Dear,
MAB on C9300 doesn't start with some medical equipment.
With my PC it works fine if i put my mac-address on the ISE.
And Dot1x work fine also.
D-9300#sh run int gi 1/0/2
!
interface GigabitEthernet1/0/2
switchport access vlan 70
switchport mode access
switchport nonegotiate
switchport voice vlan 124
device-tracking attach-policy deviceIP4ise
source template TM-Dot1x-tst
spanning-tree portfast
end
D-9300#sh derived-config int gi 1/0/2
!
interface GigabitEthernet1/0/2
description dot1x Port
switchport access vlan 70
switchport mode access
switchport nonegotiate
switchport voice vlan 124
device-tracking attach-policy deviceIP4ise
authentication periodic
authentication timer reauthenticate server
access-session host-mode multi-domain
access-session control-direction in
access-session port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 7
spanning-tree portfast
service-policy type control subscriber DOT1X-DEFAULT
end
D-9300# sh access-session brief
No sessions currently exist
When I change on the interface "switchport access vlan 70" to "switchport access vlan 505"
Vlan 70 is the rubish vlan, vlan 505 is the vlan where the equipment must go
Then It works fine
D-9300#sh derived-config int gi 1/0/2
!
interface GigabitEthernet1/0/2
description dot1x Port
switchport access vlan 505
switchport mode access
switchport nonegotiate
switchport voice vlan 124
device-tracking attach-policy deviceIP4ise
authentication periodic
authentication timer reauthenticate server
access-session host-mode multi-domain
access-session control-direction in
access-session port-control auto
mab
dot1x pae authenticator
dot1x timeout tx-period 7
spanning-tree portfast
service-policy type control subscriber DOT1X-DEFAULT
end
D-9300# sh access-session brief
Interface MAC Address AuthC AuthZ Fg Uptime
-----------------------------------------------------------------------------
Gi1/0/2 00e0.4b83.f071 m:OK AZ: SA-D:V: X 14s
Key to Authentication Attributes:
RN - Running
ST - Stopped
OK - Authentication Success
CF - Credential Failure
AD - AAA Server Failure
NR - No Response
TO - Timeout
AR - AAA Not Ready
Key to Authorization Attributes:
AZ - Authorized, UZ - UnAuthorized
SA - Success Attributes, FA - Failed Attributes
- DACL, F: - Filterid / InACL, U: - URL ACL
V: - Vlan, I: - Inactivity Timer, O: - Open Dir
Key to Session Events Blocked Status Flags:
A - Applying Policy (multi-line status for details)
D - Awaiting Deletion
F - Final Removal in progress
I - Awaiting IIF ID allocation
P - Pushed Session
R - Removing User Profile (multi-line status for details)
U - Applying User Profile (multi-line status for details)
X - Unknown Blocker
D-9300#
It seems that the equipment doesn't send any packet out, the equipment is unfortunately in IP fixe and not dhcp.
It seems that the equipment wait info from a central management equipment.
Is it something possible at network level to find a solution without to put static "switchport access vlan 505" in the configuration ?
Thanks
