topic Re: ISE COA after disable a user on AD ( how to kick automatically disabled user on AD ) in Network Access Control

ISE COA after disable a user on AD ( how to kick automatically disabled user on AD )

eugeniodesideri — Mon, 15 Mar 2021 14:33:47 GMT

hi y'all.

I have a question , i womder if someone out there can suggest me the easiest way to automatically

kick an authenticated user doing traffic over the network , after i disable his AD account.

Basically if an account has been disabled on AD the user can't join the network , ofcourse.

but if a user is already authenticated inside the network and i disable his account on AD , untill

a re-auth occurs the user keeps been connected and allowed to make traffic inside the network.

So , is there a quick way to re-asses his status on AD trough a keep alive or something that tells ISE to check if the user account is still valid ?

thanks

Marcelo Morais — Mon, 15 Mar 2021 15:14:17 GMT

please try:

in Context Visibility > Endpoints, filter by Username
on Change Authorization > CoA Session Terminate

Hope this helps !!!

eugeniodesideri — Mon, 15 Mar 2021 16:25:31 GMT

Thanks for the answer , but as i wrote i would like this to happen automatically as i disable a user inside the AD.

Do you think is that something i can achieve?

thanks again

Eugenio

Greg Gibbs — Mon, 15 Mar 2021 22:24:31 GMT

I can only think of two possible ways to accomplish this:

Use a super aggressive Reauth timer in the AuthZ Profile pushed by your AuthZ Policy for AD user/computer sessions. The downside is that this would apply to all AD sessions and drastically increase the amount of RADIUS events/logs; possibly impacting performance.
Look into possibly using scripting on the AD side (maybe a PowerShell script) that both disables the user account and uses the REST API to find the MAC address associated with that particular user session and issues a COA.

Example AuthZ Profile setting:

eugeniodesideri — Tue, 16 Mar 2021 08:43:07 GMT

the REST API looks like a very smart solution ! thanks for the advice !