ISE Wireless Profiling and Computer Imaging Process

[Alex Pfeil]

     We have deployed ISE on our wireless network.  We need to modify our imaging process so that the techs can make sure the computer is profiled correctly before they ship it out to a user.  I was wondering if anybody can recommend a way or share the best practice.

     Currently, computers are being shipped out and if the computer does not profile correctly, the end user will call about not getting onto the wireless network.  The computer will profile correctly with a reboot and wireless auth attempt.  I was just wondering if after a computer is imaged and joined to the domain, is rebooting the computer a best practice or is there some other solution?

Thanks,

Alex

[paul]

What kind of authentication are you doing on the wireless network?  i.e. why are you using profiling on wireless?

[Alex Pfeil]

We are doing 802.1x authentication on the wireless network. We are using profiling so that our devices can get on the network without any manual process.

Our current process is to image the computer, and reboot it.  We tested this out today and it seems to be working pretty good.  We are running ISE 2.4 with the latest patch.

[paul]

When your  devices are being reimaged, aren't they joined to the domain, get GPOs pushed etc. to enabled wireless authentication.  Still confused where profiling comes into play on wireless Dot1x SSID.

[Alex Pfeil]

Before we send the computer to the end user, we want to make sure it automatically gets added to the ISE database.

[paul]

Still confused.  Being in the ISE database should have nothing to do with and 802.1x SSID.  I am sure there is more to this puzzle, but with standard 802.1x authentication there is no requirement to be in the ISE database.

[Alex Pfeil]

We are only allowing specific devices to get on the network. So the device must be in the database, and the user must authenticate.

[hslai]

If the endpoints have to be in the ISE internal endpoints store first before allowed to authenticate, then the tech either add the endpoints using Cisco ISE ERS APIs, or authenticate them in a limited-access network to get them profiled.

[mick_johnson@hotmail.com]

All you need to do is create a specific goup in AD for devices permitted onto the wireless and put this into your your ISE policy for authorisation, you can go even further and create multiple groups with different policies, say one group with internet access and one without.