topic Re: Switch End User Interfaces CTS config with Dot1x Authentication in Software-Defined Access (SD-Access)

Switch End User Interfaces CTS config with Dot1x Authentication

ifabrizio — Tue, 27 Feb 2024 12:55:33 GMT

I'm testing trustsec in a test environment.

I connected a test PC, on a port of a 4500 Sup8 switch.

Initially I excluded Dot1x(TEAP) type authentication and configured a static mapping on the port using the cts manual policy static sgt command.

While another test PC is connected to a 9300 switch, where I configured the PC port again with the CTS manual by assigning another tag. The two switches are connected to each other with a link where CTS is enabled.

Everything works correctly. By changing the policy on the trustsec matrix, enforcement is performed on the Cisco ISE. If on the 4500 switch I change the access port configuration, removing the cts manual instruction, and configuring the authorization policy on the Cisco ISE, assigning the trustsec group, the enforcement do not work anymore.

Someone cold help me?

Bye,

JF.

Re: Switch End User Interfaces CTS config with Dot1x Authentication

Torbjørn — Wed, 28 Feb 2024 09:17:56 GMT

Can you see that the tag value is assigned as intended by ISE? You can verify this with the following command:

show cts interface ethernet {port}

Re: Switch End User Interfaces CTS config with Dot1x Authentication

ifabrizio — Thu, 29 Feb 2024 08:51:44 GMT

Hi Torbj0rn,

Thank you for your reply.

I found the problem,

The problem was caused by the switch interface configuration.

initially I configured the cts as manual, assigning the tag via static policy. When I configured the interface to activate dot1x type authentication, I first had to deactivate the cts manual, but when I exited the interface configuration mode, I did not use the exit command, but ctrl+Z.

By configuring the interface again with the CTS manual and then disabling it, and then doing shut no shut and then exit, after reconfiguring the dot1x everything works!

Re: Switch End User Interfaces CTS config with Dot1x Authentication

Torbjørn — Thu, 29 Feb 2024 09:36:26 GMT

No problem @ifabrizio! Glad you found the cause of the issue.