EndPoint Whitelist

[sawosankung]

In ISE v1.1.1, is it possible to create a whitelist of endpoints just for a specific WLAN SSID - i.e. a whitelist that can be associated wih only one SSID?

Many thanks.

Sankung

[sawosankung]

Sorry, I mean to say whether it is possible to enable MAB for Wireless endpoints?

many thanks

Sankung

[Ravi Singh]

Yes it possible to enable MAB for wireless endpoint. For configuration help you can see the below link.

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_sw_cnfg.html

[Muhammad Munir]

Hello Sankung

1. A guest user connects to the network using a wireless connection and has a MAC address that is not in the

endpoint identity store or is not marked with an AUP accepted attribute set to true, and receives a URL redirection authorization profile. The URL redirection presents the user with an AUP acceptance page when the guest user attempts to go to any URL.

2.  If the guest user accepts the AUP, their MAC address is registered as a new endpoint in the endpoint identity store (assuming the endpoint does not already exist). The new endpoint is marked with an AUP accepted attribute set to true, to track the user’s acceptance of the AUP. An administrator can then assign an endpoint identity group to the endpoint, making a selection from the Guest Management Multi-Portal Configurations page.

3.  If the guest’s endpoint already exists in the endpoint identity store, the AUP accepted attribute is set to true on the existing endpoint. The endpoint’s identity group is then automatically changed to the value selected in the Guest Management Multi-Portal Configurations page.

4.  If the user does not accept the AUP or an error occurs in the creation of the endpoint, an error page appears.

5.  After the endpoint is created or updated, a success page appears, followed by a CoA termination being sent to the NAD/WLC.

6. After the CoA, the NAD/WLC reauthenticates the user’s connection with a new MAB request. The new authentication finds the endpoint with its associated endpoint identity group, and returns the configured access to the NAD/WLC.

Enter the following commands to enable the various AAA functions between the switch and Cisco ISE, including 802.1X and MAB authentication functions:

aaa new-model                 

Creates an 802.1X port-based authentication method list

aaa authentication dot1x default group radius

Required for VLAN/ACL assignment

aaa authorization network default group radius

Authentication & authorization for webauth transactions

aaa authorization auth-proxy default group radius

Enables accounting for 802.1X and MAB authentications

aaa accounting dot1x default start-stop group radius

aaa session-id common

aaa accounting update periodic 5

Update AAA accounting information periodically every 5 minutes

For more detail configuration and commands, please see the below link:

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_ug.pdf

at page no.807

Best Regards:

Muhammad Munir

[aqjaved]

WIRELESS:

Simply means brining a new device onto the network for the first time. On-boarding can be designed many ways however for this post we will use two SSIDs called Provisioning_Wireless for new devices and Employee_Wireless for existing approved devices.  An accesslist limiting access to ISE, DHCP and DNS will be enabled to prevent devices from staying on the provisioning SSID. 

Go to WLANs > Create New > Go and fill out the profile details. Use NONE for the layer 2 settings so it’s OPEN. For AAA, set the Radius server for ISE. Under advanced, enabled Allow AAA Override and change the NAC state to Radius NAC. Go to Controller > General > Fast SSID change and enabled Fast SSID to help speed up the SSID changing.

i- Join the ISE to an AD system. ii- Define the certificate authentication profile

iii- Define an Identity Source Sequence iv- Configure ISE to act as a Simple Certificate Enrollment proxy server

For this scenario, Configure ISE authentication to use MAB for on-boarding new devices. 

In many cases, ISE will not know the MAC addresses in advance so it must be configured to continue the authentication process via redirection regardless.

This is done in ISE:

• Policy > Authentication, choose your MAB wireless policy, click the carrot after allow protocols to show the user options and click the + sign for use.
• Select IF USERS NOT FOUND, CONTINUE. As a reminder, ISE Authentication policies are verified top down so make sure your MAB policy used for BYOD is at the top and open for all identity stores. You should lock down the 802.1x wireless to only wireless certificates.

Note: Client provisioning is based on how ISE classifies the client machine. There are customized packages in ISE available that include a software-provisioning wizard, which configures 802.1x settings and ability to obtain digital certificates on the endpoint.

To download wizard packages in ISE

Policy Elements > Results > Client Provisioning > Resources > Add. Common mobile devices such as iOS typically have these settings enabled natively so a wizard is not needed.

To configure client provisioning in ISE:

• Policy Elements > Results > Client Provisioning > Resources > Add.
• Create a native suppliant profile by giving it a name, selecting the Wireless Checkbox, your on-boarding SSID, WPA2 for security, TLS for allow protocols and key size 2048.
• Policy > Client > Provisioning to build your provisioning resources. Create one for native devices and select the mobile profile you just created for the results (example RULE = IOS, Identiy Group = Any, Operating systems MAC IOS ALL and your new mobile profile for results).
• Create another that is similar however use Android for the operating systems. Create a third for generic MacOsX devices and use the downloaded wizard. You may also want to create a separate one for Wired and Wireless. The same goes for two more to cover wireless and wired Windows devices. Here is an example of my Client Polices
• The final steps are verifying profiling for wireless is working as well as your authorization profiles are setup for redirection, employee and guest access (see previous postings for these configs). These can vary depending on how you want to restrict devices that pass and fail your polices.

For Complete Guide Please visit

http://www.thesecurityblogger.com/?tag=ise-advance-license

Video Link for Configuration of BYOD

http://www.labminutes.com/sec0054_ise_1_1_byod_wireless_onboarding_dual_ssid_testing