ISE in a VDI Environment

[halfdeadcat09]

I've done several ISE deployments with good results, but there is one environment where ISE is needed but not (yet) suitable:VDI. I have several customers who are extensivley virtualized for the desktop environment (80% or more) and who would benefit from user-based differentiated network access. For instance, Call Center users have no need to access Accounting resources. I understand where VSG fits in this picture, but that gives you VM to VM access-control. I am looking for user-based authorization. The guest VM's support 802.1x via their native suplicants.
This missing piece for this to work is 802.1x COA in Nexus 1000v, which is not available. I have not found a way around this lack. If anyone has a sugestion for implementing user authorization in a VDI environment, I would appreciate the input. Failing that, is 802.1x support in the 1000v on the roadmap?

I see that the 1000v now support SGT's. But without user authorization to assign them, this is pretty much useless.

[Ravi Singh]

Please review the below link for ISE in VDI environment.

http://blogs.cisco.com/borderless/using-trustsec-to-simplify-virtual-desktop-infrastructure-vdi-deployment/

HTH.

[MARK BAKER]

Ravi,

Is 802.1x supplicant only available with the RDP display protocol? Is it not available with PCoIP?

Not all networks are SGT ready and would not be able to benefit from the capability in the document from the link you provided. Is it not possible to have downloadable ACLs enforced by the AnyConnect?

I have also been trying to find out if VM-FEX ports were capable of 802.1x and dACL, but haven't found anything that says it is supported. My thinking is that since the ports were extended from the network to VM, that it may be a possibility.

Thanks,
Mark

[tgrundbacher]

Hi all

Has there been any development in the meantime that would support authentication and tagging (or identity awareness and filtering) for PCoIP-based VDI deployments?

Regards

Toni