ISE WLC Port bounce with NAC

Im having trouble renewing the IP address after a VLAN change after NAC Agent finishes its posture, the flow is as follows:
1. Wireless client access into the network, is 802.1x
2. NAC Agent succesfully validates posture and Coa is issued
3. I see the new Vlan for that client on the WLC, however my captures indicate that no dhcp renewal is issued from the PC to the DHCP Server
This is no guest access so the option for renew the VLAN dhcp is not a feasible one
any comments will be gladly received.
Thanks!

Hello,
I went through your query and for the same I have found the link below which may help in solving it:-
http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_client_prov.html

Similar Messages

ISE and CoA 'port bounce' on WLC 7.2

Hi,
Im trying to get a vlan change done with CoA and MAB on a WLC 7.2 but it looks like it doese't disconnect the client, hence no new dhcp request.
Everything is working except 'port bounce'. I can see the new vlan in the controller, if i do a ifconfig /renew on the client it gets the new subnet and everything works as it should. If i remove the endpoint in ISE it swaps the vlan again on the controller, but no port bounce...
Is it possible to do this at all?
Page 244/245 in the Configuration guide - RADISUS NAC -Guidelines and Limitations says:
VLAN select is not supported
ISE 1.1.1
WLC 7.2
Thanks
Message was edited by: Mikael Gustafsson

Hi,
So in general there is no easy solution to do a vlan change for guest users on a wireless?
What Im trying to do is to separate the guest vlan from the rest of the network.
Were the user first get the vlan with the ISE interface in, with ACL for DNS and guest portal. And DHCP proxy from WLC.
After authentication he would get the guest vlan with only DHCP proxy and a default gw at the fw
I did try the CoA DHCP option on the guest portal and it's not a good solution, the user needs interact to accept an applet install , and it's (from what I understand from the UG) only working on windows. (and I didnt get it to work)
Thanks
Message was edited by: Mikael Gustafsson

NAC port bounce feature not working with 3750 12.2(50)SE1 IOS...

Guys, would like to know the support for NAC to cisco IOS 12.2(50)SE1 IPBase version (3750).
We have the port bounce feature in test enviroment on switch 3560 with advance IP services IOS 12.2(46)SE and it was working fine, but now we are facing problem with 3750.
Any clues...

Hi Tarik,
Thanks for your reply, SNMP settings are perfect since am able to manage the switch from CAM, i can change the port settings as well and yes mac-notification change is added automatically except bouncing the ports between vlans.
Am not sure but i suspect this could be the problem with IOS as it is IPBase, but in the test environment it was AdvanceIPservices and everything was perfect.

ISe with NAC agent pop up and Posture waiting

Hi,
I have ISE running ver 1.1.1.268. We limited access certain services before authuenticate with ACL-DEFAULT(given below) as per the Trustsec desgin guide.
Now the issue is that when you have ACL-DEFAULT on the port NAC agent doest not pop-up and doest not start the posture part and saying waiting for Posture validation. When the ACL-DEFAULT removed from the access port NAC agent popup and do the posture validation.
However we do not want user to get access to network before the authorization and that is the reason we use the ACL-DEFAULT.
Please can someone advise me how to achieve the above both task. Why the NAC agent does not popup and do the posture when ACL-DEFAULT there in the switch.
Here is what I have configured on ACL-DEFAULT.
ip access-list extended ACL-DEFAULT
remark DHCP
permit udp any eq bootpc any eq bootps
remark DNS
permit udp any any eq domain
permit tcp any any eq domain
permit udp any any eq 389
permit tcp any any eq 135
permit tcp any any eq 445
permit udp any any eq 445
permit tcp any any range 135 139
permit tcp any any eq 389
permit tcp any any eq 3268
permit icmp any any
remark PXE / TFTP
permit udp any any eq tftp
permit tcp any host 172.xx.xx.xx eq 8443 (ISE-Pri)
permit tcp any host 172.xx.xx.xx eq 8443 (ISE-Sec)
remark Drop all the rest
deny ip any any log
Appreciate if someone can give a solid resolution and explanation to this.

