cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

695
Views
0
Helpful
11
Replies
Beginner

IBNS 2.0 no-match result-type method dot1x

I am having trouble making something work.

I want to apply a service-template only if mab and dot1x both fail.

I am trying to use concurrent authentication.

I used a class that is listed as an example in the

Cisco IOS Identity-Based Networking Services Command Reference

This example is listed under the command match result-type

class-map type subscriber control match-all ALL-FAILED
 no-match result-type method dot1x none
 no-match result-type method dot1x success
 no-match result-type method mab none
 no-match result-type method mab success
 no-match result-type method webauth none
 no-match result-type method webauth success

 Here is a debug after mab fails and followed by dot1x failed.

Nov 29 15:49:19: %DOT1X-5-FAIL: Authentication failed for client (001b.78f6.0aed) on Interface Gi1/0/1 AuditSessionID 0A3D011E0000006886626E6C
Nov 29 15:49:19: [PRE:RULE:EVENT:2F000038] Executing policy-map type control subscriber User_Test
Nov 29 15:49:19: [PRE:RULE:EVENT:2F000038]   event (id:1 name:authentication-failure) match-first
Nov 29 15:49:19: [PRE:RULE:EVENT:2F000038]     class ALL-FAILED do-until-failure policy instance 0x990200E4
Nov 29 15:49:19: [PRE:RULE:EVENT:2F000038] Evaluate: class-map type control match-all subscriber ALL-FAILED
Nov 29 15:49:19: [PRE:RULE:EVENT:2F000038]   no-match result-type method dot1x none :failure

 

I expect that the method would be dot1x and the result type would be authoritative. So why do I not get a success on the no-match

 

Hope somebody can shed some light on this.

 

11 REPLIES 11
Cisco Employee

Re: IBNS 2.0 no-match result-type method dot1x

Please start with ISE Secure Wired Access Prescriptive Deployment Guide

match-all means all needing to be matched, I believe.

Beginner

Re: IBNS 2.0 no-match result-type method dot1x

That is correct. The debug should evaluate each statement in the class.

no-match ... none should result in success. no-match ... success should also be success. For both mab and dot1x. I don't have web-auth in my actual class map. So ALL-FAILED needs to match for my policy to work.

Cisco Employee

Re: IBNS 2.0 no-match result-type method dot1x

I am no expert on IBNS 2.0 but using negative against negative would be problematic and leads to un-expected results. Please use the guide I pointed out and see how things work.

Highlighted
Beginner

Re: IBNS 2.0 no-match result-type method dot1x

How is match-all against four no-match statements a double negative.

The example is listed in the command reference. I will review the guide again. Am currently on a mobile, so that will have to be later.

Cisco Employee

Re: IBNS 2.0 no-match result-type method dot1x

 

no-match result-type method dot1x none

Somehow it failed for this so it does not continue. I have no idea what it means exactly but

  • none—No result.

I guest no-match a no-result is negative against negative. hehe.

ISE Secure Wired Access Prescriptive Deployment Guide gives working examples. If any specific not working, please let mnagired know as he took it over from hariholla as the owner of this guide.

Beginner

Re: IBNS 2.0 no-match result-type method dot1x

I looked through the guide, there isn't any reference to concurrent authentication nor to match/no-match result-type none.

One need to ensure that both mab and dot1x have completed. In other words the result-type is not success and not none.

I expect that if the result type is none, then the method is either never been started, is running, or has been terminated. There might be a result-type other than none after being terminated, but should be reset back to none if started again.

I believe this to be a bug. I have a case open with no feedback as of yet.

 

Regards.

Cisco Employee

Re: IBNS 2.0 no-match result-type method dot1x

Please do not use concurrent DOT1X and MAB with ISE. At present, ISE is expecting the endpoint session either in DOT1X or in MAB at one time or another but not at the same time.

Beginner

Re: IBNS 2.0 no-match result-type method dot1x

Well its documented in these two links. The session number for MAB and dot1x are different. Are you telling me and my customer that you can't do this even though you document it. More fuel to the fire in my customers bad experiences so far.
IBNS 2.0 Deployment Guide - Cisco
https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/whitepaper_C11-729965.html#_Toc404649482
Configuring Identity Control Policies
https://www.cisco.com/en/US/docs/ios-xml/ios/san/configuration/xe-3se/3850/san-cntrl-pol.html#GUID-5D90F0D3-E498-4DE9-8153-C46695F8B7C2
Cisco Employee

Re: IBNS 2.0 no-match result-type method dot1x

Unfortunately that is where we stand for now. See CSCuy05270

It would work if DOT1X and MAB requests are sent to two distinct ISE deployments.

Beginner

Re: IBNS 2.0 no-match result-type method dot1x

Hi Hslai,

 

Sorry to comment on this discussion since it is already marked as solved.

But isn't one of the buzzing marketing for using IBNS v2.0 is because of the concurrent Flexauth that it reduces time for endpoint to join the network compared to sequential Flexauth?

To be honest i find this IBNS v2.0 complex and not offering so much advantage over the IBNS v1.0 which is more clear.

VIP Engager

Re: IBNS 2.0 no-match result-type method dot1x

Hsing,

 

The bug you posted was referencing failed MAB attempts.  As I have posted in other posts we never have a failed MAB condition in our setups.  We probably have 500k+ switch ports across our customers running simultaneous MAB/Dot1x with IBNS 2.0.  Has the BU done any research to isolate the cause for that bug to see if the issue is really around the MAB failures? 

 

In our setups MAB is successful in all cases immediately then Dot1x follows in a few second later.  The switch properly implements the priority for Dot1x and moves the client to Dot1x.  Works perfectly.