ISE 2.0 support with 2960-X Lan Lite

[Hiep Nguyen]

Hi team,

In our device compatibility docs of ISE, I see some confusions:

1. For ISE 1.2, we mentioned that 2960 LAN Lite is supported but not recommended with ISE 1.2 due to limited feature support. LAN Lite supports only 802.1X and VLAN assignments
2. For ISE 2.0, I dont see any comment related to 2960 Lan Lite. (http://www.cisco.com/c/en/us/td/docs/security/ise/2-0/compatibility/ise_sdt.html)

So I would like to ask:

1. For ISE 2.0, do we still support 2960 LAN Lite?
2. What about 2960-X Lan Lite, can it support full features (because we only see 2960-X in general in compatibility doc)

Thank you.

[thomas · Accepted solution]

The ISE 1.2 Compatibility Guide says: LAN Lite supports only 802.1X and VLAN assignments.

This means the 2960 LAN Lite  can do 802.1X to perform authentication to ISE via RADIUS for authorization enforcement with VLANs.

It will still interoperate with ISE 2.0 via the standard RADIUS protocol but it will not be able to do anything other than VLAN assignment.

The 2960-X supports all capabilities with the recommended version of IOS 15.2(2)E3 so I assume the LAN Lite versions continue to only support VLAN assignment since "LAN Lite models have reduced functionality and scalability for small deployments with basic requirements" according to Cisco Catalyst 2960-X Series Switches Data Sheet. You will want to verify this with the switching product team.

[Darren_Cooper]

Hi,

I am trying to get this working to use 802.1x authentication with RADIUS, but on LAN Lite the policy-map and service-policy commands are not available so the interface never sends the auth request to RADIUS.

On a LAN Base I have the same config and it works because the policy-map enables the authentication.

With legacy mode authentication the LAN Lite switch works fine for 802.1x and RADIUS, but it breaks when converting to new-style.  I cannot find a config sample anywhere that works.

[rezaalikhani]

Another limitation is that when using LAN Lite, the "authentication open" command is not available.