MAB and Printers strange issue

[alessandro.s]

Hi all,
i'm testing MAB authentication for several Xerox printers, i'm working on 2960S switches with IOS 5.0(2)SE6 and cisco ISE version 2.0.0.306 .
Authorization works properly but in switch logs i see this strange behavior :

Jul 28 11:52:12.517: %EPM-6-IPEVENT: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-RELEASE
Jul 28 11:52:12.522: %EPM-6-IPEVENT: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-WAIT
Jul 28 11:52:12.522: %EPM-6-IPEVENT: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-ASSIGNMENT
 Jul 28 11:52:12.527: %EPM-6-POLICY_APP_SUCCESS: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| POLICY_TYPE Named ACL| POLICY_NAME xACSACLx-IP-ACL-Printers-57909bbd| RESULT SUCCESS
4Jul 28 11:52:22.363: %EPM-6-IPEVENT: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-RELEASE
Jul 28 11:52:22.369: %EPM-6-IPEVENT: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-WAIT
Jul 28 11:52:22.369: %EPM-6-IPEVENT: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-ASSIGNMENT
Jul 28 11:52:22.369: %EPM-6-POLICY_APP_SUCCESS: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| POLICY_TYPE Named ACL| POLICY_NAME xACSACLx-IP-ACL-Printers-57909bbd| RESULT SUCCESS
Jul 28 11:52:42.618: %EPM-6-IPEVENT: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-RELEASE
Jul 28 11:52:42.623: %EPM-6-IPEVENT: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-WAIT
Jul 28 11:52:42.623: %EPM-6-IPEVENT: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-ASSIGNMENT
Jul 28 11:52:42.628: %EPM-6-POLICY_APP_SUCCESS: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| POLICY_TYPE Named ACL| POLICY_NAME xACSACLx-IP-ACL-Printers-57909bbd| RESULT SUCCESS
Jul 28 11:52:52.365: %EPM-6-IPEVENT: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-RELEASE
Jul 28 11:52:52.370: %EPM-6-IPEVENT: IP ip_addess_2| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-WAIT
Jul 28 11:52:52.370: %EPM-6-IPEVENT: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| EVENT IP-ASSIGNMENT
Jul 28 11:52:52.375: %EPM-6-POLICY_APP_SUCCESS: IP ip_address_1| MAC mac_address| AuditSessionID C0A8CA28000085FAAE7AB9DB| AUTHTYPE DOT1X| POLICY_TYPE Named ACL| POLICY_NAME xACSACLx-IP-ACL-Printers-57909bbd| RESULT SUCCESS

What i can see from logs is :
1)First there is an IP-RELEASE event (ip_address_1 is the printer static ip address) followed by an IP-WAIT event and an IP-ASSIGNMENT event(ip_addess_2 is a random ip address, is always the same for all printers but isn't configured anywhere);
2)After 10 seconds the process starts again with ip address inverted;
3)After 30 seconds from the first event the process starts from the beginning in an endless loop.

After a while i realized that the behaviour occours concurrently with ip device tracking timers (i have IPDT globally enabled in the switches), in fact IPDT probes are sent every 30 seconds and IPDT probe delay timer is 10 seconds, so i think
that those events are related.
Has anyone encountered this issue?
Thanks in advance.
Regards,

[jan.nielsen]

Yes, some printers don't respond to the switches Arp probes, and when that fails, the switch will remove the device from the authorized state and restart authentication, in same cases dhcp snooping can solve it, but obviously not if you are using static ip's. I have actually not fixed it properly, but instead used a auto smart port macro that reconfigures the port to not do any dot1x, once ise sees that the device is a printer. You can also play around with the device tracking use-svi and other command option on the switch, that might make the printer respond to the probe.

[alessandro.s]

Hi Jan,

thanks for your response. I tried to configure the ip device tracking use-svi command but it seems the issue remains the same. The behavior is very strange , if i configure switch-side interface as default and then reconfigure with mab the issue disappears for some hours and then resumes.

I also noticed that the issue does not happen with printers configured for 802.1X PEAP authentication.

Actually i was not able to solve the issue with MAB, i'll do some tests and let you know!

Regards,