topic Re: AD prob incorrect data in Network Access Control

AD prob incorrect data

Sebastien Lagueux — Wed, 10 Apr 2024 15:55:50 GMT

Hello,

I have ISE 3.1.0.518 patch 8. I have a problem that ISE is not fetching the correct attribute information for MacOS. My Macs are not joined to my Windows domain, but ISE finds AD attributes for my Mac but completely wrong. They detect that it is a Windows with another host name. I deleted the Endpoint Mac and bad data comes back. How to fix this?

Endpoint Profile: Apple-Device

AD-Operating System: Windows 10

AD-Fetch-Host-Name: wrong host name

Re: AD prob incorrect data

ahollifield — Wed, 10 Apr 2024 20:03:13 GMT

Do you have the need for the AD probe? Why is it enabled to start with?

Re: AD prob incorrect data

Sebastien Lagueux — Thu, 11 Apr 2024 13:04:44 GMT

The AD prod is activated to be able to make rules depending on which group or OU a computer finds itself in.
But I think I found my problem. ISE relies on reverse DNS entry, and I notice that I have a problem at this level. My PTR entries do not match the DNS entries.

Re: AD prob incorrect data

ahollifield — Thu, 11 Apr 2024 13:19:20 GMT

Yeah without properly functioning reverse records you will see issues like this with the AD probe. I would argue active authentication based on machine certificates and looking up OU based on the derived machine name from the certificate is a much better approach for checking group/OU membership than relying on the AD probe.

Re: AD prob incorrect data

Sebastien Lagueux — Thu, 11 Apr 2024 13:22:43 GMT

Interesting, I'll look into that. Do you happen to have any documentation on this? I'm quite new to ISE. Thanks for your help

Re: AD prob incorrect data

ahollifield — Thu, 11 Apr 2024 13:28:06 GMT

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214975-configure-eap-tls-authentication-with-is.html#toc-hId-133117567

I would also suggest going through some ISE training to learn about authorization policy logic, etc. I would also suggest working with your Cisco Account SE and your preferred Cisco Partner of choice to also help with ISE deployment and policy creation.