topic Cisco ISE 2.3: How to check, wether AD Authentication has been used in Network Access Control

Cisco ISE 2.3: How to check, wether AD Authentication has been used

schlesix — Mon, 08 Feb 2021 14:08:08 GMT

Hi,
I've 'inherited' an ISE 2.3 installation at a customer site some time ago. This ISE has a configuration for Active Directory as an External Identity Source amongst other identity sources.

I suspect that the AD Identity Source is not being used anymore, but I want to be sure before deleting it. Unfortunately, I didn't find something helpful (e. g. in Operations > Endpoints and Users..). How can I figure out, if the AD has been used in the last 360 days?

Thanks,

Thomas

Re: Cisco ISE 2.3: How to check, wether AD Authentication has been used

Mike.Cifelli — Mon, 08 Feb 2021 15:59:51 GMT

There are a couple of ways to do so. You can rely on context visibility by spot checking some clients and looking under the 'Authentication' tab for 'Authentication Identity Store', you could also look at detailed radius live logs and search for the 'Authentication Identity Store' OR you could rely on Authentication reports by adding 'Identity Source' filter with contains <your ID source>. HTH!

Re: Cisco ISE 2.3: How to check, wether AD Authentication has been used

schlesix — Tue, 09 Feb 2021 11:56:10 GMT

Thank you very much, Mike!

I've fooled my self by using the Google Chrome browser. With Chrome, some buttons and pull-down menus can't be selected. After using Firefox, I got somewhere 😉

Thanks again,
Thomas