Cisco Ise 13 User Guide

							Diagnose Active Directory Problems
TheDiagnosticToolisaservicethatrunsoneveryCiscoISEnode.Itallowsyoutoautomaticallytestand
diagnosetheActiveDirectorydeploymentandexecuteasetofteststodetectissuesthatmaycausefunctionality
orperformancefailureswhenCiscoISEusesActiveDirectory.
TherearemultiplereasonsforwhichCiscoISEmightbeunabletojoinorauthenticateagainstActiveDirectory.
ThistoolhelpsensurethattheprerequisitesforconnectingCiscoISEtoActiveDirectoryareconfigured
correctly.Ithelpsdetectproblemswithnetworking,firewallconfigurations,clocksync,userauthentication,
andsoon.Thistoolworksasastep-by-stepguideandhelpsyoufixproblemswitheverylayerinthemiddle,
ifneeded.
Procedure
Step 1ChooseAdministration>IdentityManagement>ExternalIdentitySources>ActiveDirectory.
Step 2ClicktheAdvancedToolsdrop-downandchooseDiagnosticTools.
Step 3SelectaCiscoISEnodetorunthediagnosison.
IfyoudonotselectaCiscoISEnodethenthetestisrunonallthenodes.
Step 4SelectaspecificActiveDirectoryjoinpoint.
IfyoudonotselectanActiveDirectoryjoinpointthenthetestisrunonallthejoinpoints.
Step 5ClickRunAllTestsonNodetostartthetest.
Step 6ClickViewTestDetailstoviewthedetailsfortestswithWarningorFailedstatus.
Thistableallowsyoutorerunspecifictests,stoprunningtests,andviewareportofspecifictests.
Enable Active Directory Debug Logs
ActiveDirectorydebuglogsarenotloggedbydefault.YoumustenablethisoptionontheCiscoISEnode
thathasassumedthePolicyServicepersonainyourdeployment.EnablingActiveDirectorydebuglogsmay
affectISEperformance.
Procedure
Step 1ChooseAdministration>System>Logging>DebugLogConfiguration.
Step 2ClicktheradiobuttonnexttotheCiscoISEPolicyServicenodefromwhichyouwanttoobtainActive
Directorydebuginformation,andclickEdit.
Step 3ClicktheActiveDirectoryradiobutton,andclickEdit.
Step 4ChooseDEBUGfromthedrop-downlistnexttoActiveDirectory.Thiswillincludeerrors,warnings,and
verboselogs.Togetfulllogs,chooseTRACE.
Step 5ClickSave.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
265
Active Directory as an External Identity Source 
						

							Obtain the Active Directory Log File for Troubleshooting
DownloadandviewtheActiveDirectorydebuglogstotroubleshootissuesyoumayhave.
Before You Begin
ActiveDirectorydebugloggingmustbeenabled.
Procedure
Step 1ChooseOperations>Troubleshoot>DownloadLogs.
Step 2ClickthenodefromwhichyouwanttoobtaintheActiveDirectorydebuglogfile.
Step 3ClicktheDebugLogstab.
Step 4Scrolldownthispagetolocatethead_agent.logfile.Clickthisfiletodownloadit.
Active Directory Alarms and Reports
CiscoISEprovidesvariousalarmsandreportstomonitorandtroubleshootActiveDirectoryrelatedactivities.
Alarms
ThefollowingalarmsaretriggeredforActiveDirectoryerrorsandissues:
•Configurednameservernotavailable
•Joineddomainisunavailable
•Authenticationdomainisunavailable
•ActiveDirectoryforestisunavailable
•ADConnectorhadtoberestarted
•AD:ISEaccountpasswordupdatefailed
•AD:MachineTGTrefreshfailed
Reports
YoucanmonitorActiveDirectoryrelatedactivitiesthroughthefollowingtworeports:
•RADIUSAuthenticationsReport—ThisreportshowsdetailedstepsoftheActiveDirectoryauthentication
andauthorization.Youcanfindthisreporthere:Operations>Reports>AuthServicesStatus>
RADIUSAuthentications.
