cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

882
Views
0
Helpful
5
Replies
Wissam Bteich
Beginner

Cisco ISE - Reauthentication of client if server becomes alive again

Dears,

I have this case where Cisco ISE server is used to authenticate & authorize clients on the network.

I configured the switch port to authorize the client in case the ISE server is dead (or not reachable).

The thing is that I want to reauthenticate the client once the ISE server becomes alive again but I am not able to.. ("Additional Information is needed to connect to this network" bullet is not appearing and the client PC remains authenticated and assigned to the VLAN.

Below is the switch port configuration:

interface FastEthernet0/5

switchport access vlan 240

switchport mode access

switchport voice vlan 156

authentication event server dead action authorize vlan 240

authentication event server alive action reinitialize

authentication host-mode multi-domain

authentication order dot1x mab

authentication priority mab

authentication port-control auto

mab

dot1x pae authenticator

spanning-tree portfast

Anyone can help?

Regards,

5 REPLIES 5
mlovellette
Enthusiast

Did you get a fix for this?  I am running into the same issue running 12.2(55)SE9.

Saurav Lodh
Rising star

Refer. the Auth fail config. ,, while Radius is down ,

https://supportforums.cisco.com/discussion/9994111/8021x-critical-authentication-feature-12225see

mohanak
Cisco Employee

Please check whether the switch is dropping the connection or the server.

 

Symptoms or Issue

 

802.1X and MAB authentication and authorization are successful, but the switch is dropping active sessions and the epm session summary command does not display any active sessions.

Conditions

 

This applies to user sessions that have logged in successfully and are then being terminated by the switch.

Possible Causes

 

The preauthentication ACL (and the subsequent DACL enforcement from Cisco ISE) on the NAD may not be configured correctly for that session.

 

The preauthentication ACL is configured and the DACL is downloaded from Cisco ISE, but the switch brings the session down.

 

Cisco ISE may be enforcing a preposture VLAN assignment rather than the (correct) postposture VLAN, which can also bring down the session.

Resolution

 

Ensure the Cisco IOS release on the switch is equal to or more recent than Cisco IOS Release 12.2.(53)SE.

 

Check to see whether or not the DACL name in Cisco ISE contains a blank space (possibly around or near a hyphen "-"). There should be no space in the DACL name. Then ensure that the DACL syntax is correct and that it contains no extra spaces.

 

Ensure that the following configuration exists on the switch to interpret the DACL properly (if not enabled, the switch may terminate the session):

 
radius-server attribute 6 on-for-login-auth
 
radius-server attribute 8 include-in-access-req
 
radius-server attribute 25 access-request include
 
radius-server vsa send accounting
 
radius-server vsa send authentication

 

Stephen McBride
Beginner

Just noticed your config has "authentication priority mab"

Try "authentication priority dot1x mab"

 

Not 100% but I would suggest this could be your problem

Venkatesh Attuluri
Cisco Employee

what is switch model and software version

Create
Recognize Your Peers
Content for Community-Ad

ISE Webinars


Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube