topic Re: Tacacs+ Backup identity store in Network Access Control

Tacacs+ Backup identity store

Palazsto — Tue, 26 Mar 2024 10:46:49 GMT

Hi Guys,

I need to configure an backup identity store( actually the local database of the ISE ) , but it should be used only in case when the primary (in this case Active Directory) fails.The users in the local database should not be usable if the AD is reachable . Is this possible ?

Re: Tacacs+ Backup identity store

afahmy — Thu, 08 Mar 2018 06:52:31 GMT

Yes out all identify sources in an identity source sequence

Assign the source sequence to your flow

Sent from my iPhone

Re: Tacacs+ Backup identity store

ldanny — Thu, 08 Mar 2018 07:37:13 GMT

when Identity Source Sequence is created , ISE will go through the chosen Identity stores in the order they are placed until it hits a match , much like an ACL behavior . When that match is hit it will stop the sequence of lookups

e.g

In above snap shot , if you were to chose AD1 as first identity store and then Internal Users as your second , then ISE would search for the user under AD1 and if not found would move on to Internal Users.

Hope thats clear.

Re: Tacacs+ Backup identity store

Palazsto — Thu, 08 Mar 2018 08:09:44 GMT

Thanks for the quick response guys ,but that's doesn't solve my case ... because I want the ISE to use the local database only in situation when the AD is not reachable(fail) . The Identity Source Sequence is configured just like you have suggested , of course ,but in this situation there will be users in the local database that will always have an access , even if the AD is up, and I don't wont that.

Re: Tacacs+ Backup identity store

ldanny — Thu, 08 Mar 2018 09:43:35 GMT

sounds like you have same accounts on both internal and AD data base .

In that case ISE does not support this option.

Re: Tacacs+ Backup identity store

Palazsto — Thu, 08 Mar 2018 09:51:24 GMT

No , the accounts are different , but I want the accounts from local store to be usable only if the primary id store fail(in my case the AD and the ISE are not in the same location and sometimes there are connectivity issues ). There are options in the authentication policies ( continue ,reject and drop ) , but when I tried to configure it with them , they doesn't work like I expected .

Re: Tacacs+ Backup identity store

ldanny — Thu, 08 Mar 2018 11:47:58 GMT

ISE does not support this , if you feel this is a feature that is need I recommend you contact your Cisco representative with your use case.

Re: Tacacs+ Backup identity store

kthiruve — Thu, 08 Mar 2018 19:38:45 GMT

Hi Stoyan,

There is another option in Identity store sequence at the end to deal with the situation when ID store is not accessible.

Have you tried this?

-Krishnan