BYOD in ISE, Meraki Wireless AP, Microsoft Azure is AD. Also Intunes

[amalmichaelvj]

Hello Guys,

Am working on testing Scenario For Cisco ISE.

We have Meraki Network , Users are connected to Meraki AP now with AD authentication (Microsoft azure Cloud ).

I am looking for a BYOD solution, that my Employees can access resources from there personal devices.

We have intunes for MDM and Pushing Certificate. We are planning EAP-TLS (Certificate based authentication) for BYOD. And need to use SSO using SAML.

Do anyone Have done similar setup? if YES then please share any configuration example or document which help this?

MY PLAN

========

1.Users connect to BYOD SSID, which can redirect to BYOD portal ISE. ISE will Check the Authentication and then will push certificate to client.

2. Posture check in Client.

3.Allow access to suggested VLAN for IP address and Resources.

Am not a expert in ISE. Please guide if someone have similar Setup.

Thank you

[Flavio Miranda]

@amalmichaelvj 

 Standard BYOD means everyone´s device and  any device. How do you suppose to manage people´s personal device with MDM?

  it would required privilege access to those device. Will everyone´s allow it?

I never saw BYOD with EAP-TLS, if BYOD here means really BYOD.

[ammahend]

will recommend you to go through this guide first and then put together a test Lab.

https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867