_20190423)FLO_DSGS7, EARLY DEPLOYMENT DEVELOPMENT BUILD, synced to V152_6_0_81_E

interface eth 0/1
switchport host
authentication open
authentication host-mode multi-auth
authentication order mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator

SW4#show authentication sessions interface ethernet 0/1 details
Interface: Ethernet0/1
MAC Address: 50d6.9f00.9dff
IPv6 Address: Unknown
IPv4 Address: 5.2.35.2
User-Name: 50-D6-9F-00-9D-FF
Status: Authorized
Domain: DATA
Oper host mode: multi-auth
Oper control dir: both
Session timeout: N/A
Restart timeout: N/A
Periodic Acct timeout: N/A
Session Uptime: 225s
Common Session ID: 960107220000000E00282A68
Acct Session ID: 0x00000001
Handle: 0x6D000003
Current Policy: POLICY_Et0/1

Local Policies:
Service Template: xxxxxxxxxxxxxx (priority 150)
Security Policy: Should Secure
Security Status: Link Unsecure

Server Policies:
Vlan Group: Vlan: 305
ACS ACL: xxxxxxxxxxxxxxxxx

Method status list:
Method State

mab Authc Success