Optionally, Cisco switches can be configured to perform MAB as EAP-MD5 authentication, in which case the Service-Type attribute will be set to 1 (Framed). However, because the MAC address is sent in the clear in Attribute 31 (Calling-Station-Id), MAB EAP does not offer any additional security by encrypting the MAC address in the password. Lastly, Cisco ISE uses a simple check-box within the allowed-protocols configuration as another method to permit or deny the access into the endpoint database for the MAB request, as seen in Figure-5.
I'm going to use this page for links to the configuration templates I use when deploying Cisco ISE. These templates are provided As-Is with no guarantee. Yes, even I sometimes have a fat finger error. I will be updating them on the share if/when I find better configurations.
Be sure to check the Network Component Compatibility list for your version of Cisco ISE as well as the feature list for your NAD OS release before trying to apply any configuration settings. Otherwise, you may just receive a lot of errors.
Switch Templates for Cisco ISE Authentication
Ise Mab Authentication
Switch Templates for Cisco ISE Authentication
Ise Mab Authentication
Note: The C3PL templates are based on IBNS 2.0. It was just shorter by a couple of characters to name them C3PL (what will I do with the time saved?).
The following four C3PL configurations will authenticate Dot1x and MAB at the same time. It will work for most deployments but can cause duplicate records to show up in the Live Logs (1 for MAB, 1 for Dot1x). Be sure to test if this will work for your deployment. Note that running Dot1x and MAB concurrently is not fully supported by Cisco. To change this behavior, replace the policy map in these templates with the policy map found in the Cisco ISE IBNS 2.0 Switch Config template below.
Cisco ISE C3PL Switch Config Template
Cisco ISE C3PL Switch Denali Config Template
Cisco Ise Mab Config
Cisco ISE C3PL & TrustSec Config Template
Cisco ISE C3PL & TrustSec Denali Config Template
The following C3PL configuration is IBNS 2.0 compliant. Dot1x and MAB run separately (MAB after Dot1x failure). The policy map in this template can be copy/pasted into the above C3PL templates (replacing the policy map found there) so that Dot1x and MAB does not run concurrently.
Daoc exploits. These 2 templates are IBNS 1.0 compliant.
Cisco ISE non-C3PL with Device Sensors Config Template
Cisco ISE non-C3PL without Device Sensors Config Template
Cisco Ise Architecture
This template is for configuring TACACS+ authentication on IOS/IOS-XE.
Cisco Ise Design Guide
Adaptive Security Appliance (ASA) Templates for Cisco ISE Authentication
