Critical VLAN/"fail open" support when ISE PSN is unavailable
This thread regards ISE operation (and options) where a policy node becomes unavailable - so, in the case of either a single standalone ISE appliance (no HA), or more often a PSN becoming unavailable due to a WAN failure to a remote branch. The intended design for the deployment in question would involve using downloadable ACLs (dACLs) to provide differentiated access, specifically:
- A default ACL would be configured on 802.1x switchports would allow "limited" access (possibly Internet-only, but TBD).
- Successful 802.1x authentication would require 1) validation of a corporate certificate on the endpoint, and 2) successful AD login. This would provision a dACL providing full access.
ISE provides the option to configure Inaccessible Authentication Bypass to support RADIUS unavailability when 802.1x is configured on switch ports, but I'm needing to confirm how this works when using dACLs instead of VLANs for differentiated access. Specifically, if IAB is configured so that 802.1x ports (maybe all of them if all ports at the branch need to be functional) get placed into a "critical VLAN", will this override the default ACL on the port, which would no longer be applicable to the new VLAN anyway?
Simply put - we need to configure the deployment so that all endpoints fail open and have full access in the event of ISE/RADIUS becoming unavailable. (There'll be no local RADIUS and/or AD server in the event of WAN failure.) This will need to work although the 802.1x authentication/authorization will be using dACLs to determine access.
Thank you
I have a similar set up i.e. Pre-auth ACL applied on each port which is overwritten by a 'permit ip any any' DACL from the ISE server if a device successfully authenticates.
My understanding is that if the ISE PSN nodes become unavailable then if a Critical Vlan has been configured then devices will be placed into that vlan, however, the pre-auth ACL will still apply. Hence, if the pre-auth ACL only allows limited network connectivity, then in the event of all the ISE PSN nodes being unreachable then the device will only get the connectivity you allow via the pre-auth ACL.
This is obviously quite undesirable and so when I raised this with TAC they suggested that I add an EEM script to each switch so that if the ISE PSN nodes become unavailable then the EEM script will kick in and add a "1 permit ip any any' at the top of the pre-auth ACL.
Similar Messages
-
RADIUS-assigned VLANs are not supported when you enable multiple BSSIDs
Could someone please tell me is this 100% correct?
"RADIUS-assigned VLANs are not supported when you enable multiple BSSIDs"
Any ideas why? Does anyone have a way around this?
As a workaround I was thinking of setting up one broadcast SSID for guests and one non-broadcast SSID for RADIUS assigned VLANs, however i'd prefer to have both broadcast due to numerous Vista and PDA connection issues.Hi.
Thanks for your reply.
That is what I would like to do; have one SSID and assign the users to different VLANs based on policy.
I have all the VLANs and subinterfaces set up correctly and working independently, but the VLAN assigment does not seem to work correctly.
If I do a "show dot11 association all-client" the RADIUS attribute appears to have altered the VLAN, but the device has no connectivity and cannot DHCP.
This is with 1130AG in autonomous mode and Microsoft IAS as RADIUS.
Apparently there may be a problem with mbssid and RADIUS assigned VLANs. -
Reinitialize Critical VLAN Fail
Hi everybody.
I have a setup, containing 2x ACS 5.3 Servers and a 2960 Switch running Version 12.2(55)EX2.
When the ACS Servers are going down, we are authorizing client to the critical VLAN. This works just fine.
When the ACS Servers are coming up again, the reinitializing of the clients are not using the Authentication Priority as configured on the port.
We are using MAB and Dot1x (in this order) but have dot1x with highest priority, and the clients are getting a valid authentication from both MAB and dot1x.
When getting reinitialized after the ACS server is getting alive, the switch using the MAB only = First order and not First Priority.
Please find the Access Port configuration attached:
vlan 2
name NIRVANA
vlan 1250
name OFFICE
vlan 1750
name STAGING
interface GigabitEthernet0/1
description *** CLIENT 802.1x ***
switchport access vlan 1750
switchport mode access
authentication control-direction in
authentication event fail action authorize vlan 2
authentication event server dead action authorize vlan 1250
authentication event no-response action authorize vlan 2
authentication event server alive action reinitialize
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
mab
dot1x pae authenticator
dot1x timeout quiet-period 10
dot1x timeout supp-timeout 5
spanning-tree portfast
Did anyone else expirience simular limitations with the "server alive action" ?
