topic Re: ISE AD Integration in Network Access Control

ISE AD Integration

Indula1 — Wed, 31 Oct 2018 06:49:23 GMT

There a login problem with ISE with Wifi in our organization .We are using Cisco WLC and integrated with ISE. The issue is any ssid can access in any Active Directory Group Users and also Active Directory integrated properly in ISE. What is the reason and how to solve.

Indula

Re: ISE AD Integration

ognyan.totev — Wed, 31 Oct 2018 06:58:32 GMT

Hi , explain more detailed what happen and what you want to do.

Share with us some screenshot of configuration on ISE and in WLC.

What version of ISE you use ,be more detailed please.

Re: ISE AD Integration

hslai — Wed, 31 Oct 2018 21:25:09 GMT

Adding to what ognyan.totev suggested, please check ISE RADIUS Live Logs for the authentication attempts. On WLC, use debug commands, such as "debug client ..." to see the info from WLC prospective. Also, consult Wireless LAN Controller Best Practices - Cisco Community

Re: ISE AD Integration

Indula1 — Tue, 06 Nov 2018 13:59:01 GMT

ISE version is 2.1.0

Re: ISE AD Integration

paul — Tue, 06 Nov 2018 14:13:26 GMT

The only screen shot we need to see is your Policy Set that you have configured for each SSID. You should have specific policy sets configured for each SSID and the authorization section should control exactly who can connect to that SSID. My guess is you are using the Cisco default policy set (which should be the first thing you disable) that allows everything on.

Re: ISE AD Integration

Indula1 — Tue, 06 Nov 2018 14:21:55 GMT

This is the policy set in ISE

Re: ISE AD Integration

ognyan.totev — Tue, 06 Nov 2018 14:27:40 GMT

As i see there you have 2 ssid ( staff and students)

What show in radius live logs ?

Re: ISE AD Integration

paul — Tue, 06 Nov 2018 14:28:00 GMT

We need to see the authorization rules.

Re: ISE AD Integration

Indula1 — Wed, 07 Nov 2018 04:12:51 GMT

Re: ISE AD Integration

ognyan.totev — Wed, 07 Nov 2018 04:17:12 GMT

are you have radius live logs when they try to connect ?

Re: ISE AD Integration

Indula1 — Wed, 07 Nov 2018 04:49:55 GMT

Re: ISE AD Integration

ognyan.totev — Wed, 07 Nov 2018 05:21:53 GMT

As i saw above ,they match correct Authorization profiles ,what you allow in this profiles. You must define Air Acl in the WLC and use it in Ise

Re: ISE AD Integration

Surendra — Wed, 07 Nov 2018 11:12:23 GMT

If your question is about how you can limit the rules to one specific SSID so that people logging into other SSIDs do not hit this rule, you can add an attribute to the current condition to check the RADIUS:Called-Station-Id contains <SSID name> . In the WLC make sure you set the called station ID attribute being sent is AP-Mac-Address:SSID under the RADIUS server authentication settings. If you need detailed instructions, let me know.

Re: ISE AD Integration

Indula1 — Mon, 12 Nov 2018 05:48:20 GMT

How can i define Air ACL in the WLC and how to use it in ISE