ISE - RADIUS AUTHENTICATION - Match on AD Group Membership to base Identity Source

jason.erbe — Wed, 22 Jan 2020 03:21:36 GMT

Is it possible to match upon initial Authentication against an AD Group to then have a different Identity Source used?

Generally I'm only aware of it being possible to match against an AD Group AFTER a User has authenticated via an Authorization Policy. Use Case is for VPN users, and the client wants to slowly role out changing authentication sources (AD to MFA). I've gotten the standard method I'm aware of working, which is via matching on a different Group-Policy and/or Tunnel-Group from the ASA, but they were looking for an easier method to deploy to end users.

If they can't get it to work this way, then I'll just work on modifying the AnyConnect Profile to point to the new FQDN URL and call it good, but I wanted to ask this space if they had ever tried matching against AD Group during initial Authentication Queries.

I'm thinking not, the more I think of it, as the endpoint/user hasn't been sent to the Identity Source which would then pull/provide those details.

Re: ISE - RADIUS AUTHENTICATION - Match on AD Group Membership to base Identity Source

Francesco Molino — Wed, 22 Jan 2020 04:38:49 GMT

Hi

You can't use ad group in the authentication rule, only on authorization.
You need to differentiate using other attributes like you said.

topic ISE - RADIUS AUTHENTICATION - Match on AD Group Membership to base Identity Source in Network Access Control

ISE - RADIUS AUTHENTICATION - Match on AD Group Membership to base Identity Source

Re: ISE - RADIUS AUTHENTICATION - Match on AD Group Membership to base Identity Source