Best Regards
Jarle- First off, your switch commands tell me you are using an old software on your switch, you should upgrade it firstly, there has been many bug fixed and enhancements to dot1x/mab in recent releases
- Your problem is probably that your guest dhcp client is timing out before you are done with dot1x and mab, susally adjusting tx-period to a lower number could help the time it takes before you reach the guest vlan, but could also have an impact on your machines that are running dot1x, you would have to try some different values. Also using Windows XP SP3 or Windows 7, helps as well on your dot1x machines, and finally using AnyConnect NAM supplicant will make it work fine without having problems when adjusting dot1x timers on your switch.
- With the new software i would go with default timers, maybe change tx-period to 5 secs, and then use the "authentication order mab dot1x" and "authentication priority mab dot1x", also having your guest vlan as your default vlan, will usually also solve the problem of guests having to do a new dhcp reqeust once aauthorized, however you could run into problems with stuff you wan't to use mab on. -
ISE Fail OPEN configuration/testing
Greetings,
We will be performing a live test of ISE Fail Open on our production system tomorrow night. When the policy nodes are all unavailable we want the switches to allow open access to all devices on all interfaces.
I have done some testing of this on an individual test switch by routing packets to the ISE policy nodes to null 0 to emulate a failure. It appears to be working well, but was hoping for more input from the community before my Live test tomorrow night.
First, I believe these to be the only commands needed to make this work correctly. Does anyone have any comment on this configuration? Am I missing anything? Do these timers seem OK? I'm wondering if the deadtime should be greater in case the nodes or the network connection are flapping?
Global Config:
radius-server dead-criteria time 5 tries 3
radius-server deadtime 5
dot1x critical eapol
Interface Config:
authentication event server dead action reinitialize vlan <normal data vlan>
authentication event server dead action authorize voice
authentication event server alive action reinitialize
Next, this is the behavior I am seeing after the policy nodes go down. Is this as it should be?
1. Absolutely nothing happens until an interface undergoes (re)authentication. All ports remain in current authentication/authorization state.
2. If an interface undergoes (re)authentication, the switch tries to reach one of the configured policy nodes. After 5 seconds there is a message the first node is dead. In another 5 seconds there is a mesage that the second node is dead.
3. After another ~20 seconds, the interface that was attempting (re)authentication goes into Critical Authorization:
TEST#sh auth sess int f1
Interface: FastEthernet1
MAC Address: 1234.5678.90ab
IP Address: Unknown
User-Name: UserName
Status: Authz Success
Domain: DATA
Oper host mode: multi-host
Oper control dir: in
Authorized By: Critical Auth
Vlan Policy: 2
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0A0A010B0000013D093F17CC
Acct Session ID: 0x0000072B
Handle: 0x5A00013E
Runnable methods list:
Method State
dot1x Authc Failed
mab Not run
Critical Authorization is in effect for domain(s) DATA
TEST#
All other interfaces remain in current mode, nothing on them changes so long as they don't attempt to (re)authenticate.
4. If another interface attempts to (re)authenticate, it goes into critical state immediately w/o trying to contact the dead policy nodes.
5. The switch will try every so often (every 5 minutes?) to reach the policy nodes. If one of them is up, all interfaces that were in critical state immediately transition to normal authc/authz modes. Normal timers apply, dot1x endpoints come up almost immediately, mab clients lose connectivity until dot1x times out.
To emulate a global fail for the organization, I plan to stop the ISE services on both of my policy nodes.
Thanks for any comments/insights/input.We appreciate the detailed scenario description, the question itself was very informative.
I used
authentication event server dead action authorize
critical VLAN=accessVLAN
instead of
authentication event server dead action reinitialize vlan -
Itunes wont open and when re-installed received this msg: Service Apple mob device failed to start. You have insufficent privileges to start system svc. Help?
Download Itunes from Apple.com, not from within Itunes.
Redo the install, following the below procedure. However, when you re-install Itunes, right click and run the install as administrator. For Win 7, you have to hold down the cntrl and shift keys when you right click and then "run as administrator" will be an option.
Go to Control Panel > Add or Remove Programs (Win XP) or Programs and Features (Vista, Win 7 & later)
Remove all of these items in the following order:
iTunes
Apple Software Update
Apple Mobile Device Support (if this won't uninstall move on to the next item)
Bonjour
Apple Application Support
Reboot, download iTunes, then reinstall, either using an account with administrative rights, or right-clicking the downloaded installer and selecting Run as Administrator.
The uninstall and reinstall process will preserve your iTunes library and settings, but ideally you would back up the library and your other important personal documents and data on a regular basis. See this user tip for a suggested technique.
Please note:
Some users may need to follow all the steps in whichever of the following support documents applies to their system. These include some additional manual file and folder deletions not mentioned above.
