ISE - Active Directory - LDAPS

[descalante2007]

I think I understood the customer concern. This is quoted from Microsofthttp://support.microsoft.com/kb/321051

"The Lightweight Directory Access Protocol (LDAP) is used to read from and write to Active Directory. By default, LDAP traffic is transmitted unsecured. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology."

So the question now is how can we be sure the ISE communication is secure? ... I understand port 636 is used to transport LDAP-Secure ...

The ISE User Gude indicates that one of the ports required to be open in the case a firewall exists between ISE and ADE is 636 (LDAPS). -(ISE User Guide Page 5-6)

In my case there is no FW between ISE and AD, so how can I be sure LDAPS is being used?

ISE User Guide explais a little about security if the external identity source is an LDAP, but nothing about security is indicated in Active Directory configuration.

Regards.

[Richard Atkin]

I'm sure somebody else will have a better answer, but if you're in doubt about how the AD feature works, why not just mirror the port and capture some traffic - prove how it works for yourself? Alternatively, just create your own LDAPS connection instead of using the AD feature?

Sent from Cisco Technical Support iPad App

[manjeets]

Kindly review the below link

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_troubleshooting.html#wp1049448

[Tarik Admani]

Hi,

The AD join operations allows you to run PEAP protocol and is much more resilient than using ldap because of the way it joins itself to the domain. It uses kerberos and rpc when performing user authentication.

When using ldaps that is configuration based on when you add the ldap instance.

Sent from Cisco Technical Support iPad App