topic Re: Ask the Experts:iPads on Your Network in Wireless

Ask the Experts: iPads on Your Network

ciscomoderator — Sun, 04 Jul 2021 03:34:28 GMT

With Saurabh Bhasin

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn about iPads on Your Network and how you can securely on-board employee-owned devices while protecting your network with Cisco expert Saurabh Bhasin. Saurabh has been involved with various wireless technologies over the years, since the first days of 802.11 becoming a standard and, more recently, with the evolution of the wireless industry to 802.11n. Saurabh has been with the Cisco Wireless Networking Business Unit for about five years, and in this role, he has worked closely with Cisco technology partners (enabling advanced services over wireless networks), leading key architectural features and training various members of the Cisco and partner community in person or through the numerous papers he has authored. Most recently, Saurabh has been leading the product strategy for Cisco's network management efforts. In his past, Saurabh has also authored numerous articles for reputable industry publications, and contributed to open source projects.

Remember to use the rating system to let Saurabh know if you have received an adequate response.

Saurabh might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Wireless,Other Mobility Subjects discussion forum shortly after the event. This event lasts through August 26 , 2011. Visit this forum often to view responses to your questions and the questions of other community members.

Ask the Experts:iPads on Your Network

Farrukh Haroon — Wed, 17 Aug 2011 08:34:30 GMT

Hello Saurabh Bhasin

Welcome to the forum, so that do you recommened to contain these devices on a corproate network.

Can can network be secured from these devices?

Regards

Farrukh

Ask the Experts:iPads on Your Network

mohsin-raza — Wed, 17 Aug 2011 13:45:16 GMT

Hi Saurabh,

We have few IPAD users who want to connect through VPN. They are using the builtin IPSEC vpn client, but when they try to login through the credentials that we provide, they dont get connected without any warning etc. On the ASA, it shows in the log that "SA parameters do not match". This has been verified that the credentials being used are correct and they work on a normal computer..

Ask the Experts:iPads on Your Network

sabhasin — Wed, 17 Aug 2011 16:24:31 GMT

Hello Farukh,

The network can be secured from these devices. However, to your question about "

do you recommened to contain these devices on a corproate network" - that's entirely up to the corporate/organizational policy of what should be done with employee-owned assets. There's a lot of organizations that follow one of the three models below:

1. Allow them free access

2. Allow them limited access (let's say, to the internet, or parts of the intranet)

3. Deny them any access.

There's also some others who look at #3 above, and perform additional checks before moving them in to #2 or #1 states above.

-Saurabh

Ask the Experts:iPads on Your Network

sabhasin — Wed, 17 Aug 2011 16:50:09 GMT

Hi Mohsin-raza,

It appears that this may be related to a misconfiguration at the ASA and it's likely a mismatch of the IKE and ISAKMP policy.

Here's a reference link:
http://www.cisco.com/en/US/docs/security/asa/asa70/configuration/guide/ike.html#wp1042302

I would suggest to work with our TAC organization who can help you with the right configuration.

-Saurabh

Ask the Experts:iPads on Your Network

Stephen Rodriguez — Wed, 17 Aug 2011 17:44:54 GMT

Saurabh,

I've heard we can use ISE/WISE to help with the iPad issues. Can you speak to how this will help?

Cheers,

Steve

Ask the Experts:iPads on Your Network

sabhasin — Wed, 17 Aug 2011 21:37:52 GMT

Steve,

I am not sure what "WISE" is - that you reference, but yes, NCS and ISE provide a great way to provide visibility and control in to iPads and other tablets on a network. I'd certainly suggest looking at the following:

ISE Fundamentals:

http://www.youtube.com/watch?v=qZoEgLp6N0Q

Also, I recently did a TechWise TV episode that showcases the NCS and ISE integration. There's 3 parts to this video, and here's a link:

http://www.youtube.com/watch?v=ce_grICxU-4&feature=related

Let me know if you need additional details!

-Saurabh

Ask the Experts:iPads on Your Network

George Stefanick — Wed, 17 Aug 2011 21:43:03 GMT

Sabhasin,

New to ISE, here. Does every device require a certificate ? Or are devices with no certificates deemed guest or rogues ? Can you touch on that quick ?

Ask the Experts:iPads on Your Network

ssimkin — Thu, 18 Aug 2011 04:16:42 GMT

We have a brand new White Paper that covers securely on-boarding employee owned devices and how to handle BYOD from an IT perspective. You may find it helpful:

http://www.cisco.com/web/about/ciscoitatwork/downloads/ciscoitatwork/pdf/any_device_white_paper.pdf

Ask the Experts:iPads on Your Network

romainpage — Thu, 18 Aug 2011 08:30:39 GMT

Hi Saurabh,

With the increase of iOS devices connected to Wireless networks (Iphone / IPAD / IPOD), do you validate your new WLC versions with the current iOS version ? In the same way, do you validate new iOS versions (for example the planned 5.0) with the current WLC versions ?

The iPAd 802.1X supplicant for example is really basical from users point of view, a small change in its code could prevent it from working with the Cisco wireless architecture and even if it would be Apple's fault, it would end with a "Cisco wireless issue"...so checking on this would prevent you big issues as people upgrade their device all the time.

