topic Re: Off-Prem Onboarding without an MDM in Network Access Control

Off-Prem Onboarding without an MDM

pethomas — Thu, 28 Apr 2016 05:32:16 GMT

Hi Guys

Is there a work flow available to onboard a device remotely?

The context is a school district would like to remotely onboard student devices before the beginning of a new school year. They currently do not have an MDM. The students will already have a AD account at the school.

Thanks

Peter

Re: Off-Prem Onboarding without an MDM

Jason Kunst — Thu, 28 Apr 2016 11:50:29 GMT

Windows, MacOS, and Android (when Android user connected to VPN over local

WiFI) should work for BYOD using AC with ACIDEX support starting in ASA 9.2..1

and AC 3.1MR5.

It required the Anyconnect to pass along the internal MAC address (not the VPN tunnel).

Re: Off-Prem Onboarding without an MDM

pethomas — Fri, 29 Apr 2016 04:37:37 GMT

Thanks Jason - just so I get this right - is this correct?

1: The school could publish an AnyConnect installer on a public site

2: The student then install AnyConnect and then Authenticate to the ASA using AD credentials

3: Assuming split tunneling is disallowed, ISE/ASA will initiate the onboarding (Certs and SPW) process (using the wireless Mac address that has been passed down using ACIDEX)

Thanks

Peter

Re: Off-Prem Onboarding without an MDM

Jason Kunst — Fri, 29 Apr 2016 11:08:44 GMT

the 1st step is not required as the Asa hosts anyconnect already

they would simply need to web to the asa to start a connection and then download the package via that site

once package downloaded they would initiate VPN connection

once vpn established they could require (through redirect) that the device goes through byod flow

Re: Off-Prem Onboarding without an MDM

pethomas — Fri, 29 Apr 2016 12:22:25 GMT

Thanks Jason

cheers

Peter