cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Configuring Cisco Mobility Express AP with ISE

5214
Views
8
Helpful
0
Comments

Introduction

This document describes steps to configure Cisco Mobility Express AP (ME-AP) running version 8.7 to work with ISE 2.4 for guest access (CWA) and BYOD (Single-SSID). Mobility Express version 8.7 is the first version to support RADIUS CoA, RADIUS based URL-Redirect, and DNS based ACL which allows users to use advanced use cases with ISE. ME-AP 8.7 also automatically configures redirect ACL as well as advanced WLAN settings to work with ISE, thus simplifying the configuration process. This document will leverage smart default policy settings present in the ISE where possible.

For more information about Cisco Mobility Express, please go to Mobility Express - Fast Wireless LAN Solutions for SMBs - Cisco

 

Prerequisites, assumptions, and caveats

  • ME-AP capable of running 8.7 (This document uses CLI to bootstrap ME-AP and continues after there is IP connectivity to the ME-AP GUI)
  • ISE 2.4 (Using 2.4, but should also work with previous version of ISE though UI will look different) with default settings
  • Underlying network elements have been configured, including VLAN, DNS, DHCP, Routing, etc.
  • ISE Secure Access Wizard does not support ME-AP

 

Configuration Overview

Mobility Express AP

  1. Bootstrap
  2. Add ISE as RADIUS
  3. Configure CWA WLAN
  4. Configure BYOD WLAN

ISE

  1. Add AP as NAD
  2. Add test employee user
  3. Modify BYOD profile with SSID name
  4. Modify default Authorization profiles
  5. Enable Policy set for CWA and BYOD

 

IP addressing and other network ID used in the document

Use Value
ISE 192.168.201.93
Mobility Express AP Management Interface 192.168.80.66
Endpoint Subnet 192.168.80.0/24
Guest SSID OPEN
Employee/BYOD SSID SECURED

 

Mobility Express AP

Bootstrap

If the Mobility Express AP (ME-AP) has not been configured previously, go through the initial configuration either by connecting to the initial SSID or through the console port. Here is sample output from bootstrapping via console port:

Bootstrap

Welcome to the Cisco Wizard Configuration Tool

Use the '-' character to backup

 

Enter Administrative User Name (24 characters max): admin

Enter Administrative Password (3 to 127 characters): *********

Re-enter Administrative Password                 : *********

 

System Name [Cisco-2cd0.2d3f.8a80] (24 characters max): MEAP

 

Enter Country Code list (enter 'help' for a list of countries) [US]: 7

 

Management Interface IP Address Configuration [STATIC][dhcp]:

 

Management Interface IP Address: 192.168.80.66

Management Interface Netmask: 255.255.255.0

Management Interface Default Router: 192.168.80.1

Create Management DHCP Scope? [yes][NO]:

Employee Network Name (SSID)?: PSK

Employee Network Security? [PSK][enterprise]:

Employee PSK Passphrase (8-63 characters)?: ********

Re-enter Employee PSK Passphrase: ********

Enable RF Parameter Optimization? [YES][no]:

Client Density [TYPICAL][Low][High]:

Traffic with Voice [NO][Yes]:

 

Configuration correct? If yes, system will save it and reset. [yes][NO]: yes

Once ME-AP reloads, connect to the Web GUI and login using the credential entered via CLI

 

Add ISE as RADIUS server

Screen Shot 2018-04-20 at 11.24.08 AM.png

  1. Switch to Expert View. This enables the UI to allow admin to add RADIUS servers to the ME-AP. Click OK on confirmation pop-up.
  2. Click on Management > Admin Accounts
  3. Click on RADIUS
  4. Scroll down and add RADIUS Authentication Server with ISE IP address and Shared Secret
  5. Repeat for RADIUS Accounting Server with same IP address and Shared Secret
  6. (Optional) Once RADIUS servers have been added, the expert mode can be turned off

Screen Shot 2018-04-20 at 11.24.53 AM.png

 

Add Guest (OPEN) WLAN

  1. Go to Wireless Settings > WLANs
  2. (Optional) Delete WLAN created during bootstrap
  3. Click on Add new WLAN/RLAN
  4. Create Guest WLAN with following information
    • General Tab
      • Profile Name/SSID: OPEN
    • WLAN Security
      • Captive Network Assistant: Enabled
      • Security Type: Central Web Auth
  5. Click on Add RADIUS Authentication Server and ensure ISE IP is shown and click apply.
  6. Repeat for RADIUS Accounting Server
  7. Make note of the ACL name shown for ‘CWA ACL Rule Name’. It should read ‘me_cwa_acl_redirect_#’. You will need to use the same ACL name in the ISE AuthZ Profile in later steps
  8. Click Apply

