Cisco Ise 13 User Guide

◦Useraccountisrestricted(disabled,lockedout,expired,passwordexpired,andsoon)
◦InitializationErrors—UsetheLDAPservertimeoutsettingstoconfigurethenumberofseconds
thatCiscoISEshouldwaitforaresponsefromanLDAPserverbeforedeterminingthatthe
connectionorauthenticationonthatserverhasfailed.
PossiblereasonsforanLDAPservertoreturnaninitializationerrorare:
◦LDAPisnotsupported.
◦Theserverisdown.
◦Theserverisoutofmemory.
◦Theuserhasnoprivileges.
◦Administratorcredentialsareconfiguredincorrectly....

•SearchingtheLDAPserverforanentrythatmatchestheMACaddressofthedevice
•RetrievingaMACAddressgroupinformationforthedeviceforuseinpolicies
•Retrievingvaluesforspecifiedattributesforuseinpolicies
Add LDAP Identity Sources
Before You Begin
•Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
•CiscoISEalwaysusestheprimaryLDAPservertoobtaingroupsandattributesforuseinauthorization
policies.Therefore,yourprimaryLDAPservermustbereachablewhenyouconfiguretheseitems.
Procedure
Step...

Procedure
Step 1ChooseAdministration>IdentityManagement>ExternalIdentitySources>LDAP.
Step 2CheckthecheckboxnexttotheLDAPinstancethatyouwanttoeditandclickEdit.
Step 3ClicktheDirectoryOrganizationtab.
Step 4EnterthevaluesasdescribedinLDAPIdentitySourceSettings.
Step 5ClickSubmittosavetheconfiguration.
Retrieve Group Membership Details from the LDAP Server
YoucanaddnewgroupsorselectgroupsfromtheLDAPdirectory.
Procedure
Step 1ChooseAdministration>IdentityManagement>ExternalIdentitySources>LDAP.
Step...

Procedure
Step 1ChooseAdministration>IdentityManagement>ExternalIdentitySources>LDAP.
Step 2CheckthecheckboxnexttotheLDAPinstancethatyouwanttoeditandclickEdit.
Step 3ClicktheAttributestab.
Step 4ChooseAdd>AddAttributetoaddanewattributeorchooseAdd>SelectAttributesFromDirectory
toselectattributesfromtheLDAPserver.
a)Ifyouchoosetoaddanattribute,enteranameforthenewattribute.
b)Ifyouareselectingfromthedirectory,enteranexampleuserandclickRetrieveAttributestoretrieve...

Step 2ConfigureCiscoISEtousesecureauthenticationwhencommunicatingwiththeLDAPidentitysource
(Administration>IdentityManagement>ExternalIdentitySources>LDAP;besuretocheckthe
SecureAuthenticationcheckboxintheConnectionSettingstab).
Step 3SelecttherootCAcertificateintheLDAPidentitystore.
RADIUS Token Identity Sources
AserverthatsupportstheRADIUSprotocolandprovidesauthentication,authorization,andaccounting(AAA)
servicestousersanddevicesiscalledaRADIUSserver.ARADIUSidentitysourceissimplyanexternal...

Failover in RADIUS Token Servers
CiscoISEallowsyoutoconfiguremultipleRADIUSidentitysources.EachRADIUSidentitysourcecan
haveprimaryandsecondaryRADIUSservers.WhenCiscoISEisunabletoconnecttotheprimaryserver,it
usesthesecondaryserver.
Configurable Password Prompt in RADIUS Token Servers
RADIUSidentitysourcesallowyoutoconfigurethepasswordprompt.Youcanconfigurethepassword
promptthroughtheAdminportal.
RADIUS Token Server User Authentication...

oraUserNotFoundmessage.However,thisoptionreturnsaUserNotFoundmessagenotonlyforcases
wheretheuserisnotknown,butforallfailurecases.
ThefollowingtableliststhedifferentfailurecasesthatarepossiblewithRADIUSidentityservers.
Table 17: Error Handling
Reasons for FailureFailure Cases
•Userisunknown.
•Userattemptstologinwithanincorrect
passcode.
•Userloginhoursexpired.
AuthenticationFailed
•RADIUSserverisconfiguredincorrectlyin
CiscoISE.
•RADIUSserverisunavailable.
•RADIUSpacketisdetectedasmalformed....

•User-Name(RADIUSattribute1)
•User-Password(RADIUSattribute2)
•NAS-IP-Address(RADIUSattribute4)
CiscoISEexpectstoreceiveanyoneofthefollowingresponses:
•Access-Accept—Noattributesarerequired,however,theresponsecancontainavarietyofattributes
basedontheRADIUStokenserverconfiguration.
•Access-Reject—Noattributesarerequired.
•Access-Challenge—TheattributesthatarerequiredperRADIUSRFCarethefollowing:
◦State(RADIUSattribute24)
◦Reply-Message(RADIUSattribute18)...

Delete a RADIUS Token Server
Before You Begin
•Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
•EnsurethatyoudonotselecttheRADIUStokenserversthatarepartofanidentitysourcesequence.If
youselectaRADIUStokenserverthatispartofanidentitysourcesequencefordeletion,thedelete
operationfails.
Procedure
Step 1ChooseAdministration>IdentityManagement>ExternalIdentitySources>RADIUSToken.
Step 2CheckthecheckboxnexttotheRADIUStokenserverorserversthatyouwanttodelete,thenclickDelete.
Step...

CiscoISEsupportsonlyoneRSArealm.
Cisco ISE and RSA SecurID Server Integration
ThesearethetwoadministrativerolesinvolvedinconnectingCiscoISEwithanRSASecurIDserver:
•RSAServerAdministrator—ConfiguresandmaintainsRSAsystemsandintegration
•CiscoISEAdministrator—ConfiguresCiscoISEtoconnecttotheRSASecurIDserverandmaintains
theconfiguration
ThissectiondescribestheprocessesthatareinvolvedinconnectingCiscoISEwiththeRSASecurIDserver...