topic Re: ISE deployment queries in Network Access Control

ISE deployment queries

ymadheka — Thu, 11 Jan 2018 18:30:55 GMT

Hi Team,

We are in middle of a deployment planning of ISE in one of a very large management college and customer needs this features as mentioned here:

Solution must be capable of providing Advertising Services (Play Video before Access, offer current Promotions, Advise of Health Alerts).

Domain users with non-domain assets coming to the classroom for exam between 2Pm to 4PM should be given limited access. Time based policy can be done but the user is a part of multiple groups. If the user comes in at 1:30PM, he might be part of a different policy. How can I do a session timeout and ensure that when the time strikes 2PM , he is a part of the time based policy.

Pop-ups of advertising services on all machines in the campus

Thanks for advance for any help provided.

Thanks & Regards,

Yogesh Madhekar

Re: ISE deployment queries

hslai — Fri, 12 Jan 2018 15:06:12 GMT

Video is likely needed to be externally hosted and link to ISE guest portals. Then, you would probably need some javascript to disable and enable the login button.

In order to ensure domain users with non-corporate assets to re-auth at the right moment, I would suggest to use an external script on ISE session API to perform CoA.

Pop-ups on all machines are not an ISE feature. I would suggest to find some MDM/MAM/EMM.

Re: ISE deployment queries

ymadheka — Sat, 13 Jan 2018 14:27:27 GMT

Thanks for the quick response.

For the first two points do we have anyone who can guide us with the scripting part to achieve the customer requirement?

Appreciate your quick response on this.

Thanks & Regards,

Yogesh Madhekar

Re: ISE deployment queries

Jason Kunst — Sat, 13 Jan 2018 15:25:14 GMT

this is not a trivial task This is something they would need to contract with a web developer (like the portal builder team) partner or advanced services team

Would also recommend looking into CMX EMSP as a better fit On advertisements couponing videos etc

Re: ISE deployment queries

Jason Kunst — Sat, 13 Jan 2018 15:46:15 GMT

Also one thing to add, ISE would only be able to display advertising videos on a redirection portal (example the guest portal) upon login

Popping up advertising outside of a redirection portal is not a capability of ise like hsing stated

Might be a possible item with CMX and a special mobile app

Re: ISE deployment queries

ymadheka — Thu, 18 Jan 2018 04:11:08 GMT

Thanks for all the inputs.

Regarding the advertising videos can you please help with the flow on how the below point can be achieved?

Also can we have a context based security integration policy through NAC for example – Facebook and YouTube gets disabled for students when they enter in class, user is not allowed to connect to network if antivirus signature is not up to date or windows/security patches are not up-to-date, Operating System on desktop is not genuine etc.

Thanks in advance for any help.

Re: ISE deployment queries

Jason Kunst — Thu, 18 Jan 2018 12:17:54 GMT

You’re asking several different things here on one thread

I would suggest engage local ISE expert partner and ISE champion to understand requirements

You’re mixing capabilities of ISE and other systems as well

For adding In videos you will need to do advanced customization outside of the scope of this community, need to engage separately a partner such as the ISE portal builder team on how that can be achieved, you can upload and link videos to portal page with basic option built into page however with the custom portal files upload and storage then link the file easily in the portal Customization

I would suggest you lab up and have someone play around

To be able to restrict access depending on location in a building you would need to integrate wireless location however this only work with Mse 8.x, suggest you reach out to CMX team to see about their roadmap

I am not sure about your last ask

If you’re requiring posture and location to have different policy then you will need to integrate with mse and also deploy AnyConnect or use web agent