This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC!
We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.
We are running Cisco ISE 1.4 with machine authentication only and recently had a power outage for about 6 hours. When the UPS batteries drained the ISE servers are connected to, none of the computers could connect to anything. The NIC's on the computers had an error of Authentication Failed. We have "Fallback to unauthorized network access" selected on every computer. Is there a way to allow all the computers to have access to the network and internet as usual when the ISE servers are down?
The port config is below:
switchport access vlan 77
switchport mode access
switchport voice vlan 777
ip access-group ACL-DEFAULT in
authentication event fail action next-method
authentication event server dead action authorize vlan 77
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity 180
authentication violation restrict
mab
no snmp trap link-status
auto qos voip cisco-phone
dot1x pae authenticator
dot1x timeout tx-period 10
qos trust device cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable
service-policy input AutoQos-VoIP-Input-Cos-Policy
service-policy output AutoQos-VoIP-Output-Policy
Solved! Go to Solution.
You need to use some EEM script to change the ip access-list you have assigned to the interface, to something with "permit ip any any" in it.
"authentication event server dead action authorize vlan 77" will only work in closed mode configurations, which don't use a pre-auth acl.