ISE fallback to second ID store when first ID store is not reachable

[Madura Malwatte]

Hi All,

I am trying to solve the following problem:

We have MFA for our VPN using Okta with ISE. Okta is configured as a RADIUS Token server on ISE and is working fine. In the event we have the Okta servers not reachable for any reason, we want to be able to fallback to a secondary identity store (Active Directory with no MFA), so users are not locked out of the VPN and have another method to authenticate. So basically, when Okta servers are not reachable, I want ISE to then check the 2nd ID store in the list which would be AD. Is my understanding correct and is the configuration I am proposing going to work?

RADIUS token config:

For ID source sequence, I have first on the list the RADIUS token server (Okta), then AD. And have selected treat as if user not found and proceed to next store.

The the authentication policy would have this ISS.

When the RADIUS token (Okta) servers are not reachable, this is what ISE would report. So would the above proposed config then revert to using the AD for auth?

[Colby LeMaire · Accepted solution]

Your understanding is correct; however, it would be good to test to be sure.  When the option of "User not found" is used, ISE will move on to the next identity store.  This is not what you want since users would then be able to bypass MFA.  But with the "authentication failed" option, ISE should stop processing the identity store sequence and reject the request.

[cisco.13]

Hello  

can you tell me how I check the group (okta) of the user please?

Thank you