cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
277
Views
0
Helpful
2
Replies

DB Integration in ISE ODBC vs Active Directory

We are trying to decide between ODBC and AD for our external DB.
We are familiar with AD, but not with ODBC.
Does the integration between ISE and ODBC work well?
We would be grateful to know your experience.

1 Accepted Solution

Accepted Solutions

2 Replies 2

Arne Bier
VIP
VIP

It depends what your use case is.

AD has one major advantage over all the other methods (LDAP/ODBC) with regards to password protocol support. If you are doing simple PAP password checking (password string comparison), then AD/LDAP/ODBC are equivalent. But as soon as you need CHAP or MSCHAP protocols, then AD (and ISE internal user accounts) are the only option.

If however, your use case involves looking up records in an existing ODBC database (e.g. a warehouse system, or a hospital patient record system) then ISE integration certainly works well. It's been a while, but you'll need to write some SQL stored procedures on your SQL back-end, and then ISE can call those procedures, and process the returned data, and map the results to ISE attributes, that you can use in the Authorization Policies. I find it quite tricky and fiddly, because I am not well versed in SQL - but you can find enough tips on web searches to make something happen.

Many years ago there was a bug in ISE that prevented the successful fail-over from SQL server 1 to server 2 (if you provided two servers) - but I am sure that bug is resolved - but it would be worthwhile checking that the HA works as expected.

 

JustTakeTheFirstStep_0-1739328898259.png

https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_asset_visibility.html

Cisco ISE does not support encryption with ODBC. |Hence, ODBC connections are not secured