•ADConnectorOperationsReport—TheADConnectorOperationsreportprovidesalogofbackground
operationsperformedbyADconnector,suchasCiscoISEserverpasswordrefresh,Kerberosticket
management,DNSqueries,DCdiscovery,LDAP,andRPCconnectionsmanagement.Ifyouencounter
anyActiveDirectoryfailures,youcanreviewthedetailsinthisreporttoidentifythepossiblecauses.
Youcanfindthisreporthere:Operations>Reports>AuthServicesStatus>ADConnector
Operations.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
266
Active Directory as an External Identity Source 
						

							Active Directory Advanced Tuning
Theadvancedtuningfeatureprovidesnode-specificsettingsusedforsupportactionunderthesupervisionof
Ciscosupportpersonnel,toadjusttheparametersdeeperinthesystem.Thesesettingsarenotintendedfor
normaladministrationflow,andshouldbeusedonlyunderguidance.
Supplemental Information for Setting Up Cisco ISE with Active Directory
ForconfiguringCiscoISEwithActiveDirectory,youmustconfiguregrouppolicies,andconfigureasupplicant
formachineauthentication.
Configure Group Policies in Active Directory
FormoreinformationabouthowtoaccesstheGroupPolicymanagementeditor,refertotheMicrosoftActive
Directorydocumentation.
Procedure
Step 1OpentheGroupPolicymanagementeditorasshowninthefollowingillustration.
GroupPolicyObjectsselection
Step 2Createanewpolicyandenteradescriptivenameforitoraddtoanexistingdomainpolicy.
Example:
Inexamplebelow,weusedWiredAutoconfigurationforthepolicyname.
Step 3ChecktheDefinethispolicysettingcheckbox,andclicktheAutomaticradiobuttonfortheservicestartup
modeasshowninthefollowingillustration.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
267
Active Directory as an External Identity Source 
						

							PolicyProperties
Step 4ApplythepolicyatthedesiredorganizationalunitordomainActiveDirectorylevel.
Thecomputerswillreceivethepolicywhentheyrebootandthisservicewillbeturnedon.
Configure Odyssey 5.X Supplicant for EAP-TLS Machine Authentications Against Active Directory
IfyouareusingtheOdyssey5.xsupplicantforEAP-TLSmachineauthenticationsagainstActiveDirectory,
youmustconfigurethefollowinginthesupplicant.
Procedure
Step 1StartOdysseyAccessClient.
Step 2ChooseOdysseyAccessClientAdministratorfromtheToolsmenu.
Step 3Double-clicktheMachineAccounticon.
Step 4FromtheMachineAccountpage,youmustconfigureaprofileforEAP-TLSauthentications:
a)ChooseConfiguration>Profiles.
b)EnteranamefortheEAP-TLSprofile.
c)OntheAuthenticationtab,chooseEAP-TLSastheauthenticationmethod.
d)OntheCertificatetab,checkthePermitloginusingmycertificatecheckbox,andchooseacertificate
forthesupplicantmachine.
e)OntheUserInfotab,checktheUsemachinecredentialscheckbox.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
268
Active Directory as an External Identity Source 
						

							Ifthisoptionisenabled,theOdysseysupplicantsendsthemachinenameintheformat
host\andActiveDirectoryidentifiestherequestascomingfromamachineandwill
lookupcomputerobjectstoperformauthentication.Ifthisoptionisdisabled,theOdysseysupplicant
sendsthemachinenamewithoutthehost\prefixandActiveDirectorywilllookupuserobjectsandthe
authenticationfails.
AnyConnect Agent for Machine Authentication
WhenyouconfigureAnyConnectAgentformachineauthentication,youcandooneofthefollowing:
•Usethedefaultmachinehostname,whichincludestheprefix“host/.”
•Configureanewprofile,inwhichcaseyoumustincludetheprefix“host/”andthenthemachinename.
