MAB user failed to land correct Authorization policy after posture success

[pemasirid]

Hi,

We have MAB user who authenticates via webportal using domain username/password and get the NAC web agent download and do the posture.

After posture is complated (say success/passed), the user is landing on Defaul Policy which is DenyAccess.

I have change the gestportal setting with enabling Vlan DHCP Release and CoA, but there is no luck. I have similar rules for wired dot1x and its working fine after posture part, only different is they are MAB users and authenticated via webportal and belongs to different user group in AD.

What we could see on the switch, once you authenticated, it get the Web Redirect and when the user authenticates in get the NAC web agent direct and after posture completed it again go back to Web portal redirection and giving error saying both dot1x and MAB failed,

Attached is the switch logs and ISE configuration and failed logs.

If someone has clue on this or has come across this issue, please update me.

Thanks in advance.

[Richard Atkin]

Instead of using the Wired_MAB prefix in your first three authorisation rules, refer to the Endpoint Identity Group instead. The reason you get Deny Access is because the event you're looking for isn't a MAC Auth event, and therefore those rules get skipped. Using the Endpoint Identity Group will allow you to evaluate the MAC Address and will get your rules working as required.

Sent from Cisco Technical Support iPad App