HT1925: Removing and Reinstalling iTunes for Windows XP
HT1923: Removing and reinstalling iTunes -
Good afternoon,
NAC offers ip admission command for fail open on a router. Is there an equivalent command for access switches pointing to a RADIUS server?
Situation:
Access switches have two RADIUS servers configured, one pointing to Load Balancer at Site A (with 6 PSNs behind) and the second RADIUS pointing at the LB at Site B (6 PSNs behind). If neither Site Load Balancers are reachable, how could we have the access switch fail-open and apply a ACL which would give access only to the Internet to the staff?
Thanks.
Cath.Cath,
You can actually leverage the command "authentication event dead action authorize vlan id" and dump the users on a vlan that will grant them access while the radius servers are unreachable.
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/15.0_2_se/configuration/guide/sw8021x.html#wp1194433
Thanks,
Tarik Admani
*Please rate helpful posts* -
I got the error -2147467262 "No such interface supported" when open an ActiveX automation reference to a proprietary DLL. I check the forum which suggested solutions related to comcat.dll and IE6.0. I also tried to re-reqister the dll by regsvr32.exe, still does not work. However, I did nto get any luck. I was told that the DLL support iDispatch interface and should work ok with ActiveX in labview. Any suggestions? I appreciate it.
Hello, Nandini,
I am using the WinXP and I am calling the DLL provided by Pirouette for their chemometrics software. I just solved the error -2147467262, but the new error comes out is :
Error code: -2147467259 Exception occured in IxAsObjs.CoSIMCAPredict.1, Language Server QueryInterface failed: No such interface supported.
Here is a few word for the problem from priouette:
" just a few more words that might help you understand the nature of the problem. your LabView client talks to AlgSuite.dll using IDispatch interfaces AlgSuite.dll communicates with the language server on an IUnknown interface.
Your client knows nothing about the internal workings of AlgSuite.AlgSuite communicating with objects that do not have IDispatch interfaces should be irrelevant to your client."
Since the VB demo works fine in my machine, so they though it is percular to labview. Any comments? I appreciate it.
LvvL -
after updating to Mavericks a window pops up saying "Power PC applications are no longer supported" when I try to open AppleWorks6, Microsoft Word, and Illustrator CS. How can I access my files. Secondly, is there a way to allow these programs to function?
MichelPM wrote:
I use those terms primarily for users who seem not too computer savvy as explaining and going through the procedures can be daunting to a user who doesn't do much more than just being able to install and use software on a basic or novice level.
That is why I wrote the "Installing Snow Leopard Server into Parallels for DUMMIES" guide, to give a literal step by step instruction set on how to use Parallels in this situation for a basic or novice level user on up!
http://forums.macrumors.com/showpost.php?p=17285039&postcount=564
Quite honestly, a step by step guide to install Windows into Parallels could be needed by some basic or novice users, as well!
My point is to not scare aware a user with a problem where a potential solution exists.
This is especially true because some of the few, but vocal, "naysayers" about this approach would use your statements to validate their continued criticism of it.
One guy in particular criticises every option other than upgrading to Mavericks compatible software, even when the OP clearly expresses a problem where that option does not exist! ... and he was an early and very vocal proponent of the "installing Snow Leopard into a new partition - 'dual-booting' solution" when Lion was first released back in 2011! -
I tried to update to the most recent version of itunes but the update failed. Now when I try to open itunes I get a dialog box telling me it can,t open because MSVCR80.dll is missing. I tried uninstalling and reinstalling itunes but I grt the same message. What can I do to fix this?
Solving MSVCR80 issue and Windows iTunes install issues.
Thanks to user turingtest2 for this solution.
Solving MSVCR80 issue and Windows iTunes install issues.
If the above doesn’t do the trick entirely, then use the instructions in the following as it applies to the version of Windows you are using:
HT1925: Removing and Reinstalling iTunes for Windows XP
HT1923: Removing and reinstalling iTunes for Windows Vista, Windows 7, or Windows 8
You may be required to boot into safe mode to complete the folder deletion process. -
Having installed Aperture, iPhoto won't open. When I try it fails with the message "You can't open the iPhoto.app because it may be damaged or incomplete. Any help please?
OK, fixed it. Found that iPhoto is now BACK in the App store.
Found iPhoto app in Finder and dragged it to Trash.
Downloaded iPhoto from App store and all now back working again.
Didnt expect to find iPhoto in App store as last time I looked it wasn't available.
