topic Re: BYOD Setup in Wireless

BYOD Setup

jain.manish94 — Sun, 10 Apr 2022 16:41:25 GMT

Hello team,

Can any one help me to setup BYOD using ISE from starting point by point.

Plz if any good documents.

Re: BYOD Setup

balaji.bandi — Sun, 10 Apr 2022 17:01:35 GMT

start from here :

https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867

https://community.cisco.com/t5/security-documents/ise-byod/ta-p/3641689

Re: BYOD Setup

jain.manish94 — Mon, 11 Apr 2022 05:43:21 GMT

what is the configuration from wlc end.

in this link there is only ise configuration.

Re: BYOD Setup

Ambuj M — Mon, 11 Apr 2022 06:15:16 GMT

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216535-configure-single-ssid-wireless-byod-on-w.html#anc12

hope this helps.

Re: BYOD Setup

jain.manish94 — Mon, 11 Apr 2022 06:42:28 GMT

can i use foreign and anchor setup on this. ?

i have two wlc one is my primary and second one is my anchor wlc.

can i use this kind of setup if yes then what would be configuration and where need to be done.

mean to say on primary or anchor wlc. ?

Re: BYOD Setup

Ambuj M — Tue, 12 Apr 2022 19:26:22 GMT

I have not done it myself and can't find a document specifically for BYOD in Foreign-Anchor setup.

keep in mind that different people perceive BYOD in different ways, I have seen countless people call guest devices as BYOD (which is not incorrect)

In Cisco's terms, BYOD is when internal users bring their own devices and as organizations want to give flexibility to work and access internal resources on some well provisioned personal devices, that's why it involves certificate provisioning for these devices via ISE and integration with some form of MDM to ensure device check.

Guest is a different case and it makes sense to tunnel all traffic to Anchor in DMZ, because you don't want guest devices to access anything internal, not even DHCP or DNS, once tunnel to DMZ, traffic can not come back in to inside (low to high) unless allowed explicitly and can only go out to internet (high to low).

So its important to know if you are planning to deploy BYOD or Guest with Anchor setup in DMZ.

if you are trying to do guest here is a link.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html

if you still plan to do BYOD with anchor setup, you can try the flow logic is still same. I haven't tried it myself yet.

hope this helps.