Set SSH/TELNET max sessions connections - ISE 2.7

[croonos23]

Hi cisco community, I have tested this feature "Max Sessions" I have understood that this option limits the ssh or telnet connection per user, however I have created a python script using netmiko and have seen more sessions successfully established. 

Could you explain this feature? I want to block ssh/telnet max sessions per user and set limit.

ISE: 2.7

[ahollifield · Accepted solution]

That is for RADIUS sessions.  Not for SSH connections to ISE.

https://community.cisco.com/t5/network-access-control/ise-v3-0-max-concurent-sessions/td-p/4413212

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

[croonos23]

Thanks ahollifield,  I want to block ssh/telnet sessions per user when a limit set by me is reached. Can I do this from the ISE server?

[ahollifield]

So do you mean for TACACS+ authentications to network devices (switch, router, etc.) or for SSH to ISE itself?   

[croonos23]

TACACS+ authentications to network devices on network devices, I want to set a limit for ssh or telnet connections to the devices.

[ahollifield]

This should work for TACACS+ but I've never personally tested it.  What is the authentication source? AD? Local? Something else?  This also requires Accounting to be properly configured so ISE can monitor the active sessions accurately.  

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-22/204463-Configure-Maximum-Concurrent-User-Sessio.html#anc14

[croonos23]

I am using Local authentication source, but i changed value and it don't block sessions

[ahollifield]

Do you have TACACS+ accounting configured? 

[croonos23 · Accepted solution]

Thanks for your support, I found a bug in my version (ISE 2.7 patch 2), I will install upgrade and tell you later.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvv14390

[Marcelo Morais]

Hi @croonos23 ,

 I would like to add just one thing ... please take a look at: Configure Maximum Concurrent User Sessions on ISE 2.2, special attention to:

" ... Enforcement and count of a Concurrent Session is unique and managed by each PSN. There is no synchronization between the PSNs in terms of session count. Concurrent Session feature is implemented in the runtime process and data is stored only in memory. In case of PSN restart, MaxSessions counters reset... "

Hope this helps !!!