Cisco ISE 2.x - Restrict Host to only one valid authentication session

[Claudio Truttmann]

I have a question related to wired dot1x based on EAP-TLS authentication with ISE 2.x.

Is there a possible configuration to restrict one computer with a computer certificate to authenticate only once on an ISE cluster.

As soon the same certificate (subjectname) tries to authenticate on another switch, the client should not get a valid connection.

And what about PEAP-MSCHAPv2 authentication and MAB as well ?
Can we limit one user to only one valid session, so that it is not possible to authenticate twice with the same account/credentials ?

[Francesco Molino · Accepted solution]

Hi

On ISE 2.2, you have now the possibility to limit the number of session per user. The configuration is done in: Administration > System > Settings > Max Sessions

A user (MSCHAPv2), a computer (certificate for example) and MAC address are all users and this will be limited by this feature.

Here is the official Cisco doc: http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/204463-Configure-Maximum-Concurrent-User-Sessio.html

Can you do the setup and let me know if you have issues?

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

[Claudio Truttmann]

Thanks a lot for your Information.

We'll planning to upgrade to newest Version 2.2.

As soon we've upgraded and implemented those configuration, I'll give Feedback in this discussion.

[Francesco Molino]

No problem. You're welcome