Dot1X timers and MAB

[SMD28316]

When configuring Do1X we can configure timers like this:

dot1x timeout quiet-period 300
dot1x timeout tx-period 5
dot1x max-reauth-req 1

But how do we configure timers for MAB authentication? Does it use the same values as Dot1X?

[balaji.bandi · Accepted solution]

the authentication happens based on the order like 802.1x then MAB, so 802,1X then wait for time out, then go to MAB, if that fails it wait for retry timer.

some information may help you :

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-663759.html#wp9000135

[inderdeeps]

@SMD28316 : This document will help you 

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-663759.html 

[thomas]

MAB typically happens after 802.1X retries and timeouts:

See ISE Secure Wired Access Prescriptive Deployment Guide for best practice settings including timers:

IBNS 1.0 interface Configuration for Monitor Mode

interface GigabitEthernet1/0/1
 description ** Endpoints and Users **
 switchport access vlan 100
 switchport mode access
 switchport voice vlan 101
 device-tracking attach-policy IPDT_POLICY
 authentication host-mode multi-auth
 authentication open
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate server
 authentication timer inactivity server dynamic
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 7
 dot1x max-reauth-req 3
 spanning-tree portfast

IBNS 2.0:

interface GigabitEthernet1/0/1
 description ** Endpoints and Users ** 
 switchport access vlan 100
 switchport mode access
 switchport voice vlan 101
 device-tracking attach-policy IPDT_POLICY
 authentication periodic
 authentication timer reauthenticate server
 access-session port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 7
 dot1x max-reauth-req 3
 spanning-tree portfast
 service-policy type control subscriber POLICY_Gi1/0/1