Nige -
Firefox is not open, will not open, but when I try to update or uninstall it says I need to close Firefox first. This is a common problem, as I have seen many posts with the same problem. I don't know what else I can say about it, it is pretty straightforward.
http://kb.mozillazine.org/Kill_application
-
We just implemented ISE 802.1x in couple of our Cisco 4507 switches and we are seeing the following error in the log.
%HA_EM-3-LOG: NAC-RADIUS-FAIL-OPEN-DEAD: All RADIUS servers are dead changing the nac-enforcement ACL to permit all
I paste it in the Cisco error message decoder and came back with not found.
Thanks...Jimmy,
Srory for the late reply but it turned out to be we needed to add the missing auth data vlan command on the switch. After that the error went away.
Thanks for you input I do appreciate it.
Jack. -
NAS/NAM fail open/fail close modes
I need a quick small help, its not documented any place so I need a clarification.
I need this in terms of authentication through AD
1. If my NAS goes down/unreachable what will happen? But nam is up?
2. If my NAM goes down/unreachable and NAS is up what will happen?
3. If both NAS and NAM are both down?
If you can help me out on this point. I cant find any configuration guide stating fail open or fail closed modes of NAM and NASWe appreciate the detailed scenario description, the question itself was very informative.
I used
authentication event server dead action authorize
critical VLAN=accessVLAN
instead of
authentication event server dead action reinitialize vlan -
IPhone 5 iOS 7.1.4 Call failed every time when the other person hung up before me
iPhone 5 iOS 7.0.4 says Call failed every time when the other person hung up before me,
Is there anything I can do to about that please?Hey there Yonidawit,
It sounds like you are are getting a message saying that the call failed, when the person you are talking to hangs up. I have a few things to recommend here. First close all the open apps:
iOS: Force an app to close
http://support.apple.com/kb/ht5137
Double-click the Home button.
Swipe left or right until you have located the app you wish to close.
Swipe the app up to close it.
When you have done that restart the phone and test it out again:
iOS: Turning off and on (restarting) and resetting
http://support.apple.com/kb/ht1430
If that does not resolve it, try resetting your network settings:
Reset network settings by tapping Settings > General > Reset > Reset Network Settings. Note: This will reset all network settings including:
previously connected Wi-Fi networks and passwords
recently used Bluetooth accessories
VPN and APN settings
From: iOS: Troubleshooting Wi-Fi networks and connections
http://support.apple.com/kb/ts1398
If the issue persists, I would next backup your device to iTunes, and restore it:
iOS: How to back up and restore your content
http://support.apple.com/kb/HT1766
Thank you for using Apple Support Communities.
Regards,
Sterling -
ITunes fails to launch when iPhone 5 is connected
With the 11.1.3 (8) upgrade, iTunes fails to launch when my iPhone 5 is connected to my MacPro. iPhoto launches automatically, as expected. When I manually launch iTunes, it will recognize the phone, but I must manually sync it and back it up. When I select the iPhone, open SUMMARY and view Options (at the bottom of the page), Options, the box that says "Automatically sync when this iPhone is connected" is grayed-out and cannot be checked or selected. I've re-downloaded and re-installed iTunes, to no avail. Any tips on how to restore this basic functionality?
Hi SC Dad,
Thanks for using Apple Support Communities. This article has steps to take to enable iTunes to automatically launch when your iPhone is connected that may help:
iTunes for Mac won't open automatically when connecting device
http://support.apple.com/kb/TS3927
Cheers,
- Ari
Maybe you are looking for
-
How to connect my c660 to the tv
Hi guys really hope you can help (i know deep down you can its what you do) my problem is that i have bought this laptop c660 and my son has put some videos on it and ,we want to watch these videos on the tv,but i was told i need a vga to scart lead
-
Error while registering RMAN from primary to catalog database
Hi all, Here we have a 10g dataguard environment with db1(db_unique_name) as primary and db2(db_unique_name) as physical standby database. Also we configured one schema on a third machine as catalog database using following steps. The steps executed
-
How to control internet sharing via MAC access control list?
Hello, I know how to share the internet over the Wi-Fi. I know that there could be a password. But I need to control users by MAC addresses, just like in the routers. So, I want to give an access ONLY to a several MAC addresses which I'll write in so
-
Can I use a certificate that contains multiple DN's with Oracle Wallet Manager? When I speak of multiple DN's I mean the certificate knows about more than one DN (i.e. www.myplace1.com and www.myplace2.com)...
-
Difference between Business Partner and Customer Master repository
What is the difference between Business Partner and Customer Master repository ? Is the Business Partner repository to be used in case CRM is also in landscape ? or Customer master repository is good enough ? Sandesh