Question

A network administrator configures an ISE authentication policy for a dot1x-based wired deployment. Contractors authenticate using EAP-TLS certificates stored in an LDAP directory, while full-time employees authenticate using PEAP-MSCHAPv2 credentials in Active Directory. Both user types hit the same authentication policy rule. The administrator wants ISE to first attempt to validate the user against Active Directory, and if the user is not found there, fall through and check the LDAP store before rejecting the request. Which configuration achieves this behavior?

Accepted Answer

Reference an Identity Source Sequence in the authentication rule that lists Active Directory first and LDAP second, with the advanced option to continue searching when a user is not found in the current store

Answer

Create two separate authentication policy rules, one pointing to Active Directory and one to LDAP, and rely on ISE to merge the results automatically

Answer

Set the authentication rule's identity source to Internal Users and add Active Directory and LDAP as external authorization sources

Answer

Configure Active Directory as the identity source and enable the LDAP store as a certificate authentication profile fallback within the AD join point