Windows 7 / 2008 duplicate static address when using 802.1x / MAB - ISE

adrian.watmough · ‎05-01-2013

Hi all!

ISE 1.1.3

Cisco 3750 switches

Windows XP / 7 / 2008 clients

I'm having some weird issues were if a client connects to a switchport and happens to be using a static IP address then the client warns of a duplicate address problem. Also the client will then only show the default gateway within ipconfig even though the IP address / mask is still in the GUI network properties of the adaptor. This is happening with Windows 7 and Windows 2008 devices.

Windows XP clients don't get the issue.

Some clients will use 802.1x native supplicant and some will be authenticated based on MAB. Not noticed the problem with 802.1x clients but it always occurs on MAB.

I came across a similar issue here:

http://networkingblog.vvlabs.com/2012/07/cisco-ise-duplicate-ip-address-windows-7.html

Going of that blog I tried using the "ip device tracking delay probe delay" command but the switches don't recognise the "delay" keyword.

The switches are 3750 switches running version 12.2(58)SE2.

All I have is "count, interval, use-svi" as extra options.

Catalyst 4500 switch guide has "delay" option but no "count, interval or use-svi".

The only way I have managed to avoid the problem is using the second solution which is a registry hack on each client. This is fine for the odd server but not realistic when there will be hundreds of other clients.

Any ideas?

Richard Atkin · ‎05-29-2013

Don't use Clients with static IP addresses?

adrian.watmough · ‎05-29-2013

No sorry. That's not an option. Servers need to be statically assigned and use 802.1x.

Richard Atkin · ‎05-29-2013

Are you JUST doing 1x? Not doing any Posture or CoA stuff? If so, can you paste your switch Config please? If you've built it using something like the TrustSec Universal Switch Configuration as a guide, then most of it will be superfluous. Pure .1x doesn't take much in terms of Config and certainly shouldn't care about the Client IP Address being static.

Sent from Cisco Technical Support iPad App

adrian.watmough · ‎05-31-2013

Hi

We are doing 802.1x for clients using the Windows supplicant. For clients not using supplicants we are using MAB. So the print servers and printers use MAB.

Extract of config...

aaa new-model

!

aaa authentication login default local

aaa authentication dot1x default group radius

aaa authorization network default group radius

aaa authorization auth-proxy default group radius

aaa accounting update periodic 5

aaa accounting dot1x default start-stop group radius

aaa accounting system default start-stop group radius

!

aaa server radius dynamic-author

client x server-key 7 x

!

aaa session-id common

clock summer-time BST recurring last Sun Mar 23:00 last Sun Oct 23:00

system mtu routing 1500

vtp mode transparent

authentication mac-move permit

ip routing

no ip domain-lookup

!

ip device tracking

!

dot1x system-auth-control

dot1x critical eapol

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

interface FastEthernet1/0/1

description ### Dot1x with MAB fallback ###

switchport mode access

switchport voice vlan 2

ip access-group ACL-DEFAULT in

srr-queue bandwidth share 10 10 60 20

priority-queue out

authentication event fail action next-method

authentication event server dead action authorize vlan 1

authentication event server alive action reinitialize

authentication host-mode multi-auth

authentication open

authentication order dot1x mab

authentication priority dot1x mab

authentication port-control auto

authentication periodic

authentication timer restart 0

authentication timer reauthenticate server

authentication violation restrict

mab

mls qos trust device cisco-phone

mls qos trust cos

auto qos voip cisco-phone

dot1x pae authenticator

dot1x timeout tx-period 5

spanning-tree portfast

service-policy input AutoQoS-Police-CiscoPhone

!

ip http server

ip http secure-server

!

ip access-list extended ACL-DEFAULT

remark Deny access to new network

deny ip any 172.x.x.x 0.0.0.255 log

remark Allow everything else to other networks

permit ip any any

!

ip radius source-interface Vlan2

logging esm config

logging host x transport udp port 20514

!

radius-server attribute 6 on-for-login-auth

radius-server attribute 8 include-in-access-req

radius-server attribute 25 access-request include

radius-server dead-criteria time 30 tries 3

radius-server vsa send accounting

radius-server vsa send authentication

!

radius server ISE-1

address ipv4 x auth-port 1645 acct-port 1646

key 7 x

!

radius server ISE-2

address ipv4 x auth-port 1645 acct-port 1646

key 7 x

!

Richard Atkin · ‎05-31-2013

Ok, so your config looks pretty standard from what I can see. What happens if you delete the following;

aaa server radius dynamic-author

client x server-key 7 x

>> Only needed if you're doing CoA, which you're not

ip device tracking

>> Not needed and is possibly what's causing the problem

ip http server

ip http secure-server

>> Only needed if you're doing URL re-directs or configuring the switch via a GUI, which you're not

What outputs do you get from a "Show Auth Session Interface Fa1/0/1" while all of this is going on?

Obviously also need to get rid of the "authentication open" statement when this is all up and running ok