We're currently doing a tech refresh and replacing older switches with 2960s and we're having an issue with our switches displaying UKNOWN when doing the command "sh auth sess". Here's an example of the command output. The switch I use in this example is allowing users to connect however sometimes this is not the case.
sh auth sess
Interface MAC Address Method Domain Status Fg Session ID
Gi1/0/18 xxxx.xxxx.xxxx dot1x UNKNOWN Auth 842A611B000000F31868AABC
Gi1/0/13 xxxx.xxxx.xxxx dot1x UNKNOWN Auth 842A611B000000EE1868A9ED
Gi2/0/5 xxxx.xxxx.xxxx mab UNKNOWN Auth 842A611B000000F61868B3AA
A detailed auth session
sh auth sess int g1/0/18 det
Interface: GigabitEthernet1/0/18
MAC Address: xxxx.xxxx.xxxx
IPv6 Address: Unknown
IPv4 Address: xxx.xxx.xxx.xxx
Status: Authorized
Domain: UNKNOWN
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Common Session ID: 842A611B000000E91868A97E
Acct Session ID: 0x0000011B
Handle: 0xF30000CE
Current Policy: POLICY_Gi1/0/18
Local Policies:
Service Template: CRITICAL_AUTH_VLAN_Gi1/0/18 (priority 150)
Vlan Group: Vlan:
Service Template: DEFAULT_CRITICAL_VOICE_TEMPLATE (priority 150)
Voice Vlan:
Method status list:
Method State
dot1x Stopped
mab Authc Failed
----------------------------------------
Interface: GigabitEthernet1/0/18
MAC Address: xxxx.xxxx.xxxx
IPv6 Address: Unknown
IPv4 Address: xxx.xxx.xxx.xxx
Status: Authorized
Domain: UNKNOWN
Oper host mode: multi-domain
Oper control dir: both
Session timeout: N/A
Common Session ID: 842A611B000000F31868AABC
Acct Session ID: 0x000000DE
Handle: 0x040000D8
Current Policy: POLICY_Gi1/0/18
Local Policies:
Service Template: CRITICAL_AUTH_VLAN_Gi1/0/18 (priority 150)
Vlan Group: Vlan:
Service Template: DEFAULT_CRITICAL_VOICE_TEMPLATE (priority 150)
Voice Vlan:
Method status list:
Method State
dot1x Authc Failed
Here's is what every port is configured with.
description USER_Port
switchport access vlan
switchport mode access
switchport voice vlan
authentication event fail action next-method
authentication event server dead action authorize vlan
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 8
dot1x max-req 3
spanning-tree portfast
Global commands we use for dot1x.
dot1x system-auth-control
dot1x critical eapol
Here are our radius/aaa commands we're using for ISE.
aaa authentication dot1x default group ISE
aaa authorization network default group ISE
aaa accounting dot1x default start-stop group ISE
aaa accounting update newinfo periodic 2880
!
aaa session-id common
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 30 tries 3
radius-server vsa send accounting
radius-server vsa send authentication
!
Finally here are the switches versions and models.
1 52 WS-C2960X-48LPD-L 15.2(2)E3 C2960X-UNIVERSALK9-M
2 52 WS-C2960X-48LPD-L 15.2(2)E3 C2960X-UNIVERSALK9-M
