topic Re: ISE PassiveID User-IP Mapping timeout in Network Access Control

ISE PassiveID User-IP Mapping timeout

wileong — Tue, 25 Aug 2020 14:29:11 GMT

Hi,

Working on a use case as follows:

UserA - 192.168.1.1 (First Login)

UserA - 192.168.1.2 (Second Login)

UserA login into 192.168.1.1 after login at 192.168.1.1. Based on ISE passiveID, only first IP is registered in User-IP mapping and shared via pxGrid to FMC. Any possibility for the same UserA map to multiple IPs for concurrent login?

Currently even based on endpoint probes, the mapping will not get updated within 4 hours if user has no logout from earlier session.

Without relying on limiting concurrent login at AD and PAM solution, do we have any workaround for ISE PassiveID to get latest endpoint information? Or are there any possibility for same username mapped to 2 or more IP?

Thanks

Wing Churn

Re: ISE PassiveID User-IP Mapping timeout

Mohammed al Baqari — Tue, 25 Aug 2020 15:35:45 GMT

Hi,

I am using this with FMC configured with passive authentication identity
policy pointing to AD realm. Basically my users login to network either
with dot1x for LAN/WLAN or ISE authorization for VPN. Once logged in, ISE
updates FMC using PxGrid. Then FMC updates user-ip mapping DB and contact
AD to obtain AD groups as well.

It can support multiple IPs for same user and I can see this update in FTD
DB by running the script user_identity.pl.

Here is an example:

root@lab-firepower:/home/admin# user_map_query.pl -u mohammed.baqari

WARNING: This script was not tested on this major version (6.5.0)! The
results may be unexpected.
Current Time: 08/25/2020 15:33:27 UTC

Getting information on username(s)...
___
User #1: mohammed.baqari
---

ID: 2981
Last Seen: Unknown
for_policy: 0
Realm ID: 5

==============================
| Database |
==============================

##) IP Address [Realm ID]
1) ::ffff:10.11.15.10 [5]
2) ::ffff:192.168.1.130 [5]

##) Group Name (ID)
1) Domain Users (3)

**** please remember to rate useful posts

Re: ISE PassiveID User-IP Mapping timeout

wileong — Tue, 25 Aug 2020 15:59:02 GMT

Our problem is more towards ISE-PIC. PassiveID does not reflect new IP for new login with another IP address.

If userA login from 192.168.1.1 for the first time, we receive the login message in ISE-PIC and share across to FMC via pxGrid. A second login from userA without logout from previous session at another IP address does not appear in ISE-PIC. Are there any specific tuning in ISE-PIC for concurrent/multi IP mapping?

Wing Churn

Re: ISE PassiveID User-IP Mapping timeout

Timothy Abbott — Wed, 26 Aug 2020 16:26:14 GMT

You can tune the global timeout value for the session directory but that is about all. Sadly, it won't solve the issue you are experiencing. If you moved to ISE instead of PIC, you would get the benefit of RADIUS accounting.

Regards,
-Tim

Re: ISE PassiveID User-IP Mapping timeout

DMel — Wed, 15 Jun 2022 13:53:45 GMT

@Timothy AbbottI know this is old, but do you have some info on how to convert the FMC integration with ISE from ISE-PIC to ISE?