To implement external authentication against Active Directory, the Cisco ISE server needs to communicate with the domain controller using either RADIUS or LDAP protocols. RADIUS is used for network access control, while LDAP is used for identity management and directory services. Both protocols require the appropriate ports to be opened and firewall rules to be configured to allow the traffic between the ISE server and the domain controller.
The ISE account does not need to be a domain administrator in Active Directory to perform JOIN operations.
It only needs to have the permissions to create computer objects and reset passwords in the domain. This can be achieved by delegating the rights to a specific OU or using a service account with limited privileges.
Active Directory supports user and machine authentication by using various methods, not only MSCHAPv2.
MSCHAPv2 is a challenge-response authentication protocol that is commonly used with RADIUS and VPN connections. However, Active Directory also supports other protocols such as Kerberos, NTLM, EAP, and PEAP, depending on the scenario and the client capabilities.
References:
* Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0
* Cisco ISE Integration with Microsoft Active Directory
* RADIUS vs. LDAP: What's the Difference?
* MS-CHAP v2 Authentication