Open mode (monitor mode) with ise and catalyst switches

Question

Hi There,
Anyone know if the following observation is correct ?
From the TrustSec 2.1 "Monitor Mode" guide i get the idea that Open mode, is not really as zero impact in a data gathering part of an ISE deployment is a was expecting. The guide describes using Profiling to authorize Cisco IP phones for the Voice VLAN.
- Does this mean that regular methods like using CDP won't work to for this once i enable dot1x on an access switch port interface ?
- And that i will need to figure out which ports should be set for multi-domain (phone+pc), and which should be set for multi-auth(possibly multiple devices on one port) during the open mode period ?
Regards
Jan

Answer 1

Hello Jan-
Below is my input to your questions:
From the TrustSec 2.1 "Monitor Mode" guide i get the idea that Open mode, is not really as zero impact in a data gathering part of an ISE deployment is a was expecting.
Yes, a device is still allowed on the network even if it fails all authentication methods (MAB, 802.1x, etc). Basically you use monitor mode to perform discovery and see what would have been blocked had ISE been deployed in production.
The guide describes using Profiling to authorize Cisco IP phones for the Voice VLAN.
Yes, you can use profiling to do this. Keep in mind that you will need advanced licensing for this. Otherwise, you can either use MAB with static MACs imported/entered in the local database or EAP-TLS with phone certificates
- Does this mean that regular methods like using CDP won't work to for this once i enable dot1x on an access switch port interface ?
CDP will still work, in fact some of the profiling happens thanks to CDP, however, the device will simply not going to be allowed to get on the network and the Voice VLAN unless it passes authentication/authorization.
- And that i will need to figure out which ports should be set for multi-domain (phone+pc), and which should be set for multi-auth(possibly multiple devices on one port) during the open mode period ?
This really depends on how secure you want your network to be
Hope this helps!
Thank you for rating!