Vinodh,
Hello again after direct chat. It is good that questions posted here so other SMEs can respond and responses are archived for future reference!
As noted, Machine Access Restrictions (MAR) has a number of caveats. The basis of MAR is that a machine auth must first occur and the MAC address, not hostname or other credential, is cached in a specific PSN. If MAR enabled and policy is based on user and "if machine-authenticated", then subsequent user auth will perform a lookup into MAR cache on local PSN and determine if MAC address (as learned from Calling Station ID) is present.
When both auth events occur from same connection and to same PSN, which is often the case for initial bootup, then life is wonderful and MAR works as expected. However, there are cases where MAR can be problematic, including:
- MAR Cache times out and user reauth fails since no longer a corresponding MAC in MAR cache, thus requiring reboot or user logoff to re-trigger machine auth.
- Load Balancer is not configured for MAC address persistence, or the persistence/sticky cache expires before next user auth, thus resulting in user auth occurring against a different PSN which has no MAR cache entry from previous machine auth.
- Without logging off or shutting down, user moves from one NAD or location to another, again resulting in the user auth hitting a different PSN or LB VIP.
- Machine and user authenticate on wired (or wireless) and then moves to wireless (or wired) without rebooting computer or logging off user account.
- PSN where MAR cache exists is cleared out after a PSN restart.
As you can see, many of the cases where MAR can fail include case where PC goes into hibernation/sleep mode and when it returns, it may hit a different PSN, or it connects with a different MAC, or cache on PSN has times out. Increasing the MAR cache timer may help address specific cases resulting from cache time out, but that is only attempts to address the first bullet above and as noted, becomes a potential security exposure.
As noted in email, two features will help case where PSN restarts or if move between PSNs:
1) ISE 2.2 adds support to persist MAR cache between restarts.
2) ISE 2.3 adds support to synchronize MAR cache between PSNs in same node group (not globally if multiple clusters).
You mentioned that Machine Auth automatically occurs after return from sleep/hibernate, or that user auth automatically occurs if machine+user. I don't think that is the case and machine auth only occurs after user logoff or restart or connection termination (such as plug and unplug wired connection, or disconnect and reconnect to SSID). I suspect you are seeing a reauth event due to session timeout and when switch requests identity, it is either sending machine or user based on client config. In either case, the most problematic case is where MAR enabled and one of the above conditions occurs after device exists sleep/hibernate.
If goal is to authenticate machine once and not have to repeat that step after a long interval, then I would recommend using device registration to allow MAC address to be registered and optionally purged at some interval--whether week, month, quarter as that can be persisted globally and device is associated to the user (portal_user attribute). You can also customize registration to a specific Endpoint Identity Group.
If goal is to truly authenticate machine + user via 1X credentials for both in each connection, then recommendation would be AC NAM for supported Windows clients, but ultimately TEAP is the preferred route and that still has not been adopted by major players like Microsoft / Apple.
HTH,
Craig
