topic Re: Authentication policies order of operation with multiple join points in Network Access Control

Authentication policies order of operation with multiple join points

Madura Malwatte — Wed, 05 Jun 2019 15:57:51 GMT

I just wanted to confirm the behaviour, where I have two active directory join points in ISE. If I am not using scope mode or All_AD_Join_Points in Identity Source Sequences can I have multiple authentication policies with a single AD join point?

Example, I have two authentication polices with identical condition, but each one is referencing a different join point. If the user is not found in AD-server1 in rule 802.1x AD1, will ISE move to the next rule 802.1x AD2 and check the user in AD-server2?

Re: Authentication policies order of operation with multiple join points

Aravind Ravichandran — Wed, 05 Jun 2019 16:17:18 GMT

No, it will check the first policy and get rejected if the user is belong to AD server 2. As you have mentioned if user not found reject.

Re: Authentication policies order of operation with multiple join points

Madura Malwatte — Wed, 05 Jun 2019 16:56:00 GMT

Thanks for the reply. So the way around it is to use "If User not found - CONTINUE" option so the second authentication policy is checked?

And also using a scope with both join points or identity source sequence with each individual join point would work with REJECT option right?

Re: Authentication policies order of operation with multiple join points

Sathiyanarayanan Ravindran — Wed, 05 Jun 2019 19:17:02 GMT

If you provide condition continue it will move to the authorization policy.

You can create a identity source sequence for AD1 and AD2. So that if the user not found on AD1 , then it will do the look up on AD2. This will happen based on the sequence you have defined.

Re: Authentication policies order of operation with multiple join points

Aravind Ravichandran — Wed, 05 Jun 2019 23:33:30 GMT

Yes correct, user not found - continue option is used in case of guest user with mab authentication. And for dot1x, create a identity sequence and call both the AD and select the option as move to next identity store.

Re: Authentication policies order of operation with multiple join points

kthiruve — Tue, 18 Jun 2019 00:37:04 GMT

Scope is used to have multiple join points. These join points may not be trusted. You will be using the scope in the auth policy or Identity source sequence. At that point ISE checks the join points in the scopes or Identity source sequence since it is part of the same policy, "The USER not found = Reject" does not impact as long as the join points, User stores are part of scopes or ISS.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html#concept_2D3FDBAD9F50469BA09704BF409209C7

Thanks

Krishnan