topic Re: Max failed login attempts on Web Portal and AD in Network Access Control

Max failed login attempts on Web Portal and AD

slevesqu — Tue, 12 Dec 2017 21:13:46 GMT

Hi team,

Does the Maximum Failed Login Attempts control work for web portal authentication with Active Directory users? If not would there be another way to prevent AD user account lockout when using the web portal?

Thanks

Re: Max failed login attempts on Web Portal and AD

hslai — Fri, 15 Dec 2017 00:44:58 GMT

It seems you are referring the "Web Portal" to any end-user facing portals, such as MyDevices portal with the login page settings:

In that case, I believe it applies to AD as well. Is your plan to set a huge number for the time between login attempts when rate timing? Otherwise, it would not help much if the AD users have the policy to lock the accounts after number of failures.

Re: Max failed login attempts on Web Portal and AD

slevesqu — Fri, 15 Dec 2017 01:26:18 GMT

The use case is the guest portal that is used on an open ssid by both guests and employees for internet access. The customer wants to prevent the employee AD user accounts lockout.

Yes the idea would be as you said to rate limit for a very long time after the user has tried 2 times for example assuming that the AD account lockout policy is 3 times.

Re: Max failed login attempts on Web Portal and AD

hslai — Fri, 15 Dec 2017 04:09:28 GMT

CSCva98129 might impact customer deployments on ISE 1.4 ~ 2.2. Please ensure on the latest patches.