ISE  pxGrid  Identity Mapping
IdentityMappingenablesyoutomonitorusersthatareauthenticatedbyaDomainController(DC)andnot
byCiscoISE.InnetworkswhereCiscoISEdoesnotactivelyauthenticateusersfornetworkaccess,itis
possibletouseIdentityMappingtocollectuserauthenticationinformationfromtheactivedirectory(AD)
DomainController.TheIdentityMappingconnectstoWindowssystemusingtheMSWMIinterfaceand
querieslogsfromtheWindowseventmessaging.Onceauserlogsintothenetworkandisauthenticatedwith
anActiveDirectory,theDomainControllergeneratesaneventlogthatincludestheusernameandIPaddress
allocatedfortheuser.
IdentitymappingcanalsobeactivatedevenifCiscoISEplaysanactiveroleforauthentication.Insuchcases,
thesamesessionmaybeidentifiedtwice.Theoperationaldatahasasessionattributethatindicatesthesource.
YoucangotoOperations>AuthenticationsandclickShowLiveSessionstochecktheSessionSource.
TheIdentityMappingcomponentretrievestheuserloginsfromtheDomainControllerandimportstheminto
theCiscoISEsessiondirectory.SousersauthenticatedwithActiveDirectory(AD)areshownintheCisco
ISElivesessionsview,andcanbequeriedfromthesessiondirectoryusingCiscopxGridinterfacebythird-party
applications.Theknowninformationistheusername,IPaddress,andtheADDChostnameandtheADDC
NetBiosname.
TheCiscoISEplaysonlyapassiveroleanddoesnotperformtheauthentication.WhenIdentityMappingis
active,CiscoISEcollectsthelogininformationfromtheADandincludesthedataintothesessiondirectory.
Key Features
•IdentityMappingisconfiguredfromtheCiscoISEadministrationconsole.Theconfigurationincludes
thefollowingsettings:
◦DefinitionofalltheDCsfromwhichIdentityMappingistocollectuserauthenticationinformation.
ThisalsoincludesimportandexportoftheDClistusing*.csvfiles
◦DCconnectioncharacteristicssuchasauthenticationsecurityprotocol(NTLMv1orNTLMv2)
andusersessionagingtime
◦Connectiontesting,toverifytheDCissetcorrectlytoinitializevalidconnectionwithIdentity
Mapping
Cisco Identity Services Engine Administrator Guide, Release 1.3    
269
ISE  pxGrid  Identity Mapping 
						

							•IdentityMappingreport.ThisreportprovidesinformationabouttheIdentityMappingcomponentfor
troubleshooting
•IdentityMappingdebuglogs
•CiscoISEsessiondirectorymaintainsthecollecteduserinformation,sothatcustomerscanviewitfrom
theLiveSessionsandqueryitfromthepxGridinterface
•UsingtheCLIcommandshowapplicationstatusprovidesthehealthstatusofnodesthatuseIdentity
Mapping
•SupportsHighAvailability
Configuring Identity Mapping
IDMappingrequiresconfigurationinISE,andtheActiveDirectoryDomainServermusthavetheright
patchesandconfiguration.
Configure Identity Mapping
ISEmustbeabletoestablishaconnectionwithanADDomainController(DC).
Before You Begin
EnablepxGridservicestoconfigureIdentityMapping.ChooseAdministration>System>Deploymentto
enablepxGridservices.
ToaddanewDomainController(DC)forIdentityMapping,youneedthelogincredentialsofthatDC.
MakesuretheDomainControllerisproperlyconfiguredforISEIdentityMapping.
Procedure
Step 1ChooseAdministration>pxGridIdentityMapping>ADDomainController.
Step 2ClickGeneralSettings.
Step 3TheActiveDirectoryGeneralSettingspop-upisdisplayed.SettherequiredvaluesandclickSave.
•HistoryintervalisthetimeduringwhichIdentityMappingreadsuserlogininformationthatalready
occurred.ThisisrequireduponstartuporrestartofIdentityMappingtocatchupwitheventsgenerated
whileitwasunavailable.
•Usersessionagingtimeistheamountoftimetheusercanbeloggedin.IdentityMappingidentifies
newuserlogineventsfromtheDC,howevertheDCdoesnotreportwhentheuserlogsoff.Theaging
timeenablesCiscoISEtodeterminethetimeintervalforwhichtheuserisloggedin.
•YoucanselecteitherNTLMv1orNTLMv2asthecommunicationsprotocolbetweentheISEandthe
DC.
