I don't understand why a phone I'm using to test my ISE setup get access and works although the MAB authentication is indicated as failed and ISE shows the device was rejected. The phone always stays in DATA domain
I have a 3750 in stack with IOS 12.2-55.SE3
This is from Switch Console (Terminal Monitor)
SWPHP2ACCESO(config-if)#no shut
SWPHP2ACCESO(config-if)#
*May 11 05:52:08.843: %ILPOWER-7-DETECT: Interface Gi1/0/29: Power Device detected: IEEE PD
*May 11 05:52:09.254: %ILPOWER-5-POWER_GRANTED: Interface Gi1/0/29: Power granted
*May 11 05:52:09.892: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/29, changed state to down
*May 11 05:52:16.334: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/29, changed state to up
*May 11 05:52:17.341: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/29, changed state to up
*May 11 05:52:28.464: %AUTHMGR-5-START: Starting 'dot1x' for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.879: %DOT1X-5-FAIL: Authentication failed for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID
*May 11 05:52:45.887: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.887: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.887: %AUTHMGR-5-START: Starting 'mab' for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.896: %MAB-5-FAIL: Authentication failed for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.896: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'mab' for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.896: %AUTHMGR-7-FAILOVER: Failing over from 'mab' for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.896: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
*May 11 05:52:45.896: %AUTHMGR-5-FAIL: Authorization failed for client (001e.be91.920f) on Interface Gi1/0/29 AuditSessionID 0A229585000000DA6EE600D1
SWPHP2ACCESO#show auth sess
Interface MAC Address Method Domain Status Session ID
Gi1/0/29 001e.be91.920f N/A DATA Authz Failed 0A229585000000DA6EE600D1
SWPHP2ACCESO#show auth sess int g1/0/29
Interface: GigabitEthernet1/0/29
MAC Address: 001e.be91.920f
IP Address: 10.34.140.190
User-Name: 001ebe91920f
Status: Running
Domain: DATA
Security Policy: Should Secure
Security Status: Unsecure
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0A229585000000DA6EE600D1
Acct Session ID: 0x0000041F
Handle: 0x480000DA
Runnable methods list:
Method State
dot1x Running
mab Not run
If I connect a PC behind the Phone it authenticates properly with 802.1X, in that case the PC stays in DATA domain, the phone stays in Unknown domain, but still working. In this case the switch indicates Security Violations because the MAC address
*May 11 05:58:50.246: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface Gi1/0/29, new MAC address (001e.be91.920f) is seen.AuditSessionID 0A229585000000DC6EEB8EB0
SWPHP2ACCESO#show auth sess
Interface MAC Address Method Domain Status Session ID
Gi1/0/29 e89a.8fcf.7f38 dot1x DATA Authz Success 0A229585000000DB6EEB89AC
Gi1/0/29 001e.be91.920f dot1x UNKNOWN Running 0A229585000000DD6EECA505
Finally it is my port config
SWPHP2ACCESO#show run int g1/0/29
Building configuration...
Current configuration : 568 bytes
!
interface GigabitEthernet1/0/29
description PRUEBAS 802.1X
switchport access vlan 801
switchport mode access
switchport voice vlan 81
authentication event fail action next-method
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication open
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
snmp trap mac-notification change added
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
end
I should not worry as the phone is working, but I like to have clear if it is something expected or not.
On the ISE the Phone is profiled and identified as Cisco-Device, but even the default rule in ISE for Cisco-IP Phones appears to not match.
The ISE is running 1.2.0.899 Patch 6.
Regards.
