topic Re: Does PSN query AD for every RADIUS session? in Network Access Control

Does PSN query AD for every RADIUS session?

YediaelHutahaean — Thu, 14 May 2020 17:47:47 GMT

Hi Everyone,

From what I understand, when you integrate your AD to your ISE deployment, the PSN will be the one that make direct connection to the AD. My question here is: does PSN query AD for every new/unique RADIUS session?

Thanks.

Best regards,

Yedi

Re: Does PSN query AD for every RADIUS session?

Shivu b — Thu, 14 May 2020 18:06:00 GMT

Its depend what policy have been set it for ? Unless endpoint not logged into it doesn't query

were you using AD credential login for ISE servers ? or end users and NAD devices ?

Re: Does PSN query AD for every RADIUS session?

Mohammed al Baqari — Thu, 14 May 2020 19:03:49 GMT

If you use AD probe for profiling then yes. Also, if you use AD
authentication for endpoint dot1x, then yes.

In both cases ISE will probe AD for every new connection.

***** please remember to rate useful posts

Re: Does PSN query AD for every RADIUS session?

Arne Bier — Fri, 15 May 2020 00:09:02 GMT

In general yes - that is the case. If you want to limit the connection rates to AD for EAP-PEAP, then you can enable a feature in ISE called Fast-Reconnect - this will cache the last Authentication status of that user for a specified number of minutes. The only trouble is, if that user's status changes in that time frame (e.g. account locked) then ISE will not take note of it. But it's still a useful feature.

Re: Does PSN query AD for every RADIUS session?

thomas — Sun, 17 May 2020 00:19:45 GMT

It depends on the configuration of your ISE Authentication Policy.

In the example below - which is the ISE default with a rule for VPN added - you can see that MAB will only look to authenticate Internal Endpoints - and never to go AD. VPN, Dot1x and Default will attemtp to try each of the Identity Stores in the All_User_ID_Stores identity store sequence which, assuming you had configured one or more Active Directory stores, would include them. You may configure additional rules and conditions to control which IDentity Stores are used.

You may create your own Identity Store Sequences (with or without AD) here:

Re: Does PSN query AD for every RADIUS session?

YediaelHutahaean — Tue, 16 Jun 2020 16:27:28 GMT

Hi Thomas,
Thanks for your detailed and well-thought answers, it helps me a lot!!

Cheers,
Yedi

Re: Does PSN query AD for every RADIUS session?

YediaelHutahaean — Tue, 16 Jun 2020 16:29:38 GMT

Hi Arne,
Thanks for your confirmation, and especially for the information about "Fast-Reconnect", didn't know about it before this.

Cheers,
Yedi