topic Re: Using ISE to authenticate windows users (no Active Directory) in Network Access Control

Using ISE to authenticate windows users (no Active Directory)

Tod Larson — Mon, 11 Mar 2019 08:50:36 GMT

I am trying to design a system where we have lots of routers/switches but only a few windows machines. We have a couple window PCs and servers for network management tools. This network management system is independent and physically separate from our corporate active directory. It's small enough so we don't need AD. We have local logons and do local group policy to lock down the windows machines. We use TACACS+ on ISE for user authentical for the several hundred routers and switches, but we then have local accounts for the windows computers. We don't want to deploy AD and have yet another thing to manage and patch (I get that isn't not super hard, but zero work is better).

Can we configure a windows computer to authenticate users against ISE?

Re: Using ISE to authenticate windows users (no Active Directory)

Jason Kunst — Sat, 13 Oct 2018 17:10:25 GMT

Yes. Ise has an internal user store and that can be used

Re: Using ISE to authenticate windows users (no Active Directory)

Tod Larson — Sun, 14 Oct 2018 14:46:07 GMT

Can I use the ISE internal user store to authenticate a user logging into a Windows 10 laptop?

Re: Using ISE to authenticate windows users (no Active Directory)

Jason Kunst — Sun, 14 Oct 2018 18:36:00 GMT

Yes works the same way as AD just the user is created on ise internal database as a network access user .

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_01110.html

Re: Using ISE to authenticate windows users (no Active Directory)

Tod Larson — Sun, 14 Oct 2018 22:16:28 GMT

Jason,

Thank you for posting but I'm not sure we are communicating.

I don't see in the link you provide where to configure my Windows 10 laptop to authenticate a Windows user with the ISE internal user store. I want to be able to log into my windows laptop using ISE. I would expect to have to configure some local Windows policy to point Windows at the ISE for authentication. But I might be missing something.

Thank you.

Re: Using ISE to authenticate windows users (no Active Directory)

Jason Kunst — Sun, 14 Oct 2018 23:42:00 GMT

Ok you’re looking for ise to act as a domain controller ? No this is not possible it’s not active directory. You would create local users to login to the machines and these accounts can match those on ise to login to the network

Re: Using ISE to authenticate windows users (no Active Directory)

Tod Larson — Mon, 15 Oct 2018 23:18:08 GMT

That is what I was afraid of but at least now I know for sure.

Thank you for the assistance.