ISE COA after disable a user on AD ( how to kick automatically disabled user on AD )

[eugeniodesideri]

hi y'all.

I have a question , i womder if someone out there can suggest me the easiest way to automatically 

kick an authenticated user doing traffic over the network , after i disable his AD account.

Basically if an account has been disabled on AD the user can't join the network  , ofcourse.

but if a user is already authenticated inside the network and i disable his account on AD , untill 

a re-auth occurs the user keeps been connected and allowed to make traffic inside the network.

So , is there a quick way to re-asses his status on AD trough a keep alive or something that tells ISE to check if the user account is still valid  ? 

thanks 

[Marcelo Morais]

Hi @eugeniodesideri 

 please try:

in Context Visibility > Endpoints, filter by Username
on Change Authorization > CoA Session Terminate

Hope this helps !!!

[eugeniodesideri]

Thanks for the answer , but as i wrote i would like this to happen automatically as i disable a user inside the AD.

Do you think is that something i can achieve?

thanks again 

Eugenio

[Greg Gibbs · Accepted solution]

I can only think of two possible ways to accomplish this:

1. Use a super aggressive Reauth timer in the AuthZ Profile pushed by your AuthZ Policy for AD user/computer sessions. The downside is that this would apply to all AD sessions and drastically increase the amount of RADIUS events/logs; possibly impacting performance.
2. Look into possibly using scripting on the AD side (maybe a PowerShell script) that both disables the user account and uses the REST API to find the MAC address associated with that particular user session and issues a COA.

Example AuthZ Profile setting:

[eugeniodesideri]

the REST API looks like a very smart solution ! thanks for the advice !