ISE with BitLocker Network Unlock

[jmorton1]

Is there anyone who uses ISE MAC filtering who has successfully implemented BitLocker Network Unlock? If so, was there a trick to doing this? Our Network Unlock is not working, and I am wondering if ISE has anything to do with this since network unlock seems to require a DHCP connection at pre-boot, but ISE appears to not give it until after it boot to the login screen.

[howon · Accepted solution]

You will need to provide limited network access during the initial UEFI network boot up for the machines. One option is to use low impact mode wired deployment with Cisco Catalyst switches. At minimum it looks like you will need to provide access to DHCP, WDS and possibly DNS to allow the BitLocker Network Unlock enabled machines to boot up properly to the point it can authenticate to the network.

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock

[samsunday · Accepted solution]

I assume this issue is resolved.

Environment where I have configured this to work does not Implement ISE so you may be able to see if any of the suggestion below may help in your specific environment. 

In the deployment where I have had this working, I was using cisco Router DHCP server for the clients.

Few things to want to consider is as follow:

1) on the switch port that client machine connect to, you need to ensure that spanning-tree portfast is enabled so the port transmits immediately the client comes online. 

2) You need to configure ip-helper address to WDS on the SVI interface of the client so the bootp request is forwarded to the WDS once the initial DHCP allocation is done.