MS Access Policy Re-Authentication Interval Advice

[Zimeroski]

Hello,

I am wondering if anyone out here has used the "re-authentication interval" option for access policies on MS switches. 

I have some VoIP devices that have been having issues, and it looks like they go into "critical auth" every once in a while. When they do this, I cannot get the client attached to the port the policy is on to come alive until I remove the policy and cycle the port then re-apply the policy.

The option sounds like it would help but I can't find much more info than what's in the standard documentation. So, I was wondering if anyone was using it and what the interval should be set to.

[alemabrahao]

Re-authentication Interval
When the Re-authentication Interval (time in seconds) is specified, the switch will periodically attempt authentication for clients connected to switch ports with access policies. Apart from providing for a better security policy by periodically validating client authentication in a network, the re-authentication timer also enables the recovery of clients placed in the Failed Authentication VLAN because of incomplete provisioning of credentials.

Re-authentication will not occur if no re-authentication interval has been configured, or if a reauthentication-interval has been configured but the switch has lost connectivity to all of the RADIUS servers listed under the access policy.

MS Switch Access Policies (802.1X) - Cisco Meraki Documentation

[DarrenOC]

The re-auth internal default on most platforms ie ISE and Clearpass is 30 minutes.

[ChrisC83]

The fact that the clients went to "critical VLAN" indicate they may fail the authentication or fail to reach the Radius servers. It seems the clients were unable to recover when the Radius servers come back, may want to try to enable the Radius server monitoring function to see if this can help the switch bouncing the port and trigger the reauthentication for the clients again.