topic ISE: Auth computer based on AD group in Network Access Control

ISE: Auth computer based on AD group

Philip Vilhelmsson — Mon, 11 Mar 2019 02:48:43 GMT

Hi,

I am trying to get ISE to check if a computer is in a specific Active Directory group and then authorize based on that information.

I have connected ISE to Active Directory and successfully added the group domain.com/Users/Domain Computers and then under Authorization I have added the policy IF Any AND domain.com:ExternalGroups EQUALS domain.com/Users/Domain Computers Then PermitAccess.

It is the first rule in the list.

But this doesn't seem to work. The computer goes to the last Default rule. Did I forget to do something?

Regards,

Philip

ISE: Auth computer based on AD group

nspasov — Tue, 20 Nov 2012 19:18:37 GMT

Hello Philip-

Can you post screen shots of the live authentication event (both the first page and then the details). Also, can you post screen shots of how your supplicant (Machine client) is configured

Re: ISE: Auth computer based on AD group

Philip Vilhelmsson — Tue, 20 Nov 2012 20:17:02 GMT

Hi Neon.

I can't show you exactly that at the moment since I did try some thing else before I went home. I made profiling based on if the computer hostname contains 'xx' and if it is a microsoft workstation. Then I made a new authorization policy under the AD one and saw that the computers hit the new policy.

But to my knowledge the client should still hit the AD policy first.

I have some screens from that (some names are in swedish, let me know if you want a translation of those). To me it looks like it hits the wrong Identity Store.

I don't have a screen of the supplicant at the moment. How should it be configured?

Re: ISE: Auth computer based on AD group

Philip Vilhelmsson — Tue, 20 Nov 2012 20:40:55 GMT

I did some changes to the Authentication Policy:

Before the Default part was set to Internal Endpoints.

Now it fails authentication with the following log:

So now it is actually checking AD but it is checking for User, not computer name.

Any ideas?

Re: ISE: Auth computer based on AD group

jan.nielsen — Tue, 20 Nov 2012 21:01:56 GMT

It looks to me like all the authentication log screenshots you have sent are when your switch is using mac bypass (mab), which of course won't work with AD authentication, unless of course you have the mac address of all your pc's in your AD (which you normally don't).

Basically you need to configure your windows supplicant for either wired dot1x peap or eap-tls and your switch also need to have dot1x in the "authentication order" and "authentication priority" commands on the switchport your pc is connected to.

Here is a few screenshots of how i did my testlab ise setup :

authentication rules :

Authorization example, you could put this at the very top, just to make sure you don't have any broader rules that it can match further down in you rules.

ISE: Auth computer based on AD group

Philip Vilhelmsson — Wed, 21 Nov 2012 06:55:41 GMT

Thank you. It seems that I had a knowledge gap on how this works. For some reason I believed that ISE would take the hostname of the computer and check if it excists in AD, without aditional config(.1x) on the host.

When I look in the switch log I see that 802.1x fails and it authenticates the computer on MAB.

ISE: Auth computer based on AD group

dirkmelvin — Fri, 15 Feb 2013 17:01:10 GMT

Can anyone tell me if this can also be done to VPN clients?

We are using an ASA 5515X for incoming VPN using Anyconnect 3.1.02026 and NAC Agent v4.9.0.47

Would like to be able to restirct access to the network in general, or even specific network devices based on workstation group memebership or non AD member workstation.

(i.e. all corporate assets can come through VPN and get to all network resources based on their department, however, when contrators come through the VPN their systems are not in AD, therefore they can only get to specific systems on the LAN, or we have certain specific users that work from home using their personal system and we only want them to access specific systems on the LAN)

Thanks in advanced,

ISE: Auth computer based on AD group

ccsipaul01 — Fri, 15 Feb 2013 17:11:30 GMT

Hey Dirk

Have you tried in the authz policy, domain group not equal domain computers?

Using a not equal might solve your problem.

Thanks!

ISE: Auth computer based on AD group

shekharmore003 — Fri, 22 Feb 2013 20:58:59 GMT

If you just want to authenticate VPN users through ISE you can use your existing ISE node but If you want to do CoA for VPN users then you have to use Inline Posture node.

Please have supplicant setting as follows for machine auth.... This can be an issue

ISE: Auth computer based on AD group

dirkmelvin — Sat, 23 Feb 2013 02:32:03 GMT

How do you get to that 802.1x setting for the VPN?

Re: ISE: Auth computer based on AD group

shekharmore003 — Mon, 25 Feb 2013 15:03:01 GMT

Not 802.1x settings. You just have to configure ISE as a radius server on VPN for VPN access . And have the poilicies for VPN users in ISE. It will be just normal Radius server and client communication.

Re: ISE: Auth computer based on AD group

dirkmelvin — Tue, 26 Feb 2013 15:26:01 GMT

But I am trying to get 2 factor authentication going here.

First being the username/password, 2nd being the machine login to the domain

How would I set that up?

Re: ISE: Auth computer based on AD group

shekharmore003 — Tue, 26 Feb 2013 15:44:32 GMT

Hello Dirk,

You are talking about MAR (Machine Access Restrictions). I think Cisco has introduced 802.1x for ASA in 9.0 IOS.

http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/aaa_trustsec.html

If you just want a simple Radius authentication for VPN users, let me know.

Re: ISE: Auth computer based on AD group

nspasov — Tue, 26 Feb 2013 16:40:47 GMT

I could be wrong but I don't think EAP type VPNs are supported even in 9.x code

Re: ISE: Auth computer based on AD group

shekharmore003 — Tue, 26 Feb 2013 20:16:44 GMT

Hello Neno,

I am also not sure but in following doc say that "eap-proxy" command enables EAP which permits the security appliance to proxy the PPP authentication process to an external RADIUS authentication server.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/l2tp_ips.html

The ASA only supports the PPP authentications PAP and Microsoft CHAP, Versions 1 and 2, on the local database. EAP and CHAP are performed by proxy authentication servers. Therefore, if a remote user belongs to a tunnel group configured with the

authentication eap-proxy

authentication chap

commands, and the ASA is configured to use the local database, that user will not be able to connect.

Re: ISE: Auth computer based on AD group

nspasov — Fri, 01 Mar 2013 16:41:09 GMT

That is very interesting. Thank you for sharing (+5 from me). I am by no mean a VPN expert so it will be interesting to lab this out and see how it works out. Have you had the chance to play with it?

Re: ISE: Auth computer based on AD group

shekharmore003 — Fri, 01 Mar 2013 17:04:08 GMT

No, Actually I havent tried this yet. Just share a result if you try this in lab. If I get a chance to test this, I will share a result with you. Thanks

Re: ISE: Auth computer based on AD group

dirkmelvin — Tue, 19 Mar 2013 16:44:46 GMT

From all that I have learned so far, the only way the ASA can talk to the ISE IPN is via RADIUS.and that takes a lot of options out of play for VPN users/machine authentications.

Ideally we would like to verify that both the user and the machine are members of the domain before we allow full access to our network. Better still would be certificate verification for any machines that are members of our domain.

At this time we have settled for a simple NAC agent read of a specific registry key that says the machine is a member of our domain. Primitive, yes, but does what we need for now.

Now my challenge is contractor systems...we have about 30 of them....and I am afraid that to read a registry key for the exact machine name they give us upon signing our access agreement means that I have to create 30 different policies to make it read the registry key over and over as it goes through each policy.

Is there some way to make a list in a policy, so that instead of 30 different policies, I have one policy that reads through a list of possible texts that would be acceptable?

Dirk

ISE: Auth computer based on AD group

manjeets — Wed, 22 May 2013 10:38:04 GMT

Kindly review the below link:

https://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf

Re: ISE: Auth computer based on AD group

siryonz — Wed, 19 Jun 2024 07:30:42 GMT

did you ever get this to work? thanks