Configure 802.1X with MAB fallback on a switch port using RADIUS

Tasks

1. Define ISE1 as a RADIUS server in a server group, sourcing requests from Vlan99.
2. Create AAA method lists for 802.1X authentication, network authorization and accounting.
3. Send the RADIUS attributes ISE expects and enable change of authorization from ISE1.
4. Enable 802.1X globally.
5. Configure the access ports for multi-auth with 802.1X first and MAB as fallback, reaching MAB within about 30 seconds.
6. Keep the ports usable in VLAN 10 if ISE is unreachable, and reauthenticate when it returns.

Solution

1. 1RADIUS server and groupASW2

   aaa new-model
   !
   radius server ISE1
    address ipv4 10.10.50.11 auth-port 1812 acct-port 1813
    key Rad1usKey2026
   !
   aaa group server radius ISE-RADIUS
    server name ISE1
    ip radius source-interface Vlan99

   State the ports explicitly. Older IOS defaults used 1645 and 1646, and a mismatch looks exactly like a dead server.

2. 2Method listsASW2

   aaa authentication dot1x default group ISE-RADIUS
   aaa authorization network default group ISE-RADIUS
   aaa accounting dot1x default start-stop group ISE-RADIUS

   aaa authorization network is what allows the switch to apply the VLAN or downloadable ACL that ISE returns.

3. 3Attributes, dead detection and CoAASW2

   radius-server attribute 6 on-for-login-auth
   radius-server attribute 8 include-in-access-req
   radius-server attribute 25 access-request include
   radius-server vsa send authentication
   radius-server vsa send accounting
   radius-server dead-criteria time 5 tries 3
   radius-server deadtime 15
   !
   aaa server radius dynamic-author
    client 10.10.50.11 server-key Rad1usKey2026
   !
   dot1x system-auth-control

   Attribute 8 sends the client's IP, and the Cisco VSAs carry the audit session ID that ISE uses to match accounting and CoA to the session. dead-criteria and deadtime decide how fast the switch gives up on an unresponsive server and how long before it tries again.

4. 4Access port templateASW2

   interface range GigabitEthernet1/0/1 - 46
    switchport mode access
    switchport access vlan 10
    authentication host-mode multi-auth
    authentication order dot1x mab
    authentication priority dot1x mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    authentication event server dead action authorize vlan 10
    authentication event server alive action reinitialize
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 10
    spanning-tree portfast

   With tx-period 10 and the default two retries, a device that never answers EAPOL reaches MAB after about 30 seconds instead of about 90. These are the classic authentication commands; on current IOS-XE you can convert them to the newer policy style with authentication convert-to new-style.

Verify

ASW2# show aaa servers
RADIUS: id 1, priority 1, host 10.10.50.11, auth-port 1812, acct-port 1813, hostname ISE1
     State: current UP, duration 3720s, previous duration 0s
     Dead: total time 0s, count 0

ASW2# show authentication sessions
Interface                MAC Address    Method  Domain  Status Fg  Session ID
--------------------------------------------------------------------------------------------
Gi1/0/10                 0050.5689.7c41 dot1x   DATA    Auth        0A63000C000000125F3A9C10
Gi1/0/22                 0026.73aa.10f2 mab     DATA    Auth        0A63000C000000135F3A9D44

ASW2# show authentication sessions interface GigabitEthernet1/0/10 details
            Interface:  GigabitEthernet1/0/10
          MAC Address:  0050.5689.7c41
         IPv4 Address:  10.10.10.61
            User-Name:  host/pc1.corp.example.com
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
     Oper control dir:  both
    Common Session ID:  0A63000C000000125F3A9C10

Method status list:
       Method           State
        dot1x           Authc Success

Mistakes people make

• Forgetting dot1x system-auth-control. The interface commands are accepted but nothing authenticates.
• Leaving out aaa authorization network, so the switch ignores the VLAN or dACL that ISE returns.
• No mab on the template, so printers and cameras never get on once the port is closed.
• Default timers, which leave MAB devices waiting about 90 seconds, long enough for some to give up on DHCP.
• RADIUS requests sourced from an address ISE does not know as a network device. ISE drops them and the switch marks the server dead.
• No server-dead action, which turns an ISE outage into a floor-wide outage.