topic Re: Eap-chaining and PXgrid in Network Access Control

Eap-chaining and PXgrid

tuenoerg — Mon, 28 Nov 2016 07:21:26 GMT

x-posted to internal cs-firepower mailling list.

Hi all,

I have the following problem :

User are normally represented with domain\username which can be used for group lookup in AD/LDAP by FMC by the username = "username".

But with eap-chaining - it will look like : domain\username/PCname, which can not be used in LDAP/AD lookup inside FMC, since username will be : username, host/PCname.

Can I in any way strip information before it "leaves" ISE info PXGRID ?

best regards

Tue

Re: Eap-chaining and PXgrid

Timothy Abbott — Thu, 01 Dec 2016 15:09:47 GMT

Hi,

No, I don't think this is possible today. Including jeppich to comment further.

Regards,

-Tim

Re: Eap-chaining and PXgrid

jeppich — Thu, 01 Dec 2016 16:29:20 GMT

Hey Tim, Tue,

So for EAP Chaining the username and machine syntax such as domain\username, username@domain is dependent on the protected identity pattern. You can use AnyConnect NAM to test around with this, With Firepower it is possible to get username, domain/name.

This is not a pxGrid issue. Which version of Firepower are you using?

Thanks,

John

jeppich@cisco.com

Re: Eap-chaining and PXgrid

tuenoerg — Fri, 02 Dec 2016 16:05:26 GMT

Hi John,

I´m not sure I fully understand what you mean.

Firepower version 6.1 is being used.

In FMC is looks like this now :

Then the identiy does not match and then rules does not apply.

Best regards

Tue

Re: Eap-chaining and PXgrid

tuenoerg — Tue, 06 Dec 2016 08:52:28 GMT

This is how it looks inside FMC :

So the identity received from ISE is not able to be matched ..

How do I make sure I can use the identity in my FMC policies ?

I have attached a pdf file showing the live log form ISE.

Best regards

Tue

Re: Eap-chaining and PXgrid

jeppich — Thu, 08 Dec 2016 03:03:53 GMT

Hey Tue,

What do you see under the FMC User Activity Screen? Are you seeing the same? What version of FMC are you using

You can try creating an Access policy based on user. Or better yet, assign an ISE authorization SGT policy of employee to the successfully authenticated user. You can then assign the access policy based on the Employee SGT.

Send me an email, and we can schedule a webex.

Thanks,
John

(jeppich@cisco.com

Re: Eap-chaining and PXgrid

Andrii Oliinyk — Fri, 24 Sep 2021 17:58:44 GMT

Hi Guys

topic is quite aged but what did u finish with (it looks quite similar to deployment we plan in our customer)?

tnx in adv