Hi Guys, This isn't my area of expertise so please bear with me. We had this setup working but had to change a few things and now the Access-Failed ports are not being placed into the correct 'guest/restricted' vlan 998. Here's a cut and paste of the relevant sections from the config. I've also attached a partial log output. The log shows Access-Reject message from ACS/Radius server is being received on the switch. The class-map and policy-map look correct for activating service-template CRITICAL_AUTH_VLAN_998 but the ports never get changed to 998. Any suggestions would be appreciated! 3850 Config: ! aaa new-model ! ! aaa group server radius ACS-SERVERS server name WEHO-ACS1 server name WEHO-ACS2 mac-delimiter colon ! aaa authentication login LINE-CON local aaa authentication dot1x default group ACS-SERVERS aaa authorization network default group ACS-SERVERS aaa authorization network auth-list group ACS-SERVERS aaa authorization auth-proxy default group ACS-SERVERS aaa accounting update periodic 5 aaa accounting identity default start-stop group ACS-SERVERS aaa accounting network default start-stop group ACS-SERVERS aaa accounting system default start-stop group ACS-SERVERS ! ! aaa server radius dynamic-author client 192.168.10.190 server-key 7 XXXXXXXXX client 192.168.10.191 server-key 7 XXXXXXXXX auth-type any ! aaa session-id common access-session mac-move deny ip device tracking probe count 10 ip device tracking probe use-svi ip device tracking probe delay 10 ip device tracking ! ! dot1x system-auth-control ! ! fallback profile WEB_AUTH_PROFILE ! service-template webauth-global-inactive inactivity-timer 3600 service-template webauth-IP_ADMIN_RULE inactivity-timer 3600 service-template DEFAULT_CRITICAL_VOICE_TEMPLATE voice vlan service-template CRITICAL_AUTH_VLAN_650 vlan 650 service-template CRITICAL_AUTH_VLAN_998 vlan 998 ! ! parameter-map type webauth global custom-page login device flash:Login.html custom-page success device flash:Success.html custom-page failure device flash:Failed.html custom-page login expired device flash:Expired.html ! ! parameter-map type webauth WEB_AUTH_PROFILE type webauth ! ! parameter-map type webauth IP_ADMIN_RULE type webauth ! class-map type control subscriber match-all AAA_SVR_DOWN_AUTHD_HOST match result-type aaa-timeout match authorization-status authorized ! class-map type control subscriber match-all AAA_SVR_DOWN_UNAUTHD_HOST match result-type aaa-timeout match authorization-status unauthorized ! class-map type control subscriber match-all DOT1X match method dot1x ! class-map type control subscriber match-all DOT1X_FAILED match method dot1x match result-type method dot1x authoritative ! class-map type control subscriber match-all DOT1X_MEDIUM_PRIO match authorizing-method-priority gt 20 ! class-map type control subscriber match-all DOT1X_NO_RESP match method dot1x match result-type method dot1x agent-not-found ! class-map type control subscriber match-all DOT1X_TIMEOUT match method dot1x match result-type method dot1x method-timeout ! class-map type control subscriber match-any IN_CRITICAL_VLAN match activated-service-template DEFAULT_CRITICAL_VOICE_TEMPLATE match activated-service-template CRITICAL_AUTH_VLAN_998 ! class-map type control subscriber match-all MAB match method mab ! class-map type control subscriber match-all MAB_FAILED match method mab match result-type method mab authoritative ! class-map type control subscriber match-none NOT_IN_CRITICAL_VLAN match activated-service-template DEFAULT_CRITICAL_VOICE_TEMPLATE match activated-service-template CRITICAL_AUTH_VLAN_998 ! ! policy-map type control subscriber ACS-PMAP-1 event session-started match-all 10 class always do-until-failure 10 authenticate using dot1x retries 2 retry-time 0 priority 10 event authentication-failure match-first 10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure 10 activate service-template CRITICAL_AUTH_VLAN_998 20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE 30 authorize 40 pause reauthentication 50 clear-authenticated-data-hosts-on-port 20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure 10 pause reauthentication 20 authorize 30 class DOT1X_NO_RESP do-until-failure 3 terminate dot1x 6 authenticate using mab priority 20 10 activate service-template CRITICAL_AUTH_VLAN_998 20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE 30 authorize 40 class MAB_FAILED do-until-failure 10 terminate mab 15 activate service-template CRITICAL_AUTH_VLAN_998 17 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE 20 authentication-restart 60 50 class DOT1X_FAILED do-until-failure 3 terminate dot1x 6 authenticate using mab priority 20 10 activate service-template CRITICAL_AUTH_VLAN_998 20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE 30 authorize 60 class always do-until-failure 10 terminate dot1x 20 terminate mab 30 authentication-restart 60 event agent-found match-all 10 class always do-until-failure 10 terminate mab 20 authenticate using dot1x retries 2 retry-time 0 priority 10 event aaa-available match-all 10 class IN_CRITICAL_VLAN do-until-failure 10 clear-session 20 class NOT_IN_CRITICAL_VLAN do-until-failure 10 resume reauthentication event violation match-all 10 class always do-until-failure 10 restrict ! policy-map port_child_policy class non-client-nrt-class bandwidth remaining ratio 10 ! class class-default