topic Re: Limits on AD Client Authz attempts in Network Access Control

Limits on AD Client Authz attempts

gaowen — Tue, 22 May 2018 15:56:39 GMT

Hi all, I have a customer who uses dual SSID BYOD, the open SSID using AD creds for auth. The issue they have is that 5 x wrong password = account lockout. They are concerned that a malicious actor would be able to exploit this and they would like to have an Authz rule which prevents any more requests being sent to the DC after say 2 or 3 failures. Has anyone seen anything like this before and able to help?

Thanks, Gareth

Re: Limits on AD Client Authz attempts

kthiruve — Tue, 22 May 2018 18:11:54 GMT

If you are using AD creds then the password policies should be controlled in AD environment.

Authorization happens after authentication so even say for eg: if we have a rule in ISE to prevent this, it will not affect authentication since your concern is multiple auth failures hitting DC.

ISE does’t have rules to control the behavior of AD.

However we do have rules for Network access user such as password policy and account lockout if you have a local user that you can take advantage of.

-krishnan

Re: Limits on AD Client Authz attempts

Craig Hyps — Wed, 23 May 2018 11:40:27 GMT

One option is to use Client Exclusions on access device. For example, if the endpoint fails auth X number of times in an interval, the endpoint is prevented from attempting auth again for specified period. You can try setting the exclusion time to a value > than the AD lockout interval.