Refer to the exhibit. What will occur when this device tries to connect to the port?
Refer to the exhibit. What will occur when this device tries to connect to the port?
The provided configuration includes the command 'dot1x pae authenticator,' which means that the port is enabled for 802.1X authentication. The configuration does not mention MAC Authentication Bypass (MAB), so options involving MAB can be excluded. Given this configuration and assuming that the supplicant (the connecting device) correctly supports and is configured for 802.1X, the device will be able to communicate with the authenticator (the switch), thus allowing 802.1X authentication to take place. Therefore, the device will be allowed on the network.
There is no MAB in the config. So any question with MAB working is false. D is fasle. Dot1x config is correct. As there is no info that the client is misconfigured it is B
B is the answer guys. Cheers
look at the description on the port, it says dot1x port. Leading me to believe that B is the correct answer. The device (workstation) will be allowed on the network.
Hello, maybe I'm wrong but : - A and D are wrong answers because "mab" is missing in the interface configuration Regarding 802.1X : The interface configuration is OK. Even if there is no information regarding the policies, the supplicant (which supports 802.1X (a notebook for instance)) can communicate with the Authenticator (the swich) using the 801.1X protocol. And thus, the answer C should be excluded. The only answer which remains is B. And more precisely regarding the answer B : It is sure that "802.1X will work" but it is not that "the device will be allowed on the network" (because it depends on the Authentication as well as the Authorization (which are validated and authorized by the server (ISE))
802.1X will not work and the device will not be allowed network access
... ok after rethinking this question I need your help guys WHAT DEVICE - this question make no sense, what do they mean a PC, Printer, Phone, Access Point, I dont get it??
C its so Easy. The config is missing "dot1x pae authenticatior" so 802.1x will not work. MAB also will not work since interface is missing mac auth config
I am so very blind. Never mind the C.... completely wrong on my part.
There is a voice vlan in the config so I would assume there is a desktop phone and the config is missing MAB.
I will go with A: In the given configuration, the line "dot1x pae authenticator" is present. This command enables the switch interface to act as an authenticator for 802.1X authentication. However, the configuration does not include any specific 802.1X authentication settings such as the EAP (Extensible Authentication Protocol) method or RADIUS server information. Additionally, the line "switchport mode voice vlan 44" indicates that the interface is configured to use a Voice VLAN. This suggests that the device connecting to this port might be a VoIP phone, which typically uses MAB for authentication rather than 802.1X. Therefore, when this device tries to connect to the port, 802.1X authentication will not work because it is not configured properly. However, since MAB is enabled by default when 802.1X fails, MAB will start and allow the device on the network.
Looks like something is missing in the question. "What will occur when this device" - what is this device? authentication port-control auto is missing from the config so it will not be forced by switch to initiate authentication = device will be just put to access vlan, in fact MAB is not cofnigured for authenticaiton, but device while not being asked, will present itself with MAC and just be allowed? I will vote for A
Looks like something is missing in the question. "What will occur when this device" - what is this device? authentication port-control auto is missing from the config so it will not be forced by switch to initiate authentication = device will be just put to access vlan, in fact MAB is not cofnigured for authenticaiton, but device while not being asked, will present itself with MAC and just be allowed? I will vote for A
The "authentication port-control auto" command is not missing :) The "access-session port-control auto" command instructs the switch port to rely on 802.1X authentication for access control. Devices need to successfully authenticate to gain access, and the switch automatically grants access upon successful authentication.
it is policy based decision and either MAB Dot1x web auth or whatever can be used
C or D
i think A because there is no "mab" command in provided config.
D is correct as we don't know if the device "will be allowed" (i. e. options A, B, C). Instead "ISE can use policy to determine the access level" = option D. In this case, the new style of auth. configuration is used with "policy-map type control subscriber", which provides very wide range of parameters by which connected devices and their sessions can be matched and authenticated / authorized / denied. All types of authentication can be used - Dot1X, MAB, WebAuth. Example: policy-map type control subscriber CONCURRENT_DOT1X_MAB_WEBAUTH event session-started match-all 10 class always do-until-failure 10 authenticate using mab priority 20 20 authenticate using dot1x priority 10 (rest ommited for brevity) Reference: https://www.cisco.com/en/US/docs/ios-xml/ios/san/configuration/xe-3se/3850/san-cntrl-pol.html
Even with the new style policy maps & service polices (IBNS v2) you still need mab enabling on the switch port, so answer is A.
Sorry, I meant B, not A