Troubleshoot Identity-Based Networking Services (IBNS) 2.0

Available Languages

Download Options

PDF (46.0 KB)
View with Adobe Reader on a variety of devices
ePub (114.9 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (118.1 KB)
View on Kindle device or Kindle app on multiple devices

Updated:July 15, 2016

Document ID:200570

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Background Information

debug aaa authentication/authorization

Related Information

Introduction

This document describes the procedure to troubleshoot authentications on switches which use Identity-Based Networking Services (IBNS) 2.0

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

Identity Service Engine (ISE)
IEEE 802.1X concepts (dot1X)
MAC Authentication Bypass (MAB)

Components Used

The information in this document is based on these software and hardware versions but not lmited to:

Cisco Switch - C3750X-48PF-S with IOS 15.2.1E3(ED)
Identity Service Engine 2.1

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Background Information

IBNS 2.0 is a new policy engine which replaces the traditional auth-manager. It is equipped with a set of enhanced capabilities which offer flexible configuration with the Cisco Common Classification Policy Language (C3PL). Now called the Access Session Manager, IBNS 2.0 gives administrators options to configure policies and actions based on specific conditions and endpoint events. Instead of regular conditions, C3PL is used to define the authentication conditions, parameters and the actions. For more information on IBNS 2.0, follow the link given in the Related Information section.

There are different types of policy maps that are used for various purposes. This paragraph focuses on subscriber type. There are three sections in a policy map to be noted.

Event section
Class section
Action section

They follow the hierarchy Event > Class > Action. When a policy map is applied to an interface, all events defined in the policy map are evaluated. Based upon the current event, the appropriate action defined in the policy map is applied at the interface level.

Once the event is matched, there is an option to evaluate the classes based on the event/method/result of the authentication/authorization. The results of these classes can be ALWAYS EXECUTE or called in additional class maps.

In the action section, the important actions that can be included are:

Specify an authentication method with a priority

 event session-started match-all
  10 class <class-map> do-until-failure
   10 authenticate using <dot1x or mab or local webauth> priority <Value>

Specify an authentication method list for a particular authentication method

event session-started match-all
  10 class <class-map> do-until-failure
   10 authenticate using <dot1x or mab or local webauth> aaa authc-list <method-list name>

Specify an authorization method list for an authentication method

event session-started match-all
  10 class <class-map> do-until-failure
   10 authenticate using <dot1x or mab or local webauth> aaa authz-list <method-list name>

Specify number of retries

event session-started match-all
  10 class <class-map> do-until-failure
   10 authenticate using <dot1x or mab or local webauth> retries <value>

Replace the existing authntication/authorization data with new authentication/authorization data

event timer-expiry match-all
  10 class <class-map> do-until-failure
   10 authenticate using <dot1x or mab or local webauth> replace aaa <authc-list/authz-list>

Force Authorization

event session-started match-all
  10 class <class-map> do-until-failure
   10 authorize

Force Unauthorization

event timer-expiry match-all
  10 class <class-map> do-until-failure
   10 unauthorize

Activate a service template

event timer-expiry match-all
  10 class <class-map> do-until-failure
   10 activate service-template <Name of the template>

In the traditional IOS Switches, there was no option to apply a method list specific to a authenticated session. IBNS 2.0 provides this capability using a service-templates. The service template is configured locally on the switch and applied post successful session authorization. There is also an option to push the required service template from a AAA server.

The radius attribute that is used to do the same is subscriber:service-name = <name of the service template>. In Identity Serice Engine (ISE), you can name the authorization profile exactly the same as of the local service-template configured on the switch and check the Service Template check box. This authorization profile along with any other authorization profile can be pushed as an authorization result.

In the authorization result report, there is a Cisco-AV-Pair named subscriber:service-name = <name of the service template> . This indiacates that the swich has been notified to apply that service template for that session.

Here is a picture which shows the exact meaning of every entity of a sample policy map.

