ISE and Cisco IP phones.

[Dustin Anderson]

Greetings,

Just wanted to see if people have ideas or best practices. We are moving from an Avaya system using 802.1x username to log onto the network. We just got a dev system up yesterday for Cisco and they only do cert based 802.1x.

Right now I have ISE checking a field in the cert and letting them on, but auth fails since the cert is not from our domain.

So, here is my questions.

1: What is the best secure way to handle the phones?

2: If 802.1x cert, hat is the best way to issue/authz them?

     (I'm not sure if UCS can be a CA, or ISE can do it)

We are on ISE 2.3

Thanks,

[paul · Accepted solution]

I have only played around with certs on the Cisco phones briefly, but you have two options:

1. You can use the Manufacturer Installed Cert (MIC) that is installed on all Cisco phones.  The CA trust certs for the Cisco manufacturing CA come with ISE and all you need to do is enable them to trust for client authentication.  This will tell you the phone is a Cisco phone, but not necessarily that it is the customer's Cisco phone.  It is by far the easiest authentication to enable on the phones.
2. You can install an Locally Significate Cert (LSC) onto the phones from the customer's CA environment and configure the phones to use that cert to identify the fact that this is the customer's phone.  Definitely more work and something I haven't played around with.

Check out the 802.1x IP Telephony Design guide for more information:

https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/IP_Tele/IP_Telephony_DIG.html

[Dustin Anderson]

Thanks,

I didn't remember the cert being on ISE.I like the idea of a domain LSC,

This is also the fun of someone spending money and expecting you to implement after the fact with no prior info.

[paul]

These are the certs in the trusted cert section I am talking about: