topic Cisco ISE NAC Agent RDP session in Network Access Control

Cisco ISE NAC Agent RDP session

jms112080 — Mon, 11 Mar 2019 03:08:31 GMT

Is there a way to get the NAC Agent to run when a user logs on a Windows machine in a RDP session?

fyi, the device which will

Saurav Lodh — Tue, 22 Apr 2014 09:40:25 GMT

fyi, the device which will give services of RDP to other clients should have NAC if it has to be part of any network.

You have to go and check the

ankur1984 — Fri, 02 May 2014 13:13:14 GMT

You have to go and check the dACL that is part of authorization profile, you will find that it is blocking your RDP access as when you do a remote desktop your authentication token is host/machine-name.domain. Now, the easiest FIX to permit RDP traffic is to modify the dACL but this won't solve your problem. Why? Because now your dACL will allow you do a remote desktop now BUT it will block rest of your communication.

So either you permit all as soon as your machine is authenticated or you will continue to face this issue.

Hi ankur1984How can I permit

nicanor00 — Thu, 02 Oct 2014 09:40:57 GMT

Hi ankur1984

How can I permit RDP for one user only ?

for exemple windows user login administrator_123 ?

regards

Microsoft supplicant does not

Emerson Oliveira — Thu, 02 Oct 2014 13:46:44 GMT

Microsoft supplicant does not support 802.1X & RDP sessions per user, as detailed in http://support.microsoft.com/kb/2820847. An alternative is to adopt the supplicant Cisco AnyConnect NAM (Network Access Manager), which is free and supports RDP sessions & 802.1x for user.

Microsoft supplicant does not

Emerson Oliveira — Thu, 02 Oct 2014 13:47:12 GMT

Hi Nicanor00,Unfortunately in

ankur1984 — Mon, 06 Oct 2014 13:26:18 GMT

Hi Nicanor00,

Unfortunately in the current scenario you can only user machine authentication to create your authorization profiles or you can use 'security reports' suggestion but i haven't tried that personally.

thanks,

Ankur

Thanks for sharing your

ankur1984 — Mon, 06 Oct 2014 13:30:37 GMT

Thanks for sharing your thoughts securityreports but i have a mandate be implement this without a supplicant and hence the challenge.

-Ankur