Configure

AAA configuration

aaa new-model
aaa authentication dot1x default group radius
aaa authorization exec default local
aaa authorization network default group radius
aaa accounting identity default start-stop group radius
aaa session-id common 

dot1x system-auth-control

RADIUS server configuration

radius server ise
 address ipv4 X.X.X.X auth-port 1812 acct-port 1813
 automate-tester username probe-user
 key XXXXXXXXXX

Policy map configuration

policy-map type control subscriber Inter_Gi_3/0/48
 event session-started match-all           //On session-start event
  10 class always do-until-failure         //Both mab and dot1x start at the same time
   10 authenticate using dot1x priority 10
   20 authenticate using mab priority 20
 event authentication-failure match-first  //On authentication event failure
  10 class DOT1X_NO_RESP do-until-failure  //If dot1x fails
   10 terminate dot1x
   20 authenticate using mab priority 20
  20 class MAB_FAILED do-until-failure     //If mab fails
   10 terminate mab
   20 authentication-restart 60
  30 class always do-until-failure         //If both mab and dot1x fail
   10 terminate dot1x
   20 terminate mab
   30 authentication-restart 60
 event agent-found match-all               //On dot1x agent found event
  10 class always do-until-failure         
   10 terminate mab
   20 authenticate using dot1x priority 10

Class maps configuration

class-map type control subscriber match-all DOT1X_NO_RESP //If dot1x and no response from client
 match method dot1x
 match result-type method dot1x agent-not-found

class-map type control subscriber match-all MAB_FAILED    //On mab failure
 match method mab
 match result-type method mab authoritative

Interface configuration

interface GigabitEthernet3/0/48
 description ** Access Port **
 switchport access vlan 100
 switchport mode access
 switchport voice vlan 10
 ip access-group IPV4-PRE-AUTH-ACL in
 access-session port-control auto
 mab
 dot1x pae authenticator
 spanning-tree portfast
 service-policy type control subscriber Inter_Gi_3/0/48

Troubleshoot

The best way to troubleshoot is to compare the working logs and the non-working logs. This way, the exact step at which the process went wrong is known. There are a few debugs which are needed to be enabled to troubleshoot mab/dot1x issues. Here are the commands to enable those debugs.

debug aaa authentication
debug aaa authorization
debug mab all
debug dot1x all
debug radius

Here are the working logs with dot1x and mab enabled at the same time.

debug mab all

mab-ev: [28d2.4496.5376, Gi3/0/48] Received MAB context create from AuthMgr // New mac-address detected
mab-ev: MAB authorizing 28d2.4496.5376 //mab authorization event should start
mab-ev: Created MAB client context 0xB0000001
mab : initial state mab_initialize has enter //Initialize mab
mab-ev: [28d2.4496.5376, Gi3/0/48] Sending create new context event to EAP from MAB for 0xB0000001 (28d2.4496.5376)
mab-ev: [28d2.4496.5376, Gi3/0/48] MAB authentication started for 0x0782A870 (28d2.4496.5376) //mab authentication initialized
%AUTHMGR-5-START: Starting 'mab' for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003300C586C2
mab-ev: [28d2.4496.5376, Gi3/0/48] Invalid EVT 9 from EAP 
mab-sm: [28d2.4496.5376, Gi3/0/48] Received event 'MAB_CONTINUE' on handle 0xB0000001
mab : during state mab_initialize, got event 1(mabContinue)
@@@ mab : mab_initialize -> mab_authorizing //mab authorizing event started
mab-ev: [28d2.4496.5376] formatted mac = 28d244965376 //mac-address formatted as required
mab-ev: [28d2.4496.5376] created mab pseudo dot1x profile dot1x_mac_auth_28d2.4496.5376 //peuso dot1x profile formed (username=macaddress)
mab-ev: [28d2.4496.5376, Gi3/0/48] Starting MAC-AUTH-BYPASS for 0xB0000001 (28d2.4496.5376) //starting mab authentication
mab-ev: [28d2.4496.5376, Gi3/0/48] Invalid EVT 9 from EAP
mab-ev: [28d2.4496.5376, Gi3/0/48] MAB received an Access-Accept for 0xB0000001 (28d2.4496.5376) //received mab success from the server
%MAB-5-SUCCESS: Authentication successful for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003300C586C2
mab-sm: [28d2.4496.5376, Gi3/0/48] Received event 'MAB_RESULT' on handle 0xB0000001 // mab authorization result received
mab : during state mab_authorizing, got event 5(mabResult)
@@@ mab : mab_authorizing -> mab_terminate //mab authorization process terminate
mab-ev: [28d2.4496.5376, Gi3/0/48] Deleted credentials profile for 0xB0000001 (dot1x_mac_auth_28d2.4496.5376) //deleted pseudo dot1x profile
%AUTHMGR-5-SUCCESS: Authorization succeeded for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003300C586C2 // posting mab authorization succeeded

