Showing results for 
Search instead for 
Did you mean: 

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

Wissam Bteich

Cisco ISE - Reauthentication of client if server becomes alive again


I have this case where Cisco ISE server is used to authenticate & authorize clients on the network.

I configured the switch port to authorize the client in case the ISE server is dead (or not reachable).

The thing is that I want to reauthenticate the client once the ISE server becomes alive again but I am not able to.. ("Additional Information is needed to connect to this network" bullet is not appearing and the client PC remains authenticated and assigned to the VLAN.

Below is the switch port configuration:

interface FastEthernet0/5

switchport access vlan 240

switchport mode access

switchport voice vlan 156

authentication event server dead action authorize vlan 240

authentication event server alive action reinitialize

authentication host-mode multi-domain

authentication order dot1x mab

authentication priority mab

authentication port-control auto


dot1x pae authenticator

spanning-tree portfast

Anyone can help?



Did you get a fix for this?  I am running into the same issue running 12.2(55)SE9.

Saurav Lodh
Rising star

Refer. the Auth fail config. ,, while Radius is down ,

Cisco Employee

Please check whether the switch is dropping the connection or the server.


Symptoms or Issue


802.1X and MAB authentication and authorization are successful, but the switch is dropping active sessions and the epm session summary command does not display any active sessions.



This applies to user sessions that have logged in successfully and are then being terminated by the switch.

Possible Causes


The preauthentication ACL (and the subsequent DACL enforcement from Cisco ISE) on the NAD may not be configured correctly for that session.


The preauthentication ACL is configured and the DACL is downloaded from Cisco ISE, but the switch brings the session down.


Cisco ISE may be enforcing a preposture VLAN assignment rather than the (correct) postposture VLAN, which can also bring down the session.



Ensure the Cisco IOS release on the switch is equal to or more recent than Cisco IOS Release 12.2.(53)SE.


Check to see whether or not the DACL name in Cisco ISE contains a blank space (possibly around or near a hyphen "-"). There should be no space in the DACL name. Then ensure that the DACL syntax is correct and that it contains no extra spaces.


Ensure that the following configuration exists on the switch to interpret the DACL properly (if not enabled, the switch may terminate the session):

radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server vsa send accounting
radius-server vsa send authentication


Stephen McBride

Just noticed your config has "authentication priority mab"

Try "authentication priority dot1x mab"


Not 100% but I would suggest this could be your problem

Venkatesh Attuluri
Cisco Employee

what is switch model and software version

Recognize Your Peers
Content for Community-Ad

ISE Webinars

Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube