MAB permit after valid 1x Session

[Oliver Laue]

Hi,

most of you know a certain behavior. A Windows machine which was authenticated via dot1x sets it's NIC to WOL on shutdown and a MAB session is initiated. But with newer devices Mac addresses are in most cases from the Dock or an USB dongle. This leads to a problem where you can't whitelist the MAC and the switch retries the authentication which leads to a lot of failed auth messages in the ISE.

My question is, how to write a rule which checks if the Mac was previously authenticated via 802.1x to set the Client in some kind of deployment vlan or permit him a client vlan with an dACL until it boots and starts a new 1x session.

There are a couple of attributes but they can't be used in Auth or AuthZ rules. 

[Oliver Laue]

I think I answered my own question.

MAR (Machine Access Restriction) should achieve this.

In your Active Directory Identity Source under Advanced the "Enable Machine Access Restriction" must be checked and an aging timer should be set (12h set for test purposes).

If you have multiple ISE Nodes they should be in a Node group and the option MAR Cache Distribution has to be enabled.

Now you can create a rule like this. (rule in monitor for test purpose)