MAB for Printers - AuthZ failed - Wired

[laurathaqi]

Dear community, 

I connected the Printer to the switch port, ISE reads its MAC via Probing. I assigned a static group that I created named "Printers" to that MAC, and created a rule with AuthC(if MAB) and AuthZ(if MAB and if part of the Printers static group), to allow access to Printers VLAN. However, what I noticed is that the Printer gets AuthC successfull, and in "show auth session int f0/2" I see MAB authenticated successful. However, AuthZ shows Failed. 

In Logs, I see the printer going in the rule of AuthZ for printers and it tells successfully Authorized, however, the printer does not get communication with the network that is allowed in that VLAN. And also in switch the show Auth Session also shows AuthZ failed.     

So my question is: what is the best practice to configure the Printers to allow access to the network via MAB, whilst integrating with Cisco ISE?

All blogs tell to just configure MAB and that is all, but sounds that am missing something in the end to end process of AuthC and AuthZ for printers! 

Please find the switch port config for Printers, which is a practice for all other ports:  

switchport mode access

authentication event fail action next-method
authentication event server dead action authorize vlan 15
authentication event server alive action reinitialize

authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
mab
snmp trap mac-notification change added
snmp trap mac-notification change removed
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast

Here the port fails to MAB, and it authenticated with MAB, however, AuthZ fails. The session finds the Domain, MAC, and IP. 

Looking forward to hearing from you. 

Thank you,

Laura

[Pat Pouna · Accepted solution]

The switch port configs looks good to me, it will failover to mab AuthC after dot1x Authc attempts expire.
I guess you created an Endpoint Identity Group list "Printer", and added the MAC Address statically in there.

Your Wired policy set rule for your printers could have the "Wired_Mab" compound condition in it.

Light Example:

Policy Set Name: Condition "Wired_Mab"

AuthC policy: Conditiong "Wired_Mab", Use "Internal Endpoints"

AuthZ policy: Condition AND
"Wired_Mab"
"IdentityGroup Name Equals Endpoint Identity Groups:Printer"

Check the radius live logs, filtering on your MAC address (Operation > Radius > Live Logs) to make sure it is falling into the right AuthC/AuthZ policies.
Check the Context Visibility's Endpoints in ISE for your MAC Address to see if any AuthC failure shows.

[laurathaqi]

Hi @Pat Pouna 

Thank you for your feedback. 

I checked the rules, and the Device was going through the right AuthC. However, not showing through that AuthZ is failing. The devices were remote so I was unable to do any reboot of the devices directly. Left the devices through a night and the next day, the devices did go through ... This, seems that it needs time till the end to end systems process takes till it synchronizes all the information with each other, and in-between sending failed attempt to Authorize. 

The good thing is that the issue is fixed. The bad thing is that I did not understand what exactly was throwing the issue which was happening. 

Thank you for the feedback. 

Wish you a happy week. 

Best,

Laura