802.1x Deployment with Nexus 3000 Switches

[nspasov]

I have a customer that manages a highly secure network and they are now being asked to implement dot1x on switches that are providing network access to their servers. The switches that they use are 3100 series Nexus switches.

I checked the latest compatibility matrix for ISE and those switches are not listed. The NX-OS documentation does indicate that there is some support for dot1x but I saw no references that would indicate support for CoA:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/security/7x/b_Cisco_n3k_Security_Config_7x/b_Cisco_n3k_Security_Config_7x_chapter_010000.html

So, here are my questions:

1. Has anyone done a dot1x deployment with Nexus 3100 switches? If yes, any feedback would be greatly appreciated
2. Anyone aware if CoA is supported or on the roadmap for NX-OS?
3. Any suggestions on a better/different approach here?

Thank you!

Neno

[hslai]

I moved this from Identity Services Engine (ISE) to Data Center as the inquiries are specific to NX-OS.

Network Infrastructure at SalesConnect has a Customer Facing Content on Nexus 9000 Greensboro - NX-OS 7.0(3)I7(1) Release TDM Deck, which has a couple of slides showing 802.1X configuration, but nothing on RADIUS CoA. Anything further, please check with the NX-OS support teams.

[gbekmezi-DD · Accepted solution]

No first hand experience. However, looks like you shouldn’t have a problem with 802.1x https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/security/7x/b_Cisco_n3k_Security_Config_7x/b_Cisco_n3k_Security_Config_7x_chapter_010000.html I would not have any expectation that these switches support CoA.

Regarding your question on a better or different approach, you’d have to provide more details in order to get relevant responses.

George