Cisco ISE and Fast User Switching

[David Pease]

Greetings,

In our deployment, we are interested in utilizing the "Fast User Switching" that is contained within the Windows Functionality.   After searching for quite a while, I see that the native Windows supplicant is not compatible with Fast User Switching.   It does not appear that Anyconnect is either.   Can you please inform me as to what suppluicant I would need to research in order to allow for the User Switchign Functionality?

We are currently using ISE 1.2 Patch 4.

Thank You for any assistance.

David

[Saurav Lodh · Accepted solution]

The  NAC Agent for Cisco ISE does not support Windows Fast User Switching  when using the native supplicant. This is because there is no clear  disconnect of the older user. When a new user is sent, the Agent is hung  on the old user process and session ID, and hence a new posture cannot  take place. As per the Microsoft Security policies, it is recommended to  disable Fast User Switching.

Source:

http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_pos_pol.html

[David Pease]

Saurav,

While I appreciate the reply, you failed to answer my question.   If you re-read what I originally wrote, I was already aware that the Native Supplicant does not support Fast User Switching.  My question was if there were any other supplicants that *DO* support it.    

You basically just repeated back to me the statement I had in my initial question about the Native Supplicant.

Thank You.

[David Pease]

Does anyone else have a reply to this?   There has to be someone who has run into this issue before...