Hi Saurav,
We have already allowed those ports with another acl (ACL-POSTURE-REDIRECT). Our issue is not with the web nac agent.
The issue is with NAC agent installed on corperate PCs connecting via wired port. With the ACL-DEFAULT it does not pop-up and does not do the posturing, however once we removed the ACL-DEFAULT from the access port, everything works fine.
Since we do not want any user to access unwanted services before authorization we add this ACL on the access-port and as per the trustsec desgin this has to be there if you want to have ISE with closed mode.
thanks

Wireless WLC with NAC appliance

Hi,
We just design a wireless network and integrated with NAC appliance :
1. My customer have campus A & campus B, these 2 campus connected with 100Mbps FTTB link, these 2 campus are in different Layer 2 domain.
2. Both campus A & B have thin APs, but only campus A have WLC.
3. all wireless users must check by NAC CAS appliance, then access to wired intranet or internet.
Is the attached network diagram correct or not? Can you share your experiance to me?
Best Regards,

You could layer 3 Lwapp in Byuilding A and REAP for access points in Building B

RADIUS CoA Port Bounce query

Hello
I have a question relating to RADIUS CoA Port Bounce.
I'm planning to deploy 802.1x with ISE 1.3 to:
802.1x authenticate corporate desktop PCs (with anyconnect client installed for user and machine authentication) - on successful machine authentication, ISE will dynamically assign a VLAN
Profile Cisco IP phones
In order for an authenticated corporate desktop to pick up an IP address on its dynamically assigned VLAN I was thinking of using CoA Port Bounce. If this desktop was connecting through a successfully profiled Cisco IP phone, am I right in saying that the resulting Port Bounce will also affect the phone (phone will de-register from callmanager)?
Thanks
Andy

Hi Andy, if you are using PoE then a port-bounce the phone would definitely drop from the network and Call Manager. The phone would basically power down and then power back up.
Now with that being said you should keep in mind that a port-bounce would remove the existing dot1x session and will a new session would be initialized. Thus, the endpoint would end up starting at the original VLAN again and then getting the new VLAN after authorization :) So I guess what I am trying to say is that port-bounce is not the solution for this. Instead, you should consider:
1. Using dACLs instead of dynamic VLANs. That way you can have everyone in the same VLAN but use different dACLs to define network access
2. Continue to use dynamic VLANs but keep in mind that some "dumb" devices won't detect the VLAN change, thus not grabbing a new IP address. The good news is that most modern devices will detect the VLAN change and should grab a new IP. For instance, you should not have any issues with Windows 7 and newer devices
My recommendation is to go with option #1 though as that has always worked for me.
I hope this helps!
Thank you for rating helpful posts!

Virtual WLC Ports Confusion -or- ADDING ports to the vWLC

I am a struggling with configuring a virtual wireless controller (vWLC).
I am working with the newest vWLC, 8.0.100.0
I currently own an elderly 2504 WLC with 4 ports. (four physical interfaces on the box)
On this 2504, I use one port for the management of the WLC and for WLC to communicate with the APs.
The APs are on the same network as the 2504. The other port is the interface that all my wireless traffic from the clients use.
Now with this vWLC, the virtual machine has two network interface, but once I get to a point that I am able to login to the vWLC, I only see one 'port'. According to this posting, I am suppose to take the service port and point it too a dummy virtual switch or a 'Black Hole' https://supportforums.cisco.com/document/12098556/vwlc-getting-started-key-points-and-common-issues.
Okay, I've done this and it works, but it not what I am accustomed to.
I enjoy having the web console of the WLC and the AP on separate networks from the wireless clients.
To complicate things my desire is for this new vWLC and my 2504 to work together.
I want over time to migrate APs from the 2504 to the vWLC without re-addressing them.
Can I add "ports" to my vWLC controller? Do I need to rethink my wireless infrastructure?
I am confused and am seeking your help, advice, suggestions, opinions and flames.
Bryan Smith
Butler, Indiana

I think you need to re-look at your wireless design. I would prefer the 2504 over a vWLC, but that's me. I would not of separated the ports also on the WLC. No real reason to, to be honest. Keep AP's on a seperate subnet and the traffic to and from the WLC is tunneled using capwap. Breaking up ports was an old design to be honest and that was also done back them with the 4400's. You have to also look at the pro's and con's of FlexConnect AP's vs local mode. I never create an ap manager interface on the newer WLC's. I have always kept the dynamic ap manager in the managemt. Traffic is tunneled and you control user traffic when it leaves the WLC.
Scott

