Cisco ISE – Basic 802.1x With WindowsPart Three – Adding Network Devices (Authenticators)


KB ID 0001077 Dtd 17/06/15


Back in Part Two we configured the specific 802.1x policies in Cisco ISE. Remember with 802.1x it is a three tier system there is a supplicant, (a machine that wants to authenticate), the Authenticator, (the device the supplicant connect to, in our case a switch), and finally an Authentication server (Cisco ISE).

Below I will add our switch into ISE, as a RADIUS device and create some groups, and locations for good housekeeping.


1. From within ISE > Authentication > Network Resources > Network Devices > Network Devices > Add.

ISE Network Devices

2. Specify a name and description for the device > Set its IP address > Set the device type and location (we will change these in a minute) > Under authentication settings select RADIUS and enter a shared secret, (you can set these up globally if you prefer).

ISE Switch Radius

3. Create a Device Type: Administration > Network Devices > Network Device Groups > Groups > All Device Types > Add.

Note: You can have as many of these as you like to make managing your network easier, I'm just going to set one up for Cisco Switches.

Cisco ISE Add Device Type

4. Give the group a name and description > Submit.


5. Create a Location: On the same page > All Locations > Add.

Cisco ISE Add Location

6. Give the location a name and description > Submit.

ISE Locations

7. You can now go back to the network device you created earlier, and set the location and group accordingly.

Cisco ISe location and Type

8. Now you can configure the Cisco switch for RADIUS Authentication.

Note: is the IP address of the ISE server, and 666999 is the shared secret we setup in step 2.

Petes-3750(config)#aaa new-model 
Petes-3750(config)#aaa group server radius ISE
Petes-3750(config-sg-radius)#server-private key 666999
Petes-3750(config)#aaa authentication dot1x default group ISE
Petes-3750(config)#aaa authorization network default group ISE
Petes-3750(config)#dot1x system-auth-control
Petes-3750(config)#do write
Building configuration...

9. To configure the port that our supplicant is going to connect to;

Note: I'm setting the host-mode to multi-host because my clients are all in VMware ESXi and are coming from a VMware vSwitch into the Cisco switch.

Petes-3750(config)#interface fastEthernet 1/0/4
Petes-3750(config-if)#authentication host-mode multi-host
Petes-3750(config-if)# authentication port-control auto
Petes-3750(config-if)# dot1x pae authenticator
Petes-3750#write mem
Building configuration...

10. Once a supplicant has been authenticated you can check like so;

Petes-3750#show dot1x all summary
Interface PAE Client Status
Fa1/0/4 AUTH 0050.56b1.5f5c AUTHORIZED

Related Articles, References, Credits, or External Links

Cisco ISE - Basic 802.1x With Windows - Part Four - Configuring The Windows Clients (Supplicants)

Author: Migrated

Share This Post On