topic Re: Does ISE use a cache for AD authentication? in Network Access Control

Does ISE use a cache for AD authentication?

REJR77 — Wed, 23 Nov 2022 16:37:04 GMT

Hello,

I would like to know if ISE is able to cache authentications when a user is authenticated with AD?

For example, a user connects to the network , then disconnects and reconnect few minutes later.

Does ISE use a cache or does it search each time in the AD?

Of course where is the setting?

Kind regards

Re: Does ISE use a cache for AD authentication?

balaji.bandi — Wed, 23 Nov 2022 17:08:28 GMT

for the Device authentication it will not cache.

for 802 1x machine acess it keep 5 hours default as per i know...you can change this in

Re: Does ISE use a cache for AD authentication?

REJR77 — Thu, 24 Nov 2022 07:45:42 GMT

So if I understand you well when ISE authenticate a user with AD it keeps it in cache for 5h? Not searching for this user in AD for 5h.

Re: Does ISE use a cache for AD authentication?

thomas — Mon, 12 Dec 2022 23:18:20 GMT

ISE performs an authentication direct to AD (or any identity store) every single time because you may have just fired someone or changed their authorized groups, etc.

The cache setting that Balaji showed is for Machine Access Restrictions (MAR) cache which is for machine authentication requirements before a user logs in. This is totally separate scenario than a basic authentication.

Re: Does ISE use a cache for AD authentication?

ahollifield — Tue, 13 Dec 2022 12:30:32 GMT

By default no but you can enable PEAP session resume which will use the cached information in ISE to authenticate a user without performing the full auth against AD. However, I'm not sure if ISE still actively searches/applied authz conditions (like AD group) or if those are cached too.