Authentication and Posture options if ISE fails

[jalfredo.garcia]

What are the suggested configuration for WLC and Catalyst Switches if ISE authentication fails in a single server environment? What other DB users sources could be used? The endpoints could gain acces to the network? Under what conditions/configurations? If posture features will be used and ISE is unavailable, what will be the behaviour?

Thanks a lot for your responses! 

[Kasun Bandara]

Hi,

if ISE is unavailable, already authenticated users will keep sessions till timeout and new authentications/posture tests/etc, will fail to continue.

rate this and mark as answer, if this resolved your issue

[Mike.Cifelli · Accepted solution]

Totally agree with @Kasun Bandara comments.  

 The endpoints could gain acces to the network? Under what conditions/configurations? If posture features will be used and ISE is unavailable, what will be the behaviour?

-There are some other mechanisms you can configure/deploy on your NADs.  For example, role based critical authz.  This essentially grants clients the same network access even when ISE is not reachable next time in the event of an outage.  Take a look here at further info: ISE Secure Wired Access Prescriptive Deployment Guide - Cisco Community

HTH!

[jalfredo.garcia]

Thanks for your response. I reviewed the url, is an excellent option for wired clients. What happens with wireless clients and endpoints like phones and cameras? Exists a way to provide some similar authentication and permit network access?
Thanks again and regards.