cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

685
Views
0
Helpful
2
Replies
ashvaras
Cisco Employee

Fast switching? Px Grid?

HI there!  Im looking for some information that im having trouble finding.  Ive seen discussions on fast switching but it was unsupported with windows 7...im wondering if:

- Do we have any information on how Windows 10 Fast Switching works with ISE as well as Cisco Any Connect.

ALSO:

- Do we have any examples or guides on how reports can be generated out of ISE using pxGrid?

1 ACCEPTED SOLUTION

Accepted Solutions
thomas
Cisco Employee

Please ask questions about separate, unrelated topics (fast-user-switching and pxGrid) in separate community questions.

You are referring to Microsoft Windows Fast User Switching "feature".

With Microsoft Windows Fast User Switching the OS sends no notification of a logoff and logon of the user change therefore ISE cannot detect/know about this event and change network authorization accordingly:

In older operating systems, a user was required to log off before another user could log on. As of Windows XP, a user does not have to log off to allow another user to log on. Instead, it is possible for multiple users to log on and switch quickly between their open accounts. This feature is referred to as fast user switching.

If you use AnyConnect NAM for 802.1X authentication, it restricts network authentication to a single user. It will disable this feature to prevent such inconsistency in user login behavior to properly enforce network access per user.

Please see the Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.5  - Cisco for how the NAM Module does Single Sign On “Single User” Enforcement.

View solution in original post

2 REPLIES 2
thomas
Cisco Employee

Please ask questions about separate, unrelated topics (fast-user-switching and pxGrid) in separate community questions.

You are referring to Microsoft Windows Fast User Switching "feature".

With Microsoft Windows Fast User Switching the OS sends no notification of a logoff and logon of the user change therefore ISE cannot detect/know about this event and change network authorization accordingly:

In older operating systems, a user was required to log off before another user could log on. As of Windows XP, a user does not have to log off to allow another user to log on. Instead, it is possible for multiple users to log on and switch quickly between their open accounts. This feature is referred to as fast user switching.

If you use AnyConnect NAM for 802.1X authentication, it restricts network authentication to a single user. It will disable this feature to prevent such inconsistency in user login behavior to properly enforce network access per user.

Please see the Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.5  - Cisco for how the NAM Module does Single Sign On “Single User” Enforcement.

View solution in original post

hslai
Cisco Employee

802.1X in general is not supported well with fast user switching. CSCud51790 mentioned it not working with AnyConnect NAM.

ISE pxGrid has a live log, which shows us the connection attempts.

Content for Community-Ad