topic Re: Wireless Controller - ISE - Microsoft Domain Controller in Network Access Control

Wireless Controller - ISE - Microsoft Domain Controller

bluesea2010 — Tue, 21 May 2024 18:22:59 GMT

Hi,

When using EAP-PEAP-GTC, the Active Directory (AD) response time is around 8 ms. Currently, NL_AUTH_SIGNATURE is being used. However, when using EAP-PEAP-MSCHAPv2, the Domain Controller (DC) response time increases to around 2-3 seconds, Is it ideal for Microsoft Active Directory and it causes wireless authentication to fail
Also How can I change to a more secure signature algorithm, such as NL_AUTH_SHA2_SIGNATURE?

Thanks

Re: Wireless Controller - ISE - Microsoft Domain Controller

Arne Bier — Tue, 21 May 2024 23:44:34 GMT

What version and patch of ISE are you using? I don't think we have any control over those algorithms within ISE - the best we can do is to run the latest versions of ISE. There have been some discussions around Windows Server registry hacks set/prefer certain algorithms.

Re: Wireless Controller - ISE - Microsoft Domain Controller

bluesea2010 — Wed, 22 May 2024 08:23:54 GMT

Thanks for the reply .I am using 2.x

what could be the ideal Active Directory challenge response time in

Re: Wireless Controller - ISE - Microsoft Domain Controller

Arne Bier — Thu, 23 May 2024 02:45:28 GMT

Version 2.x ? I guess that is anything from 2.0 to 2.7. Quite a difference. In any case, time to upgrade to 3.2 or later 🙂

In most customer scenarios, where the ISE node is in the same data centre as the AD controllers, you'll get responses as low as 10ms in most cases. It depends on how quickly the AD controller can process your request.

In ISE 3.x I also enable DNS caching to alleviate the constant DNS lookups that ISE is performing (because older ISE versions do not cache DNS results). That also helps a bit.