03-20-2018 03:12 AM - edited 02-21-2020 10:50 AM
Hi All
I'm new to ISE and using it currently in a lab. My goal is to make profiles based on AD membership of clients for 802.1x authentication on a switch.
I've successfully added the AD and the ISE is joined. I'm using ISE 2.3 with patch2 installed.
My sample client provides these attributes:
But the dictionary / policy elements don't match a single of those attributes, so I am unable to profile it:
I did find this bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg57342
Am I indeed hitting that bug and does that mean it's not possible in ISE 2.3 to use the Active Directory Profiling for authentications?
Solved! Go to Solution.
03-21-2018 05:26 AM
03-20-2018 03:26 AM - edited 03-20-2018 03:28 AM
Hi,
In order to use AD group membership for Authentication/Authorisation:
- Create an External Identity Source for AD domain (Administration > External Identity Source)
- Import groups from AD (Administration > External Identity Source > YOURADDOMAIN > Groups)
- In your Policy Set create your rules and select YOURADDOMAIN:ExternalGroups EQUALS YourGroupName
You can use the AD probe information in the rules aswell to determine that the actual computer is joined to the AD domain etc.
03-20-2018 03:44 AM
03-20-2018 03:51 AM
Well you probably want to combine matching those groups with other attributes, AD probe information if possible is a start.
What supplicant are you using to authenticate? AnyConnect or Windows native?
If AC you could use EAP Chaining, authenticate the computer and user and then create a rule that only allows access if both computer and user authentication succeeded.
03-20-2018 04:33 AM
03-21-2018 05:26 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide