web authentication as a fallback method for Cisco ISE

mjrmontemayor — Mon, 11 Mar 2019 04:47:35 GMT

Hi,

Please help to share how to configure wired dot1x fallback to web authentication. I could not find any documentation how to configure the ise to do the web authentication. for my switchport i configured this:

switchport mode access

switchport access vlan 135
ip access-group PREAUTH in
authentication event fail action next-method
authentication host-mode multi-auth
authentication open
authentication order dot1x web
authentication priority dot1x web
authentication port-control auto
authentication violation restrict
dot1x fallback WEB_FALLBACK
dot1x max-reauth-req 1
dot1x pae authenticator
spanning-tree portfast
spanning-tree bpduguard enable

ip access-list extended PREAUTH
permit udp any eq bootpc any eq bootps
permit icmp any any
permit tcp any host 172.21.2.82 eq www

ip admission name WEB_ADMISSION proxy http

fallback profile WEB_FALLBACK
ip admission WEB_ADMISSION

Please advice how to configure the ISE to make the fallback successful.

Thanks

regards,

Mike

Try this Configuration

mohanak — Fri, 13 Jun 2014 10:05:05 GMT

Try this Configuration Process

The following example shows a WebAuth fallback profile:

ip admission name IP_ADMIN_RULE proxy http

ip access-list extended PRE_WEBAUTH_POLICY

permit udp any any eq bootps

permit udp any any eq domain

fallback profile WEB_AUTH_PROFILE

ip access-group PRE_WEBAUTH_POLICY in

ip admission IP_ADMIN_RULE

The following example shows all the required elements of a configuration for IEEE 802.1X with WebAuth fallback in the order they would appear in the command-line interface (CLI):

aaa new-model

aaa authentication dot1x default group radius

aaa authentication login default group radius

aaa authorization network default group radius

aaa authorization auth-proxy default group radius

aaa accounting dot1x default start-stop group radius

aaa accounting auth-proxy default start-stop group radius

ip device tracking

ip admission name IP_ADMIN_RULE proxy http

fallback profile WEB_AUTH_PROFILE

ip access-group PRE_WEBAUTH_POLICY in

ip admission IP_ADMIN_RULE

dot1x system-auth-control

interface Gigabit 1/0/5

switchport mode access

switchport access vlan 30

authentication port-control auto

authentication fallback WEB_AUTH_PROFILE

dot1x pae-authenticator

dot1x tx-period 5

ip http server

ip http secure-server

ip access-list extended PRE_WEBAUTH_POLICY

permit udp any any eq bootps

permit udp any any eq domain!

radius-server host 10.100.10.117 key cisco123

radius-server vsa send authentication

http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/app_note_c27-577494.html

topic web authentication as a fallback method for Cisco ISE in Network Access Control

web authentication as a fallback method for Cisco ISE

Try this Configuration