Step 4ClickAdd.
Step 5IntheGeneralSettingssection,entertheDisplayName,DomainFQDN,andHostFQDNoftheDC.
Step 6IntheCredentialssection,entertheUsernameandPasswordoftheDC.
Step 7(Optional)TesttheconnectiontothespecifieddomainbyclickingVerifyDCConnectionSettings.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
270
ISE  pxGrid  Identity Mapping 
						

							ThistestensuresthattheconnectiontotheDCishealthy.HoweveritdoesnotcheckwhetherCiscoISEcan
fetchtheuserinformationuponlogin.
Step 8ClickSubmit.Anupdatedtableisdisplayedwiththenewly-definedDCincludedinthelistofDCs.The
statuscolumnindicatesthedifferentstatesofDC.
YoucanalsoImportorExporttheDClist.
Whileimporting,youneedtoprovidethepasswordinthetemplate.Asthefilecontainspassword,
theimporttemplateshouldbetreatedassensitive.TheExportoptiondoesnotexportthepassword.
Note
Filter Identity Mapping
Youcanfiltercertainusers,basedontheirnameorIPaddress.Youcanaddasmanyfiltersasneeded.The
“OR”logicoperatorappliesbetweenfilters.Ifboththefieldsarespecifiedinasinglefilter,the“AND”logic
operatorappliesbetweenthesefields.TheMonitoringlivesessionshowsIdentityMappingcomponentsthat
arenotfilteredoutbytheMappingFilters.
Procedure
Step 1ChooseAdministration>pxGridIdentityMapping>MappingFilters.
Step 2ClickAdd,entertheUsernameandorIPaddressoftheuseryouwanttofilterandclickSubmit.
Step 3Toviewthenon-filteredusersthatarecurrentlyloggedintotheMonitoringsessiondirectory,choose
Operations>Authentications.
LDAP
LightweightDirectoryAccessProtocol(LDAP)isanetworkingprotocoldefinedbyRFC2251forquerying
andmodifyingdirectoryservicesthatrunonTCP/IP.LDAPisalightweightmechanismforaccessingan
X.500-baseddirectoryserver.
CiscoISEintegrateswithanLDAPexternaldatabase,whichisalsocalledanidentitysource,byusingthe
LDAPprotocol.
LDAP Directory Service
LDAPdirectoryserviceisbasedonaclient-servermodel.AclientstartsanLDAPsessionbyconnectingto
anLDAPserverandsendingoperationrequeststotheserver.Theserverthensendsitsresponses.Oneor
moreLDAPserverscontaindatafromtheLDAPdirectorytreeortheLDAPbackenddatabase.
Thedirectoryservicemanagesadirectory,whichisadatabasethatholdsinformation.Directoryservicesuse
adistributedmodelforstoringinformation,andthatinformationisusuallyreplicatedbetweendirectory
servers.
AnLDAPdirectoryisorganizedinasimpletreehierarchyandcanbedistributedamongmanyservers.Each
servercanhaveareplicatedversionofthetotaldirectory,whichissynchronizedperiodically.
Cisco Identity Services Engine Administrator Guide, Release 1.3    
271
LDAP 
						

							Anentryinthetreecontainsasetofattributes,whereeachattributehasaname(anattributetypeorattribute
description)andoneormorevalues.Theattributesaredefinedinaschema.
Eachentryhasauniqueidentifier:itsdistinguishedname(DN).Thisnamecontainstherelativedistinguished
name(RDN),whichisconstructedfromattributesintheentry,followedbytheDNoftheparententry.You
canthinkoftheDNasafullfilename,andtheRDNasarelativefilenameinafolder.
Multiple LDAP Instances
BycreatingmorethanoneLDAPinstancewithdifferentIPaddressesorportsettings,youcanconfigure
CiscoISEtoauthenticateusingdifferentLDAPserversordifferentdatabasesonthesameLDAPserver.Each
primaryserverIPaddressandportconfiguration,alongwiththesecondaryserverIPaddressandport
configuration,formsanLDAPinstancethatcorrespondstooneCiscoISELDAPidentitysourceinstance.