debug dot1x all

Since dot1x has a lot of message exchanges because of the protocol negotiations, certificate exchanges and so on, not all the debug logs have been mentioned here. The flow of events in the order in which they are supposed to occur and their corresponding debug logs have been documented here.

dot1x-packet:EAPOL pak rx - Ver: 0x1  type: 0x1 // Initial EAPoL packet received by switch
dot1x-packet: length: 0x0000

dot1x-ev:[28d2.4496.5376, Gi3/0/48] New client detected, sending session start event for 28d2.4496.5376 // dot1x client detected

dot1x-ev:[28d2.4496.5376, Gi3/0/48] Dot1x authentication started for 0x26000007 (28d2.4496.5376)  //dot1x started

%AUTHMGR-5-START: Starting 'dot1x' for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003500C9CFC3 

dot1x-sm:[28d2.4496.5376, Gi3/0/48] Posting !EAP_RESTART on Client 0x26000007 //requesting client to restart the EAP Proces

dot1x-sm:[28d2.4496.5376, Gi3/0/48] Posting RX_REQ on Client 0x26000007 //waiting fot the EAPoL packet fromt he client

dot1x-sm:[28d2.4496.5376, Gi3/0/48] Posting AUTH_START for 0x26000007 // Starting authentication process

dot1x-ev:[28d2.4496.5376, Gi3/0/48] Sending out EAPOL packet // Identity Request
dot1x-packet:EAPOL pak Tx - Ver: 0x3  type: 0x0 
dot1x-packet: length: 0x0005
dot1x-packet:EAP code: 0x1  id: 0x1  length: 0x0005
dot1x-packet: type: 0x1 
dot1x-packet:[28d2.4496.5376, Gi3/0/48] EAPOL packet sent to client 0x26000007 

dot1x-ev:[Gi3/0/48] Received pkt saddr =28d2.4496.5376 , daddr = 0180.c200.0003, pae-ether-type = 888e.0100.000a
dot1x-packet:EAPOL pak rx - Ver: 0x1  type: 0x0              // Identity Response
dot1x-packet: length: 0x000A

dot1x-sm:[28d2.4496.5376, Gi3/0/48] Posting EAPOL_EAP for 0x26000007 //EAPoL packet(EAP Response) received, preparing request to server

dot1x-sm:[28d2.4496.5376, Gi3/0/48] Posting EAP_REQ for 0x26000007 //Server response received, EAP Request is being prepared

dot1x-ev:[28d2.4496.5376, Gi3/0/48] Sending out EAPOL packet
dot1x-packet:EAPOL pak Tx - Ver: 0x3  type: 0x0 
dot1x-packet: length: 0x0006
dot1x-packet:EAP code: 0x1  id: 0xE5 length: 0x0006
dot1x-packet: type: 0xD 
dot1x-packet:[28d2.4496.5376, Gi3/0/48] EAPOL packet sent to client 0x26000007 //EAP request sent out

dot1x-ev:[Gi3/0/48] Received pkt saddr =28d2.4496.5376 , daddr = 0180.c200.0003, pae-ether-type = 888e.0100.0006 //EAP response received
dot1x-packet:EAPOL pak rx - Ver: 0x1  type: 0x0 
dot1x-packet: length: 0x0006 
||
||
||
|| Here a lot of EAPOL-EAP and EAP_REQ events occur as a lot of information is exchanged between the switch and the client
|| If the events after this do not follow, then the timers and the information sent till now need to be checked
||
||
||
dot1x-packet:[28d2.4496.5376, Gi3/0/48] Received an EAP Success //EAP Success recieved from Server

dot1x-sm:[28d2.4496.5376, Gi3/0/48] Posting EAP_SUCCESS for 0x26000007 //Posting EAP Success event

dot1x-sm:[28d2.4496.5376, Gi3/0/48] Posting AUTH_SUCCESS on Client 0x26000007 //Posting Authentication success

