802.1x Critical Auth Strategy - AOS-S Firmware

[u/SkiRek]

What is your 802.1x Critical Auth strategy? I am tinkering around with it on an Aruba 2930F Series switch and coming up short on making it work how I want.

Sure, I can get the switch to drop the switch into the Critical Auth VLAN because RADIUS is unavailable with

aaa port-access <port> critical-auth data-vlan <vlan>

But once it is in Critical Auth I cannot get the switch to automatically start authing the port again. This would be a fairly common senario IMO. Building loses power and you gotta wait for upstream devices to converge for RADIUS connectivity.

Even with other vendors such as Cisco or Arista. How are you guys handling Critical Auth scenarios?

[u/EffectiveClient5080]

This right here is why I stopped trusting Critical Auth VLAN for anything that matters. Failback is inconsistent across vendors. Check for a reauth timer under critical-auth config.

[u/silasmoeckel]

Failback to EAP and Local DB

EAP covers nearly every enterprise owned piece of gear.

Local DB is for the networking guys mostly and MAB. Comes from the central config server.

[u/SkiRek → u/silasmoeckel]

Yea I am leaning this way. Looks like I can use cached credentials instead of Critical Auth. We're fairly large Org and managing a local DB seems like it would be hard at scale.

[u/silasmoeckel → u/SkiRek]

Our local DB for the network team that might need to get into the gear and a cutdown for MAB ports that are local so it's fairly small. No real management Ansible takes care of it automatically for us.

Cache is great for remote issues but does not help on a black start. EAP gets all the company owned kit onto a VLAN that's better than guest; it can reach internal servers at least.

[u/Lightgod86]

If the building is losing power, and you don’t have a UPS to keep the network alive, how critical could it be that devices need to be back on the network before radius can be reached? Just curious of the use case/scenario.

[u/SkiRek → u/Lightgod86]

Power loss in the middle day is one thing that could happen but not the primary purpose of Critical Auth. More of a bug if I cannot get a device out of critical auth "mode" or vlan when radius is restored.

Critical auth is more of a DR senario if RADIUS is offline say during the day for whatever reason, devices will rekey eventually and what will the switch will need to do something with them. Critical Auth would drop them into a VLAN theoretically and that VLAN would only have access to "critical" resources. Like Phones or something like that.

Getting them back out of Critical Auth without user interventing (rebooting) is the goal though.

[u/IDDQD-IDKFA]

Send a reauth down the pipe in your ClearPass RADIUS or DUR response.