Hi Team,
We have a customer that purchased ISE with one particular use case in mind. They want to limit the number of devices a student can have to 1. However, they don't want to limit the number of devices that a teacher or administrator can have. The partner stated the following and the customer is now coming back to us asking if what the partner said is true. If it is, can we help them with another approach?
Partner comments below:
First, to answer the question of whether we can limit user sessions with ISE, the answer is yes,but... There are a couple of consequences or caveats to that configuration that have to be understood.
1 - If we authenticate students to AD through ISE, then we can limit them to 1 session at a time. However, that means if we ever authenticate staff through ISE, they will also be limited to 1 session. We cannot selectively limit or not limit different users or groups that authenticate back to AD via ISE. So going forward, there will need to be some alternate authentication infrastructure for staff users, since ACS is nearing end of life status.
2 - Whatever authentication method we decide on for students, it will have to be the same regardless of what kind of device they are using. Unfortunately that brings us full circle to the same old Microsoft chicken/egg problem with wireless authentication. That issue has to do with how Windows deals with "user logon time" processes like login scripts and group policy. In short, we get around that problem today by having your Windows domain computers authenticate themselves to the wireless network prior to user login, so that when the user does log in there is a network connection present and login scripts will run. That pre-user-login computer authentication will not work for non-Windows devices.
3 - If using Chromebooks, we've seen issues where those devices don't pass login credentials over to the wireless connection. So those users will likely need to log in once to the device, then again to the wireless network.
The direction we go from here depends on exactly what kinds of devices are to be used by students, and if Windows is included in that mix, then do they need or not need login scripts to run when the user logs in? If they do need login scripts, then I'm not sure if we will be able to implement a single SSID/Security combination that will accommodate all types of devices.
My first thought is that we could use a captive portal setup, so that when a user opens their browser on any type of device they have to log in with AD credentials. That will work on non-Windows devices, and Windows devices provided they don't need login scripts.
