topic Re: Cisco ISE Dynamic VLAN with Microsoft AD in Network Access Control

Cisco ISE Dynamic VLAN with Microsoft AD

Kevin Raditheo — Wed, 25 Jan 2017 15:13:02 GMT

Hi all,

I want to ask some questions.

Currently I'm using Cisco ISE for dynamic vlan assignment based on group on AD.

The problem I'm facing is, the user will only get IP address after they put username and password in dot1x supplicant. But sometimes, some user need to contact their domain controller for their windows login and this happens before the endpoint get an IP address. So the endpoint can't contact their DC.

Any suggestions for this case?

Thank you very much for your advice.

Re: Cisco ISE Dynamic VLAN with Microsoft AD

howon — Wed, 25 Jan 2017 16:01:01 GMT

When user is not logged in, typically the Windows Supplicant is configured to do machine authentication. You will need to create a policy that allows AD 'Domain Computers' Group to have access to the Domain controllers to let the endpoints contact domain controllers.

Re: Cisco ISE Dynamic VLAN with Microsoft AD

Kevin Raditheo — Wed, 25 Jan 2017 16:54:12 GMT

Hi howon,

Thanks for your advice.

If the endpoint do machine authentication to domain controller, how it can be done without an IP address?

Have you try this before?

Re: Cisco ISE Dynamic VLAN with Microsoft AD

howon — Wed, 25 Jan 2017 17:07:26 GMT

Just like you authenticate AD user via 802.1x, you can authenticate AD joined machine (computer) to authenticate via 802.1x. It is configurable in the supplicant. Make sure it is set to 'User or Computer authentication' which is the default. Since this is 802.1x authentication it happens at OSI layer 2 without IP. See supplicant setting below on Windows:

Re: Cisco ISE Dynamic VLAN with Microsoft AD

Kevin Raditheo — Wed, 25 Jan 2017 17:24:54 GMT

Thank howon,

I think I get it. So the endpoint will authenticate with its machine name through ISE and ISE will query the AD just like user authentication, right?

So I will need a policy with a condition like, if the user is domain computer or something like that.

How about the policy result? Must I put default permit access or can I restrict the traffic with an ACL so it can only contact the DC but not anything else?

Re: Cisco ISE Dynamic VLAN with Microsoft AD

howon — Wed, 25 Jan 2017 17:27:47 GMT

Yes, typically you would allow access to AD related IP only + DHCP & DNS.