topic Re: Identity Collector & Cisco ISE - Failed Logins in General Topics

Identity Collector & Cisco ISE - Failed Logins

Austin35 — Fri, 24 Jan 2025 17:28:44 GMT

Hello!

I have recently started going down the path of testing Identity Collector with Cisco ISE SGTs. We currently have SGTs deployed to one of our sites and wanted to see how the integration works.

I was able to successfully get ISE connected to identity collector and SGT information from that site is being ingested. How ever when looking at logs for the mappings I noticed that there are only failed logins with Make sure the Account exists in AD description message.

A little bit about how are authentications are being handled. Are Computers (Desktops & Laptops) with security group computers are authenticating with EAP-TLS with a machine based certificate tied to the GUID of the device.

Some of our wireless clients that can't use EAP-TLS we use PEAP/MSCHAPv2 with a static username and password defined in ISE and not AD.

In the provided screenshot you can see both of these scenarios.

My questions then are.

I assume the reason why I am getting the make sure the account exists in AD is because the security gateway is doing a LDAP Query? This would be failing due to the Source usernames not being in AD as users (GUIDs are in as computers and the static ISE usernames are not in AD at all).

Even with the integration in this state am I still able to enforce the SGTs through access groups and roles or do you need a successful login?

And if you need a successful login how can that be achieved with machine based auth and static usernames in ISE?

Environment:

Cluster Running R81.20

Identity Collector

ISE 3.3

Any input is greatly appreciated!

Re: Identity Collector & Cisco ISE - Failed Logins

PhoneBoy — Fri, 24 Jan 2025 23:26:20 GMT

Group information can comes from LDAP, so if the users aren't defined there, those messages seem reasonable.
I believe you can define Identity Tags that match what is in Cisco ISE and those will be associated with the relevant users/machines (the capitalization should be identical to what's in ISE).

Re: Identity Collector & Cisco ISE - Failed Logins

Chris_Atkinson — Sat, 25 Jan 2025 00:16:14 GMT

For context, what patch level are the Involved components, Check Point JHF, Cisco ISE 3.3 (patch 4?) and AD environment version?

How are your access roles defined also verify the LDAP account unit credentials and DN.

From there we would leverage the following useful commands:

pdp idc groups_consolidation enable | disabled

pdp conciliation idc_multiple_users enabled | disabled

pdp idc groups_update on | off | status

Refer also: sk182935, sk165457, sk180392

Re: Identity Collector & Cisco ISE - Failed Logins

Chris_Atkinson — Sat, 25 Jan 2025 00:32:55 GMT

Example tag / access role:

Re: Identity Collector & Cisco ISE - Failed Logins

Austin35 — Mon, 27 Jan 2025 23:00:20 GMT

Cisco ISE 3.3 P4

R81.20 JHF 65

I looked through those SKs and they are about AD Group membership and that side is working fine. Our SE was able to get me in touch with one of the regional architects and we poked around at our configuration and did some testing.

Here is what we came up with,

Current configuration is that we have an identity collector with 1 query pool with both our AD and ISE tied to it.

AD and LDAP membership are working fine, Our ISE authentications do not have user information as we are doing device auth vs user auth.

When we ran some tests, we noticed that in the identity collector there are two mappings for the same IP in identity collector logs one being the username tied to the IP from AD, and the other being the GUID of the device authentication in ISE.

Speculation then being because the AD and the ISE are in the same query pool, identity collector or pdp is unable to correlate the two. From his recommendation we are going to be trying to separate the ISE and AD into two different Identity collector servers to get them out of the same query pool and see if that resolves the issue.

Re: Identity Collector & Cisco ISE - Failed Logins

SteveMad — Wed, 30 Apr 2025 12:30:58 GMT

Hey!

I'm facing a very similar situation ... Have you been able to solve it?

Re: Identity Collector & Cisco ISE - Failed Logins

Chris_Atkinson — Mon, 12 May 2025 10:47:22 GMT

For awareness there is a new IDC version available to support Cisco ISE 3.4 and other enhancements.