dACL don't working properly

[Didier587]

Hello,

I am writing you about a issue i am facing.

After credentials validation on Cisco ISE captive portal our Cisco 2960 witch receive a dACL to users port.

However after almost 30 seconds the port lose dACL configuration.

As you can see below

show access-session interface gigabitEthernet 1/0/6 details
Interface: GigabitEthernet1/0/6
MAC Address:
IPv6 Address: Unknown
IPv4 Address:
User-Name: rnsh5697
Status: Authorized
Domain: DATA
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Restart timeout: N/A
Periodic Acct timeout: N/A
Session Uptime: 38s
Common Session ID: AC1C8EA20000B52CC86E1B21
Acct Session ID: 0x0000B4ED
Handle: 0x2D000084
Current Policy: CISCO_ISE

Server Policies:
ACS ACL: xACSACLx-IP-Remediation-dacl-67beffcf

show access-session interface gigabitEthernet 1/0/6 details
Interface: GigabitEthernet1/0/6
MAC Address:
IPv6 Address: Unknown
IPv4 Address:
User-Name: rnsh5697
Status: Unauthorized
Domain: DATA
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Restart timeout: N/A
Periodic Acct timeout: N/A
Session Uptime: 161s
Common Session ID: AC1C8EA20000B52CC86E1B21
Acct Session ID: 0x0000B4ED
Handle: 0x2D000084
Current Policy: CISCO_ISE

Method status list:
Method State

dot1x Stopped
mab Authc Success

Do you have a idea how i can fix this problem ?

Best regards.

[MHM Cisco World]

You share two authc session' first one is not complete.

Also the different between two authc session is one is authz and other not authz' can I see port config 

MHM

[Didier587]

Hello,

You will find below port configuration.

interface GigabitEthernet1/0/6
switchport access vlan 105
switchport mode access
access-session host-mode multi-domain
access-session port-control auto
mab
dot1x pae authenticator
service-policy type control subscriber CISCO_ISE
end

show policy-map type control subscriber CISCO_ISE
CISCO_ISE
event session-started match-all
10 class always do-until-failure
10 authenticate using dot1x priority 10
20 authenticate using mab priority 20

I use the same configuration on other switch and i have not encountered this problem.

[MHM Cisco World]

this new style mode are you sure about both SW use new mode ?

MHM

[Didier587]

Yes, both use new mode.

[Didier587]

I checked by my side the log.

I noticed an uninstallation of Dacl after about 1 minute

Apr 16 09:29:59 172.28.142.162 EPM_SESS_EVENT: ACL xACSACLx-IP-Remediation-dacl-67beffcf provisioning successful

Apr 16 09:30:25 172.28.142.162 EPM_SESS_EVENT: Feature (EPM MISC PLUG-IN) identity has been updated (status 1)

Apr 16 09:30:25 172.28.142.162 EPM_SESS_EVENT: Feature (SM ACCOUNTING PLUG-IN) identity has been updated (status 1)

Apr 16 09:30:25 172.28.142.162 EPM_SESS_EVENT: Received Mac [246a.0ea2.7413]

Apr 16 09:30:25 172.28.142.162 EPM_SESS_EVENT: Received audit-session-id [AC1C8EA20000B52CC86E1B21]

Apr 16 09:30:25 172.28.142.162 EPM_SESS_EVENT: Received IDB [GigabitEthernet1/0/6]

Apr 16 09:30:25 172.28.142.162 EPM_SESS_EVENT: Received IPv4 [10.242.3.99]

Apr 16 09:30:25 172.28.142.162 EPM_SESS_EVENT: Feature (EPM ACL PLUG-IN) identity has been updated (status 0)

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Feature (EPM ACL PLUG-IN) Status (2) Notified

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Successful feature attrs provided for EPM MISC PLUG-IN

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Successful feature attrs provided for SM ACCOUNTING PLUG-IN

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Successful feature attrs provided for EPM ACL PLUG-IN

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Feature (EPM MISC PLUG-IN) has been terminated

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Feature (SM ACCOUNTING PLUG-IN) has been terminated

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Feature (EPM ACL PLUG-IN) has been terminated

Apr 16 09:30:51 172.28.142.162 EPM_SESS_EVENT: Un-Installing Named ACL xACSACLx-IP-Remediation-dacl-67beffcf session_ctx F3A2CD0 feat_ctx EF80968 feat_conf F4ED158

[MHM Cisco World]

There is bug about number of line of ACL' try reduce number of line of dacl if you use many lines.

MHM