Dot1x Client Authentication With Mab fallback method

[ifabrizio]

Dear All,

I have configured a test switch port, with Dot1x and Mab as fallback authentication.

I connected a new PC that is not know by the ISE, with no certificates, so the Dot1x do not works.

I aspect that the MAB auth should not allow PC access to the network cause the PC is unknow.

I also modify the Default Authentication roule with setting:

If auth fail = Reject

If user not found = Reject

If proccess fails = Drop

But after few second the ISE accept the new PC and grant access to the network, using the Default MAB auth roule:

Authentication Policy Default >> MAB
Authorization Policy Default >> Basic_Authenticated_Access
Authorization Result PermitAccess

Could you help pls?

Best regards,

JF

[MHM Cisco World]

Which dB you use for check endpoint?

Can I see the SW port config 

MHM

[ifabrizio]

Hi MHM,

I use internal database.

The port is configured in this way:

interface GigabitEthernet10/32
description LABTEST
switchport access vlan 75
switchport mode access
switchport nonegotiate
authentication event server dead action authorize
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast edge
spanning-tree guard root
end

[balaji.bandi]

there are couple elements involved and how they configured, right from switch port and ISE config.

check below guide example :

https://community.cisco.com/t5/security-knowledge-base/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

[ifabrizio]

Dear All,

Finally I found the problem.

In the ISE Default Authorization Policy was missing a Policy that deny to the Unknow devices to grant access to the Network.

such as:

Identity Group-Name Equals EnndPoint Identity Groups:Unknow Results = Deny Access.

Bye,

JF.