Screen Shot 2018-04-20 at 11.27.39 AM.png

Screen Shot 2018-04-20 at 11.29.13 AM.png

 

Add Employee/BYOD (SECURED) WLAN

  1. Click on Add new WLAN/RLAN
  2. Create Configuring Cisco Mobility Express AP with ISE with following information
    • General
      • Profile Name/SSID: SECURED
    • WLAN Security
      • Captive Network Assistant: Disabled
      • Security Type: WPA2 Enterprise
    • BYOD: Enabled
  3. Click on Add RADIUS Authentication Server and ensure ISE IP is shown and click apply.
  4. Repeat for RADIUS Accounting Server
  5. Make note of the ACL name shown for ‘CWA ACL Rule Name’. It should read ‘me_cwa_byod_acl_redirect_#’. You will need to use the same ACL name in the ISE AuthZ Profile in later steps
  6. Click on 'Pre Auth ACLs'
  7. Click on 'Add URL Rules' and enter following one at a time. This allows Android devices access to Google Play store to download ISE Network Setup Assistant App to assist in BYOD flow:
    • .google.co
    • accounts.youtube.com
    • gstatic.com
    • .googleapis.com
    • .appspot.com
    • ggpht.com
    • gvt1.com
    • market.android.com
    • android.pool.ntp.org
    • .googleusercontent.com
    • .google-analytics.com
  8. Click Apply

Screen Shot 2018-04-20 at 11.36.03 AM.png

Screen Shot 2018-04-20 at 11.49.47 AM.png

Screen Shot 2018-04-20 at 3.45.59 PM.png

 

ISE

Add Mobility Express AP as Network Access Device (NAD)

  1. Go to Administration > Network Resources > Network Devices, click on Add
  2. Enter Name, IP address, and check 'RADIUS Authentication Settings'
  3. Enter matching Shared Secret configured on the Mobility Express AP in the earlier step and Click Submit

Screen Shot 2018-04-20 at 3.07.56 PM.png

 

(Optional) Add test user

  1. Go to Administration > Identity Management > Identities, click on Add
  2. Enter Name and Login Password and click Submit

 

Modify BYOD profile

This step reconfigures default BYOD profile with Employee/BYOD SSID of 'SECURED'. If using different name for employee SSID, then modify the name to match the SSID name used in the deployment.

  1. Go to Policy > Policy Elements > Results
  2. Click on Client Provisioning > Resources on the left menu
  3. Check 'Cisco-ISE-NSP' and click on Edit
  4. Check 'ISE' SSID Name and click on Edit
  5. Change 'SSID Name' to SECURED and click Submit
  6. Click Submit to save the Native Supplicant Profile

Screen Shot 2018-04-20 at 3.09.16 PM.png

 

Modify Authorization profile

We will be leveraging existing Authorization profile to simplify the steps. If default Authorization profiles are already in use, make a copy before modification. Also, if using copied Authorization profile, ensure that the policy set rules are using the copied Authorization Profile instead of the default ones in the next section.

  1. Go to Policy > Policy Elements > Results
  2. Click on Authorization > Authorization Profiles on the left menu
  3. Check 'Cisco_WebAuth' and click on Edit
  4. Under 'Common Tasks' area scroll down to 'Web Redirection' and replace the ACL with ACL value auto configured by Mobility Express AP in the previous steps for Guest WLAN
  5. Click Save
  6. Click on Authorization Profiles on the left menu
  7. Check 'NSP_Onboard' and click on Edit
  8. Under 'Common Tasks' area scroll down to 'Web Redirection' and replace the ACL with ACL value auto configured by Mobility Express AP in the previous steps for BYOD WLAN
  9. Click Save

Screen Shot 2018-04-20 at 11.44.47 AM.png

 

Modify Policy Set

  1. Go to Policy > Policy Sets
  2. Click on '>' to expand Default Policy Set
  3. Expand Authorization Policy by clicking '>'
  4. Scroll down and Enable following Rules by clicking the 'Status' icon and selecting 'Enabled'
    • Employee_EAP-TLS
    • Employee_Onboarding
    • Wi-Fi_Guest_Access
    • Wi-Fi_Redirect_to_Guest_Login
  5. Click Save

Screen Shot 2018-04-20 at 11.46.23 AM.png