300-715 · Question #335
A network administrator is configuring a new access switch to use with Cisco ISE for network access control. There is a need to use a centralized server for the reauthentication timers. What must be c
The correct answer is A. Issue the authentication timer reauthenticate server command on the switch.. To centralize reauthentication timers with Cisco ISE, the network administrator must configure the authentication timer reauthenticate server command on the access switch. This command instructs the switch to use the reauthentication timeout value pushed by the RADIUS server, rat
Question
A network administrator is configuring a new access switch to use with Cisco ISE for network access control. There is a need to use a centralized server for the reauthentication timers. What must be configured in order to accomplish this task?
Options
- AIssue the authentication timer reauthenticate server command on the switch.
- BConfigure Cisco ISE to block access after a certain period of time.
- CConfigure Cisco ISE to replace the switch configuration with new timers.
- DIssue the authentication periodic command on the switch.
How the community answered
(28 responses)- A86% (24)
- B4% (1)
- C11% (3)
Why each option
To centralize reauthentication timers with Cisco ISE, the network administrator must configure the `authentication timer reauthenticate server` command on the access switch. This command instructs the switch to use the reauthentication timeout value pushed by the RADIUS server, rather than a locally configured one.
The `authentication timer reauthenticate server` command configures the switch to accept and apply the reauthentication timer value provided by the RADIUS server (Cisco ISE) during the authentication process. This allows for centralized management of reauthentication intervals, ensuring consistency across the network from a single policy engine.
Configuring Cisco ISE to block access is a policy enforcement action, not the mechanism for centrally managing or pushing reauthentication timers.
Cisco ISE pushes dynamic attributes like reauthentication timers, but it does not directly replace or modify the switch's persistent configuration.
The `authentication periodic` command enables periodic reauthentication, but it does not, by itself, enable the use of a centralized server for the timer value.
Concept tested: Cisco switch 802.1X reauthentication timer server configuration
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-12/configuration_guide/sec/b_1612_sec_9300_cg/nm_dot1x_config.html#concept_f5b_r53_qyb
Topics
Community Discussion
No community discussion yet for this question.