Wired 802.1X with IBNS 2.0

What it is

IBNS 2.0 is the Cisco Identity Based Networking Services framework that controls how a switch port authenticates a device.

It replaces the older interface commands with a policy map. The policy map says which methods to try, in what order, and what to do on failure. This is the style used on current IOS XE Catalyst switches.

How it works

The switch is configured globally for AAA, then each port gets a service policy that drives the session.

Global switch settings

The first block turns on AAA and 802.1X, and points the switch at ISE.

Switch(config)# aaa new-model
Switch(config)# aaa authentication dot1x default group ISE-GRP
Switch(config)# aaa authorization network default group ISE-GRP
Switch(config)# aaa accounting dot1x default start-stop group ISE-GRP
Switch(config)# dot1x system-auth-control
Switch(config)# radius server ISE-PSN1
Switch(config-radius-server)# address ipv4 10.1.1.11 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key SECRET
Switch(config-radius-server)# exit
Switch(config)# aaa group server radius ISE-GRP
Switch(config-sg-radius)# server name ISE-PSN1

ISE can send vendor specific attributes, such as a downloadable ACL name. The switch has to be told to send and accept them. CoA from ISE also needs an entry.

Switch(config)# radius-server vsa send authentication
Switch(config)# radius-server vsa send accounting
Switch(config)# aaa server radius dynamic-author
Switch(config-locsvr)# client 10.1.1.11 server-key SECRET

Classic and IBNS 2.0 syntax

Older switches use interface commands that begin with authentication. IBNS 2.0 uses policy maps and the access-session commands.

Class maps and policy maps

A control class map matches a condition, such as a failed method. A control policy map reacts to events using those classes.

Switch(config)# class-map type control subscriber match-all DOT1X_NO_RESP
Switch(config-filter-control-classmap)# match method dot1x
Switch(config-filter-control-classmap)# match result-type method dot1x agent-not-found
Switch(config-filter-control-classmap)# exit
Switch(config)# policy-map type control subscriber PMAP_DOT1X_MAB
Switch(config-control-policymap)# event session-started match-all
Switch(config-event-control-policymap)# 10 class always do-until-failure
Switch(config-class-control-policymap)# 10 authenticate using dot1x priority 10
Switch(config-action-control-policymap)# exit
Switch(config-class-control-policymap)# exit
Switch(config-event-control-policymap)# exit
Switch(config-control-policymap)# event authentication-failure match-first
Switch(config-event-control-policymap)# 10 class DOT1X_NO_RESP do-until-failure
Switch(config-class-control-policymap)# 10 terminate dot1x
Switch(config-action-control-policymap)# 20 authenticate using mab priority 20

Read it from the top. When a session starts, the switch tries 802.1X. If the device has no supplicant, the 802.1X method ends with agent not found, and the switch moves on to MAB.

Real policies add more events, such as a failure of MAB and an event for when an agent appears later. Cisco publishes a standard template for this, and you can start from that.

Apply it to the port

Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# switchport mode access
Switch(config-if)# access-session port-control auto
Switch(config-if)# access-session host-mode multi-auth
Switch(config-if)# mab
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# service-policy type control subscriber PMAP_DOT1X_MAB

The port runs with port-control auto, which means it follows the result of authentication. A port that does not have it does not authenticate.

Verify

Switch# show authentication sessions
Switch# show authentication sessions interface GigabitEthernet1/0/5 details
Switch# show aaa servers

The details output shows the method used, the status, the host mode, and any ACL or VLAN that ISE applied. It is the most useful command on the switch for this topic.

ISE side

On ISE, add the switch as a network device with the same shared secret. Then match wired traffic with the wired 802.1X condition in a policy set. The ISE authorization result sets the VLAN, ACL, or tag for the port.