CiscoISEdoesnotrequirethateachLDAPinstancecorrespondtoauniqueLDAPdatabase.Youcanhave
morethanoneLDAPinstancesettoaccessthesamedatabase.ThismethodisusefulwhenyourLDAP
databasecontainsmorethanonesubtreeforusersorgroups.BecauseeachLDAPinstancesupportsonlyone
subtreedirectoryforusersandonesubtreedirectoryforgroups,youmustconfigureseparateLDAPinstances
foreachuserdirectoryandgroupdirectorysubtreecombinationforwhichCiscoISEsubmitsauthentication
requests.
LDAP Failover
CiscoISEsupportsfailoverbetweenaprimaryLDAPserverandasecondaryLDAPserver.Afailoveroccurs
whenanauthenticationrequestfailsbecauseCiscoISEcouldnotconnecttoanLDAPserverbecauseitis
downorisotherwiseunreachable.
IfyouestablishfailoversettingsandthefirstLDAPserverthatCiscoISEattemptstocontactcannotbe
reached,CiscoISEalwaysattemptstocontactasecondLDAPserver.IfyouwantCiscoISEtousethefirst
LDAPserveragain,youmustenteravalueintheFailbackRetryDelaytextbox.
CiscoISEalwaysusestheprimaryLDAPservertoobtaingroupsandattributesforuseinauthorization
policiesfromtheAdminportal,sotheprimaryLDAPservermustbeaccessiblewhenyouconfigurethese
items.CiscoISEusesthesecondaryLDAPserveronlyforauthenticationsandauthorizationsatruntime,
accordingtothefailoverconfiguration.
Note
LDAP Connection Management
CiscoISEsupportsmultipleconcurrentLDAPconnections.Connectionsareopenedondemandatthetime
ofthefirstLDAPauthentication.ThemaximumnumberofconnectionsisconfiguredforeachLDAPserver.
Openingconnectionsinadvanceshortenstheauthenticationtime.Youcansetthemaximumnumberof
connectionstouseforconcurrentbindingconnections.Thenumberofopenconnectionscanbedifferentfor
eachLDAPserver(primaryorsecondary)andisdeterminedbasedonthemaximumnumberofadministration
connectionsconfiguredforeachserver.
CiscoISEretainsalistofopenLDAPconnections(includingthebindinginformation)foreachLDAPserver
thatisconfiguredinCiscoISE.Duringtheauthenticationprocess,theconnectionmanagerattemptstofind
anopenconnectionfromthepool.Ifanopenconnectiondoesnotexist,anewoneisopened.
   Cisco Identity Services Engine Administrator Guide, Release 1.3
272
LDAP 
						

							IftheLDAPserverclosedtheconnection,theconnectionmanagerreportsanerrorduringthefirstcallto
searchthedirectory,andtriestorenewtheconnection.Aftertheauthenticationprocessiscomplete,the
connectionmanagerreleasestheconnection.
LDAP User Authentication
LDAPcanbeusedasanexternaldatabaseforCiscoISEuserauthentication.CiscoISEsupportsplainpassword
authentication.Userauthenticationincludes:
•SearchingtheLDAPserverforanentrythatmatchestheusernameintherequest
•CheckingtheuserpasswordwiththeonethatisfoundintheLDAPserver
•Retrievingagroup’smembershipinformationforuseinpolicies
•Retrievingvaluesforspecifiedattributesforuseinpoliciesandauthorizationprofiles
Toauthenticateauser,CiscoISEsendsabindrequesttotheLDAPserver.ThebindrequestcontainstheDN
andpasswordoftheuserincleartext.AuserisauthenticatedwhentheDNandpasswordoftheusermatch
theusernameandpasswordintheLDAPdirectory.
WerecommendthatyouprotecttheconnectiontotheLDAPserverusingSecureSocketsLayer(SSL).
