topic Re: ISE 2.2 Wireless Setup in Network Access Control

ISE 2.2 Wireless Setup

UN Minustah — Tue, 20 Jun 2017 14:41:29 GMT

I have upgraded to ISE 2.2 and I'd like to use the Wireless Setup feature, but it's not showing in my tool bar.

Re: ISE 2.2 Wireless Setup

Jason Kunst — Tue, 20 Jun 2017 15:58:11 GMT

Please reference the admin guide

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0100100.html

If you upgrade ISE from a previous version, the Wireless Setup menu does not appear. This is because Wireless Setup is only supported for new ISE installations.

If you still want to run it you can manually enable it via CLI

In the CLI, run application configure ise and choose the option to enable

https://communities.cisco.com/docs/DOC-71189

Re: ISE 2.2 Wireless Setup

UN Minustah — Tue, 20 Jun 2017 18:34:43 GMT

Thank you Jason. I read in the document that it's recommended to use the Wireless Setup in a standalone environment.

Will I mess things up if I try it in my distributed environment?

It's not yet in production by the way. My goal is to get a basic configuration up and running and fine tune it later on.

Thanks

Re: ISE 2.2 Wireless Setup

Jason Kunst — Tue, 20 Jun 2017 18:37:48 GMT

It's fine just be aware that if you wanted to add a specific psn to your WLC you made to do it manually

The tool will only setup the first 2 psns to use

Re: ISE 2.2 Wireless Setup

UN Minustah — Tue, 20 Jun 2017 21:45:28 GMT

Hey Jason, quick question to make sure I'm doing this correctly.

My system has an administrator node, a backup and 2 PSNs setup in failover mode.

Now in order to run the wireless setup tool, I understand that I need to wipe the previous configuration using the "application reset-config ise" command.

Now when I tried that I got a message that I should deregister the nodes prior to running the command.

So, If I understand correctly I should follow the steps below:

Deregister all nodes
Run the "application reset-config ise" command on the admin node
Register all the nodes and setup the failover again.
Run the wireless setup tool.

Am I missing anything?

cheers

Re: ISE 2.2 Wireless Setup

Jason Kunst — Tue, 20 Jun 2017 22:46:20 GMT

you don't need to reset ise config, you simply need to enable the wifi setup tool

ise-1/admin# application configure ise

Selection ISE configuration option

[1]Reset M&T Session Database

[2]Rebuild M&T Unusable Indexes

[3]Purge M&T Operational Data

[17]Enable/Disable Wifi Setup

[18]Reset Config Wifi Setup

[19]Exit

Re: ISE 2.2 Wireless Setup

UN Minustah — Tue, 20 Jun 2017 23:00:24 GMT

Ah, excellent.

I'll try that.

Thanks a lot.

P.S: Your videos on YouTube are very helpful

Re: ISE 2.2 Wireless Setup

Jason Kunst — Wed, 21 Jun 2017 12:44:07 GMT

Thank you!

Re: ISE 2.2 Wireless Setup

UN Minustah — Wed, 21 Jun 2017 12:56:37 GMT

Ok, I tried that.

When I went to option [17] it said that the wifi is currently running.

I tried to disable it, and then re-enabled it again.

Logged off the gui and logged back in and it was still not available.

I want to try to reset the ise config and start over with a clean slate.

Are the steps I listed in the previous post correct?

Re: ISE 2.2 Wireless Setup

Jason Kunst — Wed, 21 Jun 2017 15:23:06 GMT

yes

Re: ISE 2.2 Wireless Setup

UN Minustah — Thu, 22 Jun 2017 14:54:47 GMT

Hey Jason, I'm in the process of creating a sponsored guest portal.

I have joined the domain and now selecting a sponsor group.

Can you please confirm if the sponsor group selected is the group that will be allowed to create accounts for guest users?

Re: ISE 2.2 Wireless Setup

Jason Kunst — Thu, 22 Jun 2017 15:20:53 GMT

The AD group is mapped to a sponsor group that is allowed to use the sponsor portal

The sponsor group also controls what the sponsor can do with the sponsor portal

Re: ISE 2.2 Wireless Setup

UN Minustah — Thu, 22 Jun 2017 18:34:40 GMT

Hey Jason, something weird is happening with the tool, or perhaps I'm doing something wrong.

I reached step 3 in the wireless setup where I selected the sponsor group from my AD.

When I click commit, I get a message:" no Active Directory by the name of domain.com found"

See here: https://www.screencast.com/t/chCC3CBQ2rK

I can confirm that all my nodes have successfully joined the domain: https://www.screencast.com/t/6S2fmKrV

Any ideas on what could be causing this issue?

Thanks

Re: ISE 2.2 Wireless Setup

Jason Kunst — Thu, 22 Jun 2017 20:12:35 GMT

please read this in its entirety

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_0100100.html

If you already defined Active Directory in ISE, and you plan to use this AD for Wireless Setup, then:

The join name and domain name must be the same. If the names are not the same, then make them the same in ISE before using that AD in Wireless Setup.

Re: ISE 2.2 Wireless Setup

UN Minustah — Thu, 22 Jun 2017 20:23:03 GMT

You nailed it.

Thanks very much for your patience.

Cheers

Re: ISE 2.2 Wireless Setup

UN Minustah — Wed, 02 Aug 2017 19:49:25 GMT

Suddenly, when I click on the wireless setup tool, I get a page that's stuck in loading.

I tried to enable/disable wifi setup via the CLI, that didn't help.

Any ideas on how I can fix this?

Thanks

Re: ISE 2.2 Wireless Setup

Jason Kunst — Wed, 02 Aug 2017 20:19:53 GMT

Did you try resetting the config as well

Sent from my iPhone

Re: ISE 2.2 Wireless Setup

UN Minustah — Wed, 02 Aug 2017 20:35:01 GMT

Resetting the config doesn't work either.

Re: ISE 2.2 Wireless Setup

Jason Kunst — Wed, 02 Aug 2017 20:37:53 GMT

Please work with tac

Sent from my iPhone