Hello Everyone,
Wanted to check with you if you've encountered such scenario where you had NAC enabled (multi-auth mode) on the Catalyst 9300 switch and on some ports there were some downstream switches connected that do not support dot1x/mab. I wanted to authenticate the connected switch's MAC and push a dynamic template on that port that makes it trunk with 1 allowed vlan and root guard, but im worried that there might be some cases e.g :
- session timeout (reauthentication timer)
- link up/down
Downstream's switch directly connected devices like printers, laptops packet might arrive as first packet on the Catalyst 9300 port and it will then authenticate, but with a dynamic VLAN assignment or access-accept but not with the dynamic template. Even worse if someone connects a device to the downstream switch that is not included in the Endpoint Identity Group for MAB and the whole port will get unathorized.
Additionally if the downstream switch will be unmanaged , then I guess I'll need to push a template with switchport mode access and not trunk as the unmanaged switches do not support trunking i think.
Have you encountered such scenario and what helped you the most in such case?
Thank you for any responses.
