topic ISE ports (TCP 464) with AD in Network Access Control

ISE ports (TCP 464) with AD

saghisha — Thu, 05 Jan 2017 07:57:26 GMT

We have a customer that is asking if port TCP 464 “KPASS” is required to be opened between the ISE and AD. If yes, what is the exact purpose of opening this port and is it required during the authentication phase ?

Re: ISE ports (TCP 464) with AD

Charlie Moreton — Thu, 05 Jan 2017 13:10:12 GMT

It is not specifically needed, but could alleviate some headaches. KPASS is used on TCP Port 464 for Kerberos based password changes. Starting in Vista, Microsoft used this as the default password change method. However, if KPASS is not accessible (as in the port is closed), it will default back to NTLM for password changes.

This article goes more in-depth:

https://blogs.technet.microsoft.com/askds/2011/09/30/friday-mail-sack-super-slo-mo-edition/

Charles Moreton

Re: ISE ports (TCP 464) with AD

kthiruve — Fri, 06 Jan 2017 01:45:35 GMT

HI Samer,

Please see the ports that need to be open between ISE nodes. ISE PSN talks to AD using certain functionalities.

For ISE to work correctly the ports need to be open.

http://www.cisco.com/c/dam/en/us/td/i/400001-500000/410001-420000/413001-414000/413702.jpg

Thanks

Krishnan

Re: ISE ports (TCP 464) with AD

saghisha — Fri, 06 Jan 2017 07:37:31 GMT

Thanks Charles. Much appreciated.