Accepted Solutions
There is this setting
There is no way to call this out in client provisioning policy.
Its still not clear on your flows.. How do you want to handle other OS. Are you doing BYOD certificate provisioning or posture.. etc
You might want to call the TAC and explain this to have a detailed conversation. Or request through your sales channel to discuss with an ISE expert. From this thread you are not providing enough context on what you're wanting to do.
You could possibly do this:
if wired_mab and windows/mac and using certificate then permitWindowsMACaccess
if wired_mab and linux then PermitLinuxAccess
if wired_mab and windows/mac then BYOD
if wired_mab then redirect to CWA (when they hit the portal they will be profiled)
Hi Jason
See below. Network setup assistant pushed below settings with Public ROOT CA from ISE. No EAP-TLS is used in this deployment.
You have let say 10000 clients which some of them are domain user but private machines.
Only domain machines are postured checked with any connect clients and posture agent. Working on all windows machines. EAP Chain result machine and user authenticated.
Rest of machines are BYOD machines. Above native supplicant profile is used and send to Windows and MAC OX users. Tested working. User can be identified as staff or non staff and authorization profiles with rights enforced.
Now you have users how have their own machines with Linux. For them to access corparate resource you need to identify them. You send them to a portal to login (catch all mab CWA rule ) to capture their details, from here device not supported displayed on the BYOD for linux machines. The question here is how do you allow these machines on the network without any user interaction or little and how do you identify the user for this machine.
Settings already enabled as per your screen shot.
Hope this information helps or if still unclear I can add more if you need.
Hi Jason
What I am currently doing is the following. MAB rule with CWA then user login with AD credential to get the machine profiled as linux. I have set the Native supplicant provisioning policy Unavailable " Allow Network Access" under the Administration settings to get passed the client provision issue for Linux device not support is that is now displayed but network access is allowed. With the COA user now falls in the Wired_BYOD_Devices and combined with Authorization rules to match Linux and Wired_BYOD_Devices user is then redirected to Guest Portal with no BYOD flow. When user then authenticated against AD correct access is allocated with a DACL. This only happens once with the redirect to 2 different Portals.
MAB with CWA Guest Portal flow with BYOD
The other issue I am now faces with is below when a guest logs in.
