Hello ISE experts, I am trying to solve an issue I have come across in my DOT1X design. I am looking to build a switching configuration that I can replicate across my company. I have been working in a lab designing different ideas and testing them which leads me to my reason I am posting here. I have come to the end my understanding of IBNS 2 and I am currently stuck with a choice, I will try and explain its complex and has many moving parts.
I am looking to have a switch configuration that will allow interface templates to be called/downloaded/applied by ISE using Authorization Profiles . I currently have this working and the interface templates are sourced locally on the switch and called from ISE by the policy sets and Authorization Policy profiles. This part is working great, and for most companies this is would be enough.
For my company we maintain a small IT foot print on ocean going vessels (Router/ASA/Switches/ESXi HA hosts/Endpoints etc.) This leads to periods of convergence and lost of upstream connectivity which is here IBNS 2.0 shines, it will hold the auth session on the ports during these up/downs very well. I have tested it and it works as designed, I couldn't be happier with this result as I thought I was going to have a local ISE node on every vessel (I manage 37 vessels) to keep the sessions active ($$$$$). So, we have ISE working nicely doing its part and IBSN 2.0 caching/holding sessions for periods when ISE can't get reached (AAA DOWN) situations. (See attached screenshot of my IBNS policy)
Now the final situation that most people won't consider is I need a way to auth the endpoints in a situation where AAA is down and the power on the switch has been cycled (refit/maintenance work on the vessel in a ship yard for example). Again IBNS 2.0 comes to the recue here again but with one problem.
With my current understanding you can statically assign a source template to the interrace config can call a service-template, interface-template or policy. I need one that would encompass many different vlans for cameras/phones/workstations/vendor hardware. I have able to get around this obstacle but creating a interface template by endpoint type and calling the VLAN in the service templates. This makes the ports configuration static based off the template assigned (keeping in mind that the AAA server not reachable in this failure scenario) this breaks the dynamic nature of service templates downloaded from ISE. Any port that has been moved accidently or on purpose gets the static config and not the dynamic one from ISE.
Let me explain:
This works if nobody ever moves cables on the switch physically or access to our AAA server is available, in our case we have non-IT staff often supporting the vessel when its at sea to act as IT support while its not possible to attend the vessel unit is docks. Cables get put back in the wrong ports and then this breaks it function.
So with all that said, does anybody know of a way I could create an generic IBNS template that would accommodate different vlans and allow the traffic to flow until the AAA server could be marked alive and re-auth the ports.
