topic Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect in Network Access Control

ISE 2.2p1 Passive ID with Agent not working with EasyConnect

scamarda — Thu, 29 Jun 2017 12:29:50 GMT

I posted this question in the ISE-PIC community page but got to thinking it is ISE related and not ISE-PIC and was unsure I would get a response. Please forgive the double post.

Trying to get ISE 2.2p1 PassiveID working with either the Agent or WMI. I believe I am getting the passive-id information as the user info is showing up in PassiveID > active sessions. The domain computer login is not present in the active sessions log.

The active directory servers in this instance are Server 2008R2. The agents are installed directory on the AD servers. My authz rules are looking for PassiveID:domain computer and PassiveID:domain user. These rules are not being hit.

In the agent log I see the domain computer login and I see the domain user login. The domain computer reference indicates it is dropped.

In the ISE logs I am getting an error for one server saying the agent is not responding. No firewall in the picture just a layer three router.

Would like some ideas on what to troubleshoot next on this.

Thanks.

Sam

Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect

hslai — Thu, 29 Jun 2017 12:35:01 GMT

PassiveID is for AD domain users only. It does not look at computer logins. If you have a use case that we should also consider computer logins, please discuss it with our PM teams.

Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect

scamarda — Thu, 29 Jun 2017 12:39:07 GMT

OK. I understand the domain computer login not working (hence the drops in the log) but I am still not getting the user login.

Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect

hslai — Thu, 29 Jun 2017 12:41:12 GMT

Agent is not supported with Easy Connect currently. Please share with me the complete logs. Are they in DEBUG?

Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect

scamarda — Thu, 29 Jun 2017 12:48:56 GMT

OK. Thanks. In troubleshooting I also set this up using WMI as the interface in PassiveID. I received the same negative results. Should I expect WMI to not be supported as well?

Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect

hslai — Thu, 29 Jun 2017 13:00:02 GMT

WMI provider is supported. I will check the logs you sent and might need to meet with you to discuss further.

Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect

scamarda — Thu, 29 Jun 2017 13:05:49 GMT

Thank you. I can be available for troubleshooting.

Re: ISE 2.2p1 Passive ID with Agent not working with EasyConnect

Craig Hyps — Thu, 29 Jun 2017 13:55:16 GMT

To add, other Passive ID sources are not currently tracked at MnT as part of the Easy Connect merge and CoA process, so not only is it not supported, but not expected to work. If not working with WMI, then that is another issue and Hsing is an expert troubleshooter!