Hi All,
i'm testing dot1x authentication and authorization on CISCO ISE. I have connected CISCO Access Point on a port of CISCO 3560. its authentication is successful but Authorization is Failed. When i restart AP i get following messages
000123: Jun 8 04:10:22.260 utc: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/34, changed state to up
000124: Jun 8 04:12:32.929 utc: %AUTHMGR-5-START: Starting 'mab' for client (c89c.1d6e.9422) on Interface Gi0/34 AuditSessionID 0000000000000015007522FA
000125: Jun 8 04:12:32.971 utc: %MAB-5-SUCCESS: Authentication successful for client (c89c.1d6e.9422) on Interface Gi0/34 AuditSessionID 0000000000000015007522FA
000126: Jun 8 04:12:32.979 utc: %AUTHMGR-7-RESULT: Authentication result 'success' from 'mab' for client (c89c.1d6e.9422) on Interface Gi0/34 AuditSessionID 0000000000000015007522FA
000127: Jun 8 04:12:32.979 utc: %EPM-6-POLICY_REQ: IP 0.0.0.0| MAC c89c.1d6e.9422| AuditSessionID 0000000000000015007522FA| AUTHTYPE DOT1X| EVENT APPLY
000128: Jun 8 04:12:32.979 utc: %EPM-6-AAA: POLICY xACSACLx-IP-PERMIT_ALL_TRAFFIC-537cb1d6| EVENT DOWNLOAD-REQUEST
000129: Jun 8 04:12:32.988 utc: %EPM-6-AAA: POLICY xACSACLx-IP-PERMIT_ALL_TRAFFIC-537cb1d6| EVENT DOWNLOAD-FAIL
000130: Jun 8 04:12:32.988 utc: %EPM-4-POLICY_APP_FAILURE: IP 0.0.0.0| MAC c89c.1d6e.9422| AuditSessionID 0000000000000015007522FA| AUTHTYPE DOT1X| POLICY_TYPE dACL| POLICY_NAME xACSACLx-IP-PERMIT_ALL_TRAFFIC-537cb1d6| RESULT FAILURE| REASON AAA download failure
000131: Jun 8 04:12:32.988 utc: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (c89c.1d6e.9422) on Interface Gi0/34 AuditSessionID 0000000000000015007522FA
000132: Jun 8 04:12:32.988 utc: %EPM-6-POLICY_REQ: IP 0.0.0.0| MAC c89c.1d6e.9422| AuditSessionID 0000000000000015007522FA| AUTHTYPE DOT1X| EVENT REMOVE
000133: Jun 8 04:12:33.583 utc: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (c89c.1d6e.9422) on Interface Gi0/34 AuditSessionID 0000000000000015007522FA
000134: Jun 8 04:13:04.015 utc: %PLATFORM_ENV-1-FRU_PS_ACCESS: FRU Power Supply is not responding
000135: Jun 8 04:18:40.979 utc: %PLATFORM_ENV-1-FRU_PS_ACCESS: FRU Power Supply is not responding
000136: Jun 8 04:24:18.942 utc: %PLATFORM_ENV-1-FRU_PS_ACCESS: FRU Power Supply is not responding
000137: Jun 8 04:29:55.927 utc: %PLATFORM_ENV-1-FRU_PS_ACCESS: FRU Power Supply is not responding
i have following information on Interface and also the ACL which is applied on switch
POC-3560X-SW1#sh runn int gi 0/34
Building configuration...
Current configuration : 746 bytes
!
interface GigabitEthernet0/34
switchport trunk encapsulation dot1q
switchport trunk native vlan 102
switchport trunk allowed vlan 102,124,668
switchport mode trunk
ip access-group ACL-DEFAULT in
load-interval 30
authentication event fail action next-method
authentication event server dead action authorize vlan 102
authentication event server alive action reinitialize
authentication host-mode multi-host
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer inactivity 180
authentication violation replace
mab
no snmp trap link-status
mls qos trust dscp
dot1x pae authenticator
dot1x timeout tx-period 10
end
ip access-list extended ACL-DEFAULT
permit ip any any
permit udp any any
the clients are connected to ISE but AP is not authorized.
