After migrating from Cisco ISE version 2.7 to 3.1 re-authentication of dot1x devices fails. Nothing has changed on the switch.
Port configuration (relevant) is as follows:
authentication order mab dot1x
authentication priority dot1x mab
This is because dhcp clients should get an ip as soon as possible. For this to work in ISE we have the following configured in the autorization profile:
cisco-av-pair = termination-action-modifier=1
Everything works fine if we config the port as follows:
authentication order dot1x mab
authentication priority dot1x mab
But as i said; the old situation did work using ISE 2.7 and we would like to have it working again.
ISE version: ISE 3.1 patch 7
Switch version: cisco WS-C3650-48PS Version 16.12.08
Initial authentication using dot1x works (after a shut/ no shut), but after the reauthentication timer expires the device falls back to a default MAB profile. We can see in a packet trace the switch sends a MAB access request but only an dot1x Accounting request. No access request.
Device is an IP phone, but this problem occures with other devices as well (printers, clients)
We already contacted TAC, they think the problem is somewhere in the switch. I disagree as nothing has changed since migrating.
Any idea?
