06-29-2018 05:03 AM
We have deployed ISE on our wireless network. We need to modify our imaging process so that the techs can make sure the computer is profiled correctly before they ship it out to a user. I was wondering if anybody can recommend a way or share the best practice.
Currently, computers are being shipped out and if the computer does not profile correctly, the end user will call about not getting onto the wireless network. The computer will profile correctly with a reboot and wireless auth attempt. I was just wondering if after a computer is imaged and joined to the domain, is rebooting the computer a best practice or is there some other solution?
Thanks,
Alex
06-29-2018 11:00 AM
What kind of authentication are you doing on the wireless network? i.e. why are you using profiling on wireless?
06-29-2018 11:05 AM
We are doing 802.1x authentication on the wireless network. We are using profiling so that our devices can get on the network without any manual process.
Our current process is to image the computer, and reboot it. We tested this out today and it seems to be working pretty good. We are running ISE 2.4 with the latest patch.
06-29-2018 11:09 AM
When your devices are being reimaged, aren't they joined to the domain, get GPOs pushed etc. to enabled wireless authentication. Still confused where profiling comes into play on wireless Dot1x SSID.
06-29-2018 11:14 AM
Before we send the computer to the end user, we want to make sure it automatically gets added to the ISE database.
06-29-2018 11:17 AM
Still confused. Being in the ISE database should have nothing to do with and 802.1x SSID. I am sure there is more to this puzzle, but with standard 802.1x authentication there is no requirement to be in the ISE database.
06-29-2018 11:30 AM
We are only allowing specific devices to get on the network. So the device must be in the database, and the user must authenticate.
06-29-2018 07:11 PM
If the endpoints have to be in the ISE internal endpoints store first before allowed to authenticate, then the tech either add the endpoints using Cisco ISE ERS APIs, or authenticate them in a limited-access network to get them profiled.
07-02-2018 01:07 AM
All you need to do is create a specific goup in AD for devices permitted onto the wireless and put this into your your ISE policy for authorisation, you can go even further and create multiple groups with different policies, say one group with internet access and one without.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide