Cisco Catalyst C9200 IOS XE integration

NAC Cisco Layer 2 Switch Configuration Example:

Note – In this example, a Cisco Catalyst C9200 IOS XE configuration is provided. Cisco Catalyst 9200 running IOS XE 17.6.1 or later are supported for centrally switched traffic. However, any Cisco C9K switch supporting the following features are eligible for integration:

  • RADIUS Authentication/Accounting

  • 802.1X

  • MAC Authentication Bypass (MAB)

  • RADIUS Change of Authorization (CoA)

  • Cisco-AVPair “url-redirect”

  • Cisco-AVPair “url-redirect-acl”

Note – In this example the NAC RADIUS Server / Policy Server is 10.10.10.10 (replace this IP with the IP of your NAC system)

Note – Replace the VLAN number on the example port configuration with the desired default VLAN for the port.

aaa new-model
aaa session-id common
aaa authentication dot1x default group NAC_grp
aaa authorization network default group NAC_grp
aaa accounting Identity default start-stop group NAC_grp
aaa accounting delay-start group NAC_grp
aaa accounting update newinfo periodic 2880
!
!
!
!
aaa server radius dynamic-author
client 10.10.10.10 server-key HelloEnforcer
port 3799
!
dot1x system-auth-control
radius-server vsa send authentication
radius-server vsa send accounting
!
radius server NAC
address ipv4 10.10.10.10 auth-port 1812 acct-port 1813
automate-tester username Test3 ignore-auth-port ignore-acct-port probe-on
key HelloEnforcer
!
!
aaa group server radius NAC_grp
server name NAC

IBNS 2.0 Policy and Interface Configuration

Service Template:

service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
voice vlan
service-template CRITICAL_AUTH_VLAN
service-template CRITICAL-ACCESS
description *Fallback Policy on AAA Fail*
access-group ACL-CRITICAL-V4
!

Class map:

class-map type control subscriber match-any IN_CRITICAL_AUTH
match activated-service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
match activated-service-template CRITICAL_AUTH_VLAN
match activated-service-template CRITICAL-ACCESS
!
class-map type control subscriber match-none NOT_IN_CRITICAL_AUTH
match activated-service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
match activated-service-template CRITICAL_AUTH_VLAN
match activated-service-template CRITICAL-ACCESS
!
class-map type control subscriber match-all AAA_SVR_DOWN_UNAUTHD_HOST
match result-type aaa-timeout
match authorization-status unauthorized
!
class-map type control subscriber match-all AAA_SVR_DOWN_AUTHD_HOST
match result-type aaa-timeout
match authorization-status authorized
!
class-map type control subscriber match-all DOT1X_NO_RESP

Policy map:

On the 3 following configurations if the RADIUS server is down then we will apply CRITICAL_AUTH_VLAN, DEFAULT_CRITICAL_VOICE_TEMPLATE and CRITICAL-ACCESS service template. If the RADIUS server goes up then it reinitializes the authentication if the port is in IN_CRITICAL_VLAN.

for 802.1X with MAC Authentication fallback:

policy-map type control subscriber DOT1X_MAB
event session-started match-all
10 class always do-until-failure
10 authenticate using dot1x priority 10
event authentication-failure match-first
5 class DOT1X_FAILED do-until-failure
10 terminate dot1x
20 authenticate using mab priority 20
10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
10 activate service-template CRITICAL_AUTH_VLAN
20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
30 activate service-template CRITICAL-ACCESS
40 authorize
50 pause reauthentication
20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
10 activate service-template CRITICAL_AUTH_VLAN
20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
30 activate service-template CRITICAL-ACCESS

for MAC Authentication only:

policy-map type control subscriber MACAUTH
event session-started match-all
10 class always do-until-failure
10 authenticate using mab priority 10
event authentication-failure match-first
10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
10 activate service-template CRITICAL_AUTH_VLAN
20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
30 activate service-template CRITICAL-ACCESS
40 authorize
50 pause reauthentication
20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
10 activate service-template CRITICAL_AUTH_VLAN
20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
30 activate service-template CRITICAL-ACCESS
40 pause reauthentication
50 authorize
30 class always do-until-failure
10 terminate mab
20 authentication-restart 30

for 802.1X only:

policy-map type control subscriber DOT1X
event session-started match-all
10 class always do-until-failure
10 authenticate using dot1x priority 10
event authentication-failure match-first
10 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
10 activate service-template CRITICAL_AUTH_VLAN
20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
30 activate service-template CRITICAL-ACCESS
40 authorize
50 pause reauthentication
20 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
10 activate service-template CRITICAL_AUTH_VLAN
20 activate service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
30 activate service-template CRITICAL-ACCESS
40 pause reauthentication
50 authorize
30 class DOT1X_FAILED do-until-failure
10 terminate dot1x

Interface Template (802.1X MAC Authentication):

template identity-template-mab
dot1x pae authenticator
spanning-tree portfast
switchport access vlan 1
switchport mode access
switchport voice vlan 100
mab
access-session host-mode multi-domain
access-session control-direction in
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber DOT1X_MAB

Interface Template (MAC Authentication):

template identity-template-macauth
dot1x pae authenticator
spanning-tree portfast
switchport access vlan 1
switchport mode access
switchport voice vlan 100
mab
access-session host-mode single-host
access-session control-direction in
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber MACAUTH

Interface Template (802.1X):

template identity-template-dot1x
dot1x pae authenticator
spanning-tree portfast
switchport access vlan 1
switchport mode access
switchport voice vlan 100
mab
access-session host-mode single-host
access-session control-direction in
access-session closed
access-session port-control auto
authentication periodic
authentication timer reauthenticate server
service-policy type control subscriber DOT1X

Apply the new policy-map to the Test interface

interface gigabitEthernet 1/0/1
device-tracking attach-policy IP-Tracking
source template identity-template-mab
eapol announcement

Troubleshooting command:

When you use Port Templates, use the command "show derived-config" to see the actual (total) configuration on an interface after the Template has been applied to it.

show derived-config interface gigabitEthernet 1/0/1
switchport mode access
switchport voice vlan 100
device-tracking attach-policy NAC
authentication periodic
authentication timer reauthenticate server
access-session host-mode multi-domain
access-session control-direction in
access-session closed
access-session port-control auto
mab
eapol announcement
dot1x pae authenticator
dot1x timeout tx-period 5
spanning-tree portfast
service-policy type control subscriber DOT1X_MAB
end
show authentication sessions interface gigabitEthernet 1/0/1 detail

show tech-support identity


Next to read:
Juniper Wired Layer 2 Integration(URL redirect,ACL)
On This Page
Cisco Catalyst C9200 IOS XE integrationIBNS 2.0 Policy and Interface Configuration