Cisco 3850 switch DACL not getting applied in posture "unknown" state

[SHABEEB KUNHIPOCKER]

Hi,

I have a Cisco 3850 switch doing dot1x authentication on ports. In the posture unknown state I am pushing a redirect acl and a DACL from the ISE once the user moves to posture unknown state. I have noticed that in the posture unknown state the DACL am is not taking effect. The switch version is 3.6.8. Please help.

Thanks 

[mnagired]

Hi Shabeeb,

Refer to the below link and let me know if that helps..

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116143-config-cise-posture-00.html#anc36 

[Francesco Molino]

Hi

When saying the dack had no effect, do you see it applied on the port or not?
Can you share the ise log and output of the switch showing this dacl applied?

[Aravind Ravichandran]

Take debug epm all debug from the switch & check whether dacl is applied or not.

[Mike.Cifelli]

Do you have a base_acl configured on the port that will be overridden by your dacl?  Also, ensure that you have enabled device tracking.

[Francesco Molino · Accepted solution]

Can you share plz the output of show authe sess int gx/x/x detail?

I had same issue for CWA. You can do a quick test by doing a ping from your machine to 8.8.8.8.

I believe your ACL is blocking ICMP and there just to redirect traffic to posture, am I right?

If ping works even if ACL is blocking, I highly suggest to open a TAC.

In my case, we're pushing the redirect acl (already configured on the switch) + dACL. The switch doesn't take into consideration any acl when it comes to do some kind of redirect. However, if you push an acl on a normal dot1x or mab authentication, then this acl is enforced.

[rhuel.phils]

Guys, how did you resolve the issue?

we are having the same issue.

please share workaround! Thanks

[Jason Kunst]

If urgent please work through the TAC