topic Sync ISE local user groups with external groups via LDAP in Network Access Control

Sync ISE local user groups with external groups via LDAP

rmueller@cisco.com — Mon, 10 Dec 2018 16:24:26 GMT

Hi all,

got the following request from one of my customers: They want to use ISE for device administration and want to do authentication as well as authorization based on group membership local on ISE. The users are also stored within AD, and of course they are also a member of a certain groups within AD. AD is attached to ISE via LDAP.

Now they would like ISE to synchronize group membership between LDAP and ISE, which means, if a group membership in LDAP is changed, ISE should reflect this change in the local database as well.

The reason why they want to do it this way is to be independent from Active Directory availability. If AD is not reachable, proper authentication/authorization still should happen.

Is there someone out there already doing this? Of so, how?

Any comment is welcome.

Roland

Re: Sync ISE local user groups with external groups via LDAP

Surendra — Mon, 10 Dec 2018 17:14:46 GMT

No, there is no option as such on the ISE to synchronize group membership.

Re: Sync ISE local user groups with external groups via LDAP

Arne Bier — Mon, 10 Dec 2018 19:14:37 GMT

I might be wrong here, but ACS had a feature that would allow to shadow the AD user credentials and create a local copy on ACS in case the AD connection was unavailable. That doesn't exist in ISE either.

I guess the onus is on the AD infrastructure to be 100% available 😞