topic Re: ISE AD Attribute Not Pulling. in Network Access Control

ISE AD Attribute Not Pulling.

Jordan Taylor — Wed, 06 Jun 2018 19:09:23 GMT

I have a Policy set for Anyconnect Via RADIUS, which looks at the Dial-in attribute for AD. for some reason this is only being pulled for some users and not others. All the user are under the same Domain.

Any thoughts?

Thanks,

Re: ISE AD Attribute Not Pulling.

hslai — Wed, 06 Jun 2018 23:34:13 GMT

It seems the ISE computer account in AD not having read permissions for such attribute in some particular AD user objects.

You might want to try allowing "Read All Properties" for ISE. If that not possible, then

use auditing to see what permissions you need (by looking at what accesses fail in the audit log). Repeat until it all seems to work.

References:

How Access Control Works in Active Directory Domain Services

Controlling Access to Objects and Their Properties

Setting Rights to Specific Types of Objects

Setting Rights to Specific Properties of Specific Types of Objects

Re: ISE AD Attribute Not Pulling.

Jordan Taylor — Fri, 08 Jun 2018 13:13:38 GMT

Would this still apply when I can pull the attribute need from some users over others? And these users are in the same Domain same groups. and I still get the same behavior.

Thanks,

Re: ISE AD Attribute Not Pulling.

hslai — Fri, 08 Jun 2018 13:23:49 GMT

Yes, MS permissions can be set per object. Thus, ISE might not have the same permissions to users in the same domain and same groups.

Re: ISE AD Attribute Not Pulling.

Jordan Taylor — Sat, 09 Jun 2018 03:48:50 GMT

Thanks, are there any best practice pages on Active Directory architecture.

Found this one.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/ise_active_directory_integration/b_ISE_AD_integration_2x.html#tas…