topic Re: Cisco ISE LDAP in Network Security

Cisco ISE LDAP

Marco Serato — Fri, 21 Feb 2020 12:54:33 GMT

Hello

I´ve got a problem with the authorization to use a condition with an External Group from the LDAP.

I bind the LDAP-Server to the ISE and can select all groups that I need for my authorization condition.

Now I want to create an authorization profile with the use of the group “Admins”.

My policy looks like:

LDAP: ExternalGroups EQUALS CN=Admins,DC=mydomain,DC=com

The live monitor said every time reject by authorization profile. If I use NOT EQUALS, then the computer get access to the network. It is very confused, because the computer is a member of the group “Admins”.

Can anybody help?

Many thanks.

Re: Cisco ISE LDAP

Jatin Katyal — Tue, 18 Jun 2013 08:42:28 GMT

I've seen issues while selecting LDAP as an external db with condition/attribute as ExternalGroups. Could you please go to live authentication , clcik on the magnifying glass and paste the details of failed attempt. I would like to know if this group is coming up in the memberOf attributes for the user.

Jatin Katyal
- Do rate helpful posts -

Re: Cisco ISE LDAP

Marco Serato — Wed, 19 Jun 2013 07:54:11 GMT

The appendix is an excerpt. I used the group "domain computers" for test. But I can´t see the group in the attributtes.

I hope it is helpful.

In the appendix are some missing. Here are the Other Attributes:

MTU=1500,CPMSessionID=AC1C01C7000000040022D940,EndPointMACAddress=93-9A-88-AD-18-EE,Device Type=Device Type#All Device Types,Location=Location#All Locations,Device IP Address=192.168.178.254,Called-Station-ID=02:81:D0:11:EC:31

Re: Cisco ISE LDAP

Jatin Katyal — Thu, 20 Jun 2013 12:08:27 GMT

Since it's not coming in authentication request there is no way the condition will get matched. Please don't use domain computers group for user authentication. Could you please assign user a different group like domain admins and test again.

Jatin Katyal
- Do rate helpful posts -

Re: Cisco ISE LDAP

Marco Serato — Wed, 26 Jun 2013 08:38:50 GMT

The same effect. The ISE said "Authentication failed : 15039 Rejected per authorization profile".

I tried 3 groups without success.

Re: Cisco ISE LDAP

edondurguti — Mon, 01 Jul 2013 16:35:46 GMT

post screenshot of your authorization rules.

Re: Cisco ISE LDAP

Marco Serato — Wed, 03 Jul 2013 07:29:16 GMT

Here the screenshot

Re: Cisco ISE LDAP

Marco Serato — Wed, 28 Aug 2013 14:32:44 GMT

Has anybody an idea? The problem still exists.

I have bind the LDAP add groups from directory once again. But the same effect.

If I use

LDAP:ExternalGroups Equals CN=domain computers,OU=computer, DC=mydomain,DC=com

Mycomputer get no network access. Without this condition I get full access. I despair of this problem.