topic Re: ISE Wired Guest control in Network Access Control

ISE Wired Guest control

manvik — Fri, 23 Apr 2021 10:53:35 GMT

How do I implement Guest authentication for Wired devices using Cisco ISE. Requirement is to display Guest Portal for Non-AD joined devices.

If the system is AD joined Access should be permitted.

Only AD joined systems need to have access, if someone brings a new device/system and plugs in it should not get connected.

Re: ISE Wired Guest control

balaji.bandi — Fri, 23 Apr 2021 11:15:17 GMT

That is the basic nature of ISE right, only authorised device will get in to Right VLAN, if not authenticated user will be default VLAN until they get authenticated.

Most use case on Wireless this will be redirect to Guest portal to get Authenticated.

Wired means we trusitng the devices who ever plug in - but looks you have other requirement. Can be possible with Profiles.

Reference :

https://www.cisco.com/c/en/us/td/docs/security/ise/2-6/admin_guide/b_ISE_26_admin_guide/b_ISE_admin_26_guest.html

https://ciscocustomer.lookbookhq.com/iseguidedjourney/BYOD-configuration?utm_campaign=ISE&utm_content=Guide&utm_source=Cisco.com-Open&utm_medium=ISE-Page-BYOD&pfhide=true

Re: ISE Wired Guest control

manvik — Fri, 23 Apr 2021 11:51:45 GMT

Thank you @balaji

You are right, requirement is a bit different. Not-AD joined wired systems need to get a Guest portal only.

In this scenario, should any config be done in Network switches.

Does anyone have any links to documents for this.

Re: ISE Wired Guest control

Mike.Cifelli — Fri, 23 Apr 2021 13:19:29 GMT

Additional information:

ISE Secure Wired Access Prescriptive Deployment Guide - Cisco Community

ISE Guest Access Prescriptive Deployment Guide - Cisco Community

Video: Security | Lab Minutes

HTH!

Re: ISE Wired Guest control

balaji.bandi — Fri, 23 Apr 2021 13:53:16 GMT

@mike beat me with the message - he provided all the information you need including videos

Re: ISE Wired Guest control

MHM Cisco World — Sat, 24 Apr 2021 00:41:35 GMT

802.1x will failed OR timeout for Guest
then SW will give VLAN to Guest, Guest will get IP and if it try to connect to Web it will redirect to ISE for WebAuth.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216330-ise-self-registered-guest-portal-configu.html

Re: ISE Wired Guest control

manvik — Mon, 26 Apr 2021 12:17:51 GMT

Thank you @balaji @mike

Those docs were helpful. It seems ISE Easyconnect would be an ideal solution, but few points on easyconnect;

Does easyconnect works with any network switches other than Cisco

How can ISE easyconnect track a cache login of AD user. Cache logins are not reflected in AD login audit logs.

Re: ISE Wired Guest control

balaji.bandi — Mon, 26 Apr 2021 14:16:05 GMT

ISE is Identiy - So you can use ISE Log as audit Logs, i am sure it get data from your AD.

Re: ISE Wired Guest control

hslai — Tue, 27 Apr 2021 22:51:07 GMT

> Does easyconnect works with any network switches other than Cisco

It might but our teams validated only Cisco catalyst switches.

> How can ISE easyconnect track a cache login of AD user. Cache logins are not reflected in AD login audit logs.

No. But, the WMI providers start with the last 1-hour historical events. EasyConnect works with WMI providers only today.