ISE 3.2 Patch 2.
Catlayst 9200 Series + current firmware
The issue i am having is that all Dot1x + MAB devices are working and authenticating fine - except Printers.
Workstations (Windows 11 Laptops) using dot1x are good
MAB devices like, Meraki Cameras, IoT devices, and others are good
Our Large Printers; we have 15 total, only 3 are on ISE right now. They authenticate fine, but then 1-2 hours later they reauthenticate again. I dont want this behavior. I want them to authenticate once every 8 hours (28800 seconds). I have the interface's "authentication restart server" set and the ISE policy has 28800 configured. I can verify this with "sh auth session int <port> detal", I can see 28800 (server) and the timer counting down. But its attempting to reauthenticate much much sooner. In a 24 hour period, i get 40-50 reauthentication attemps. If i have 28800 seconds configured, i should only get a max of 3 (24 / 8).
So what am i doing wrong here? What piece do i need to adjust? I have a TAC case open, but they havent been able to figure it out yet. Below is relevant config info.
Thank you all!
#sh derived-config int g2/0/6
Building configuration...
Derived configuration : 728 bytes
!
interface GigabitEthernet2/0/6
description 4-Printer1
subscriber aging inactivity-timer 60 probe
switchport access vlan 10
switchport mode access
switchport nonegotiate
switchport voice vlan 41
authentication periodic
authentication timer reauthenticate server
access-session control-direction in
access-session closed
access-session port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 7
dot1x max-reauth-req 3
storm-control broadcast level pps 100 80
storm-control action trap
no macro auto processing
spanning-tree portfast
spanning-tree bpduguard enable
spanning-tree guard root
service-policy type control subscriber CONCURRENT_DOT1X_MAB_POLICY
ip dhcp snooping limit rate 20
end
policy-map type control subscriber CONCURRENT_DOT1X_MAB_POLICY
event session-started match-all
10 class always do-until-failure
10 authenticate using dot1x priority 10
20 authenticate using mab priority 20
event authentication-failure match-first
5 class DOT1X_FAILED do-until-failure
10 terminate dot1x
10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
10 clear-authenticated-data-hosts-on-port
20 activate service-template CRITICAL_DATA_ACCESS
30 activate service-template CRITICAL_VOICE_ACCESS
40 authorize
50 pause reauthentication
20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
10 pause reauthentication
20 authorize
30 class DOT1X_NO_RESP do-until-failure
10 terminate dot1x
20 authenticate using mab priority 20
40 class DOT1X_TIMEOUT do-until-failure
10 terminate dot1x
20 authenticate using mab priority 20
50 class always do-until-failure
10 terminate dot1x
20 terminate mab
30 authentication-restart 60
event agent-found match-all
10 class always do-until-failure
10 terminate mab
20 authenticate using dot1x retries 2 retry-time 0 priority 10
event aaa-available match-all
10 class IN_CRITICAL_AUTH do-until-failure
10 clear-session
20 class NOT_IN_CRITICAL_AUTH do-until-failure
10 resume reauthentication
event inactivity-timeout match-all
10 class always do-until-failure
10 clear-session
event authentication-success match-all
10 class always do-until-failure
10 activate service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
event violation match-all
10 class always do-until-failure
10 restrict
event authorization-failure match-all
10 class AUTHC_SUCCESS-AUTHZ_FAIL do-until-failure
10 authentication-restart 60
template WIRED_DOT1X_CLOSED
dot1x pae authenticator
subscriber aging inactivity-timer 60 probe
mab
access-session control-direction in
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber CONCURRENT_DOT1X_MAB_POLICY
