cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
776
Views
15
Helpful
2
Replies
Heriberto Diaz
Beginner

SDA Wired Web Auth MAB

Hi

 

Does anybody know or have a guide how to configure Wired Web Authentication (SDA with ISE)? Because I don't find on SDA how to do this.


I checked the templates (Close Auth, Auth) but both are with 8021.X.

 

Thanks and regard.

*** Please Rate All Helpful Responses ***
*** Califica si fue de ayuda, por favor***
1 ACCEPTED SOLUTION

Accepted Solutions
Mike.Cifelli
VIP Advocate

Do you have access to the run config on one of your edge nodes in your fabric? After assigning the closed auth template DNAC will provision your edge nodes using IBNS service templates. Closed auth provisions order & priority dot1x and then mab. Meaning dot1x goes first and is set to higher priority. However, should this fail it will fallback to mab. There is another template you could use that is lighter on restrictions that is known as Easy Connect. In DNAC if you go to Design->Authentication you can tweak some of the options in the cisco default templates that you assign to your fabric. For example, if you want to use closed authentication but want the order to be mab first you can set it to use mab order first via the gui. Or if you really want to tweak configs you can leverage the template editor to modify the service template deployed from DNAC. I personally have used the template editor to modify things such as dot1x timers, critical auth vlan, and the default voice vlan.

As far as using web auth this should be straightforward. If your edges are configured to support mab just ensure that your authz profiles in ISE are configured to use whichever portal you setup. Something to note is the default webauth_acl that gets deployed from DNAC. I would double check that. Again, note that you can modify this via template editor. HTH!

View solution in original post

2 REPLIES 2
Mike.Cifelli
VIP Advocate

Do you have access to the run config on one of your edge nodes in your fabric? After assigning the closed auth template DNAC will provision your edge nodes using IBNS service templates. Closed auth provisions order & priority dot1x and then mab. Meaning dot1x goes first and is set to higher priority. However, should this fail it will fallback to mab. There is another template you could use that is lighter on restrictions that is known as Easy Connect. In DNAC if you go to Design->Authentication you can tweak some of the options in the cisco default templates that you assign to your fabric. For example, if you want to use closed authentication but want the order to be mab first you can set it to use mab order first via the gui. Or if you really want to tweak configs you can leverage the template editor to modify the service template deployed from DNAC. I personally have used the template editor to modify things such as dot1x timers, critical auth vlan, and the default voice vlan.

As far as using web auth this should be straightforward. If your edges are configured to support mab just ensure that your authz profiles in ISE are configured to use whichever portal you setup. Something to note is the default webauth_acl that gets deployed from DNAC. I would double check that. Again, note that you can modify this via template editor. HTH!

View solution in original post

Mike, Thank you for this useful reply to Heriberto!
I hope you and your love ones are safe and healthy
Monica Lluis
Community Manager Lead
Content for Community-Ad
This widget could not be displayed.