Hi Community,
I'm preparing config for 802.1x deployment and encountered a problem. I'm using IBNS 2.0 syntax like below and try to make "dot1x timeout tx-period" lower, from 30 to 10 seconds. Unfortunately after switch reload, command "dot1x timeout tx-period" is missing in running-config but is present in the startup-config. Because of that switch send EAPOL frame every 30 sec which is to long for me. Is there any way to accomplish my goal with IBNS 2.0?
Switch 2960X with IOS 15.2(2)E6:
Before reload:
running-config:
interface GigabitEthernet1/0/1
switchport access vlan 110
dot1x timeout tx-period 10
source template ISE
startup-config:
interface GigabitEthernet1/0/1
switchport access vlan 110
dot1x timeout tx-period 10
source template ISE
After reload:
running-config:
interface GigabitEthernet1/0/1
switchport access vlan 110
dot1x timeout tx-period 10 <- command is missing
source template ISE
startup-config:
interface GigabitEthernet1/0/1
switchport access vlan 110
dot1x timeout tx-period 10
source template ISE
Config:
dot1x system-auth-control
dot1x logging verbose
dot1x critical eapol
!
!
service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
voice vlan
service-template CRITICAL
access-group ACL_CRITICAL
voice vlan
service-template CRITICAL_ACCESS
access-group ACL_CRITICAL
service-template CRITICAL_VOICE
voice vlan
!
class-map type control subscriber match-all AAA_DOWN
match result-type aaa-timeout
!
class-map type control subscriber match-all AAA_SVR_DOWN_AUTHD_HOST
match result-type aaa-timeout
match authorization-status authorized
!
class-map type control subscriber match-all AAA_SVR_DOWN_UNAUTHD_HOST
match result-type aaa-timeout
match authorization-status unauthorized
!
class-map type control subscriber match-all DOT1X_FAILED
match method dot1x
match result-type method dot1x authoritative
!
class-map type control subscriber match-all DOT1X_NO_RESP
match method dot1x
match result-type method dot1x agent-not-found
!
class-map type control subscriber match-any IN_CRITICAL_AUTH
match activated-service-template CRITICAL_ACCESS
match activated-service-template CRITICAL_VOICE
!
class-map type control subscriber match-all MAB_FAILED
match method mab
match result-type method mab authoritative
!
class-map type control subscriber match-none NOT_IN_CRITICAL_AUTH
match activated-service-template CRITICAL_ACCESS
match activated-service-template CRITICAL_VOICE
!
policy-map type control subscriber POLICY_DOT1X_MAB5
event session-started match-all
10 class always do-until-failure
10 authenticate using dot1x priority 10
20 authenticate using mab priority 20
event authentication-failure match-first
5 class DOT1X_FAILED do-until-failure
10 terminate dot1x
20 authenticate using mab priority 20
10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
10 activate service-template CRITICAL_ACCESS
20 activate service-template CRITICAL_VOICE
50 authorize
60 pause reauthentication
20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
10 pause reauthentication
20 authorize
30 class DOT1X_NO_RESP do-until-failure
10 terminate dot1x
20 authenticate using mab priority 20
40 class MAB_FAILED do-until-failure
10 terminate mab
20 authentication-restart 60
50 class always do-until-failure
10 terminate dot1x
20 terminate mab
30 authentication-restart 60
event agent-found match-all
10 class always do-until-failure
10 terminate mab
20 authenticate using dot1x priority 10
event aaa-available match-all
20 class NOT_IN_CRITICAL_AUTH do-until-failure
10 resume reauthentication
!
template ISE
dot1x pae authenticator
spanning-tree portfast
spanning-tree bpduguard enable
switchport mode access
source template IP_PHONE_INTERFACE_TEMPLATE
mab
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber POLICY_DOT1X_MAB5
!
interface GigabitEthernet1/0/1
switchport access vlan 110
dot1x timeout tx-period 10
source template ISE
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 10 tries 3
radius-server deadtime 15
!
radius server RADIUS_ISE02
address ipv4 IP_1 auth-port 1645 acct-port 1646
automate-tester username RADIUS-TEST probe-on
key 7 ***
!
radius server RADIUS_ISE01
address ipv4 IP_2 auth-port 1645 acct-port 1646
automate-tester username RADIUS-TEST probe-on
key 7 ***
