topic Re: Eduroam auth with ISE 2.x in Network Access Control

Eduroam auth with ISE 2.x

annie — Tue, 24 Jan 2017 23:08:26 GMT

Do we have documentation on configuring ISE to work with Eduroam for auth on university campuses?

I see that there are threads from ISE 1.x and I understand that this should be fairly straightforward, but have not found reference documentation for interested university clients.

Thanks so much in advance!

Re: Eduroam auth with ISE 2.x

Charlie Moreton — Wed, 25 Jan 2017 02:48:01 GMT

Annie,

This is actually the best reference I have been able to find and, yes, it is written for ISE 1.4,

https://supportforums.cisco.com/document/12627176/configuring-eduroam-cisco-ise-14

The truth is, I don't think there is official Cisco documentation detailing this configuration. I have used the above link for reference and have successfully configured Eduroam for a few clients. Contact me offline to discuss further.

Also, you can see customers using ISE 2.x for Eduroam at this link:

https://www.eduroam.us/taxonomy/term/53

Just click the Miscellaneous Information tab and look under RADIUS Server Type.

Charles Moreton

Re: Eduroam auth with ISE 2.x

Charlie Moreton — Wed, 25 Jan 2017 21:09:21 GMT

Also, there's this

https://communities.cisco.com/docs/DOC-71299

Re: Eduroam auth with ISE 2.x

thomas — Thu, 26 Jan 2017 02:07:35 GMT

Nice job, Charles! Thank you!!!

Re: Eduroam auth with ISE 2.x

annie — Fri, 27 Jan 2017 01:20:26 GMT

This is fantastic! Thank you Charles!!!!

Re: Eduroam auth with ISE 2.x

innovative_elephant — Fri, 24 Aug 2018 17:19:50 GMT

ISE 2.3 introduced changes to the Policy Sets. See here for specific 2.3 steps: https://community.cisco.com/t5/security-documents/configuring-eduroam-on-cisco-identity-services-engine-ise/tac-p/3655677#M5789 (thank again to Charlie Moreton!)

Re: Eduroam auth with ISE 2.x

Nick Ciesinski_ — Tue, 04 Sep 2018 15:40:24 GMT

Edit: I found your post about bug CSCvg03448. This still seems to be a issue in ISE 2.4 patch 2....

Have you done any updates to your steps for eduroam for ISE 2.4? With ISE 2.4 they changed how policy sets are done and moved the protocols/proxy out of the authentication choice and now its on the policy set itself. When you set a proxy radius server there you no longer get options for local authorization. Seems like there is no way to do this now causing a issue for eduroam users.

Re: Eduroam auth with ISE 2.x

Charlie Moreton — Tue, 04 Sep 2018 16:24:53 GMT

It's been updated here:

Configuring eduroam on Cisco Identity Services Engine (ISE)

Re: Eduroam auth with ISE 2.x

Nick Ciesinski_ — Tue, 04 Sep 2018 19:21:07 GMT

I actually figured out my issue with the policy set screens being missing. It was because a step was missing from your steps.

Administration > Network Resources > Network Device List > RADIUS Server Sequences.

You didn't have documented the need to go to the Advanced Attribute Settings tab and then select "On Access-Accept, continue to Authorization Policy"

Once I checked that the Authorization Policy options appeared in my Policy Set for the External RADIUS setup.

Re: Eduroam auth with ISE 2.x

Charlie Moreton — Tue, 04 Sep 2018 20:05:27 GMT

Great catch. I am validating the step in my lab now. It works as-is on 2.3 unpatched. I am installing patch 4 to test this setting and, if successful, will update the guide.

Re: Eduroam auth with ISE 2.x

Nick Ciesinski_ — Tue, 04 Sep 2018 20:07:05 GMT

I am on ISE 2.4 Patch 2 which may be the reason for the difference.

Re: Eduroam auth with ISE 2.x

Charlie Moreton — Tue, 04 Sep 2018 21:23:06 GMT

Tested and verified to be working on 2.3 Patch 4 and 2.4 Patch 2. The document has been updated to reflect this setting.

Re: Eduroam auth with ISE 2.x

jickfoo — Thu, 11 Oct 2018 14:31:38 GMT

I'm looking to assign different one of two specific VLANs when a user with a specific domain suffix successfully logs in.

ie. @contonso.com VLAN = 111 , everyone else VLAN = 120

Anybody doing this, or are there any guides to make this happen ?

Many thanks, Justin