First successful authorization ISE and then failure (MAB)

Hello

ISE 1.1.1 and switch using 3650 12.2 (55) SE6.

I have a client (computer) that needs to be authenticated with MAB and then to the port of the switch must be asigned a DACL and VLAN 90 list. I get

'Authorization successful' but directly after it fails and I cannot understand why. ISE shows only the authentication successful under "Authenticaions Live".

As you can se the rating below 802. 1 x fails, as it should be, and then pass the MAB, conditioned the VLAN and then fails:

0002SWC002 (config) #int fa0/13

0002SWC002(Config-if) #shut

0002SWC002(Config-if) #.

7 jan 13:26:59.640: % LINK-5-CHANGED: Interface FastEthernet0/13, changed state down administratively

7 jan 13:27:00.647: % LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, changed state down

0002SWC002(Config-if) #no close

0002SWC002(Config-if) #.

7 jan 13:27:19.689: % LINK-3-UPDOWN: Interface FastEthernet0/13, changed State to down

7 jan 13:27:22.063: % LINK-3-UPDOWN: Interface FastEthernet0/13, changed State to

7 jan 13:27:22.776: % AUTHMGR-5-START: start "dot1x' for the client (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID 0A0005FC00000

020D7C192D1

7 jan 13:27:23.070: % LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, changed State to

7 jan 13:27:51.054: % DOT1X-5-FAIL: failure of authentication for the client (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID

7 jan 13:27:51.054: % AUTHMGR-7-RESULT: authentication result in 'no response' of 'dot1x' for the customer (f04d.a223.8f43) on the Interface

0/13 AuditSessionID 0A0005FC00000020D7C192D1

7 jan 13:27:51.054: % AUTHMGR-7-FAILOVER: failover "dot1x' for the client (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID 0

A0005FC00000020D7C192D1

7 jan 13:27:51.054: % AUTHMGR-5-START: start "mab" for the client (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID 0A0005FC0000002

0D7C192D1

7 jan 13:27:51.088: % MAB-5-SUCCESS: authentication successful for the client (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID A 0, 0005

FC00000020D7C192D1

7 jan 13:27:51.088: % AUTHMGR-7-RESULT: result of the authentication 'success' of 'mab' for the client (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID 0A0005FC00000020D7C192D1

7 jan 13:27:51.088: % AUTHMGR-5-VLANASSIGN: 90 VLAN assigned to the Interface Fa0/13 AuditSessionID 0A0005FC00000020D7C192D1

7 jan 13:27:51.096: % EMP-6-POLICY_REQ: IP 0.0.0.0. MAC f04d.a223.8f43 | AuditSessionID 0A0005FC00000020D7C192D1 | AUTHTYPE DOT1X | EVENTS APPLY

7 jan 13:27:51.096: % EMP-6-IPEVENT: IP 0.0.0.0. MAC f04d.a223.8f43 | AuditSessionID 0A0005FC00000020D7C192D1 | AUTHTYPE DOT1X | EVENT

IP-WAIT

7 jan 13:27:51.255: % AUTHMGR-5-SUCCESS: authorization succeeded for client (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID A 0, 00

05FC00000020D7C192D1

7 jan 13:27:52.027: % EMP-6-IPEVENT: IP 10.90.5.1 | MAC f04d.a223.8f43 | AuditSessionID 0A0005FC00000020D7C192D1 | AUTHTYPE DOT1X | ACE double entry of IP-ASSIGNMENTReplacing EVENT for the host 10.90.5.1

7 jan 13:27:52.036: % AUTHMGR-5-FAIL: failed authorization for customer (f04d.a223.8f43) on the Interface Fa0/13 AuditSessionID 0A0005FC00

000020D7C192D1

7 jan 13:27:52.036: % EMP-6-POLICY_REQ: IP 10.90.5.1 | MAC f04d.a223.8f43 | AuditSessionID 0A0005FC00000020D7C192D1 | AUTHTYPE DOT1X | REMOVAL OF THE EVENT

After that the process starts all over again.

It is the switch port configuration:

interface FastEthernet0/13

Description data/VoIP

switchport mode access

switchport voice vlan 20

switchport port-security

security violation restrict port switchport

IP access-group ACL-LEAVE in

SRR-queue bandwidth share 1 70 25 5

3 SRR-queue bandwidth shape 0 0 0

priority queue

authentication event fail following action method

action of death event authentication server allow voice

the host-mode multi-auth authentication

open authentication

authentication order dot1x mab

authentication priority dot1x mab

Auto control of the port of authentication

MAB

added mac-SNMP trap notification change

no link-status of snmp trap

dot1x EAP authenticator

dot1x tx-time 10

Storm-control broadcasts 2.00 1.00

Storm-control level multicast 2.00 1.00

stop storm-control action

Storm-control action trap

spanning tree portfast

service-policy input ax-qos_butnet

IP dhcp snooping limit 5 speed

end

Is there a problem with the client (computer) or ISE/switch?

No problem of Phillip,

Ultimately you want to leave the entries in the source for the dACL set with one, because the switch will replace those with the source ip address that he draws from the analysis of ip device.

Thank you

Tarik Admani
* Please note the useful messages *.

Tags: Cisco Security

Similar Questions

Maybe you are looking for