topic Re: When Primary PAN is Down,Whether BYOD support external CA or not？ in Network Access Control

When Primary PAN is Down,Whether BYOD support external CA or not？

songl — Mon, 11 Jun 2018 05:54:30 GMT

Hi Team

In below document, i see if primary pan down, BYOD couldn't support internal CA. I want to know ,When Primary PAN is Down,Whether BYOD support external CA?

Features	Available When Primary PAN is Down (Yes/No)
Existing internal user RADIUS authentication	Yes
Existing or New AD user RADIUS authentication	Yes
Existing endpoint with no profile change	Yes
Existing endpoint with profile change	No
New endpoint learned through profiling.	No
Existing guest – LWA	Yes
Existing guest – CWA	Yes (apart from flows enabled for device registration, such as Hotspot, BYOD, and CWA with automatic device registration)
Guest change password	No
Guest – AUP	No
Guest – Max Failed Login Enforcement	No
New Guest (Sponsored or Self-registered)	No
Posture	Yes
BYOD with Internal CA	No
Existing Registered Devices	Yes
MDM On-boarding	No
pxGrid Service	No

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter…

Thanks

Songl

Re: When Primary PAN is Down,Whether BYOD support external CA or not？

Nidhi — Mon, 11 Jun 2018 07:54:02 GMT

Hi,

when Primary PAN is down, no new session is created. If you are asking if external CA can be used for BYOD, then yes. but the recommended way is to use internal CA which is easy

Thanks,

Nidhi

Re: When Primary PAN is Down,Whether BYOD support external CA or not？

hslai — Mon, 11 Jun 2018 11:25:08 GMT

Part of BYOD is to register the endpoint so it would not work properly if the primary admin node is down. Proxying SCEP requests do not depend on this.

Re: When Primary PAN is Down,Whether BYOD support external CA or not？

songl — Tue, 12 Jun 2018 07:10:05 GMT

Thanks for all