ISE Wireless Profiling and Computer Imaging Process

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 05:03 AM
We have deployed ISE on our wireless network. We need to modify our imaging process so that the techs can make sure the computer is profiled correctly before they ship it out to a user. I was wondering if anybody can recommend a way or share the best practice.
Currently, computers are being shipped out and if the computer does not profile correctly, the end user will call about not getting onto the wireless network. The computer will profile correctly with a reboot and wireless auth attempt. I was just wondering if after a computer is imaged and joined to the domain, is rebooting the computer a best practice or is there some other solution?
Thanks,
Alex
- Labels:
-
Identity Services Engine (ISE)

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 11:00 AM
What kind of authentication are you doing on the wireless network? i.e. why are you using profiling on wireless?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 11:05 AM
We are doing 802.1x authentication on the wireless network. We are using profiling so that our devices can get on the network without any manual process.
Our current process is to image the computer, and reboot it. We tested this out today and it seems to be working pretty good. We are running ISE 2.4 with the latest patch.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 11:09 AM
When your devices are being reimaged, aren't they joined to the domain, get GPOs pushed etc. to enabled wireless authentication. Still confused where profiling comes into play on wireless Dot1x SSID.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 11:14 AM
Before we send the computer to the end user, we want to make sure it automatically gets added to the ISE database.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 11:17 AM
Still confused. Being in the ISE database should have nothing to do with and 802.1x SSID. I am sure there is more to this puzzle, but with standard 802.1x authentication there is no requirement to be in the ISE database.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 11:30 AM
We are only allowing specific devices to get on the network. So the device must be in the database, and the user must authenticate.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2018 07:11 PM
If the endpoints have to be in the ISE internal endpoints store first before allowed to authenticate, then the tech either add the endpoints using Cisco ISE ERS APIs, or authenticate them in a limited-access network to get them profiled.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-02-2018 01:07 AM
All you need to do is create a specific goup in AD for devices permitted onto the wireless and put this into your your ISE policy for authorisation, you can go even further and create multiple groups with different policies, say one group with internet access and one without.
