A network engineer is tasked with configuring a Cisco ISE server to implement external authentication against Active Directory. What must be considered about the authentication requirements? (Choose two.)
A.
RADIUS communication must be permitted between the ISE server and the domain controller.
B.
The ISE account must be a domain administrator in Active Directory to perform JOIN operations.
C.
Active Directory only supports user authentication by using MSCHAPv2.
D.
LDAP communication must be permitted between the ISE server and the domain controller.
E.
Active Directory supports user and machine authentication by using MSCHAPv2.
To implement external authentication against Active Directory, the Cisco ISE server needs to communicate with the domain controller using either RADIUS or LDAP protocols. RADIUS is used for network access control, while LDAP is used for identity management and directory services. Both protocols require the appropriate ports to be opened and firewall rules to be configured to allow the traffic between the ISE server and the domain controller.
The ISE account does not need to be a domain administrator in Active Directory to perform JOIN operations. It only needs to have the permissions to create computer objects and reset passwords in the domain. This can be achieved by delegating the rights to a specific OU or using a service account with limited privileges.
Active Directory supports user and machine authentication by using various methods, not only MSCHAPv2. MSCHAPv2 is a challenge-response authentication protocol that is commonly used with RADIUS and VPN connections. However, Active Directory also supports other protocols such as Kerberos, NTLM, EAP, and PEAP, depending on the scenario and the client capabilities.
References:
Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0
Cisco ISE Integration with Microsoft Active Directory
RADIUS vs. LDAP: What’s the Difference?
MS-CHAP v2 Authentication
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit