Info for ISE AAA Policy design

[matteodapozzo]

Hi Cisco Communities,

I would like to know your opionion (ISE veterans ) about this implementation that I need to design for an existing ISE installation. (two VM nodes Active/standby ISE version 2.1 patch 1):

REQUIREMENTS :

1. Non-domain client PCs should have CWA process with AD credentials or Sponsored credentials ( if CWA is successful then give Internet Access to the client)
2. Domain client PCs should have 802.1X suppplicant enabled by AD GPO and follow 802.1X authentication through EAP-PEAP (if success then FULL ACCESS = Internet connectivity + full network access to company asset

I would like to know your opinion about these two possibilities :

OPTION A (VLAN Change + DACL) :

• All switch ports in a dummy VLAN by default, that have no internal network access and no Internet access in terms of ACLs. (dot1x first than if fails  go with mab in order to trigger CWA)
• if client is domain PC and 802.1x success than apply DACL with full  network access
• if client is domain PC and 802.1x fails than go with mab in order to trigger CWA
• If client is domain PC OR non-domain PC and  CWA success than apply DACL in order to give Internet Access
• if client is domain PC OR non-domain PC and CWA fails than no access

OPTION B (SGT reassignment):

• All switch ports defined with a static SGT tag (that have no internal network access and no Internet access in terms of ACLs)
• if client is domain PC and 802.1x success than apply new SGT tag with full  network access
• if client is domain PC and 802.1x fails than go with mab in order to trigger CWA
• If client is domain PC OR non-domain PC and  CWA success than apply new SGT tag in order to give Internet Access
• if client is domain PC OR non-domain PC and CWA fails than no access.

Thanks,

M.

[Dustin Anderson · Accepted solution]

I'm not an expert, but I'll give an example of what we do here.

With switches, we do DACLs as we have a lot of vlans and would require way to many rules.

Now, we don't allow guests to plug in, but that you could obviously modify for what you need.

So, basically in a closet, the PC and voice have a separate vlan and by default we have an unauth ACL applied to the port.

When the phone logs in, we send down  full access DACL and the phone can boot up. When the PC logs in, we send a DACL to give access.

At this point, we only auth the PC from the old system. Going forward we plan to have the PC's send user data so we can send DACLs based off user roles.

Now, we do have a separate vlan for external internet access, so you could send a vlan change down to guests and a DACL to block any access to internal resources.

Anyway, it's very flexible, so really need to look at what is existing and what would be best for the environment.