ISE, WLC Device Profiling

Hi, I hope someone can provide some advice/assistance. I am currently trialling ISE 1.1.1 on VM with a Cisco 5500 WLC 7.2.110.0. I have configured this setup so clients authenticate to the WLC via 802.1x and use the ISE as a AAA Server. I have setup this configuration so VLAN ID's can be pushed to clients based on their login credentials(from AD), this all works fine. I'd like to take this on a step further and differentiate users and their devices based on their device type, iPhone, iPad etc. I have enabled DHCP profiling on the WLC. I only seem to be able to identify a device based on their DHCP hostname, should it contain iPhone etc, is there another way I can get more information from the clients or their initial 802.1x communication? I want to use 802.1x as given the nature of the users connecting the VLAN push based on credentials is key to my possible deployment.
My second query is relating to VLAN pushing on a Flex Auth AP. I've got a remote site with some AP's, it is over a L3 connection. I have my WAP at this site registered to the WLC. Over my sites I have standard VLAN numbers and IP address ranges, site 1 is x.1.a.x, x.1.b.x etc, site 2 is x.2.a.x, x.2.b.x etc. What I would ideally like to do is push VLAN's to the Flex Auth WAP's so that users in site 2 get a site 2 IP address and can use local switching for printing and other local activities. Is this supported? I know it wasn't in H-REAP when I trialled ISE/WLC 4400 last year. I tried to configure this and it looks like users always get IP addresses from site 1.
Thanks for any advice/assistance.
Kenny.

Kenny,
For the first part of your question there is no more information you can get outside of the dhcp hostname (which will get you the info you are looking for) and the mac address (which only gets you to the Apple Device policy). If you do not want to perform any redirection, then your best bet is to use a span to span all the traffic over to the ISE node in order to span the http traffic in order to profile the devices using the http user agent string.
As far as your 2nd question- the flex auth aps do not support COA and arent a "supported network access device" from Cisco's webpage.
http://www.cisco.com/en/US/docs/security/ise/1.1.1/compatibility/ise_sdt.html#wp55038
However the APs do support dynamic vlan assignment. So once an endpoint connects to these APs you can set them on the vlan once, however if you are performing posturing and need coa to place them in another rule once a decision has been made then this is where the deployment will break.
http://www.cisco.com/en/US/products/ps11635/products_tech_note09186a0080b7f141.shtml
thanks,
Tarik Admani
*Please rate helpful posts*

ISE & WLC

Quick question:
If I deploy ISE+WLC and wlc is in HREAP / Flexconnect mode, the Access-Lists do not work, how am I supposed to posture clients at remote locations?
[cuz I was gonna put an ACL to block everything but dns/etc untill they get pastured)
Can I change VLAN as per user/device once they hit the AP? I am always talking about remote locations?

Tarik,
First thanks for your prompt reply, I haven't deployed it yet but here is what I my plans are:
Software Version 7.0.220.0, ISE 1.1.1, AP 3500, with local switching (it's called flexconnect now, HREAP legacy whatever)
No DACL, Redirect ACLs defined in the controller and in ISE I plan to use AIRSPACE ACL attribute (I've labbed this - but not in flexconnect) ---> This is all for pasturing.
If there is any other way of doing this (having clients denied any access and redirected to posture url) would be great.
Here is a cisco HREAP/FlexConnect Limitation.
Other H REAP Limitations
If you have configured a locally switched WLAN, then Access Control Lists (ACLs) do not work and are not supported. On a centrally switched WLAN, ACLs are supported.
Now, CoA is also a concern - if I have an AP<====TRUNK====>SWITCH----vlan/2/3/4, I want to be able to swap clients to different VLAN based on their user/device they are connecting, I am not sure if this will work on HREAP/Flexconnect mode and there is a slight change on the wording in the authorization policiy attribute in ISE 1.1.x, before it used to be just the vlan u want to set the clients to, now it has TAG ID which i am not sure what it is.
Thanks for your help, I hope my question is clear.

Authentication mac-move permit with NAC

Hi,
I have 2 switches with NAC configured on it. i also have "authentication mac-move permit" configured on my 2 switches that are connected togther. my understanding is authentication mac-move permit does not work with 802.1x enabled ports.
so i would like to verify i my understanding is correct that if i have authentication mac-move permit configured and a laptop moves to another port without logging off the switch will see that as a violation and block the user right?

anyone run into this before?

ISE reauthenticaiton in wireless with posture

Hi,
There is an issue which the wireless reauthentication in our environment. The posture feature has been used and everyone install the Cisco NAC agent. I found that if someone disconnect the wireless SSID, then reconnect the wireless SSID by authenticate the identity & compliant, can't be transfered to the correct the right SSID again. Can anyone help resolve this problem?

