Campus Nac Dot1x

Design and triage campus 802.1X and MAB with ISE or ClearPass. Use when a port will not authorize, a phone+PC daisy-chain fails, or failed-open policy is being reviewed.

gesh75 Updated

File contents

Campus NAC / 802.1X

Do not use for VPN or ZTNA. Not for firewall identity.

Procedure

  1. Host mode: multi-auth for phone+PC, single-host for servers. MAB only for known printers, with a static MAC group.
  2. Failed-closed on access except for emergency failed-open that is time-bounded and logged.
  3. dACL / SGT downloaded per session. Default VLAN is a quarantine, not corp.
  4. Triage: show auth sess, RADIUS live logs, certificate SAN, clock skew.
  5. Verify a known-good laptop, a phone, and a printer before calling the port done.
interface Gi1/0/24
  authentication host-mode multi-auth
  authentication periodic
  mab
  dot1x pae authenticator

Anti-patterns

  • Never globally disable 802.1X to "get the auditor in".
  • Do not MAB a user's laptop.

Safety

Failed-open is an incident, not a workaround. Change-guard the template.

gesh75/claude-skill-lint/tree/main/skills/netops/campus-nac-dot1x commit b5c6ec6381

Frequently asked questions

npx skillmds@latest add gesh75/campus-nac-dot1x