Hello,
Looking to see if you can provide some thoughts about the following. We are rolling out authentication on the wire via ISE. We have first enabled monitoring on switch ports to gather visibility of devices and then whatever is doing MAB we are adding it to the database (ISE) and then all other corporate machines will be doing dot1x using a machine certificate on this case due to being Win7.
During our implementation at the site everything went well except for one machine which it is using static IP (Changed to DHCP for tshoot purposes but same issue). When we enabled NAC enforcement ISE reported PC authenticated but the PC lost connectivity. This is the only PC at the site with Win 7 so we couldn´t test with another one. Some more information:
Model No: C9300L-24P-4X
IOS: 16.12.02
Port No: Gi1/0/10
Port Config(it’s in open mode now):
switchport mode access
switchport voice vlan XXX
authentication periodic
authentication timer reauthenticate server
access-session control-direction in
access-session port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 5
spanning-tree portfast
service-policy type control subscriber DOT1X-DEFAULT
ISE version 2.4.0.357
Installed Patches 7,9,12
Product Identifier (PID) SNS-3595-K9
PC info
OS Name Microsoft Windows 7 Enterprise
Version 6.1.7601 Service Pack 1 Build 7601
