topic Re: MDM integration without device on-boarding in Network Access Control

MDM integration without device on-boarding

piotr.witkowski — Mon, 11 Mar 2019 08:52:52 GMT

Hi,

We have been running ISE 2.4 in distributed model. Recently we have added Airwatch MDM servers to ISE - connection status shows OK . I was sure that i will be able to check compliance or registration status of any device connecting to 802.1x enabled SSID (WPA2 enterprise). After couple of hours i realized that there is no correlation between 802.1x (Radius) queries and MDM HTTP calls as devices were not onboarded on ISE directly. They are on-boarded out-of-band communicating directly with Airwatch via GSM/LTE connection.

My question is: Is it possible to have such setup where devices are on-boarded independently on MDM and ISE can still check compliance status against of MDM server?

Re: MDM integration without device on-boarding

Jason Kunst — Tue, 04 Dec 2018 19:29:29 GMT

You have to setup rules so that they are registered with mdm server in order for this to work

They can onboard oob but still need rules like you’re integrated

Re: MDM integration without device on-boarding

piotr.witkowski — Tue, 04 Dec 2018 22:32:58 GMT

Hi Jason,

Do you mean Authorization rule? This is how my AuthZ rule looks like but it never has been matched. Two upper conditions are working properly if i remove two of the bottom related to MDM.

Re: MDM integration without device on-boarding

piotr.witkowski — Wed, 19 Dec 2018 20:30:23 GMT

For those who are interested in of fix this problem. I got this fix from Cisco TAC. Apologies @Jason Kunst, but you haven’t provided any reasonable solution, I don’t get why you approved your help as "solution" as in my opinion it’s not.

Anyway. See fix of the problem:

Asumptions:

We have two different MDM servers. Each keeps different mobiles resources. (geo location separation)
We dont want to perform device onboarding on ISE. MDM registration/enrollment is done via Out of Band (LTE)

Solution:

Authorization rules have to know which servers should be queried (I know it’s ridiculous as AuthZ rules should match but here they are also responsible for invoking proper MDM server)

See two AuthZ rules (one for each MDM server) which solved problem in my environment.