Please follow this link to configure your settings
https://techzone.cisco.com/t5/Identity-Services-Engine-ISE/Configuring-posture-services-with-the-Cisco-Identity-Services/ta-p/221702
also check this for trouble shoot
https://techzone.cisco.com/t5/Identity-Services-Engine-ISE/ISE-Posture-Agent-Profile-Parameter-Details-NACAgentCFG-xml/ta-p/239024

Wired WebAuth with NAC Guest Server

Hi,
I am trying to get wired WebAuth working with NAC Guest Server. In the switch_login.html file example, what should be changed for this line:
ngsOptions.actionUrl = https://1.1.1.1/;
Should this be an IP address on the switch? Shoul I have this pointing to the success.html page like this:
ngsOptions.actionUrl = "https://1.1.1.1/success.html";
When I log on, and accept the AUP, my browser just sits there trying to access Https://1.1.1.1/?redirect-url=blah blah blah
Thanks,
Peter

FYI,
In my case I WAS getting the switch_login.html web page being displayed, but after entering credentials and submitting the Acceptable Use Policy page, I did NOT 'see' any radius traffic between the switch (C2960S 12.2(55)SE3) and the ACS 5.3 radius server?!.
I used the sample .html docs that you can find on the NAC Guest Server in the 'samples' folder on that server. I used WCP app to copy them to my PC/laptop before modifying where relevant and copying to flash on switch and to the wireless 'hotspot' folders on the NGS.
I went through the following document in url below line by line, paragraph by paragraph and found that I had left out the following command in the configuration:
aaa authentication login default group radius
see doc at:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_1.99/WebAuth/WebAuth_Dep_Guide.html#wp392553
So I added it in and I am now seeing the radius debug traffic being redirected to the ACS by the switch when a user submits the credentials.
aaa new-model
aaa authentication login default group radius
aaa authentication login VTY-USER-LOGIN local
aaa authentication dot1x default group radius
aaa authorization console
aaa authorization exec EXEC-LOCAL local
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
with debug radius enabled:
Feb 1 13:36:09 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/4, changed state to down
TEST-802.1X#
Feb 1 13:36:10 PST: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/4, changed state to down
TEST-802.1X#
Feb 1 13:36:18 PST: %AUTHMGR-5-START: Starting 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
TEST-802.1X#
Feb 1 13:36:20 PST: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/4, changed state to up
Feb 1 13:36:21 PST: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/4, changed state to up
TEST-802.1X#
Feb 1 13:36:27 PST: %DOT1X-5-FAIL: Authentication failed for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID
Feb 1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-FAILOVER: Failing over from 'dot1x' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-5-START: Starting 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27.367 PST: RADIUS/ENCODE(0000058E):Orig. component type = DOT1X
Feb 1 13:36:27.367 PST: RADIUS(0000058E): Config NAS IP: 10.167.64.74
Feb 1 13:36:27.367 PST: RADIUS/ENCODE(0000058E): acct_session_id: 1421
Feb 1 13:36:27.367 PST: RADIUS(0000058E): sending
Feb 1 13:36:27.367 PST: RADIUS(0000058E): Send Access-Request to 10.167.77.70:1645 id 1645/14, len 211
Feb 1 13:36:27.372 PST: RADIUS: authenticator 2E F0 62 2D 43 D9 7D 2A - 7C 88 0A 52 B9 6E 78 A8
Feb 1 13:36:27.372 PST: RADIUS: User-Name           [1]   14 "848f69f0fcc7"
Feb 1 13:36:27.372 PST: RADIUS: User-Password       [2]   18 *
Feb 1 13:36:27.372 PST: RADIUS: Service-Type        [6]   6   Call Check                [10]
Feb 1 13:36:27.372 PST: RADIUS: Framed-MTU          [12] 6   1500
Feb 1 13:36:27.372 PST: RADIUS: Called-Station-Id   [30] 19 "20-37-06-C8-68-84"
