Bypass all endpoints in case all ISE Nodes completely down

[Da ICS16]

Dear Community,

We have 3 deployment Nodes 

- PAN

- Secondary Node

- PxGride Node

We use switch cisco model 9200 which supporting critical vlan.

In case all ISE Nodes completely down how to bypass new endpoints session and existing session still alive and able access to internal systems and internet.

We concern with endpoints that start new session after all ISE Nodes are down.

Does Critical vlan can do it on switch level? 

Do we have another solution to on ISE or else?

Thanks,

[marce1000]

 - This is not a realistic requirement ; the ISE  will never be down on a  realistic environment , except for 'global' networking calamities, 

 M,

[Rob Ingram · Accepted solution]

@Da ICS16 Inaccessible Bypass or Critical Authentication will maintain existing authenticated sessions and authorise new sessions into a Critical VLAN if all AAA servers are down.

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

https://integratingit.wordpress.com/2020/12/02/802-1x-critical-authentication/

[MHM Cisco World · Accepted solution]

If you use aaa event server dead authz vlan (critical) then any new endpoint will auth and authz get vlan critical 

And if you want to make endpoint to reauthz when server life again

Commands you need are two

authentication event server dead action authorize vlan (critical)
 authentication event server alive action reinitialize

All this config in SW per interface 

MHM

[thomas]

See ISE Secure Wired Access Prescriptive Deployment Guide :

• Role-Based Critical Authorization
• Cisco IOS Changes for Role-Based Critical Authorization
• ISE Authorization with User Role
• Validating Role-Based Critical Authorization