how to enable 802.1x Authentication for PC vlans and bypass for certain vlans like printers,voip

[getaway51]

Hi,

I search and found various kinds of 802.1x config but not sure which to follow.

Is there any good working config and real examples that i can follow to enable 802.1x authentication on PC vlan but bypass on certain vlans like IP phones, printers,etc?

[balaji.bandi]

Here is MAB Example :

https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-663759.html

[getaway51]

I cant access the links provided. blocked. May i know how certificate 802.1x auth works and config guide if any? Any website tht explains in layman term how it works. 

[balaji.bandi]

Attached document for your reference.

[getaway51]

Hi Balaji,

Thanks so much for the doc, it is very useful. Is there any commands for MAB tht I can refer to?

Btw do you hv such document for Radius and Certificate-based 802.1x authentication? Thanks again!!

[balaji.bandi]

here is the example document cover both :

https://community.cisco.com/t5/security-documents/how-to-configure-wired-802-1x-amp-mab-authentication-with-ise-on/ta-p/3657380

[getaway51]

Wow!! this is very good stuff!! I'll make sure i read all these! You gt more of those for 802.1x authentication? 

btw do you hv any doc like those for certificate-based 802.1x authentication? 

Is certificate-based for servers used mostly? is it i generate the certs and then install into the servers and servers will do the authentication with 802.1x servers via switch? is tht how it works? 

[balaji.bandi]

You can use Microsoft CA Internal for certificate.

I would suggest there are lot of resource available here :

https://community.cisco.com/t5/security-documents/ise-community-resources/ta-p/3621621#Resources

[getaway51]

Hi,

May I know how server certificate authenticate works in 802.1X? How the entire negotiation process & configuration different from the usual 802.1x switch config? I saw gt config for radius and MAC bypass? didnt found any for CA/certs   

[balaji.bandi]

added the document for reference :

[getaway51]

Hi,

Thanks for the doc. It is very informative!! So good! It talks a lot about certs.

But i didnt see any cisco switch config there. Is switch need any config for this certs to happen? or switch basically just like middle man. i doesnt need to have any CA related config? Sorry i m just trying to understand switch process with cisco acs regarding 802.1x. I heard about microsoft IDA, profiling, CA certs, MAC bypass,etc when it comes to 802.1X Cisco ACS authentication. Is there such document about 802.1x integration with above?   

[balaji.bandi]

Suggest invest some time on the First post i have added, it got all the information wht you looking for,

Or let us know wht effort you put on the building config, so we can asists if you have difficulties.

[getaway51]

Hi,

1)may i know if cisco ISE also means cisco ACS?

2)For MAB, all the mac address stored in Cisco ISE/ACS, switch just enable MAB?

3)For CA certs, all certs stored in ISE/ACS? Switch just enable 802.1x authentication which i meant all transparent to switch regardsless of mac, CA, radius username/passwd?

[balaji.bandi]

Firstly looks like you are deviating the main topic to many branches, so hard to understand requirement here and suggest what is the issue here.

May be below information help you.

1)may i know if cisco ISE also means cisco ACS?

ISE Means ISE ( ACS is different Product)

you can find the difference here 

https://community.cisco.com/t5/security-documents/acs-vs-ise-comparison/ta-p/3649661

2)For MAB, all the mac address stored in Cisco ISE/ACS, switch just enable MAB?

ISE Learns MAC from switch, based on the policy it will take action.

3)For CA certs, all certs stored in ISE/ACS? Switch just enable 802.1x authentication which i meant all transparent to switch regardsless of mac, CA, radius username/passwd?

CA is Seperated Server, ISE Interact with CA Servers.

Again please refer the URL i have provided in the orginal post.