hello,
I am on my way to make this ISE works.
Now I am able to do posture assessment and reauthenticate with success.
The logs says that's OK, I have two lines.
NACAgent on the host do the job correctly but the NIC says : "Network failure" despite NACagent grants the access.
Any Ideas folks ???
Regards.
Vincent.
The switch says :
03:04:28: %AUTHMGR-5-START: Starting 'dot1x' for client (bcae.c530.0948) on Interface Fa1/0/1 AuditSessionID C0A8066400000028009C4FA8
03:04:59: %DOT1X-5-FAIL: Authentication failed for client (bcae.c530.0948) on Interface Fa1/0/1 AuditSessionID
03:04:59: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (bcae.c530.0948) on Interface Fa1/0/1 AuditSessionID C0A8066400000028009C4FA8
03:04:59: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (bcae.c530.0948) on Interface Fa1/0/1 AuditSessionID C0A8066400000028009C4FA8
03:04:59: %AUTHMGR-7-NOMOREMETHODS: Exhausted all authentication methods for client (bcae.c530.0948) on Interface Fa1/0/1 AuditSessionID C0A8066400000028009C4FA8
03:04:59: %AUTHMGR-5-FAIL: Authorization failed for client (bcae.c530.0948) on Interface Fa1/0/1 AuditSessionID C0A8066400000028009C4FA8
Here is the SW's config :
aaa new-model
!
!
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting dot1x default start-stop group radius
!
!
aaa server radius dynamic-author
client 192.168.6.10 server-key 123456789
!
aaa session-id common
!
no ip domain-lookup
ip domain-name security.com
ip dhcp excluded-address 192.168.6.29 192.168.6.100
!
ip dhcp pool test
network 192.168.6.0 255.255.255.0
!
!
ip dhcp snooping vlan 1
ip device tracking
dot1x system-auth-control
dot1x critical eapol
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet1/0/1
switchport mode access
authentication open
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
!
interface Vlan1
ip address 192.168.6.100 255.255.255.0
!
ip classless
ip http server
ip http secure-server
!
ip sla enable reaction-alerts
snmp-server community snmp RO
snmp-server enable traps mac-notification change move threshold
snmp-server host 192.168.6.10 version 2c snmp mac-notification
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 5 tries 3
radius-server host 192.168.6.10 auth-port 1645 acct-port 1646 key 123456789
radius-server vsa send accounting
radius-server vsa send authentication
!
!
line con 0
line vty 5 15
!
ntp clock-period 36029254
ntp server 192.168.6.29
end
