300-715 · Question #207
An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network. What is…
The correct answer is D. The switch port is configured with authentication open. An endpoint receiving an access-reject message but still gaining network access indicates that the switch port is configured with authentication open, which bypasses 802.1X security.
Question
An engineer is configuring 802.1X and is testing out their policy sets. After authentication, some endpoints are given an access-reject message but are still allowed onto the network. What is causing this issue to occur?
Options
- AThe switch port is configured with authentication event server dead action authorize vlan.
- BThe authorization results for the endpoints include a dACL allowing access.
- CThe authorization results for the endpoints include the Trusted security group tag.
- DThe switch port is configured with authentication open.
How the community answered
(30 responses)- A13% (4)
- B7% (2)
- C3% (1)
- D77% (23)
Why each option
An endpoint receiving an access-reject message but still gaining network access indicates that the switch port is configured with `authentication open`, which bypasses 802.1X security.
The `authentication event server dead action authorize vlan` command applies when the RADIUS server is unreachable, not when it actively sends an access-reject message.
An access-reject message from the authorization server means access was denied, so the server would not have sent a dACL allowing access.
Similar to dACLs, a Trusted security group tag would only be assigned by the authorization server if access were granted, not after an access-reject.
The `authentication open` command on a switch port configured for 802.1X allows endpoints to gain network access even if they fail authentication (receive an Access-Reject) or if no authentication is performed, thereby bypassing the intended security controls.
Concept tested: Cisco switch 802.1X authentication open
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/b_sec_3se_3850_cg_chapter_0101.html
Topics
Community Discussion
No community discussion yet for this question.