topic Re: Use cisco-av-pair with database query. in Network Access Control

Use cisco-av-pair with database query.

rhobab — Mon, 21 Jan 2019 11:27:10 GMT

We currently are validating the computers that access the network by the uid in the cisco-av-pair. For this we have conditions to validate the uid. While this worked fine with a few computers connecting via AnyConnect the amount of machines has increased greatly and the conditions have become unmanageable.

We have been looking for a way to validate the uid against a database at the time of authentication / authorization. We would insert the known uids into a database. The idea being to authenticate the user against the Active Directory and validate the uid against the database at the time of connection.

Does anyone know of a way to do this?

Thanks

Victor

Re: Use cisco-av-pair with database query.

Peter Koltl — Tue, 22 Jan 2019 22:24:09 GMT

Remote access or 802.1X ?

Re: Use cisco-av-pair with database query.

rhobab — Tue, 22 Jan 2019 23:03:07 GMT

Remote access.

Re: Use cisco-av-pair with database query.

Surendra — Wed, 23 Jan 2019 20:54:18 GMT

When you said “We currently are validating the computers that access the network by the uid in the cisco-av-pair”, May I know where this UID is configured and how you are validating it on the ISE ? perhaps a screenshot would help to understand your current setup better before providing any suggestions.

Re: Use cisco-av-pair with database query.

rhobab — Thu, 24 Jan 2019 12:08:57 GMT

As far as I know the uid is automatically generated when you install AnyConnect on the computer. It appears in the ISE logs as mdm-tlv-device-uid.

[cid:image002.png@01D4B3DD.ED261FB0]

Re: Use cisco-av-pair with database query.

Surendra — Thu, 24 Jan 2019 19:21:31 GMT

If the UID is generated when you install AnyConnect on a machine, may i know what are you validating it against? Wouldn't any machine with AnyConnect have a UID in that case and kind of unreliable?

Re: Use cisco-av-pair with database query.

rhobab — Mon, 28 Jan 2019 08:45:20 GMT

It is being validated against a condition in an authorization rule. Any machine with AntConnect has a UID which is randomly generated. In my opinion it is reliable.