DB Integration in ISE ODBC vs Active Directory

JustTakeTheFirstStep — Fri, 20 Dec 2024 12:20:53 GMT

We are trying to decide between ODBC and AD for our external DB.
We are familiar with AD, but not with ODBC.
Does the integration between ISE and ODBC work well?
We would be grateful to know your experience.

Re: DB Integration in ISE ODBC vs Active Directory

Arne Bier — Thu, 26 Dec 2024 22:52:37 GMT

It depends what your use case is.

AD has one major advantage over all the other methods (LDAP/ODBC) with regards to password protocol support. If you are doing simple PAP password checking (password string comparison), then AD/LDAP/ODBC are equivalent. But as soon as you need CHAP or MSCHAP protocols, then AD (and ISE internal user accounts) are the only option.

If however, your use case involves looking up records in an existing ODBC database (e.g. a warehouse system, or a hospital patient record system) then ISE integration certainly works well. It's been a while, but you'll need to write some SQL stored procedures on your SQL back-end, and then ISE can call those procedures, and process the returned data, and map the results to ISE attributes, that you can use in the Authorization Policies. I find it quite tricky and fiddly, because I am not well versed in SQL - but you can find enough tips on web searches to make something happen.

Many years ago there was a bug in ISE that prevented the successful fail-over from SQL server 1 to server 2 (if you provided two servers) - but I am sure that bug is resolved - but it would be worthwhile checking that the HA works as expected.

RE: DB Integration in ISE ODBC vs Active Directory

JustTakeTheFirstStep — Wed, 12 Feb 2025 02:55:50 GMT

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_asset_visibility.html

Cisco ISE does not support encryption with ODBC. |Hence, ODBC connections are not secured

topic RE: DB Integration in ISE ODBC vs Active Directory in Network Access Control

DB Integration in ISE ODBC vs Active Directory

Re: DB Integration in ISE ODBC vs Active Directory

RE: DB Integration in ISE ODBC vs Active Directory