Reauthentication Timer

[Jason Weids]

Hello,

Why do devices that are unknown or that have no authorization policy constantly try to reauth every minute? Surely once they have failed & denied access a few times then you don't want them constantly sending radius requests. Is there a way to change the reauth timer so it only reauth when the port transitions to "up connected"?

Jason 

[paul · Accepted solution]

Unless you are doing a complete whitelisted setup, you really shouldn't be denying access to the network.  Every device should have an authorization policy applied.  The default policy should be a Limited Access policy with a DACL applied to allow access to the PSNs and DNS.  DNS is there to allow redirection to a portal if you want.

[Jason Weids]

We are whitelisting. Nothing should be allowed to connect to the wired network in our environment unless it is a "known/trusted" device. The devices we are seeing which are not authorised are filling our live radius logs & it is these I want to limit.

[paul]

Even in a whitelisted setup I would still not deny as the last rule in the wired MAB policy set. Allow the connection and put a DACL on to limit access to the ISE PSNs and maybe other security products to allow a device not whitelisted to be profiled/scanned to gather information about it.

[Jason Weids]

That really helpfull, That might be what you would do but in our environment we only allow authorised devices on the wired network.

[Mike.Cifelli]

If you are not using an ISE authorization policy result that pushes reauthentication timer then the fallback will be whatever you have configured on the host port.
dot1x reauthentication
dot1x timeout reauth-period (seconds)
Those commands will enable periodic re-authentication and set the number of seconds between re-authentication attempts.

HTH!

[Jason Weids]

Can you do this with MAB authentication?

[hslai]

I agree with paul.

dot1x timeout quiet-period seems what you asked for.

[Jason Weids]

I probably should have mentioned we are doing MAB authentication not dot1x