ā11-05-2018 06:50 PM
Hi All,
I am preparing for a wired dot1x rollout and have some questions around Monitor mode behaviour.
More I read about this, more confusing I get. Specially due to the fact that, no document cleardy states if the Switch Port with the command "access-session open" completely ignores the the Radius reply from ISE, and keep maintaining the access to the attached device(s) as per the configured Data and Voice VLANs (and Access-list if there is one) on the switch port itself or, if it only ignores it if the (ISE/Radius) reply is a REJECT. What happens if the Radius/ISE Reply is an ACCECPT but with a Authorization change to assign a new VLAN?
So just trying to understand this behaviour.
I am seeking the answers to following scenarios to fully understand what Monitor mode actually is and how to leverage it.
Switch Port config (remains for all cases):
Dot1x and MAB enabled.
access-session open
switchport access vlan X
switchport voice vlan Y
ISE Setup 1)
ISE Settings
If Dot1x -> Access-Reject (unconditionally)
if MAB -> Access-Reject (unconditionally)
Default Authz -> Access-Reject
1) What would happen to a PC that gets plugged into this switch port
2) What would happen to a Cisco Phone that gets plugged into the above switch port
ISE Setup 2)
ISE Settings
If Dot1x -> If Auth Success => Access-Accept + Assign Dynamic VLAN : Z
If MAB -> If Auth Success => Access-Accept + Assign Dynamic VLAN : Z
Default Authz -> Access-Reject
1) What would happen to a Dot1x enabled PC that gets plugged into the switch port? Would it be put into the VLAN Z or would it remain in VLAN X ?
2) What would happen to a PC or some other Device (non-Cisco) that get plugs into the port (with no Dot1x or MAB allowed)?
3) What would happen to a Cisco Phone without MAB or Dot1x configured ?
ISE Setup 3)
ISE Settings
If Dot1x -> If Auth Success => Access-Accept
If MAB -> If Auth Success => Access-Accept
Default Authz -> Access-Accept + Assign Dynamic VLAN Z
1) What would happen to a Dot1x enabled PC that gets plugged into the switch port?
2) What would happen to a PC or some other Device (non-Cisco) that get plugs into the port (with no Dot1x or MAB allowed)?. Would it remain in VLAN X or would it be assigned the Dynamic VLAN Z ?
3) What would happen to a Cisco Phone without MAB or Dot1x configured ?
Thanks in advance for spending time on replying to this. Much appreciated.
Solved! Go to Solution.
ā11-06-2018 05:59 AM
The only thing "open" mode affects is:
Everything else is the same as closed mode. So whatever you are pushing from ISE will be taken by the switch. The only message from ISE that will be ignored is REJECT.
ā11-06-2018 07:55 AM
ā11-06-2018 03:19 PM
Thanks for your detailed reply. Exactly what I was thinking.
The whole "Monitor mode" pitched by Cisco is purely based upon a lot of (not so practical) assumptions.
But in real life, if you want to truly go into Monitor stage without causing "ANY" change/damage to the production traffic, you are going to have to reduce/change the original AuthZ rule set (that you wanted to test in the first place) before going into monitor mode, which makes the whole "monitor mode" a not so useful thing in real life.
ā11-06-2018 04:21 PM
ā11-05-2018 10:54 PM
ā11-06-2018 05:11 AM
Hi Surenda,
Thanks for your explanation.
Just a bit unclear why you said on Setup3) Q1) that the PC will get the VLAN Z. Shouldn't this remain in VLAN X (Since the DOT1X specific Policy gets hit first )?
Thanks
ā11-06-2018 05:16 AM
ā11-06-2018 05:34 AM
If the PC is dot1x enabled and ISE has a specific dot1x policy only with an Access-Accept (without any AuthZ configured), wouldn't the switch only receives an Access-Accept?.
The Dynamic VLAN Z is only associated with the Default Policy. Which I believe is not considered in this case (as it already matched a policy above that). That's why I thought it should remain in VLAN X. Am I missing something here ?
Thanks again.
ā11-06-2018 05:59 AM
The only thing "open" mode affects is:
Everything else is the same as closed mode. So whatever you are pushing from ISE will be taken by the switch. The only message from ISE that will be ignored is REJECT.
ā11-06-2018 07:09 AM
ā11-06-2018 07:55 AM
ā11-06-2018 03:19 PM
Thanks for your detailed reply. Exactly what I was thinking.
The whole "Monitor mode" pitched by Cisco is purely based upon a lot of (not so practical) assumptions.
But in real life, if you want to truly go into Monitor stage without causing "ANY" change/damage to the production traffic, you are going to have to reduce/change the original AuthZ rule set (that you wanted to test in the first place) before going into monitor mode, which makes the whole "monitor mode" a not so useful thing in real life.
ā11-06-2018 04:21 PM
ā11-06-2018 05:27 PM
Yes, I agree. Only if you are not planning on VLAN changes or assigning more restrictive DACLs (than what you have preconfigured on the port).
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide