Re-Authenticate End hosts after ISE failure

[ShaunGreen]

Dear All,

We are using IBNS 2.0 with dot1x and mab.

Everything so far is working in our testing and when we simulate an ISE failure the Critical service template allows the end hosts access to the network.

When the ISE server comes back online, the dot1x hosts re-authenticate and pickup their correct policy sets.

But the MAB (profiled) devices stay in the Critical state.

Does anyone know the best procedure to automatically re-authenticate these devices once the ISE server is back online?

Thanks in advance.

[poongarg]

Please attach the "sh tech" output from the switch.

[ShaunGreen]

Hi, Thanks for your interest.

To give some more information, I closed down the ISE application on Friday evening. Everything failed over using the 'Critical' service template (screen shot below).

When the Radius servers are back online, the dot1x hosts re-autenticate, but the MAB profiled devices are still staying on the Critical service template.

We could manually carry out a COA from ISE for these hosts, but I'm wondering if there is a way to configure re-authentication once the ISE is up and running without manual intervention?

Code is 16.9.4

[Damien Miller]

It appears you may be missing policy required to resume authentication once AAA comes back online, you need to exit critical auth. If you follow Hari's secure wired access prescriptive guide you can see how this could be done.
https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515

ex. 
"event aaa-available match-all
10 class IN_CRITICAL_AUTH do-until-failure
10 clear-session
20 class NOT_IN_CRITICAL_AUTH do-until-failure
10 resume reauthentication"

[ShaunGreen]

Hi Damien,

Thanks for you assistance, it took me a while to test this and to be honest, IBNS2.0 is a bit tricky to get your head around after being used to the 'old' ways....but it now looks to be working well.

Thanks again.