Testing 802.1X authentication on Catalyst 9000v 17.12.01prd9

[rezaalikhani]

Hello;

As you know, Cisco has released CML 2.7, and along with that, it has introduced several new images like Catalyst 9000v 17.12.01prd9. Base on my personal testing, it is certain that the previous image did not support 802.1X. Has anybody managed to test 802.1X on the newly released image?

Thanks

[ahollifield]

I kind of doubt it just because of the way EAP/EAPoL works.  I could be wrong, but I would think simulating the client EAPoL start would be very difficult.  

802.1X/MAB are not officially tested or supported features: https://developer.cisco.com/docs/modeling-labs/#!cat-9000v/cat-9000v

[Arne Bier · Accepted solution]

Hi @rezaalikhani 

Yeah I tested it the day it got released. I only got as far as testing MAB, and I can report that it works well.  The previous release had all the IOS-XE commands, but they did nothing, because the release did not have a functioning Session Manager Daemon (smd). I don't see why 802.1X won't work. I had to hack together a FreeRADIUS server on an Ubuntu CML client for my MAB testing and I didn't have the stomach to figure out how 802.1X is done in FreeRADIUS. I love the idea of FreeRADIUS, but ISE is a whole lot easier to manage.

CML 2.7 also released two new images - IOL (IOS-XE on Linux). This is similar to what Cisco did many, many years ago with IOU (IOS on (Sun) Unix) - a highly compact binary that doesn't emulate a certain model of switch/router, but rather, is like a generic device. They released IOS-XE router and IOS-XE switch. Unfortunately, that switch does not support NAC - commands like "show session" and "show authentication" are missing. But other NAC commands are there. Annoying. Because the C9Kv eats up your CPU, whereas you can run tens of IOL instances and they boot in seconds, and hardly dent your CPU performance.