Feb 1 13:36:27.372 PST: RADIUS: Calling-Station-Id [31] 19 "84-8F-69-F0-FC-C7"
Feb 1 13:36:27.372 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:27.372 PST: RADIUS:   11 20 B4 9A B6 E2 56 30 AC EC 43 CD 17 13 3E 14             [ V0C>]
Feb 1 13:36:27.372 PST: RADIUS: EAP-Key-Name        [102] 2   *
Feb 1 13:36:27.372 PST: RADIUS: Vendor, Cisco       [26] 49
Feb 1 13:36:27.372 PST: RADIUS:   Cisco AVpair       [1]   43 "audit-session-id=0AA7404A0000054E16335518"
Feb 1 13:36:27.372 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:27.372 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:27.372 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:27.372 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:27.372 PST: RADIUS(0000058E): Started 5 sec timeout
Feb 1 13:36:27.377 PST: RADIUS: Received from id 1645/14 10.167.77.70:1645, Access-Reject, len 38
Feb 1 13:36:27.377 PST: RADIUS: authenticator 68 CE 3D C8 C3 BC B2 69 - DB 33 F5 C0 FF 30 D6 33
Feb 1 13:36:27.377 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:27.377 PST: RADIUS:   82 3D 31 0A C7 A2 E0 62 D5 B7 6B 26 B8 A0 0B 46            [ =1bk&F]
Feb 1 13:36:27.377 PST: RADIUS(0000058E): Received from id 1645/14
Feb 1 13:36:27 PST: %MAB-5-FAIL: Authentication failed for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'no-response' from 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-FAILOVER: Failing over from 'mab' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-5-START: Starting 'webauth' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-7-RESULT: Authentication result 'success' from 'webauth' for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27 PST: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (848f.69f0.fcc7) on Interface Gi1/0/4 AuditSessionID 0AA7404A0000054E16335518
Feb 1 13:36:27.933 PST: RADIUS/ENCODE(0000058E):Orig. component type = DOT1X
Feb 1 13:36:27.933 PST: RADIUS(0000058E): Config NAS IP: 10.167.64.74
Feb 1 13:36:27.933 PST: RADIUS(0000058E): sending
Feb 1 13:36:27.933 PST: RADIUS(0000058E): Send Accounting-Request to 10.167.77.70:1646 id 1646/151, len 100
Feb 1 13:36:27.933 PST: RADIUS: authenticator D0 F0 04 F3 A5 08 90 BE - A9 07 8D 32 1B 0E 93 AC
Feb 1 13:36:27.933 PST: RADIUS: Acct-Session-Id     [44] 10 "0000058D"
Feb 1 13:36:27.933 PST: RADIUS: Framed-IP-Address   [8]   6   10.167.72.52
Feb 1 13:36:27.933 PST: RADIUS: Acct-Authentic      [45] 6   RADIUS                    [1]
Feb 1 13:36:27.933 PST: RADIUS: Acct-Status-Type    [40] 6   Start                     [1]
Feb 1 13:36:27.933 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:27.933 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:27.933 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:27.933 PST: RADIUS: Service-Type        [6]   6   Framed                    [2]
Feb 1 13:36:27.933 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:27.933 PST: RADIUS: Acct-Delay-Time     [41] 6   0
TEST-802.1X#
Feb 1 13:36:27.938 PST: RADIUS(0000058E): Started 5 sec timeout
Feb 1 13:36:27.938 PST: RADIUS: Received from id 1646/151 10.167.77.70:1646, Accounting-response, len 20
Feb 1 13:36:27.938 PST: RADIUS: authenticator C2 DC 8D C7 B1 35 67 D9 - 28 2B 56 E4 4A 1E AD 65
At this point the user enters the credentials on the switch_login.html page and the clicks Submit on the Acceptable Use Policy splash page.
TEST-802.1X#
Feb 1 13:36:41.413 PST: RADIUS/ENCODE(0000058F):Orig. component type = AUTH_PROXY
Feb 1 13:36:41.413 PST: RADIUS(0000058F): Config NAS IP: 10.167.64.74
Feb 1 13:36:41.413 PST: RADIUS/ENCODE(0000058F): acct_session_id: 1422
Feb 1 13:36:41.413 PST: RADIUS(0000058F): sending
Feb 1 13:36:41.413 PST: RADIUS(0000058F): Send Access-Request to 10.167.77.70:1645 id 1645/15, len 176
Feb 1 13:36:41.413 PST: RADIUS: authenticator 6D 34 7E D6 34 B5 CB AC - 09 1F AC 5A 34 97 7D 6B
Feb 1 13:36:41.413 PST: RADIUS: User-Name           [1]   11 "testuser1"
Feb 1 13:36:41.413 PST: RADIUS: User-Password       [2]   18 *
Feb 1 13:36:41.413 PST: RADIUS: Calling-Station-Id [31] 14 "ip|G
Feb 1 13:36:41.413 PST: RADIUS: Service-Type        [6]   6   Outbound                  [5]
Feb 1 13:36:41.413 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.413 PST: RADIUS:   F8 4D 85 64 05 5E C9 1D D8 11 B2 A3 1A 3A 76 E0             [ Md^:v]
Feb 1 13:36:41.413 PST: RADIUS: Vendor, Cisco       [26] 49
Feb 1 13:36:41.418 PST: RADIUS:   Cisco AVpair       [1]   43 "audit-session-id=0AA7404A0000054E16335518"
Feb 1 13:36:41.418 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:41.418 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:41.418 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:41.418 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:41.418 PST: RADIUS(0000058F): Started 5 sec timeout
Feb 1 13:36:41.424 PST: RADIUS: Received from id 1645/15 10.167.77.70:1645, Access-Accept, len 173
Feb 1 13:36:41.424 PST: RADIUS: authenticator 28 48 DE B5 1A 0A 71 5A - 3B 8B 7A 12 FB EA 01 58
Feb 1 13:36:41.424 PST: RADIUS: User-Name           [1]   11 "testuser1"
Feb 1 13:36:41.424 PST: RADIUS: Class               [25] 28
Feb 1 13:36:41.424 PST: RADIUS:   43 41 43 53 3A 78 62 63 2D 61 63 73 2F 31 31 36 [CACS:xbc-acs/116]
Feb 1 13:36:41.424 PST: RADIUS:   34 37 33 32 33 39 2F 31 36 36        [ 473239/166]
Feb 1 13:36:41.424 PST: RADIUS: Session-Timeout     [27] 6   3600
Feb 1 13:36:41.424 PST: RADIUS: Termination-Action [29] 6   1
Feb 1 13:36:41.424 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.424 PST: RADIUS:   10 80 26 5D 02 C5 15 0C A8 16 AA 35 14 C9 4F 14              [ &]5O]
Feb 1 13:36:41.424 PST: RADIUS: Vendor, Cisco       [26] 19
Feb 1 13:36:41.429 PST: RADIUS:   Cisco AVpair       [1]   13 "priv-lvl=15"
Feb 1 13:36:41.429 PST: RADIUS: Vendor, Cisco       [26] 65
Feb 1 13:36:41.429 PST: RADIUS:   Cisco AVpair       [1]   59 "ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-GuestACL-4eefc9a0"
Feb 1 13:36:41.429 PST: RADIUS(0000058F): Received from id 1645/15
Feb 1 13:36:41.439 PST: RADIUS/ENCODE(0000058F):Orig. component type = AUTH_PROXY
Feb 1 13:36:41.439 PST: RADIUS(0000058F): Config NAS IP: 10.167.64.74
Feb 1 13:36:41.439 PST: RADIUS(0000058F): sending
Feb 1 13:36:41.439 PST: RADIUS/ENCODE(00000000):Orig. component type = INVALID
Feb 1 13:36:41.444 PST: RADIUS(00000000): Config NAS IP: 10.167.64.74
Feb 1 13:36:41.444 PST: RADIUS(00000000): sending
Feb 1 13:36:41.450 PST: RADIUS(0000058F): Send Accounting-Request to 10.167.77.70:1646 id 1646/152, len 119
Feb 1 13:36:41.450 PST: RADIUS: authenticator 23 E3 DA C3 06 5B 37 20 - 67 E2 96 C5 90 1C 71 33
Feb 1 13:36:41.450 PST: RADIUS: Acct-Session-Id     [44] 10 "0000058E"
Feb 1 13:36:41.450 PST: RADIUS: Calling-Station-Id [31] 14 "10.167.72.52"
Feb 1 13:36:41.450 PST: RADIUS: User-Name           [1]   11 "testuser1"
Feb 1 13:36:41.450 PST: RADIUS: Acct-Authentic      [45] 6   RADIUS                    [1]
Feb 1 13:36:41.455 PST: RADIUS: Acct-Status-Type    [40] 6   Start                     [1]
Feb 1 13:36:41.455 PST: RADIUS: NAS-Port-Type       [61] 6   Ethernet                  [15]
Feb 1 13:36:41.455 PST: RADIUS: NAS-Port            [5]   6   50104
Feb 1 13:36:41.455 PST: RADIUS: NAS-Port-Id         [87] 22 "GigabitEthernet1/0/4"
Feb 1 13:36:41.455 PST: RADIUS: Service-Type        [6]   6   Outbound                  [5]
Feb 1 13:36:41.455 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:41.455 PST: RADIUS: Acct-Delay-Time     [41] 6   0
Feb 1 13:36:41.455 PST: RADIUS(0000058F): Started 5 sec timeout
Feb 1 13:36:41.455 PST: RADIUS(00000000): Send Access-Request to 10.167.77.70:1645 id 1645/16, len 137
Feb 1 13:36:41.455 PST: RADIUS: authenticator 02 B0 50 47 EE CC FB 54 - 2A B6 14 23 63 86 DE 18
Feb 1 13:36:41.455 PST: RADIUS: NAS-IP-Address      [4]   6   10.167.64.74
Feb 1 13:36:41.455 PST: RADIUS: User-Name           [1]   31 "#ACSACL#-IP-GuestACL-4eefc9a0"