LDAP Group and Attribute Retrieval for Use in Authorization Policies
CiscoISEcanauthenticateasubject(userorhost)againstanLDAPidentitysourcebyperformingabind
operationonthedirectoryservertofindandauthenticatethesubject.Aftersuccessfulauthentication,Cisco
ISEcanretrievegroupsandattributesthatbelongtothesubjectwhenevertheyarerequired.Youcanconfigure
theattributestoberetrievedintheCiscoISEAdminportalbychoosingAdministration>Identity
Management>ExternalIdentitySources>LDAP.ThesegroupsandattributescanbeusedbyCiscoISE
toauthorizethesubject.
ToauthenticateauserorquerytheLDAPidentitysource,CiscoISEconnectstotheLDAPserverandmaintains
aconnectionpool.
YoushouldnotethefollowingrestrictionsongroupmembershipswhenActiveDirectoryisconfiguredasan
LDAPstore:
•Usersorcomputersmustbedirectmembersofthegroupdefinedinthepolicyconditionstomatchthe
policyrule.
•Thedefinedgroupmaynotbeauser’sorcomputer’sprimarygroup.Thisrestrictionisapplicableonly
whenActiveDirectoryisconfiguredasanLDAPstore.
LDAP Group Membership Information Retrieval
Foruserauthentication,userlookup,andMACaddresslookup,CiscoISEmustretrievegroupmembership
informationfromLDAPdatabases.LDAPserversrepresenttheassociationbetweenasubject(auserora
host)andagroupinoneofthefollowingways:
•GroupsRefertoSubjects—Thegroupobjectscontainanattributethatspecifiesthesubject.Identifiers
forsubjectscanbesourcedinthegroupasthefollowing:
◦Distinguishednames
Cisco Identity Services Engine Administrator Guide, Release 1.3    
273
LDAP 
						

							◦Plainusernames
•SubjectsRefertoGroups—Thesubjectobjectscontainanattributethatspecifiesthegrouptowhich
theybelong.
LDAPidentitysourcescontainthefollowingparametersforgroupmembershipinformationretrieval:
•Referencedirection—Thisparameterspecifiesthemethodtousewhendetermininggroupmembership
(eithergroupstosubjectsorsubjectstogroups).
•Groupmapattribute—Thisparameterindicatestheattributethatcontainsgroupmembershipinformation.
•Groupobjectclass—Thisparameterdeterminesthatcertainobjectsarerecognizedasgroups.
•Groupsearchsubtree—Thisparameterindicatesthesearchbaseforgroupsearches.
•Membertypeoption—Thisparameterspecifieshowmembersarestoredinthegroupmemberattribute
(eitherasDNsorplainusernames).
LDAP Attributes Retrieval
Foruserauthentication,userlookup,andMACaddresslookup,CiscoISEmustretrievethesubjectattributes
fromLDAPdatabases.ForeachinstanceofanLDAPidentitysource,anidentitysourcedictionaryiscreated.
Thesedictionariessupportattributesofthefollowingdatatypes:
•String
•Unsignedinteger32
•IPv4address
ForunsignedintegersandIPv4attributes,CiscoISEconvertsthestringsthatithasretrievedtothe
correspondingdatatypes.Ifconversionfailsorifnovaluesareretrievedfortheattributes,CiscoISElogsa
debugmessage,buttheauthenticationorlookupprocessdoesnotfail.
YoucanoptionallyconfiguredefaultvaluesfortheattributesthatCiscoISEcanusewhentheconversion
failsorwhenCiscoISEdoesnotretrieveanyvaluesfortheattributes.
LDAP Certificate Retrieval
Ifyouhaveconfiguredcertificateretrievalaspartofuserlookup,thenCiscoISEmustretrievethevalueof
thecertificateattributefromLDAP.ToretrievethevalueofthecertificateattributefromLDAP,youmust
havepreviouslyconfiguredthecertificateattributeinthelistofattributestobeaccessedwhileconfiguring
anLDAPidentitysource.
Errors Returned by the LDAP Server
Thefollowingerrorscanoccurduringtheauthenticationprocess:
•AuthenticationErrors—CiscoISElogsauthenticationerrorsintheCiscoISElogfiles.
PossiblereasonsforanLDAPservertoreturnbinding(authentication)errorsincludethefollowing:
◦Parametererrors—Invalidparameterswereentered
   Cisco Identity Services Engine Administrator Guide, Release 1.3
274
LDAP