topic Thank you Fabio. in Network Access Control

Cisco ISE - Authentication Strategy

Daniel Stefani — Mon, 11 Mar 2019 06:27:22 GMT

Hello guys,

Would like opinions to a scalable authentication strategy of users and / or workstations in Cisco ISE for the following scenario:

Customer with approximately 130 branches. Each branch has a different AD domain, without trust relationship with the HQ and with the other branches.

Knowing that the ISE supports integration with up to 50 domains, which suggestion for this case?

Regards,
Daniel Stefani

That is right. - Cisco ISE

Jatin Katyal — Thu, 04 Feb 2016 14:57:54 GMT

That is right. - Cisco ISE supports multiple joins to Active Directory domains. Cisco ISE supports up to 50 Active Directory joins. Cisco ISE can connect with multiple Active Directory domains that do not have a two-way trust or have zero trust between them. Active Directory multi-domain join comprises a set of distinct Active Directory domains with their own groups, attributes, and authorization policies for each join. More information - ISE 1.3 & AD integration.

Hi Jatin Katyal, Thank you.

Daniel Stefani — Thu, 04 Feb 2016 15:45:53 GMT

Hi Jatin Katyal, Thank you.

What the strategy for the other 80 branches?

Regards,
Daniel Stefani

Hi Daniel,

Jatin Katyal — Fri, 05 Feb 2016 02:29:43 GMT

Hi Daniel,

Let me get back to you on this.

~ Jatin

Hi Jatin,

Daniel Stefani — Fri, 05 Feb 2016 17:17:06 GMT

Hi Jatin,

thank you. I wait.

Best Regards,

Daniel Stefani

Might not be ideal from a

jj27 — Fri, 05 Feb 2016 18:21:40 GMT

Might not be ideal from a configuration standpoint, but you could build LDAP connections to the 80 remote branches, setup the user/group search base (CN=Users,DC=domain,DC=local and etc.) and then in your authentication policies, check network device group then set the LDAP server for that site to process the request.

Hi JJohnston, thanks for

Daniel Stefani — Thu, 11 Feb 2016 12:44:12 GMT

Hi JJohnston, thanks for aswer...use LDAP may be an alternative.
I was thinking of doing authentication using digital certificates only.
Each branch would have a CA (Windows) to generate and distribute a certificate to authenticate workstations.
In ISE, I would create authentication and authorization policies to validate these certificates(Workstatios).
Not sure if this design can work, but it is what I have in mind right now.

What do you think ?

Best Regards,

Daniel Stefani

Stefani,

fabioacarneiro — Mon, 22 Feb 2016 18:14:10 GMT

Stefani,

Sure it will work, you can even use a centralized CA architecture, just make sure you can distribute these certificates to the endpoints...

Another option is to check if the AD User account is restricted (disabled, locked out, expired, password expired, and so on) via LDAP, but you need the username equals some field in the certificate (CN or SAN).

regards,

Fabio

Thank you Fabio.

Daniel Stefani — Thu, 10 Mar 2016 21:57:55 GMT

Thank you Fabio.