%DOT1X-5-SUCCESS: Authentication successful for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003500C9CFC3 

dot1x-packet:[28d2.4496.5376, Gi3/0/48] EAP Key data detected adding to attribute list //Additional key data detected sent by server

%AUTHMGR-5-SUCCESS: Authorization succeeded for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003500C9CFC3

dot1x-ev:[28d2.4496.5376, Gi3/0/48] Received Authz Success for the client 0x26000007 (28d2.4496.5376) //Authorization Success

dot1x-ev:[28d2.4496.5376, Gi3/0/48] Sending out EAPOL packet //Sending EAP Success to the client
dot1x-packet:EAPOL pak Tx - Ver: 0x3  type: 0x0 
dot1x-packet: length: 0x0004
dot1x-packet:EAP code: 0x3  id: 0xED length: 0x0004
dot1x-packet:[28d2.4496.5376, Gi3/0/48] EAPOL packet sent to client 0x26000007

debug radius

Since there are lot of EAP messages,RADIUS packets sent to the server and received will also be more. Not every dot1x authentication finishes off with on Access-Request. Hence the logs shown here are the ones that are important and as the flow goes.

   //mab and dot1x start at the same time as per the configuration
   %AUTHMGR-5-START: Starting 'dot1x' for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003600CCC037
   %AUTHMGR-5-START: Starting 'mab' for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003600CCC037
   RADIUS/ENCODE(00000000):Orig. component type = Invalid
   RADIUS(00000000): Config NAS IP: 0.0.0.0
   //Since dot1x client didn't respond yet, mab authentication is done
   RADIUS(00000000): sending
   RADIUS/ENCODE: Best Local IP-Address 10.106.37.142 for Radius-Server 10.106.73.143
   RADIUS(00000000): Send Access-Request to 10.106.73.143:1812 id 1645/56, len 267
   RADIUS:  authenticator F0 E4 E3 28 7E EA E6 83 - 43 55 7F DC 96 19 EB 42
   RADIUS:  User-Name           [1]   14  "28d244965376"
   RADIUS:  User-Password       [2]   18  *
   RADIUS:  Service-Type        [6]   6   Call Check                [10]
   RADIUS:  Vendor, Cisco       [26]  31  
   RADIUS:   Cisco AVpair       [1]   25  "service-type=Call Check"
    RADIUS:  Framed-MTU          [12]  6   1500                      
   RADIUS:  Called-Station-Id   []  19  "CC-EF-48-AD-6B-"
   RADIUS:  Calling-Station-Id  [31]  19  "28-D2-44-96-53-76"
   RADIUS:  Message-Authenticato[80]  18  
   RADIUS:   AD DC 22 D7 83 8C 02 C5 1E 11 B2 94 80 85 2F 3D               [ "/=]
   RADIUS:  EAP-Key-Name        [102] 2   *
   RADIUS:  Vendor, Cisco       [26]  49  
   RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0A6A258E0000003600CCC037"
   RADIUS:  Vendor, Cisco       [26]  18  
   RADIUS:   Cisco AVpair       [1]   12  "method=mab"
   RADIUS:  Framed-IP-Address   [8]   6   1.1.1.2                   
   RADIUS:  NAS-IP-Address      [4]   6   10.106.37.142             
   RADIUS:  NAS-Port            [5]   6   60000                     
   RADIUS:  NAS-Port-Id         [87]  23  "GigabitEthernet3/0/48"
   RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
    RADIUS(00000000): Sending a IPv4 Radius Packet
   RADIUS(00000000): Started 5 sec timeout
   RADIUS: Received from id 1645/56 10.106.73.143:1812, Access-Accept, len 176
   RADIUS:  authenticator 7B D6 DA E1 70 49 6E 6D - 3D AC 5C 1D C0 AC CF D0
   RADIUS:  User-Name           [1]   19  "28-D2-44-96-53-76"
   RADIUS:  State               [24]  40  
   RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A  41  [ReauthSession:0A]
   RADIUS:   36 41 32 35 38 45       33 36    [6A258E0000003600]
   RADIUS:   43 43 43  33 37            [ CCC037]
   RADIUS:  Class               [25]  51  
   RADIUS:   43 41 43 53 3A  41 36 41 32 35 38 45     [CACS:0A6A258E000]
   RADIUS:      33 36   43 43 43  33 37 3A 69 73  [0003600CCC037:is]
   RADIUS:   65 31 34 2F 32 35 35 38 35 37 38  34 2F 36 34  [e14/255857804/64]
   RADIUS:   36                 [ 6]
   RADIUS:  Message-Authenticato[80]  18  
   RADIUS:   D3 F3 6E 9A 25 09 01 8C D6 B1 20 D6 84 D3 18 3D              [ n? =]
    RADIUS:  Vendor, Cisco       [26]  28  
   RADIUS:   Cisco AVpair       [1]   22  "profile-name=Unknown"
   //mab succeeds
   %MAB-5-SUCCESS: Authentication successful for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003600CCC037
   %AUTHMGR-5-SUCCESS: Authorization succeeded for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003600CCC037 
   //A dot1x client is detected and mab is stopped as per the configuration and dot1x authentication starts
   %AUTHMGR-7-STOPPING: Stopping 'mab' for client 28d2.4496.5376 on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003600CCC037
   RADIUS/ENCODE(00000000):Orig. component type = Invalid
   RADIUS(00000000): Config NAS IP: 0.0.0.0
   RADIUS(00000000): sending
   RADIUS/ENCODE: Best Local IP-Address 10.106.37.142 for Radius-Server 10.106.73.143
   RADIUS(00000000): Send Access-Request to 10.106.73.143:1812 id 1645/57, len 252
   RADIUS:  authenticator 1B E9 37 F4 AC C7 73 BE - F4 95 CB 5F FC 2D 3D E1
   RADIUS:  User-Name           [1]   7   "cisco"
   RADIUS:  Service-Type        [6]   6   Framed                    [2]
   RADIUS:  Vendor, Cisco       [26]  27  
   RADIUS:   Cisco AVpair       [1]   21  "service-type=Framed"
   RADIUS:  Framed-MTU          [12]  6   1500                      
   RADIUS:  Called-Station-Id   []  19  "CC-EF-48-AD-6B-"
   RADIUS:  Calling-Station-Id  [31]  19  "28-D2-44-96-53-76"
   RADIUS:  EAP-Message         [79]  12  
   RADIUS:   02 01 00 0A 01 63 69 73 63 6F             [ cisco]
   RADIUS:  Message-Authenticato[80]  18  
   RADIUS:   7B 42 C2 C2 69 CB 73 49 1A 40 81 28 71 CF CC 86          [ {BisI@(q]
   RADIUS:  EAP-Key-Name        [102] 2   *
   RADIUS:  Vendor, Cisco       [26]  49  
   RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=0A6A258E0000003600CCC037"
   RADIUS:  Vendor, Cisco       [26]  20  
   RADIUS:   Cisco AVpair       [1]   14  "method=dot1x"
   RADIUS:  Framed-IP-Address   [8]   6   1.1.1.2                   
   RADIUS:  NAS-IP-Address      [4]   6   10.106.37.142             
   RADIUS:  NAS-Port            [5]   6   60000                     
   RADIUS:  NAS-Port-Id         [87]  23  "GigabitEthernet3/0/48"
   RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
   RADIUS(00000000): Sending a IPv4 Radius Packet 
   //More information is being requested by the AAA Server
   RADIUS: Received from id 1645/57 10.106.73.143:1812, Access-Challenge, len 120
    RADIUS:  authenticator A7 2A 6E 8C 75 9C 28 6F - 32 85 B9 87 5B D2 E4 FB
   RADIUS:  State               [24]  74  
   RADIUS:   33 37 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D   [37CPMSessionID=0]
   RADIUS:   41 36 41 32 35 38 45       33 36   [A6A258E000000360]
