cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2244
Views
25
Helpful
6
Replies

Allowing access if ISE is down in Wireless

Greetings,

 

Could you advise how to set fail open in the 9800 WLC when ISE is down ?

 

Thanks,

Edouard.

2 Accepted Solutions

Accepted Solutions

thomas
Cisco Employee
Cisco Employee

"Fail Open" is generally a bad security practice for wireless networks. Better to let people use Guest services for internet access.

Best is to simply deploy a highly available ISE deployment so this doesn't happen.

View solution in original post

howon
Cisco Employee
Cisco Employee

This is fancier than what you may be looking for as it only brings up the SSID in case ISE is down. This is important as if you have the backup PSK SSID always up, the user may favor it instead of the main 802.1X SSID:

https://community.cisco.com/t5/wireless-mobility-documents/automated-backup-ssid-with-eem-on-catalyst-9800-wireless/ta-p/3743838

 

View solution in original post

6 Replies 6

Amine ZAKARIA
Spotlight
Spotlight

Hello,

You can create a Fallback SSID with Preshared-Key which is not used by RADIUS and disable it, until your ISE deployment goes down and enable it.

Hi Amine,

 

But the supplicant has already been set to use the certificate. You mean to create a fallback SSID with PSK using a different name.

 

Please advise.

Hello,

Yes of course with a different SSID Name. 

thomas
Cisco Employee
Cisco Employee

"Fail Open" is generally a bad security practice for wireless networks. Better to let people use Guest services for internet access.

Best is to simply deploy a highly available ISE deployment so this doesn't happen.

Thanks Thomas, Our design is ISE in HA mode and I wanted to know if was possible to failback from certificate-based authentication to PSK authentication in case both PSN are down.

 

I know it is possible in the wired scope, so I was wondering it was possible in the in wireless scope.

 

Thanks,

howon
Cisco Employee
Cisco Employee

This is fancier than what you may be looking for as it only brings up the SSID in case ISE is down. This is important as if you have the backup PSK SSID always up, the user may favor it instead of the main 802.1X SSID:

https://community.cisco.com/t5/wireless-mobility-documents/automated-backup-ssid-with-eem-on-catalyst-9800-wireless/ta-p/3743838

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: