topic Re: ISE LDAP to MFA server in Network Access Control

ISE LDAP to MFA server

cscotty1972 — Wed, 20 Nov 2019 16:18:40 GMT

I am in the process of trying to setup an LDAP connection to a MFA proxy server. I am able to test bind the connection and can see the connection on the MFA proxy server. The issue is when I try to login to a Nexus switch I have setup in ISE using tacacs+ for device admin. I never see anything from ISE on the MFA server when this request is done.

Here is what I am seeing in ISE:

13005	Received TACACS+ Authorization Request
	15049	Evaluating Policy Group
	15008	Evaluating Service Selection Policy
	15048	Queried PIP - Network Access.Protocol
	15048	Queried PIP - DEVICE.Device Type
	15041	Evaluating Identity Policy
	15013	Selected Identity Source - MFA_test
	24031	Sending request to primary LDAP server - MFA_test
	24016	Looking up user in LDAP Server - MFA_test
	24019	LDAP connection error was encountered - MFA_test ( Step latency=45001ms)
	22059	The advanced option that is configured for process failure is used
	22062	The 'Drop' advanced option is configured in case of a failed authentication request

I am still learning so I am sure there is something I am missing. Are there any other tools on ISe that would assist with investigating this? I am working on setting up sniffer so I don't have that info yet.

Re: ISE LDAP to MFA server

Jason Kunst — Fri, 22 Nov 2019 23:02:35 GMT

I don't think this is possible integration point. You can link together like DUO via a RADIUS proxy server like here but not via LDAP that i know of unless your RADIUS proxy can integrate

https://community.cisco.com/t5/security-documents/how-to-deploy-ise-device-admin-with-duo-mfa/ta-p/3821231

I also tag my coworker @hslai to see if she can take a look

Re: ISE LDAP to MFA server

hslai — Mon, 25 Nov 2019 22:27:27 GMT

Please note MFA may need longer timeouts because it usually waits for the user to respond (e.g. generating a new one-time password).

A couple of things to check:

ISE able to connect to the MFA proxy server via LDAP
- In ISE, verify the test connection
- In MFA proxy, check the connection logs
LDAP server timeouts
- In ISE, each LDAP server connection may have its own timeout and 99 seconds max
- In MFA proxy, check the vendor doc.