Unauthorized devices authentication (RADIUS)

[Teayuu]

Hello,

I'm working on a windows radius server, and a cisco switch 2960X.

Is it possible to put the switchport as errdisable after the authentication fail ?

I tried to configure the port security but it does not see the authentication fail as an security violation.

So even when the authentication fail, it will still put the switchport on vlan1.

Thank you for your attention.

[Mark Elsen]

 - In general this is not the intended purpose of  ISE as this has more fundamental consequences for the device and it's network connection.  You may want to look into schemes such as CoA, to isolate devices on quarantine VLAN's (that's only an example).

M.

[Teayuu]

Thank you for your anwser.

Do you know if it's possible to configure the access reject so it can be seen as a security violation ?

[Mike.Cifelli]

Is it possible to put the switchport as errdisable after the authentication fail ?

Not that I am aware of. If there is a way hopefully someone else will chime in.

What you are looking for can be accomplished via this under your port configs:
#authentication event fail action authorize vlan ##

HTH!