802.1x and mab authentication

Question

Hi all,  I would like to ask about 802.1X and mab authentication on N-series switching running firmware 6.6.0.0.  My configuration as follows: authentication enableauthentication dynamic-vlan enabledot1x system-auth-controlaaa authentication dot1x default radiusaaa authorization network default radiusradius server auth 192.168.10.20name 'RADIUS-Server'key 7 'bbg34d1bb' ! interface Gi1/0/1spanning-tree portfastswitchport mode generalauthentication host-mode single-hostauthentication max-users 1authentication event fail action authorize vlan 10mab auth-type chapauthentication order dot1x mabauthentication priority dot1x mabexit My questions: 1) Based on the above configuration, if a device doesn't pass 802.1x it will failover to mab. How do I configure so that if it authenticates only on either 802.1x or mab? If a device has 802.1x enabled, it should authenticate on that method only and if it fails, it should not failover to mab. 2) I am using ClearPass. I am seeing the switch sending RADIUS packet to ClearPass but it is not hitting a policy for 802.1X authentication. The initial service policy is generic for wired 802.1x and seen below: Appreciate your advise. Thanks

DELL-Josh Cr · Answer

Hi, The ports that need MAB, enable MAB, if a port only needs Dot1x use that. If both are enabled it will try to authenticate with both methods.

simon1112 · Answer

Hi Josh

Thanks for the reply. My usage case is I want the ports to be colorless. It can be a 802.1x device or non-802.1x device connected to the port. I believe this is pretty much standard connection method.

I am able to authenticate a 802.1x enabled laptop and access network. However, I also see my laptop performing MAC-Authentication shortly after the 802.1x authentication. Based on my configurations above, is this normal/correct behavior? If not, is there anything wrong with my configurations?

Thanks.

simon1112 · Answer

Hi,

I like to know if it is possible to configure mab auth-type on N3048 running firmware 6.2.6.6. I did a trace on the RADIUS packet from switch to RADIUS server, I did not see CHAP/PAP challenge.

Thanks

DELL-Josh Cr · Answer

dot1x time-out guest-vlan-period you may want to try increasing the timeout.

Networking General

Was this post helpful?