topic ISE & AD EAP-TLS in Network Access Control

ISE & AD EAP-TLS

ngtransge — Mon, 11 Mar 2019 04:11:13 GMT

Hello,

I have typical deployment of EAP-TLS in wireless network, with ISE and AD. The "Perform Binary Certificate Comparison with Certificate retrieved from LDAP or Active Directory", feature is activated.

The problem is, when user accound in AD is disabled, it still can authenticate to ISE without any issue ?

Untill user certificate is deleted from AD.

How is it possible to make sure that when user account is disabled in AD, it is unable to authenticate with EAP-TLS ?

ISE & AD EAP-TLS

jrabinow — Thu, 12 Dec 2013 21:29:31 GMT

I think this should be under operator control with the following attribute that can be used in the authorization policy to define a condition for what should be performed in such a case:

IdentityAccessRestricted that is created automatically in the active directory dictionary

ISE & AD EAP-TLS

ngtransge — Fri, 13 Dec 2013 11:37:55 GMT

Hello jrabinow,

If I understand correctly i should check IdentityAccessRestricted attribute in Autorization policy, and if it present then it means that user was disabled in AD, and denyaccess for user ?

thank you,