topic Cisco ISE - AD & Group Managed Service accounts in Network Access Control

Cisco ISE - AD & Group Managed Service accounts

dselfridge — Mon, 08 Apr 2019 13:02:49 GMT

We're about to deploy Cisco ISE to a customer site and they have asked the question...

"Will ISE work with a Group Managed Service Account? These are service accounts that have their passwords changed periodically."

Now, I'm assuming that if the password changes and Cisco ISE supports gMSA, then it will 'learn' the new password and won't get cut off from AD?

TIA

Dan

Re: Cisco ISE - AD

Jason Kunst — Mon, 08 Apr 2019 14:07:33 GMT

The account is used for adding ISE as a computer. Once the computer account is added then it should be fine.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html#reference_F19556CAD5C949B58DF89334E2C6255D

Re: Cisco ISE - AD & Group Managed Service accounts

hslai — Mon, 08 Apr 2019 14:43:09 GMT

Like Jason Kunst posted, ISE AD runtime is similar to any Windows PC so that it uses its own computer account in AD to authenticate AD users and retrieve their attributes for authorization.

The places where ISE needs an AD user password stored are:

LDAP -- use AD as a LDAPv3 ID store
AD providers in Passive ID -- retrieve Kerberos security events from AD DCs.

These two functions are not currently working with gMSA password change mechanism, so we would need update the passwords manually if such accounts are used.