dot1x session persistent on switches?

[Michael Bartholomæussen]

I seem to recall that if a switch looses connection to all PSN nodes, the authentication session will remain active for a during of time? Is this correct or I'm remembering it wrongly?

[Surendra]

The session will remain active till the reauthentication timer expires or if you have configured actions based on radius server status on the switch.

[Michael Bartholomæussen]

Thanks - In my case I haven't configured the interface level "dot1x reauthentication" command so the clients will be persistent if ISE fails.

Where is the configuration set in ISE?

[Surendra]

Do you have “authentication periodic” configured ? Can you share your switchport configuration ?

[Michael Bartholomæussen]

interface GigabitEthernet2/0/14
description DYNAMIC-USER
switchport mode access
switchport voice vlan 40
authentication control-direction in
authentication event fail action next-method
authentication event server dead action reinitialize vlan 2104
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer restart 5
authentication timer inactivity server dynamic
authentication violation replace
mab
dot1x pae authenticator
dot1x timeout tx-period 3
spanning-tree portfast
spanning-tree bpduguard enable

[Surendra · Accepted solution]

As per your configuration, as Mike said in the reply, If there is a re-authentication timer configuration set in the authorization profile, switch will re-authenticate the clients.

[Mike.Cifelli · Accepted solution]

If you want to rely on ISE to push the re-authentication timer you can do so in your Authz profiles under common tasks. The timer is in seconds so 3600 would be one hour re-auth timer. HTH!