Network Access, Visibility, and Enforcement · Topic 2 of 6

Configuring 802.1X and MAB with Cisco ISE

Configure 802.1X and MAB on IOS XE switches with Cisco ISE: roles, EAP methods, port modes, authentication order, authorisation results and checks.

6 min
Includes a diagram

In a nutshell

The roles are supplicant, authenticator and authentication server.
EAPOL runs between supplicant and switch, and RADIUS between switch and ISE.
EAP-TLS uses certificates on both sides, and PEAP uses a password inside a TLS tunnel.

What it is

802.1X is port based access control that makes a device authenticate before the switch port passes its traffic, and MAB covers devices that cannot do it.

Without it, anyone who plugs into a wall socket joins the network. With it, the port stays closed to normal traffic until the device is authenticated by a RADIUS server, such as ISE. MAC Authentication Bypass (MAB) uses the device MAC address as its identity, for devices with no 802.1X supplicant.

How it works

There are three roles, a set of EAP methods and a handful of switch commands.

The three roles

A laptop supplicant talks EAPOL to the switch authenticator on G1/0/5, a device without a supplicant uses its MAC address (MAB), and the switch sends RADIUS requests to ISE1, which returns a VLAN, downloadable ACL or SGT.

Role	Device	Job
Supplicant	Endpoint software	Provides the credentials
Authenticator	Switch or wireless controller	Controls the port and relays messages
Authentication server	ISE	Checks the credentials and returns the decision

The supplicant and authenticator talk using EAP over LAN (EAPOL). The authenticator and the server talk using RADIUS. Until the process succeeds, the port passes only EAPOL traffic.

EAP methods

EAP is a framework, and the method decides what is proved.

Method	Authenticates with
EAP-TLS	Certificates on both the client and the server
PEAP	A server certificate and a protected inner password exchange
EAP-FAST	A protected access credential, with an optional inner method
EAP-TTLS	A server certificate and a tunnelled inner method

EAP-TLS is the strongest, since it needs no password, but it needs a certificate on each client. PEAP is common where users sign in with directory passwords.

MAB

MAB is the fall back, and the switch takes the MAC address of a device that does not speak EAPOL, and sends it to ISE as the user name and password. ISE looks the address up in an endpoint list or profiling data, and returns a result. MAB is weaker than 802.1X because a MAC address can be copied.

Configuring the switch (IOS XE)

Enable AAA and 802.1X globally, and define the ISE server.

Switch(config)# aaa new-model
Switch(config)# radius server ISE1
Switch(config-radius-server)# address ipv4 10.1.1.10 auth-port 1812 acct-port 1813
Switch(config-radius-server)# key SHAREDSECRET
Switch(config)# aaa authentication dot1x default group radius
Switch(config)# aaa authorization network default group radius
Switch(config)# aaa accounting dot1x default start-stop group radius
Switch(config)# dot1x system-auth-control

Then configure each access port.

Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# authentication port-control auto
Switch(config-if)# authentication order dot1x mab
Switch(config-if)# authentication priority dot1x mab
Switch(config-if)# authentication host-mode multi-auth
Switch(config-if)# dot1x pae authenticator
Switch(config-if)# mab
Switch(config-if)# spanning-tree portfast

The authentication port-control auto command turns control on. The order sets which method the switch tries first, and here a device that fails 802.1X falls back to MAB. The multi-auth host mode authenticates each device on the port separately, which suits a port with several devices behind it.

These commands are the classic style, and newer IOS XE releases also offer a policy map based style with different commands.

Host modes

Mode	Behaviour
single-host	One device only
multi-host	After the first device authenticates, others on the port pass
multi-domain	One data device and one voice device
multi-auth	Many devices, each authenticated individually

ISE configuration

On ISE, define the switch as a network device with the same shared secret. Build a policy set that contains an authentication policy, which says which identity source and methods to accept, and an authorisation policy.

The authorisation policy returns a result. Common results are a VLAN, a downloadable ACL, a security group tag, or a deny. For example, employees with a certificate get the user VLAN, and MAB devices that are profiled as printers get the printer VLAN.

Open, low impact and closed modes

A closed port allows nothing before authentication, which is the strictest. Open mode allows traffic while it authenticates, which is useful for a rollout. A low impact design applies a basic ACL before authentication, so the device can get an address and reach the services that it needs for login.

Verifying and troubleshooting

Switch# show authentication sessions
Switch# show authentication sessions interface GigabitEthernet1/0/5 details
Switch# show dot1x all

The session details show the method used, the status and the result applied. On ISE, the live logs show each request and the reason for a failure. Common failures are a mismatched shared secret, a switch not defined in ISE, a client with no trusted certificate, and wrong credentials.

What to remember for the exam

Seven facts cover most questions on this topic.

The roles are supplicant, authenticator and authentication server.
EAPOL runs between supplicant and switch, and RADIUS between switch and ISE.
EAP-TLS uses certificates on both sides, and PEAP uses a password inside a TLS tunnel.
MAB uses the MAC address and is weaker, because the address can be spoofed.
The switch needs dot1x system-auth-control and authentication port-control auto.
Authentication order lets a device fall back from 802.1X to MAB.
ISE returns results such as a VLAN, a downloadable ACL or a security group tag.

Exam tip

If a question describes a printer that cannot run a supplicant, the expected answer is MAB.

Common mistakes

These four mistakes appear often.

Forgetting dot1x system-auth-control. Without it, port control has no effect.

Using single-host mode on a phone port. The phone and the PC are separate devices.

Not defining the switch in ISE. ISE ignores requests from unknown devices.

Enforcing a closed port with no testing. Use open mode first, so a policy error does not lock out every user.

Watch out

Test with a few ports first. A mistake in a closed mode design can disconnect an entire floor of users.

Check yourself

Work through these three questions.

What does the authenticator do in 802.1X?
It controls the port and relays messages between the supplicant, using EAPOL, and the authentication server, using RADIUS.
Why does a device fall back to MAB?
The authentication order lets the switch try MAB with the MAC address when the device has no supplicant or fails 802.1X.
Which host mode authenticates each device on a port separately?
The multi-auth host mode.

Topic 2 of 6 in Network Access, Visibility, and Enforcement

Test yourself on Network Access, Visibility, and Enforcement

The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.