topic Re: CISCO ISE :- External radius server in Network Access Control

CISCO ISE :- External radius server

siddhesh.parab@orange.com1 — Mon, 30 Mar 2020 17:52:13 GMT

Hello Team,

Customer wants to integrate ISE with external radius server rather than AD directly. However they also need to implement TACACS features.

So my understanding is .... user ------> ISE server -----> external radius server (microsoft NPS)------->AD

I have below queries:-

1. Since in TACACS configuration, as per my understanding to gain access of any network device we need to define AD group in authorization condition. so that only perticuler AD group can execute set of commands but in case if we use external radius server then is it possible to call perticuler AD group in TACACS authorization policy ?? or in that case AD integration is complusory ??

Thanks in advance.

Your help is highly appreciated.

Re: CISCO ISE :- External radius server

thomas — Mon, 30 Mar 2020 18:30:14 GMT

User --> NetworkDevice --> ISE --> external radius server (NPS) --> AD

The rule with AD is typically like this below with AD. However with the proxy to NPS it probably depends on what the NPS server returns to ISE in the form of RADIUS attributes.

TACACS Authorization Rule:

Status

Rule Name

Conditions

Command Sets

Shell Profiles

Hits

Actions

✔

NetAdmin

AND	subdomain.domain.com:ExternalGroups EQUALS subdomain.domain.com/Users/Domain Users

PermitAccess

⚙

Re: CISCO ISE :- External radius server

siddhesh.parab@orange.com1 — Mon, 30 Mar 2020 18:44:39 GMT

Hello Thomos,

Thanks for your revert.

Yes totally agree with you but what is cisco recommedation ?? Which method is better & Why. if you share some document then that will be great ..1.Integrate external radius server with ISE or 2. Direclty integrate AD to ISE ??

And also, can we configure NPS server to return specific AD group in radius attibute to ISE server ??

so if i need only read-only users group from AD then is it possible to fetch from NPS server ??

Re: CISCO ISE :- External radius server

thomas — Thu, 02 Apr 2020 00:48:13 GMT

Integrating directly with AD is much preferred to get the exact groups and attributes you want. 95% of customers do this. For gory details, see What's new in ISE Active Directory connector - BRKSEC-2132

I did a basic internet search and found this as the #1 hit :

Configure External RADIUS Servers on ISE - Cisco

Please consult the NPS documentation for what NPS can do with your version of Windows.