topic Re: ISE for securing VDI and Laptop user environment in Network Access Control

ISE for securing VDI and Laptop user environment

p.s.arun2020 — Sun, 26 Nov 2017 09:44:07 GMT

Hi All,

We have a customer requirement where they have VDI as well as laptop users who connect to random ports. Please advise what is the best way to securely deploy ISE in such an environment. I was thinking of having MAB for VDI and dot1X for laptop users and Also was wondering if we can have easyconnect for vdi and dot1x for laptop users. please advise.

Re: ISE for securing VDI and Laptop user environment

ldanny — Sun, 26 Nov 2017 13:12:53 GMT

Hi Arun,

I dont think there is really a straight answer here as different types of methods can be used , however keep in mind easyconnect relies on kerebos authentications.

An example for MAB would be to Whitelist or Blacklist based on Profiles.

Dot1x needs a bit more "fine tuning" if Certs are being used and Network Device configurations , but is considered one of the most secured methods.

If your laptops are windows based then easyconnect could be a more simpler solution .

Thanks,

Danny

Re: ISE for securing VDI and Laptop user environment

Jason Kunst — Mon, 27 Nov 2017 12:30:51 GMT

This should work fine

I’m not quite sure how your VDI use case will work, if the vdi client machine doesn’t support Dot1x but it does login to the domain so that IP address of local client is mapped to a domain user then that might work as well

Please lab it up

Re: ISE for securing VDI and Laptop user environment

p.s.arun2020 — Tue, 28 Nov 2017 04:50:52 GMT

Thanks Danny for your response! will try your suggestions. Was wondering if you have any use case for VDI thin client users.

Re: ISE for securing VDI and Laptop user environment

p.s.arun2020 — Tue, 28 Nov 2017 16:25:36 GMT

Sure Jason! Will lab it up.