cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
 
ISE 2.3 Patch 7 has been posted. This will be the last patch for the ISE 2.3 release!
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

279
Views
2
Helpful
8
Replies
Highlighted
Contributor

ISE Wireless Profiling and Computer Imaging Process

     We have deployed ISE on our wireless network.  We need to modify our imaging process so that the techs can make sure the computer is profiled correctly before they ship it out to a user.  I was wondering if anybody can recommend a way or share the best practice.

     Currently, computers are being shipped out and if the computer does not profile correctly, the end user will call about not getting onto the wireless network.  The computer will profile correctly with a reboot and wireless auth attempt.  I was just wondering if after a computer is imaged and joined to the domain, is rebooting the computer a best practice or is there some other solution?

Thanks,

Alex

8 REPLIES 8
VIP Engager

Re: ISE Wireless Profiling and Computer Imaging Process

What kind of authentication are you doing on the wireless network?  i.e. why are you using profiling on wireless?

Contributor

Re: ISE Wireless Profiling and Computer Imaging Process

We are doing 802.1x authentication on the wireless network. We are using profiling so that our devices can get on the network without any manual process.

Our current process is to image the computer, and reboot it.  We tested this out today and it seems to be working pretty good.  We are running ISE 2.4 with the latest patch.

VIP Engager

Re: ISE Wireless Profiling and Computer Imaging Process

When your  devices are being reimaged, aren't they joined to the domain, get GPOs pushed etc. to enabled wireless authentication.  Still confused where profiling comes into play on wireless Dot1x SSID.

Contributor

Re: ISE Wireless Profiling and Computer Imaging Process

Before we send the computer to the end user, we want to make sure it automatically gets added to the ISE database.

VIP Engager

Re: ISE Wireless Profiling and Computer Imaging Process

Still confused.  Being in the ISE database should have nothing to do with and 802.1x SSID.  I am sure there is more to this puzzle, but with standard 802.1x authentication there is no requirement to be in the ISE database.

Contributor

Re: ISE Wireless Profiling and Computer Imaging Process

We are only allowing specific devices to get on the network. So the device must be in the database, and the user must authenticate.

Cisco Employee

Re: ISE Wireless Profiling and Computer Imaging Process

If the endpoints have to be in the ISE internal endpoints store first before allowed to authenticate, then the tech either add the endpoints using Cisco ISE ERS APIs, or authenticate them in a limited-access network to get them profiled.

Re: ISE Wireless Profiling and Computer Imaging Process

All you need to do is create a specific goup in AD for devices permitted onto the wireless and put this into your your ISE policy for authorisation, you can go even further and create multiple groups with different policies, say one group with internet access and one without.