ISE 2.3 Passive ID - username gets mapped to multiple IP addresses

[imihajlo]

Hello All,

We have a setup in the lab where we are using passive ID with ISE and as a result the username gets mapped to multiple IP addresses.

Please see the attached document for the topology.

Lab components:

ASAv

Virtual ISE 2.3

AD – Server 2016

Workstation – Windows 10

Mail server using kerberos to AD for user.

Lab setup:

ASAv basic config with SXP to ISE.

ISE connected to AD and using Passive ID without agent.

AD basic config with.

Mail server using Kerberos.

I did only a couple of tests before dismantling the lab but this was the scenario as I experienced it.

Scenario:

1. User1 logs in to PC, ISE gets info via Passive ID and maps ip 1.1.1.1 to User1 and sends it via SXP to ASA.
2. User1 logs in to Webmail, ISE gets info via Passive ID and maps ip 1.1.1.3 to User1 and sends it via SXP to ASA.

Is this a known phenomenon?

Regards,

Ivana

[Ben Walters · Accepted solution]

We use CDA right now instead of Passive ID and it is a known behavior to map a user to different IPs depending on how they access various resources. I am guessing Passive ID works in a similar way. 

It looks at the authentications from AD and maps users to the IP that the authentication came from, this is more prominent with our admin staff that RDP to different servers they could have several IPs associated with their user account. Basically any service that authenticates to AD could provide IP mappings to Passive ID for any user. It will hold on to the IP mapping until there is a logout from AD or the timeout expires.