Hello,
we're currently migrating from ACS 5.8 to ISE 2.2 and I was wondering, if it is possible to profile the devices that are not authenticated on a switch interface/ISE. Our authentication is vlan-based without dACL or SGT.
Or if there is a better way to authenticate devices that can't auth with dot1x and need to have network access on startup (except changing the auth-order from dot1x mab to mab dot1x). Sometimes some of the devices won't show their mac-address for some reason, thus authentication won't work.
The first interface is our default switchport configuration and the second interface configuration is when the interface needs to be locked in a vlan for a device.
interface GigabitEthernet1/0/3
description dot1x
switchport access vlan 54
switchport mode access
switchport voice vlan 121
authentication control-direction in
authentication event server dead action authorize vlan 55
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 7
spanning-tree portfast
spanning-tree bpduguard enable
spanning-tree guard root
end
interface GigabitEthernet1/0/4
description SALTO Liz-Serv
switchport access vlan 111
switchport mode access
switchport port-security mac-address sticky
switchport port-security mac-address sticky xxxx.xxxx.xxxx
switchport port-security
end
Thanks!
