topic Re: ISE 2.4 P4: Problems with EAP-MD5 authentication in Network Access Control

ISE 2.4 P4: Problems with EAP-MD5 authentication

Nadav — Mon, 19 Nov 2018 19:49:08 GMT

Hi everyone,

EAP-MD5 is supported only with internal database, so I made a local user identity group with a single user. That user is a shadow user that external authenticates with my external identity source (Active Directory).

So: MyUser (External) --- > MyUserGroup

Here are some issues I've seen:

1) When authenticating with EAP-MD5, if I disable the user in AD the authentication still works.

2) When authenticating with EAP-MD5, even if I were to block all communications between PSN and AD authentication still works.

My policy set for EAP-MD5:

1) Allow protocol EAP-MD5

2) Authenticate from "Internal Users"

3) Authorize InternalUser.IdentityGroup EQUALS User Identity Groups: MyUserGroup

Any ideas why it's not performing proper checks with AD?

Thanks!

Re: ISE 2.4 P4: Problems with EAP-MD5 authentication

Timothy Abbott — Mon, 19 Nov 2018 20:52:04 GMT

What does your default authentication rule look like for the policy set and how is it configured?

Regards,
-Tim

Re: ISE 2.4 P4: Problems with EAP-MD5 authentication

Nadav — Mon, 19 Nov 2018 21:11:04 GMT

It's DenyAccess. Either it passes the EAP-MD5 rule, or is dropped

Re: ISE 2.4 P4: Problems with EAP-MD5 authentication

Nadav — Tue, 20 Nov 2018 15:44:16 GMT

Hi,

EAP-MD5 authentication is supported for internal database only (according to the documentation), but I assumed the user account associated with EAP-MD5 can be configured locally but get its password externally.

Apparently this doesn't work well, since I changed the password in AD for the user and yet it still authenticates correctly. Same goes for disabling the user in AD. However, if I make the user internal (don't check the External checkbox) then password verification and disable checks work fine.

From the looks of things this means I need to manage all EAP-MD5 users locally on ISE, and I can't use AD to manage their passwords.

Is this correct?

Re: ISE 2.4 P4: Problems with EAP-MD5 authentication

Nadav — Fri, 23 Nov 2018 14:54:34 GMT

Any ideas?