Feb 1 13:36:41.455 PST: RADIUS: Vendor, Cisco       [26] 32
Feb 1 13:36:41.455 PST: RADIUS:   Cisco AVpair       [1]   26 "aaa:service=ip_admission"
Feb 1 13:36:41.455 PST: RADIUS: Vendor, Cisco       [26] 30
Feb 1 13:36:41.455 PST: RADIUS:   Cisco AVpair       [1]   24 "aaa:event=acl-download"
Feb 1 13:36:41.455 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.455 PST: RADIUS:   15 EC 10 E7 2F 67 33 DD BC B5 AE 11 E3 C3 19 E1               [ /g3]
Feb 1 13:36:41.455 PST: RADIUS(00000000): Started 5 sec timeout
Feb 1 13:36:41.455 PST: RADIUS: Received from id 1646/152 10.167.77.70:1646, Accounting-response, len 20
Feb 1 13:36:41.455 PST: RADIUS: authenticator AB 0F 81 95 71 A9 61 E0 - 5B B5 D3 2E 8D A2 68 98
Feb 1 13:36:41.460 PST: RADIUS: Received from id 1645/16 10.167.77.70:1645, Access-Accept, len 560
Feb 1 13:36:41.460 PST: RADIUS: authenticator 64 53 94 79 CF CD 05 B0 - ED 12 5C 5B A0 AB 4F FA
Feb 1 13:36:41.460 PST: RADIUS: User-Name           [1]   31 "#ACSACL#-IP-GuestACL-4eefc9a0"
Feb 1 13:36:41.460 PST: RADIUS: Class               [25] 28
Feb 1 13:36:41.460 PST: RADIUS:   43 41 43 53 3A 78 62 63 2D 61 63 73 2F 31 31 36 [CACS:xbc-acs/116]
Feb 1 13:36:41.460 PST: RADIUS:   34 37 33 32 33 39 2F 31 36 38        [ 473239/168]
Feb 1 13:36:41.460 PST: RADIUS: Message-Authenticato[80] 18
Feb 1 13:36:41.460 PST: RADIUS:   A1 E6 37 EB 60 3A 28 35 92 56 C5 A9 27 7D 2C E9         [ 7`:(5V'},]
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 38
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   32 "ip:inacl#1=remark **Allow DHCP"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 57
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   51 "ip:inacl#2=permit udp any eq bootpc any eq bootps"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 37
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   31 "ip:inacl#3=remark **Allow DNS"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 47
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   41 "ip:inacl#4=permit udp any any eq domain"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 61
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   55 "ip:inacl#5=remark **Deny access to Corporate Networks"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 53
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   47 "ip:inacl#6=deny ip any 10.0.0.0 0.255.255.255"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 45
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   39 "ip:inacl#7=remark **Permit icmp pings"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 38
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   32 "ip:inacl#8=permit icmp any any"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 50
TEST-802.1X#
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   44 "ip:inacl#9=remark **Permit everything else"
Feb 1 13:36:41.460 PST: RADIUS: Vendor, Cisco       [26] 37
Feb 1 13:36:41.460 PST: RADIUS:   Cisco AVpair       [1]   31 "ip:inacl#10=permit ip any any"
Feb 1 13:36:41.465 PST: RADIUS(00000000): Received from id 1645/16
TEST-802.1X#
TEST-802.1X#
TEST-802.1X#
interface config looks like:
interface GigabitEthernet1/0/4
description **User/IPphone/Guest
switchport access vlan 702
switchport mode access
switchport voice vlan 704
ip access-group PRE-AUTH in
srr-queue bandwidth share 1 30 35 5
queue-set 2
priority-queue out
authentication event fail action next-method
authentication event server dead action authorize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab webauth
authentication priority dot1x mab webauth
authentication port-control auto
authentication fallback WEB_AUTH_PROFILE
mab
mls qos trust device cisco-phone
mls qos trust cos
dot1x pae authenticator
dot1x timeout tx-period 3
auto qos voip cisco-phone
spanning-tree portfast
service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY

Configure ADSSO with NAC

Hi Guys,
I need to configure my Cisco NAC (ADSSO) with Windows Server 2008 R2 Enterprise (64). For now we only can ADSSO with Windows XP. Windows 7 still using normal authentication. We are using KTPass to authenticate with NAC server. We are using Windows 2008 at 2003 functional level.
Anyone can help me regarding this?
Best Regards,
Azfar

Azfar,
There are a few things that you need to check/perform when configuring ADSSO. First you must check that proper version of ktpass is installed on the machine you generate the kerberos ticket for the CAS service account (I recommend using a different account for this just so you can roll back, also you can not run ktpass successfully more than once for the same service account, please delete the account first, recreate the account and try again):
http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/agntsprt.html#wp228565
After this you need to follow the steps to generate the kerberos ticket:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1301231
Here is an example more specific to your environment:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1277452
Since you are running in a mixed environment you must enable additional algorithms:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cas/s_adsso.html#wp1277452
If it fails, then purchase ISE.
Thanks,
Tarik Admani
*Please rate helpful posts*

Changing port configuration with Event Manager

Hello,
I'm trying to change the configuration of a port when the port goes down with EEM.
So when an flex connect access-point is disconnected the port becomes an access-port.
I don't want to use the MAC address.
Does anyone has experience with this.
Below is the applet I'm using.
Thanks in advanced,
Michel
event manager applet CONFIG-ACCESS-PORT
event neighbor-discovery interface regexp "(FastEthernet[0-9]\/[0-9]+)" cdp delete
action 100 regexp "(AIR-LAP)" "$_nd_cdp_platform" value
action 110 if $_regexp_result eq "1"
action 200 cli command "enable"
action 210 cli command "config t"
action 220 cli command "interface $_nd_local_intf_name"
action 240 cli command "switchport mode access"
action 250 cli command "switchport access vlan 20"
action 260 cli command "no switchport trunk encapsulation dot1q"
action 270 cli command "no switchport trunk native vlan 88"
action 280 cli command "no switchport trunk allowed vlan 88,100"
action 290 cli command "spanning-tree portfast"
action 400 syslog msg "EXECUTED EEM APPLET FOR ACCESS-PORT interface $_nd_local_intf_name"
action 500 cli command "end"
action 510 cli command "copy run start"

Hi Evan,
For sure! There is a really good example on the configuration guide, and assciated caveats.
http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/consolidated/b_cg74_CONSOLIDATED_chapter_0100011.html
Benefits for using LAG is increased bandwidth, and redundancy - especially if you have the two (or more in the case of a 5508 WLC) ports connected to different physical switches, eg a 3750 stack.
Best,
Evan

Cisco 2960 plus, works with NAC?

hi Team, I have a catalyst 2960 Plus, running IOS 15.0(2)EZ, I'm trying sync this device with my Cisco NAC, but I can't and NAC shows this message: NAC: Unable to control 180.124.143.4
NAC version 4.8
So, reviewing the compatibility matrix for NAC and switch, I can´t find the 2960 Plus series.
Is this switch compatible with NAC??
Thanks in advance,
Victor Lenis

Thanks for your reply , I know what's MAB , if you read my explanation again , i mentioned that the user is authenticated in the guest portal which mean that I have web authentication , and it is working fine .. The only issue is that I can not use the vendor1 username as part of authorization condition and this is because the switch is not sending the radius attribute type 1 to the ISE , thus , on the ise authentication log the MAC address of the client machine is shown as a username not the actual username ( vendor1)
as I mentioned also , I have exactly the same setup with ise 1.2 and 3750 switch and I do not have this issue .I experience this with 2960x only .

ISE WLC Port bounce with NAC

Similar Messages

Maybe you are looking for