topic Re: How to auhorize IP Phones withouth ISE Plus licences in Network Access Control

How to auhorize IP Phones withouth ISE Plus licences

Ditter — Thu, 06 May 2021 09:43:35 GMT

Hi to all,

i would like to know if there is a safe way to categorize Cisco IP phones with a seperate (from PCs) authorization po;icy but without the use of ISE PLUS licences.

Is that possible?

For example :

IP Phone with MAB --> Voice Domain by using an authorization policy X

PCs behind IP phones (with MAB also) --> Data domain by using a seperate Authorization Policy Y

Is that possible without ISE PLUS licences?

Thanks,

Ditter.

Re: How to auhorize IP Phones withouth ISE Plus licences

mstefanka — Thu, 06 May 2021 10:42:59 GMT

Profiling only categorizes endpoints automaticaly.

When you categorize endpoint manualy (MAC address to endpointgroup IP_phone), you can authenticate endpoint using MAB.

MAB AuthC >> IP_phone group >> Authorization policy (ISE has default IPphone policy with attributes that are reqired to corectly set ipphone to switchport voice vlan domain).

Re: How to auhorize IP Phones withouth ISE Plus licences

Ditter — Thu, 06 May 2021 15:05:30 GMT

Thanks for the answer.

As i see it i could create a static pool of endpoints that are all cisco ip phones and use this for authentication.

But the problem as i see it is in the authorization portion:

As i have no ISE Plus licences i am trying to authorize the cisco IP phones with a way that consumes only base license and put them in the voice domain.Finally my PCs behind the Cisco IP phones should get in the data domain.

I used the default ISE policy for IP Phones (the one IdentityGroup·Name EQUALS Endpoint Identity groups:profiled:cisco-ip-phone but i noticed that the phone still consumes a base + plus license.

Any proposals?

Thanks again,

Ditter

Re: How to auhorize IP Phones withouth ISE Plus licences

thomas — Thu, 06 May 2021 18:52:42 GMT

1) authenticate your phones with username/password or certificates

2) authenticate with a static MAB identity group

Either of these methods counts only a Base/Essentials license for basic AAA/802.1X.

Here is a summary of ISE licensing and which attributes trigger consumption of Plus/Advantage licenses from this week's ISE Webinar. Look for it to be posted on our ISE YouTube channel next week for more licensing info.

Re: How to auhorize IP Phones withouth ISE Plus licences

Ditter — Thu, 06 May 2021 19:15:31 GMT

Thanks Thomas, currently i am using MAB.

So my question is the following:

My problem is not the authentication but the authorization and more specifically to assign the IP Phones to the voice domain.

Can you propose an authorization policy condition i could use in order to pass the suitable authorization profile that assigns the phone to voice domain?

From what i found out thus far is that i can assign ip phones to voice domain only if i use an authorization policy condition that is based is some kind of profiling. Any other policy condition leads to the phone being in data domain.

Thanks,

Ditter

Re: How to auhorize IP Phones withouth ISE Plus licences

Greg Gibbs — Fri, 07 May 2021 02:29:19 GMT

As @thomas mentioned, the only other option would be to use a static Endpoint Identity Group. You would need to create a new EIG under Administration > Identity Management > Groups > Endpoint Identity Groups.

You would then create an AuthZ Policy that uses that EIG as a matching condition; for example:

Once the policy elements are configured, you would need to add/update the endpoints in Context Visibility to associate them with that Static Group Assignment. This can be done manually, via CSV/LDAP import, or using the API.

Re: How to auhorize IP Phones withouth ISE Plus licences

Ditter — Fri, 07 May 2021 13:13:29 GMT

Hi Greg,

thanks for the detailed reply. I haven't tried it yet, but i suppose that it will work.

Ditter.

Re: How to auhorize IP Phones withouth ISE Plus licences

mstefanka — Fri, 07 May 2021 13:56:42 GMT

You are consuming Plus license becose of this

Endpoint Identity groups:profiled:

Use olny identity group you manualy created for MAC addresses of IP Phones. NOT PROFILED (it requires PLUS Lic)

Re: How to auhorize IP Phones withouth ISE Plus licences

Ditter — Sat, 08 May 2021 11:22:21 GMT

Greg, ISE 3.9 does not seem to have an import feature for bulk update of a new EIG. Although there is an import feature for UIG, there is not such feature for EIG.

Is that correct?

As these endpoints do not exist in LDAP, i could only import them via API.

Please see attached PNGs.

Thanks, Ditter.

Re: How to auhorize IP Phones withouth ISE Plus licences

Greg Gibbs — Sun, 09 May 2021 23:06:21 GMT

Correct... you can not import bulk Endpoint Identity Groups, but that's not what you are looking to do. You only need to create one new EIG for your Non-Profiled phones and use the 'Import from file' option in Context Visibility > Endpoints to add/update the EIG associated with your phones.

If you are not sure what fields need to be updated on the endpoint, you can select one of your phones and manually edit the Attributes to enable the Static Group Assignment and select the EIG you created. You can then Export that selected endpoint to look at the values in the 'IdentityGroup' and 'StaticGroupAssignment' fields.

You can then use the 'Import from file' CSV template to add all of your phone MAC addresses and specify the values for the fields you want to update. If the endpoints already exist in Context Visibility, they will be updated. If they don't, they will be created.

Re: How to auhorize IP Phones withouth ISE Plus licences

Ditter — Mon, 10 May 2021 06:52:36 GMT

Thanks so much Greg. I will give it a try asap.

Re: How to auhorize IP Phones withouth ISE Plus licences

Andrii Oliinyk — Sun, 27 Jun 2021 15:45:09 GMT

Hi Greg

i stuck with configuring condition IdentityGroup:Name EQUALS Endpoint Identity Groups.

When i select Attribute IdentityGroup:Name i cannot find Endpoint Identity Groups in selection tree to assign specific value to attribute. I can use specific Identity Group membership with selecting it from Endpoint Groups suggested in selection tree as very 1st condition (this one coming after IF) but no with referred approach. Any help pls? SW 2.1

Re: How to auhorize IP Phones withouth ISE Plus licences

Greg Gibbs — Mon, 28 Jun 2021 07:22:51 GMT

The example I shared is using the newer Policy Set structure with the Conditions Studio that was introduced in ISE 2.3. I don't have an instance of ISE 2.1 (and this version has been End of Support since March 2020) to reference.

The approach you mention is the way an Endpoint ID Group was configured in that version.

Re: How to auhorize IP Phones withouth ISE Plus licences

Andrii Oliinyk — Mon, 28 Jun 2021 08:04:11 GMT

Hi Greg

i've found some 2.3 cube in my perimeter. but there is still no Endpoint Identity Groups dictionary available for IdentityGroup:Name.

screenshot attached

Re: How to auhorize IP Phones withouth ISE Plus licences

Greg Gibbs — Mon, 28 Jun 2021 23:51:54 GMT

If you have created the Endpoint Identity Group under Administration > Identity Management > Groups > Endpoint Identity Groups, then it should show up in the Conditions Studio. This screenshot is from ISE 3.0 patch 2.

If you're not seeing it, you might first try clearing your browser cache or using another browser. If that's not the issue, you could be running into a bug. I would suggest opening a TAC case, but ISE 2.3 has been End of Support since June 2020.

Re: How to auhorize IP Phones withouth ISE Plus licences

ali007 — Thu, 29 Sep 2022 12:11:43 GMT

Hi,

i have tried this but it wouldnt work. what have you specified in the LIM-AUTHZ-IP-Phone?

Regards,