Wired mab authorization to LDAP problems

chanyunchang — Tue, 13 Nov 2018 06:48:28 GMT

Can someone figure out that I configure the LDAP server for ISE authentication of MAB, but the session doesn't hit on the authorization policy of LDAP group, I thought maybe is incorrect value in the * Group Map Attribute or * Group Object Class.. I'm not sure what can I do..

Overview
Event    5200 Authentication succeeded
Username    00:0C:29:0A:6B:B5
Endpoint Id    00:0C:29:0A:6B:B5
Endpoint Profile    Windows7-Workstation
Authentication Policy   Default >> MAB
Authorization Policy   Default >> Basic_Authenticated_Access
Authorization Result   PermitAccess

Authentication Details
Source Timestamp    2018-11-13 14:01:36.191
Received Timestamp    2018-11-13 14:01:36.204
Policy Server    ise1
Event    5200 Authentication succeeded
Username    00:0C:29:0A:6B:B5
Endpoint Id    00:0C:29:0A:6B:B5
Calling Station Id    00-0C-29-0A-6B-B5
Endpoint Profile    Windows7-Workstation
IPv4 Address    192.168.92.171
Authentication Identity Store    TESTLDAP
Identity Group    test-whitelist
Audit Session Id    C0A85C6400000005004ADC22
Authentication Method    mab
Authentication Protocol    Lookup
Service Type    Call Check
Network Device    CR-2960
Device Type    All Device Types#switch#SW2960
Location    All Locations#Yangmei#CR
NAS IPv4 Address    192.168.92.100
NAS Port Id    GigabitEthernet0/5
NAS Port Type    Ethernet
Authorization Profile    PermitAccess
Response Time    64 milliseconds

Other Attributes
ConfigVersionId    134
DestinationPort    1645
Protocol    Radius
NAS-Port    50005
Framed-MTU    1500
OriginalUserName    000c290a6bb5
NetworkDeviceProfileId    b0699505-3150-4215-a80e-6753d45bf56c
IsThirdPartyDeviceFlow    false
AcsSessionID    ise1/331133428/16
UseCase    Host Lookup
SelectedAuthenticationIdentityStores    TESTLDAP
AuthenticationStatus    AuthenticationPassed
IdentityPolicyMatchedRule    MAB
AuthorizationPolicyMatchedRule    Basic_Authenticated_Access
CPMSessionID    C0A85C6400000005004ADC22
EndPointMACAddress    00-0C-29-0A-6B-B5
ISEPolicySetName    Default
IdentitySelectionMatchedRule    MAB
DTLSSupport    Unknown
HostIdentityGroup    Endpoint Identity Groups:test-whitelist
Network Device Profile    Cisco
IPSEC    IPSEC#Is IPSEC Device#No
Name    Endpoint Identity Groups:test-whitelist
IdentityDn    cn=000C290A6BB5,ou=OA,ou=MACAddresses,ou=MAC,dc=test,dc=com
gidNumber    503
uid    000c290a6bb5
RADIUS Username    00:0C:29:0A:6B:B5
Device IP Address    192.168.92.100
Called-Station-ID    DC:7B:94:16:53:85
CiscoAVPair    audit-session-id=C0A85C6400000005004ADC22

Result
User-Name    00-0C-29-0A-6B-B5
Class    CACS:C0A85C6400000005004ADC22:ise1/331133428/16
cisco-av-pair    profile-name=Windows7-Workstation
LicenseTypes    Base license consumed

Steps
   11001    Received RADIUS Access-Request
   11017    RADIUS created a new session
   11027    Detected Host Lookup UseCase (Service-Type = Call Check (10))
   15049    Evaluating Policy Group
   15008    Evaluating Service Selection Policy
   15048    Queried PIP - Normalised Radius.RadiusFlowType
   15041    Evaluating Identity Policy
   15013    Selected Identity Source - TESTLDAP
   24031    Sending request to primary LDAP server - TESTLDAP
   24017    Looking up host in LDAP Server - TESTLDAP
   24029    Host's attributes are retrieved - TESTLDAP
   24005    Host search finished successfully - TESTLDAP
   22037    Authentication Passed
   24715    ISE has not confirmed locally previous successful machine authentication for user in Active Directory
   15036    Evaluating Authorization Policy
   15048    Queried PIP - TESTLDAP.ExternalGroups
   15048    Queried PIP - Radius.NAS-Port-Type
   15048    Queried PIP - EndPoints.LogicalProfile
   15048    Queried PIP - Network Access.AuthenticationStatus
   15016    Selected Authorization Profile - PermitAccess
   11002    Returned RADIUS Access-Accept

Re: Wired mab authorization to LDAP problems

Surendra — Tue, 13 Nov 2018 07:08:52 GMT

ISE is checking the following attributes :

15048 Queried PIP - TESTLDAP.ExternalGroups
15048 Queried PIP - Radius.NAS-Port-Type
15048 Queried PIP - EndPoints.LogicalProfile
15048 Queried PIP - Network Access.AuthenticationStatus

I would suggest you check the policies configured as well to see if the request matches any of these attributes, may be a screenshot would help.

Re: Wired mab authorization to LDAP problems

chanyunchang — Tue, 13 Nov 2018 07:38:33 GMT

Hi Surendra

I configured the policy to match external group.

Re: Wired mab authorization to LDAP problems

Surendra — Tue, 13 Nov 2018 07:50:43 GMT

If this is only condition, ISE obviously did not match as it went through other conditions configured in other policies as well.
Would suggest you to check the authorization policy configured and also test the user groups at Administration > Identity Management > External Identity Sources > LDAP > TESTLDAP > Groups > Select Groups from Directory. See if it returns the OA group for that user. If it does, if the authorization policy has the correct condition and if it still does not work, please reach out to TAC.

Re: Wired mab authorization to LDAP problems

ognyan.totev — Tue, 13 Nov 2018 12:35:57 GMT

Absolutely agree @Surendra the ISE match in your case default rule : wich is basic authentication access = permit ip any any

Re: Wired mab authorization to LDAP problems

Andrii Oliinyk — Mon, 14 Jun 2021 16:27:23 GMT

He Guys

topic is quite old & solution is probably already found. I can confirm that matching works against entire DN (meaning ExternalGroups is not exactly CN=OA under OU=MacGroups under OU=MAC & so on up. Instead (with equal op) it must be like CN=OA,OU=MACGroups,OU=MAC,DC=test,DC=com.

topic Re: Wired mab authorization to LDAP problems in Network Access Control

Wired mab authorization to LDAP problems

Re: Wired mab authorization to LDAP problems

Re: Wired mab authorization to LDAP problems

Re: Wired mab authorization to LDAP problems

Re: Wired mab authorization to LDAP problems

Re: Wired mab authorization to LDAP problems