ISE Allow MAB for endpoints which had successful Dot1.x authentication

[JonatanSitter]

Hello everybody,

I'm looking into how to allow MAB for endpoints which had successful 802.1x authentication.

Is there a way to update some endpoint attribute based on a successful 802.1x authentication which then gets used whenever the client (for whatever reason) goes through MAB?

On another NAC solution you can set the endpoint to known through after an authentication.

How would I do that in ISE?

Thanks in advance!

BR

Jonatan

[marce1000]

  >...I'm looking into how to allow MAB for endpoints which had successful 802.1x authentication.
             Inconsistent requirement , 802.1x supersedes MAB

 >...s there a way to update some endpoint attribute based on a successful 802.1x authentication which then gets used whenever the client (for whatever reason) goes through MAB?
                 - The client doesn't go to anything  ; what the client does is determined by the NAC (ISE) infrastructure (only)

 M.

[JonatanSitter]

Thanks for the helpful response.

I know that 802.1x supersedes MAB. But as you might know, sometimes an endpoint fails to authenticate over 802.1x.
At that point the switch allows for MAB. I want ISE to authenticate/authorize an endpoint over MAB only if there has been a successful 802.1x authentication for example the day before.

We should be able to set endpoint attributes in the authorization process. Not only send radius attributes to the switch but also add custom attributes to the endpoint database.

[MHM Cisco World]

First config ISE as MAB and as 802.1x

Then config your SW with 

802.1x flexible auth 

Where order and priority make big rule in make end point auth both or one of mab/802.1x

[MHM Cisco World]

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://www.cisco.com/c/dam/en/us/support/docs/ios-nx-os-software/identity-based-networking-service/flexible_authentication.pdf&ved=2ahUKEwjJ9dHSl_iCAxXCVvEDHd3mBx4QFnoECBAQAQ&usg=AOvV...

[Charlie Moreton]

If 802.1x fails for whatever reason, do you really want to allow access?  What if the device is stolen?  The thief now has access to your network.  Just because another solution allows an insecure workaround it should not be the norm.  

[JonatanSitter]

What about PXE boot for example? In that case the PC/Laptop does not respond to 802.1x and needs to fall back to MAB. I want to only allow that if it has previously authenticated successfully and not just for any pxe device.

[Charlie Moreton]

Move the endpoint MAC address to a PXE Endpoint Identity Group and reference that in your Authorization Policy

[JonatanSitter]

Can that be done automatically?
i.e. if authenticated successfully -> endpoint gets assigned a certain endpoint identity group which later can be referenced in MAB authz policy.

[Charlie Moreton]

It can be, it depends on how you have your profiling and/or EIGs set up as to how you would determine which EIG the endpoints are assigned

[JonatanSitter]

Could you maybe give me some hints, what to look for?