Here you go. This is the template we are using. I am not worried about the template as I and other ISE engineers here have used it on ISE installs. I am just asking how to properly clear authentication sessions and get them to restart. As I said on the original post a “clear auth session” and “clear mac address-table dynamic” always works on non-CPL switches.
aaa group server radius ISE-RADIUS
server name
!
!**CPL**
!
ip access-list extended PERMIT-ANY
permit ip any any
!
service-template CRITICAL
description Apply When none of the RADIUS servers are reachable
access-group PERMIT-ANY
!
class-map type control subscriber match-any AAA-DOWN
match result-type aaa-timeout
!
class-map type control subscriber match-all DOT1X-FAILED
match method dot1x
match result-type method dot1x authoritative
!
policy-map type control subscriber DOT1X-DEFAULT
event session-started match-all
10 class always do-all
10 authenticate using dot1x priority 10
20 authenticate using mab priority 20
event violation match-all
10 class always do-all
10 restrict
event agent-found match-all
10 class always do-all
10 terminate mab
20 authenticate using dot1x priority 10
event authentication-failure match-first
10 class AAA-DOWN do-all
10 authorize
20 activate service-template CRITICAL
30 terminate dot1x
40 terminate mab
50 pause reauthentication
20 class DOT1X-FAILED do-all
10 terminate dot1x
20 authenticate using mab priority 20
event aaa-available match-all
10 class always do-all
10 clear-session
!
!**PORT CONFIG**
!
interface GigabitEthernet1/0/10
description ISE-802.1x
switchport mode access
authentication periodic
authentication timer reauthenticate server
access-session control-direction in
access-session port-control auto
no access-session closed
mab
dot1x pae authenticator
dot1x timeout tx-period 7
service-policy type control subscriber DOT1X-DEFAULT
!
