11-09-2012 07:15 AM - edited 03-10-2019 07:45 PM
Dears,
I have this case where Cisco ISE server is used to authenticate & authorize clients on the network.
I configured the switch port to authorize the client in case the ISE server is dead (or not reachable).
The thing is that I want to reauthenticate the client once the ISE server becomes alive again but I am not able to.. ("Additional Information is needed to connect to this network" bullet is not appearing and the client PC remains authenticated and assigned to the VLAN.
Below is the switch port configuration:
interface FastEthernet0/5
switchport access vlan 240
switchport mode access
switchport voice vlan 156
authentication event server dead action authorize vlan 240
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication order dot1x mab
authentication priority mab
authentication port-control auto
mab
dot1x pae authenticator
spanning-tree portfast
Anyone can help?
Regards,
05-27-2014 10:00 PM
Did you get a fix for this? I am running into the same issue running 12.2(55)SE9.
05-28-2014 02:50 AM
Refer. the Auth fail config. ,, while Radius is down ,
https://supportforums.cisco.com/discussion/9994111/8021x-critical-authentication-feature-12225see
06-02-2014 04:01 AM
Please check whether the switch is dropping the connection or the server.
Symptoms or Issue | 802.1X and MAB authentication and authorization are successful, but the switch is dropping active sessions and the epm session summary command does not display any active sessions. |
Conditions | This applies to user sessions that have logged in successfully and are then being terminated by the switch. |
Possible Causes | •The preauthentication ACL (and the subsequent DACL enforcement from Cisco ISE) on the NAD may not be configured correctly for that session. •The preauthentication ACL is configured and the DACL is downloaded from Cisco ISE, but the switch brings the session down. •Cisco ISE may be enforcing a preposture VLAN assignment rather than the (correct) postposture VLAN, which can also bring down the session. |
Resolution | •Ensure the Cisco IOS release on the switch is equal to or more recent than Cisco IOS Release 12.2.(53)SE. •Check to see whether or not the DACL name in Cisco ISE contains a blank space (possibly around or near a hyphen "-"). There should be no space in the DACL name. Then ensure that the DACL syntax is correct and that it contains no extra spaces. •Ensure that the following configuration exists on the switch to interpret the DACL properly (if not enabled, the switch may terminate the session):
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server vsa send accounting
radius-server vsa send authentication
|
06-02-2014 03:15 PM
Just noticed your config has "authentication priority mab"
Try "authentication priority dot1x mab"
Not 100% but I would suggest this could be your problem
06-04-2014 10:17 AM
what is switch model and software version
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: