topic How do I authenticate users in a specific AD group with Cisco IS in Network Access Control

How do I authenticate users in a specific AD group with Cisco ISE

Christopher Stuewe — Mon, 11 Mar 2019 02:42:28 GMT

I have ISE up and running authenticating properly. But right now it will authenticate and allow ANY account in Active Directory. I want to allow access to only users in a specific group in Active Directory. I have added the group under Administration>Identity Management>External Identity Sources>Active Directory>Groups. But, I have not been able to find a way to link membership in that group to the Authentication Policy rules.

Re:How do I authenticate users in a specific AD group with Cisco

Tarik Admani — Mon, 22 Oct 2012 16:38:00 GMT

Hi,

You will have to add the group in you AD settings.

Then you can map that group in you authorization profile.

Thanks

Sent from Cisco Technical Support Android App

How do I authenticate users in a specific AD group with Cisco IS

Christopher Stuewe — Mon, 22 Oct 2012 18:13:36 GMT

Yes, I understand that. I have added the group in AD settings.

What I need to know is HOW do I map that group to the auth profile?

How do I authenticate users in a specific AD group with Cisco IS

Tarik Admani — Mon, 22 Oct 2012 20:31:20 GMT

Under your Authorization policy, when you add the condition, choose the advanced option, there you should see an option for AD (select that) then the ExternalGroup option should appear. Set that attribute option equal to the AD group you are after.

Thanks,

Tarik Admani
*Please rate helpful posts*

How do I authenticate users in a specific AD group with Cisco IS

Christopher Stuewe — Mon, 22 Oct 2012 20:46:21 GMT

Thanks for the reply.

I'm not getting AD as an option (see below). Any idea why that might be?

How do I authenticate users in a specific AD group with Cisco IS

Tarik Admani — Mon, 22 Oct 2012 20:51:47 GMT

Chris,

I dont know where you are with the screenshot but follow this path:Policy > Authorization > (on the rule you want to limit AD group access) Select Attribute > Create New attribute (Advanced) the AD option should appear there. Currently the box i am using isnt joined to AD so I can't show you how it looks.

Thanks,

Tarik Admani
*Please rate helpful posts*

How do I authenticate users in a specific AD group with Cisco IS

Christopher Stuewe — Mon, 22 Oct 2012 21:15:26 GMT

Disregard above. I was looking in Authentication not Authorization rules.

How do I authenticate users in a specific AD group with Cisco IS

Christopher Stuewe — Mon, 22 Oct 2012 21:26:50 GMT

Thank you very much. That was the step I was missing. It works the way I want it to now.

How do I authenticate users in a specific AD group with Cisco IS

manjeets — Wed, 22 May 2013 09:37:36 GMT

Kindly review the below link:

https://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf