Bypass 802.1X

[jack samuel]

Hello everybody,

i am very new to cisco ise but i have one simple question which can be stupid,

all Cisco switch ports are configured with dot1.x on switch to authenticate the machine against Microsoft AD, if in case i opened a brand new pc how i can join that pc to a domain without any single switch port which is excluded by dot1x,???

By the below access-list i hope a pc can join to the domain which is configured on ISE  to receive a ip address once the machine is switched ON to broadcast request for IP address

permit udp any eq bootpc any eq bootps

permit udp any any eq dns

 permit ip any host 4.4.4.4 ( corporate DNS)

deny ip any any

thanks

[jan.nielsen]

As a read your question, it doesn't sound like you are using a PXE environment to image your machines, and you just need to be able to join the PC to the domain. Without a specific set of ports where you have not enabled dot1x, you basically have two options : 1. Enter the PC's mac address in some endpoint group used for this in ISE when you receive the machine, so it gets mab validated to get access to join AD

2. Allow full AD access in your pre-auth ACL on your switches, your current acl won't work, unless 4.4.4.4 is the only AD server you have.

[jack samuel]

Dear Jan,

I have configured a wired MAB authorization policy with DACL of ISE,DNS,DHCP with a redirect access-list on switch, when try to add the windows services in the same DACL it doesn't works, when i create separate authorization policy with separate DACL of windows services it works.

ip access-list extended wired guest dacl

 permit udp any eq bootpc any eq bootps
 permit udp any any eq domain
 permit ip any host 10.10.40.19
 deny   ip any any log

ip access-list extended ACL-REDIRECT
 deny   udp any eq bootpc any eq bootps
 deny   udp any any eq domain
 deny   ip any host 10.10.40.19 --ISE for redirecting
 permit tcp any any eq www
 permit tcp any any eq 443
 deny   ip any any

when i disable the guest redirect authorization policy and create a separate MAB for windows login services it work for me but i am losing the wired redirect policy. ALSO tried to do AND OPERATION in RESULTS for  " wired mab redirect policy" it doesn't  works.

ip access-list extended windows login DACL

 permit udp any eq bootpc any eq bootps
 permit udp any any eq domain

permit ip any host 10.10.39.19 ----AD servers
 permit ip any host 10.10.40.19 ----ISE servers
 deny   ip any any log

Thanks

[jack samuel]

Dear Experts,

Anybody can help me for the above query.

thanks