Cisco IOS ISR G2 IP Admission for CWS: Shared Machine, Same IP

[rafaelleao.89]

Hello.

I have a situation about IP admission using transparent NTLM.

I have a shared machine where a users logs on and after a random time, another user takes place logging on with it username/password.

But ISR have already authenticated this machine binding its IP address to the previous users and thus not refreshing this information, causing CWS to apply policies incorrectly to the new logged user.

Is there any known workaround to this? As far as I know the IP admission feature is not stateful.

Thanks in advance,

Rafael Leão

[Ashok Sakthivel]

Hi Rafael,

It is expected result , as the ISR caches the authenticated user for the default time of 60mins.

#sh ip admission cache
“Client Name user1, Client IP 192.168.1.10, Port 50240, timeout 60, Time Remaining 60, state ESTAB”

when user2  logs in to the same IP Address, unless  the timer expires on the ISR, it will continue to use user1 cached information.

Instead of IP admission feature in ISR ,  you can use EasyID (session based cookie) or SAML (auth with logon credential ) authentication in shared machine environment.

Please reach out to TAC for assistance.


Thanks and Regards,
Ashok Sakthivel.
(asakthiv@cisco.com)