topic Re: Limiting user login access in Network Access Control

Limiting user login access

lcammara — Thu, 07 Dec 2017 16:57:30 GMT

I know we can control the number of sessions per user

Is there a way to alert if a user attempts more then one login, while policy permits multiple logins?

This would be ISE 2.3

Maybe Stealthwatch integration

Re: Limiting user login access

Charlie Moreton — Thu, 07 Dec 2017 17:55:17 GMT

This was introduced in ISE 2.3. Go to Administration > System > Settings > Max Sessions.

You can choose to enforce Maximum session based upon user, group

This applies to Internal ISE Users and groups only. Also the enforcement is the max PER POLICY NODE. Here's the page in the Admin Guide:

Cisco Identity Services Engine Administrator Guide, Release 2.3 - Manage Users and External Identity Sources [Cisco Ide…

Re: Limiting user login access

ognyan.totev — Fri, 08 Dec 2017 09:42:46 GMT

Ise 2.2 support this future too.

Re: Limiting user login access

hslai — Sun, 10 Dec 2017 01:52:31 GMT

There is no alarm to alert the same user logging more than once.

Like Charles and Ognyan said, ISE 2.2+ has max sessions to limit per user, which applies to external users as well, and per internal-user-group. These settings are per PSN, unlike the guest max sessions, which are per deployment.

Re: Limiting user login access

wileong — Mon, 19 Mar 2018 15:38:03 GMT

Hi hslai,

Just to confirm the per user limit also apply for RADIUS authentication? (802.1x to be specified)

Thanks

Wing Churn

Re: Limiting user login access

hslai — Mon, 19 Mar 2018 16:09:42 GMT

That is correct. This is mainly used for RADIUS authentications.

It's not working well for T+, due to some existing bug, such as CSCvg26552.

Re: Limiting user login access

ruhearn — Thu, 02 Aug 2018 14:10:37 GMT

Is this known to work with certificates as the external user database?

Is there anything planned to make this work across multiple PSNs using the MnT or some other solution?

Thanks!

Re: Limiting user login access

hslai — Sun, 05 Aug 2018 00:40:12 GMT

I have not tested it with certificates myself but am expecting it working with the username/subject based on the cert auth profile(s).

Sure, we are looking into multiple PSN. Please discuss your use cases and customer requirements with our PM.