Even with that increase of iPADs, I did not seen any Cisco configuration best practices paper for such devices, are you planning to write one ? When configuring a SSID, I was told to disable "Aironet extension", which seems pretty obvious, but are there any other best practices that could be applied ?

In the same way, which EAP authentication recommended for such devices ? All or some wouldn't work ? One again, any options to enable/disable at ACS level to make them work better ?

Thanks.
Romain

Ask the Experts:iPads on Your Network

sabhasin — Thu, 18 Aug 2011 15:42:25 GMT

Hi George,

Certs are not required (not the only way to get devices on the network) but they're a common way of distinguising employees from ones who're not (guests/rogues).

Let me know if you have any follow-up questions.

-Saurabh

Ask the Experts:iPads on Your Network

sabhasin — Thu, 18 Aug 2011 16:44:47 GMT

Hi Romain,

We certainly do validate our controller releases with a variey of devices - including Apple's iOS-based devices. You can get more information about the program that validates our software/hardware with vendors' devices here - the program is called Assurewave.

http://www.cisco.com/en/US/netsol/ns779/networking_solutions_program_category_home.html

While we'd also like to test pre-released software - we do that on a case-by-case basis as that software is made available to us by our partners. Additionally, you might want to see the whitepaper referenced by Scott Simkin above as well (for best practices).

EAP types are more of a device-related question - however, the most commonly used and deployed EAP types are supported by the Cisco WLAN infrastructure.

Hope this helps,

Saurabh

Ask the Experts:iPads on Your Network

ewood2624 — Fri, 19 Aug 2011 13:42:36 GMT

We have our iPads segregated on a DMZ VLAN with 802.1x and dynamic vlan assignments through ACS 5.x. What are the comparisons between ACS and ISE, other than the NAC functionality of ISE? I'm leary of upgrading to ISE because it doesn't do TACACS. Any chance Cisco creates any mobile device management software?

Ask the Experts:iPads on Your Network

jmprats — Mon, 22 Aug 2011 07:27:19 GMT

Hi Saurabh,

I've configured IPAD IPSec VPN with PSK against an ASA firewall. Do you know any good document for setting VPN IPSec with certificates?

Thanks

Re: Ask the Experts:iPads on Your Network

Eric Hansen — Mon, 22 Aug 2011 16:06:40 GMT

Id really like to see this part of "romainpage" question expanded on Saurabh if you could please.

romainpage wrote:

One of the reasons I ask is I see some people throwing iPads on their wireless networks, usually an acs is involved and they just grab the eap cert on the acs. But recently I have seen a fair number of people having the iPads execute VPN internally in addition to the EAP of the wireless network. Probably depends on the enviroment and the type of data involved but it seemed like an odd configuration to me. Would be nice to know what the best practice is from cisco on how these types of devices should be connected in an official context.

thanks

Ask the Experts:iPads on Your Network

sabhasin — Mon, 22 Aug 2011 16:16:38 GMT

hi ewood2624:

ISE will support TACACS+ in an upcoming release. When compared to ACS, ISE does offer significant improvements/additions in functionality - specifically around the posture assessment and profiling capabilities. Take a look at this video (the power of Cisco ISE: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11640/vds_power_of_ise.html) for example. More information is also available at www.cisco.com/go/ise.

Saurabh

Ask the Experts:iPads on Your Network

sabhasin — Mon, 22 Aug 2011 16:23:59 GMT

Hi jmprats:

There's a lot of good examples and documents here: http://www.cisco.com/en/US/products/ps6120/prod_configuration_examples_list.html

Hope it helps,

-Saurabh

Ask the Experts:iPads on Your Network

sabhasin — Mon, 22 Aug 2011 16:34:22 GMT

Hi Eric,

The Cisco technical marketing team is working on a detailed document along these lines and is expecting to publish that in a month approximately.

As you note, there's several ways for people to get mobile devices/tablets on the network and VPN is deemed the most common way of doing so; it's overlay, and it's isolated without having to change much on the infrastructure - seems odd to me as well though. However, with ISE and its profiling capabilities, you're able to build a better policy around understanding the nature of devices being connected, and then take appropriate actions based on corporate policies.

We'll address similar deployment scenarios in an upcoming document as noted above.

Thanks,

Saurabh

Ask the Experts:iPads on Your Network

sabhasin — Mon, 22 Aug 2011 16:35:05 GMT

emwood2624: this might be another link to refer to for Cisco ISE FAQ: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/qa_c67-658591.html

Ask the Experts:iPads on Your Network

Ronald Nutter — Mon, 22 Aug 2011 16:45:55 GMT

I have been requested by management at my company to set up this type of access. We are currently doing what I will call profiling on all incoming windows connections so that we can look for a registry key and one other piece of info that will let us identify the machine as a corporate versus personal machine.

I understand that functionality is not currently in the Anyconnect mobile offering at this point. This makes me very concerned about opening up this type of access. Any idea as to if this is on the roadmap and when it might be available ?

Ron