DOT1X and MAB on the same port

[ping.tremblay]

Hi there,

Long time browser, seldom poster. Wanted to reach out to the community about this one to find the best solution instead of just a workaround. So this is probably common; I have ports which have a phone and computer plugged into it. Because of the deployment, and that different people manage different devices I can't use dot1x on the phones. I need to use MAB. but the computers plugged in I do use dot1x. So I have both on the same port. I have the priority setup just fine (dot1x first, MAB second). But I find that sometimes a computer plugs in, fails dot1x, then fails MAB. But it keeps retrying MAB. This is resulting in more failed logon attempts than one can count. Makes parsing the logs not impossible, but a nuisance. 

My question is, can I make it so the data vlan uses dot1x and the voice vlan uses MAB on the same port? This could make sure nothing is allowed to do what the other can, and should solve my logging problem.

Thanks in advance.

interface GigabitEthernet5/0/14
switchport access vlan 4
switchport mode access
switchport voice vlan 11
switchport port-security maximum 4
switchport port-security violation restrict
switchport port-security aging time 5
switchport port-security
no logging event link-status
no cdp enable
authentication control-direction in
authentication event fail action authorize vlan 192
authentication event server dead action authorize vlan 4
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
mab
no snmp trap link-status
dot1x pae authenticator
storm-control broadcast level bps 10m 2m
storm-control multicast level bps 10m 2m
storm-control action shutdown
storm-control action trap
spanning-tree portfast

Thoughts? Questions? Thanks again.

[marce1000]

 - There are many resources available on this subject which may give you inspiration and or extra things to check for , here's an example from the 'googling world' :

       https://www.google.com/search?q=cisco+how+to+DOT1X+and+MAB+on+the+same+port+with+pc+connected+to+phone&rlz=1C1CHZL_enBE751BE751&oq=cisco+how+to+DOT1X+and+MAB+on+the+same+port+with+pc+connected+to+phone+&aqs=chrome..69i57j69i64.22047j0j7&sourceid=chro...

 M.

[ping.tremblay]

Thanks for the reply M. I checked over a few pages of the suggested links you shared, but it still doesn't quite touch on my issue. I was trying to see if I could force a single port to use different authentication for different VLANs. MAB for phone vlan, dot1x for data vlan. If that's not possible and the entire port must follow both then how do people deal with the influx of logs you get on a port which the computer does not meet your MAB, nor your dot1x requirements. I was trying to push them into a guest vlan, but it seems the port continues to keep trying MAB even when in the guest vlan, and this generates a huge number of failed logon attempts. Which clutters the logs, and makes admins parsing them likely miss some of the legit logon attempts they should be looking at. Thoughts?

[marce1000]

 - My fundamental thoughts are that I have never been in favor of such setups because they defy the purposes of solid authentication on a rigid strong Intranet structured authentication setup (by that I mean  PC's plugged in behind phones). I think full benefit of products like ISE can be accomplished by giving each device a separate physical network connection.

 M.

[ping.tremblay]

Ok, I think what you're eluding to confirms my suspicions. That there is no way to separate the authentication to each vlan on a port, but rather that the authentication config is for EVERYTHING connected to that port. To make matters worse, this is not an ISE deployment, but rather using RADIUS and MS NPS. But you're right, this would be so much easier to manage if I didn't need to have an end port have more than one MAC tied to it, and more than one policy tied to it. I just wish there was an easy answer to not allow these machines to keep trying MAB and failing. It generates way too many logs.

[Massimo Baschieri]

Why don't you simply change rules on ise in order for mab to not fail anymore?

You can create a rule which redirects unprofiled mab hosts to a guest portal or change default deny rule at the end with a permit, but with acl which denies any any 

[ping.tremblay]

Thanks Massimo, now we're getting somewhere. I like that suggestion, it intrigues me. But what if I don't run ISE in my environment. Doing the same in MS NPS? 

See the missing link is that I've got phones, with devices plugged in behind them. But those devices plugged in behind are sometimes our domain machines, and sometime other byod or vendor devices. When it's one of our domain machines, no problem dot1x works, authenticated, we're good. But when it's a vendor device, they plug in, end up on the guest vlan (which is intentional), but then every like 30 seconds it tries to re-auth the port. This fails dot1x, then fails mab every time, and generates these failed logon attempts. Thing is they're not really failed, they're doing what it needs to do, but clutters all the auth logs that reviewing them for anything legit is nightmareish.

[Massimo Baschieri]

With cisco switches and ISE is not really important if the device is plugged directly to the switch port or is behind an ip phone, each mac address is threated as a single session, what makes the difference is switch configuration and ise policies.

I've used nps very few times and only for 802.1x athentications, for sure is much much less flexible and feature rich than ise, but I don't even know if it supports mab.