topic Hi in Network Access Control

Limit concurrent radius logins

dan.letkeman — Mon, 11 Mar 2019 07:31:11 GMT

Hello,

Does anyone know how to limit concurrent radius logins with ISE. I am running version 2.1 and I can't seem to find the place where I can set this. I don't do onboarding and I don't use the guest system. I just want to limit the basic radius authentication either by concurrent connections or perhaps by AD users?

Thanks,

Dan.

Hi

Francesco Molino — Tue, 07 Mar 2017 01:59:55 GMT

Is it for wireless authentication? You can limit on the wlc or on the active directory itself.

For AD I don't remember but searching on Google you should be able to found it.

I don't know for latest version but you aren't able to limit that through ISE.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

Yes this is for wireless

dan.letkeman — Tue, 07 Mar 2017 14:30:20 GMT

Yes this is for wireless authentication.

Limiting this on AD won't work for us, as we use these accounts for BYOD and for local device logins. Limiting this on the WLC also won't work as we don't want to limit this for everyone, and limiting it on the controller is a global setting.

I find it odd that many of the alternative NAC's can limit radius logins.

Dan.

Hi

Francesco Molino — Tue, 07 Mar 2017 16:50:56 GMT

On ISE you can limit for guest, you can limit the number of devices per Users that should be enrolled but not limit the number of connections. Again, you can see on latest ISE release notes if that changed.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

Just installed the latest

dan.letkeman — Mon, 13 Mar 2017 19:09:45 GMT

Just installed the latest version 2.2 and it seems to have this feature now, but you can't use AD groups or users for the authentication data source. Only internal users and groups are selectable for the authentication source for the "Max Sessions" option.

Does anyone know if adding external identity sources for "Max Sessions" will be on the road map?

Thanks,

Dan.

Looks like it is supported in

dan.letkeman — Tue, 18 Apr 2017 15:32:05 GMT

Looks like it is supported in 2.2. I tested it out against active directory logins and it works.

http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/204463-Configure-Maximum-Concurrent-User-Sessio.html#anc2

However, it is a global setting that, as far as I know, cannot be bypassed with policies. Also, the group setting does not apply to active directory, only to local ise users.

Hi

Francesco Molino — Tue, 18 Apr 2017 21:01:29 GMT

Thanks for your message. I've migrated or POC system in 2.2 and I'll test it tomorrow

Thanks

No need to test it. I

dan.letkeman — Tue, 18 Apr 2017 23:29:26 GMT

No need to test it. I already did. It works, but is only a global setting.