How to configure an integrated access switch

To configure an integrated access switch for secure network access, enable AAA, configure RADIUS servers, set up 802.1X and MAB authentication, and apply VLAN and interface policies.

Global Switch Configuration

1. Enable AAA and Authentication Methods Configure AAA to handle authentication, authorization, and accounting for 802.1X and MAB:

   aaa new-modelaaa authentication dot1x default group radiusaaa authorization network default group radiusaaa authorization auth-proxy default group radiusaaa accounting dot1x default start-stop group radiusaaa accounting system default start-stop group radiusaaa session-id commonaaa accounting update periodic 1440 This ensures the switch communicates with the RADIUS server (ISE) for authentication and accounting purposes .

2. Configure RADIUS Server Define the ISE nodes as RADIUS servers and specify authentication and accounting ports:

   radius-server host auth-port 1812 acct-port 1813 key For redundancy, configure multiple ISE PSN nodes to ensure continuous authentication service .

3. Set NTP and HTTP/HTTPS for URL Redirection Synchronize the switch with the same NTP server as ISE and enable HTTP/HTTPS for web authentication redirection:

   ntp server ip http serverip http secure-server

Interface-Level Configuration

1. Enable 802.1X and MAB on Ports Configure each access port to support 802.1X authentication and fallback MAB for non-802.1X devices:

   interface GigabitEthernet1/0/1 switchport mode access switchport access vlan 20 authentication host-mode multi-auth authentication port-control auto mab dot1x pae authenticator spanning-tree portfast edge

2. Apply Pre-Authentication ACLs and VLANs Use pre-authentication ACLs to restrict traffic before authentication and assign VLANs dynamically based on ISE policies .
3. Enable IP Device Tracking For IOS-XE switches, enable IP device tracking to monitor endpoint connectivity:

   ip device tracking

4. Configure FlexAuth (Optional) FlexAuth allows multiple authentication methods on a single port, providing flexibility for BYOD or guest devices.

Advanced Features

• Change of Authorization (CoA): Configure the switch to accept CoA messages from ISE to dynamically change VLANs or ACLs after authentication.
• Downloadable ACLs (dACLs) and Security Group Tags (SGTs): Apply policies dynamically based on user or device identity.
• Redundancy and Failover: Ensure multiple ISE nodes are configured to maintain access if one node is unreachable .

Verification and Testing

• Use commands like show dot1x all, show authentication sessions, and show radius to verify authentication status and RADIUS connectivity.
• Test with both 802.1X-capable devices and MAB devices to ensure fallback works correctly . By following these steps, an integrated access switch can securely enforce network access policies, dynamically assign VLANs, and integrate seamlessly with Cisco ISE for identity-based network control.