daily operation join domain

[williamtan]

I have configured dot1x have full access and machine authentication have limited server access for domain user. I have disabled MAB to prevent other machine to connect and access to network. But I have problem here, how I can allow access for those new machine haven't join domain or the machine lost domain trust? I'm created a whitelist group and provide full network access, I will add the mac address in the whitelist group when needed for current moment. But this is not practical, any other suggestion?

[Colby LeMaire · Accepted solution]

This is a common situation for any 802.1x deployment.  There will be times when a new device needs access or when an existing device is having problems and the Service Desk needs to access the machine remotely to resolve the problem.  Or to do a complete rebuild of the software.

What I do with my customers is create an Endpoint Identity Group called something like "Workstation Repair" and an associated authorization rule towards the top of the policy that allows access.  Then use RBAC within ISE to give the Service Desk personnel the ability to login and add MAC addresses to that whitelist group.  That allows the client machine to access the network and then the Service Desk can do what they need to do to fix it.  Once resolved, they can move the MAC address out of that group.

As a backup to ensure that no MAC addresses stay in that group for too long, I create a purge policy that clears any MAC address from that group after 48-72 hours.  This process keeps the Service Desk from having to engage Tier 2/3 every time.

The only other thing that you could do is allow "Guest" access with CWA on the switches.  If no higher-level rule is hit, then allow limited access and redirect to the Guest Portal.  If an Administrator logs in, then give full access.  But in my opinion, this adds too much complexity to an already complex solution.  And it requires someone to be physically at the machine to put credentials in.  Hard to do in large Enterprise environments where there may not be administrators available at some remote locations.

[williamtan]

Yes, I'm using this method now and you enlighten me to create a new purge policy to auto clear the MAC address. Thanks.

[Surendra]

How about creating another policy on top for just user authentication and give limited access to the domain controllers so that the machine could be registered on to a domain ?

[Colby LeMaire]

The problem is that if a particular user never logged on to a specific machine, there are no cached credentials and the machine would have to connect to a domain controller to authenticate the user.  If the user cannot logon the machine, then the user credentials would never be presented by the supplicant.  So trying to do user authentication for 802.1x would not work in this scenario.  You have to authenticate the machine first to provide some access to the domain controllers.  But as the original post stated, there are situations when the machines somehow get removed from the domain.  In that case, your only option would be to authenticate the machine using a certificate that is already on the machine or use MAB and a whitelist group.  As I stated previously, I recommend having MAB enabled with 802.1x using FlexAuth and then use a "Workstation Repair" whitelist in ISE to handle these types of situations.  802.1x is not going to work perfectly in all cases, so give yourself and the Service Desk a way to allow access temporarily for resolving supplicant issues.

[Mike.Cifelli]

IMO I agree with the statement of using flexauth so that when those hosts fail 8021x, it terminates, and goes to mab. I think you have a variety of options. As far as the comment on having a default policy that allows restricted access there are some security concerns. One concern in my mind is that if anyone rogue plugs into a NAD they default to a restricted area that allow them to access important servers that provided certain services that aide in getting a machine up-to-snuff on your domain could cause issues. Many may argue that from a security in depth viewpoint there are other mechanisms that may deter that concern I mentioned such as building access, lab access, server firewall, etc. Anyways, you could use a type of portal that registers them with some sort of approval that then adds the mac to a mab group. Then as mentioned already you could purge that group every few days. I think an issue with that is the required manual intervention of approving registrations. Regardless though you will still require manual intervention if you determine that the best method is to enable mab and add endpoints to it without profiling. I would maybe look into types of profiling attributes that you may be able to leverage to assist in automating your concern/s. Something else to consider is if you use mab with manually adding MACs you may want to look into leveraging bulk adds or simply adds via REST apis. Not sure how big your environment is, but that could help. Good luck & HTH!

[Jason Kunst]

@Mike.Cifelli your register your MAC for access is what we do at cisco on the wired. you can't do anything without the machine being approved to a certain set of rules. We use ISE API and also SGTs to put correct ACLs on the session.