bandwidth remaining percent 25 queue-buffers ratio 25 !!EXAMPLE INTERFACE!! interface GigabitEthernet1/0/21 switchport access vlan 650 switchport mode access switchport voice vlan 111 trust device cisco-phone access-session host-mode multi-domain access-session closed access-session port-control auto mab dot1x pae authenticator dot1x timeout tx-period 10 dot1x max-req 1 dot1x max-reauth-req 1 auto qos voip cisco-phone spanning-tree portfast service-policy type control subscriber ACS-PMAP-1 ! ip access-list extended PRE_WEBAUTH_POLICY permit udp any any eq bootps permit udp any any eq domain deny ip any any ! ip radius source-interface Vlan1 ! radius-server attribute 6 on-for-login-auth radius-server attribute 6 support-multiple radius-server attribute 8 include-in-access-req radius-server attribute 25 access-request include radius-server attribute 31 mac format ietf upper-case radius-server attribute 31 send nas-port-detail mac-only radius-server retransmit 2 radius-server timeout 3 radius-server deadtime 15 ! radius server WEHO-ACS1 address ipv4 192.168.10.190 auth-port 1645 acct-port 1646 key 7 XXXXXXXXX ! radius server WEHO-ACS2 address ipv4 192.168.10.191 auth-port 1645 acct-port 1646 key 7 XXXXXXXXX ! ... View more

Hello, In the past on a 881 I've been able to NAT traffic out the Cellular 0/0/0 interface with an ACL on Cell0/0/0 permitting only NAT'd traffic and denying everything else. This was done to prevent traffic leaving cell0/0/0 with a source address other than the ISP assigned WAN IP. For some reason on the 1921 the access list is not being utilized and non-nat'd traffic is also leaving the interface which causes the link to flap since the ISP detects source address violations. Any idea on what would be causing this?  I even stripped the config down to the following but the problem persists, any advice?   ip route 0.0.0.0 0.0.0.0 Cellular0/0/0 5 ! interface Loopback0  description Management Interface (do not shut)  ip address 10.224.0.165 255.255.255.255  ip nat inside  ip virtual-reassembly in ! ip access-list extended TEST-CELL-ACL deny   ip any any deny   icmp any any ! ! interface Cellular0/0/0 ip address negotiated ip access-group TEST-CELL-ACL out no ip unreachables ip nat outside ip virtual-reassembly in zone-member security OUTSIDE encapsulation slip load-interval 30 dialer in-band dialer idle-timeout 0 dialer string ltescript dialer watch-group 1 async mode interactive end ------------------------------------------------------------- SG-142-1921#ping 8.8.8.8 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 104/110/116 ms SG-142-1921#ping 8.8.8.8 source lo0     Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: Packet sent with a source address of 10.224.0.165  ..... Success rate is 0 percent (0/5) 000083: *Oct  1 20:16:48.115 UTC: %LINK-5-CHANGED: Interface Cellular0/0/0, changed state to reset 000084: *Oct  1 20:16:49.115 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Cellular0/0/0, changed state to down... 000085: *Oct  1 20:16:53.115 UTC: %LINK-3-UPDOWN: Interface Cellular0/0/0, changed state to down. Success rate is 0 percent (0/5)   SG-142-1921#sh ip access-lists TEST-CELL-ACL Extended IP access list TEST-CELL-ACL     10 deny ip any any     20 deny icmp any any SG-142-1921#       ... View more

Hello, I'm trying to determine the best approach for a somewhat complicated redundancy scenario. Initially we have setup an HSRP failover mechanism between 2 routers which has worked great. Things are getting interesting now that the customer wants to add 4G to the mix. Here's a little background first.   Currently: Remote site has 2 routers, a 1921 as primary with VPLS connection to HQ core switch. They also have an 881 onsite with a DSL connection which hosts a couple of DMVPN tunnels that home back to a couple of routers at HQ. The two remote site routers are setup in an HSRP arrangement with the 1921 setup w/ IP SLA tracking next hop reach ability, decrementing priority in the event of a failure. The 1921's default route is learned from HQ over the VPLS connection. The 881 has a static route pointing out the DSL interface. In the event the 1921 fails reaching its next hop the 881 takes over and send everything out the WAN port. So far so go.   Going to: Time to spice it up, the customer wants to add a 4G card to 1921 and offer 4G as a last resort. If the VPLS goes down default gateway for data changes to 881, if  the 881's DSL goes down then I'll need a mechanism to forward toward the 1921 for egress from 4G. I figure the easiest way to do this will be to configure IP SLA to track reach ability. I'd then tie that tracker to a static route pointing out DSL w/ a floating static route pointing back to 1921. So if the DSL does die then routing table will point all traffic to the 1921. I'd like to avoid messing with HSRP further if possible (feel free to interject if you think this isn’t a good approach). So the packets are now arriving back on the 1921, VPLS is down and 4G is the only way out... here's where I get fuzzy. Customer only wants to utilize 4G at these times, otherwise it wouldn’t be active. I know I have to setup a dialer which kicks in when interesting traffic is detected but I'm not exactly sure how to pull that off in this case.  Any help would  be appreciated. I hope everyone's day is going well!   {C}   ... View more