topic Re: User authentication time in Network Access Control

User authentication time

williamtan — Wed, 17 May 2023 10:03:02 GMT

Customer have one ISE and five AD domains which have zero trust between. I'm able to join the ISE to all five ADs and created the identity source sequence from top AD1 to bottom AD5.

Any different of time taken to authenticate between user from AD1 and AD5? Is it in millisecond? Customer want to know how long it take and document it.

Re: User authentication time

Marcelo Morais — Wed, 17 May 2023 11:28:55 GMT

Hi @williamtan ,

1st please take a look at Administration > Identity Management > Identity Source Sequences > select your Sequence Name and make sure that at Advanced Search List Settings, the Treat as if the user was not found and proceed to the next store in the sequence is selected.

2nd at Administration > System > Settings > Protocols > RADIUS > check the value of Highlight steps longer than (millisenconds).

3rd at Operations > Reports > Reports > Endpoint and Users > RADIUS Authentications > click the Details icon > at the new windows you are able to check the Steps of the RADIUS Authentication and check the 24325 Resolving Identity, if this step takes longer than the value of Highlight steps longer than (millisenconds), then you have your answer in an exact number.

Hope this helps !!!

Re: User authentication time

williamtan — Thu, 18 May 2023 04:12:12 GMT

Thank you Marcelo Morais for your fast reply.

1. Yes, I have select this already.

2. This one is default 1000 milliseconds.

3. I didn't see a clock there so it should be less than 1000ms.

Re: User authentication time

Marcelo Morais — Thu, 18 May 2023 11:58:34 GMT

Hi @williamtan ,

that's correct ... in your case less than 1000 ms.

Hope this helps !!!

Re: User authentication time

williamtan — Fri, 19 May 2023 13:10:25 GMT

Hi Marcelo Morais ,

I try to change the value of Highlight steps longer than to 500ms and it still not show the time. But customer want to know the exact time. Is it possible?

Re: User authentication time

Marcelo Morais — Fri, 19 May 2023 18:14:22 GMT

Hi @williamtan ,

at Operations > Troubleshooting > Diagnostic Tools > General Tools > TCP Dump:

select the PSN
Promiscuous Mode = Off

Download and open the TCPDump.pcap file via Wireshark and filter by: tcp.port == 389. (for example), you are able to check the Time between packets exchange.

Hope this helps !!!

Re: User authentication time

hslai — Mon, 22 May 2023 01:06:09 GMT

@williamtan For active directory, it's preferred to use scopes so the ISE will query all AD join points the same time.

It's hard to judge the authentication time because it depends on both ISE and AD servers. AD servers could be busy and slower in responses.

Re: User authentication time

williamtan — Tue, 23 May 2023 05:07:57 GMT

Hi @hslai,

Do I still need to select "Treat as if the user was not found and proceed to the next store in the sequence" after use the initial scope?

Re: User authentication time

hslai — Tue, 23 May 2023 17:26:36 GMT

We may use the Active Directory scope directly as the identity authentication source. That setting is for an ISE identity source sequence so it would not be in effect unless we are using one when we combine the Active directory scope with other other sources.

Re: User authentication time

ajc — Wed, 24 May 2023 14:45:31 GMT

Hi @hslai , let me investigate the "scope" configuration you are mentioning.