   RADIUS:    43 43 43  33 37 3B 32 39 53 65 73 73 69 6F  [0CCC037;29Sessio]
   RADIUS:   6E 49 44 3D 69 73 65 31 34 2F 32 35 35 38 35 37  [nID=ise14/255857]
   RADIUS:   38  34 2F 36 34 38 3B          [ 804/648;]
   RADIUS:  EAP-Message         [79]  8   
   RADIUS:   01 0A 00 06 0D 20                 [  ]
   RADIUS:  Message-Authenticato[80]  18  
   RADIUS:   E2 7C 2B 0E CA AB E3 21 B8 CD 04 8A 7F 23 7A D2             [ |+!#z] 
||
||
||
|| As mentioned before, the excess logs of Access-Requestes and Access-Challenges come here
||
||
|| 
   //Authentication and Authorization succeeds for dot1x
   RADIUS: Received from id 1645/66 10.106.73.143:1812, Access-Accept, len 325
   RADIUS:  authenticator F0 CF EE 59 3A 26 25 8F - F7 0E E4 03 E1 11 7E 86
   RADIUS:  User-Name           [1]   7   "cisco"
   RADIUS:  State               [24]  40  
   RADIUS:   52 65 61 75 74 68 53 65 73 73 69 6F 6E 3A  41  [ReauthSession:0A]
   RADIUS:   36 41 32 35 38 45       33 36    [6A258E0000003600]
   RADIUS:   43 43 43  33 37            [ CCC037]
    RADIUS:  Class               [25]  51  
   RADIUS:   43 41 43 53 3A  41 36 41 32 35 38 45     [CACS:0A6A258E000]
   RADIUS:      33 36   43 43 43  33 37 3A 69 73  [0003600CCC037:is]
   RADIUS:   65 31 34 2F 32 35 35 38 35 37 38  34 2F 36 34  [e14/255857804/64]
   RADIUS:   38                 [ 8]
   RADIUS:  EAP-Message         [79]  6   
   RADIUS:   03 12 00 04 
   RADIUS:  Message-Authenticato[80]  18  
   RADIUS:   3F 7A DA 59 F7 8A DE 1D 33 4B 07 88 62 F3 3B 71          [ ?zY3Kb;q]
   RADIUS:  EAP-Key-Name        [102] 67  *
   RADIUS:  Vendor, Microsoft   [26]  58  
   RADIUS:   MS-MPPE-Send-Key   [16]  52  *
   RADIUS:  Vendor, Microsoft   [26]  58  
   RADIUS:   MS-MPPE-Recv-Key   [17]  52  *
   RADIUS(00000000): Received from id 1645/66
   RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes
   //Dot1x succeeds
   %DOT1X-5-SUCCESS: Authentication successful for client (28d2.4496.5376) on Interface Gi3/0/48 AuditSessionID 0A6A258E0000003600CCC03

debug aaa authentication/authorization

debug aaa authentication and debug aaa authorization shows useful information during various authentication/authorization methods. In this case, It is only a single line specifying the method list being used.

AAA/AUTHEN/8021X (00000000): Pick method list 'default'

This shows if any of the authentication methods are unavailable/not enabled.

The procedure to troubleshoot CWA/Posture/DACLs etc., is the same as that of the traditional IOS switches. Configuration verification is the first step in troubleshooting. Ensure the configuration meets the requirements. If the configuration of the policy map, class map is upto the mark, then debugg problems if any, can be very easy. For further details on configuration using IBNS 2.0, refer the Related Information section.

Related Information

IBNS 2.0 Deployment Guide

Contributed by Cisco Engineers

Surendra Reddy
Cisco TAC Engineer

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

Troubleshoot Identity-Based Networking Services (IBNS) 2.0

Available Languages

Download Options

Bias-Free Language

Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Configure

Troubleshoot

debug mab all

debug dot1x all

debug radius

debug aaa authentication/authorization

Related Information

Contributed by Cisco Engineers

Was this Document Helpful?

Contact Cisco