cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Does ISE Support My Network Access Device?

7401
Views
20
Helpful
0
Comments

 

ISE Supports the RADIUS and TACACS Protocols

image.pngIf your network device can issue access control requests using the standard RADIUS and TACACS protocols then ISE can support it! ISE supports RADIUS to perform access control with whatever enforcement mechanisms the network device's hardware and software supports.

The capabilities of a given network device to do port-based access control with the IEEE 802.1X standard are software - and often hardware - dependent! Simply supporting RADIUS does not mean the network device supports many useful enforcement capabilities like MAC Authentication Bypass (MAB), RADIUS Change of Authorization (CoA) [RFC-5176], Layer-3/4 Access Control Lists (ACLs), domain-based ACLs, URL-redirection or software-defined segmentation with Cisco TrustSec. We cannot always tell you what any given network device is capable of and you may need to research that with the vendor or product team.

When people ask "Does ISE support my network device?" they are really asking "Can ISE give me all of these modern access control capabilities even with this old, inexpensive switch"? For these older and less expensive switches, ISE offers features like SNMP CoA and Authentication VLAN to provide some similar capabilities needed to handle Guest, BYOD and Posture flows.

 

ISE Compatibility Guides

Always check the ISE Compatibility Guides to see what our Quality Assurance (QA) team has Validated for each ISE release.

 

Network Device Capabilities for ISE

These are modern network device functions typically required to deliver ISE capabilities:

ISE Capability Network Device Features
AAA 802.1X, MAB, VLAN Assignment, Downloadable ACLs
Profiling RADIUS CoA and Profiling Probes
BYOD RADIUS CoA, URL Redirection + SessionID
Guest RADIUS CoA, URL Redirection + SessionID, Local Web Auth
Guest Originating URL RADIUS CoA, URL Redirection + SessionID, Local Web Auth
Posture RADIUS CoA, URL Redirection + SessionID
MDM RADIUS CoA, URL Redirection + SessionID
TrustSec SGT Classification

So what do you do if your network device does not have all of the features for the ISE capability? Create a Network Access Device (NAD) Profile.

 

How Do I Know The Capabilities of My Network Devices?

We have conveniently documented the capabilities for those hardware and software combinations that we validated in our ISE Compatibility Guides. For all others, you will need to research this on the vendors' websites, product documentation, forums, etc. Sometimes you may just have to play in your lab to find out what works and what doesn't and create a Network Device Profile for the different combinations of capabilities.

 

I Don't See My Hardware or Software in the ISE Compatibility Guide

Just because a hardware model or software release is not explicitly listed, does not mean that it will not work - only that we haven’t validated it with ISE! The Supported Network Access Devices section of the ISE Compatibility Guides clearly states what ISE supports:

Cisco ISE supports interoperability with any Cisco or non-Cisco RADIUS client network access device (NAD) that implements common RADIUS behavior (similar to Cisco IOS 12.x) for standards-based authentication.

ISE supports protocol standards like RADIUS, its associated RFC Standards and TACACS+ . If your network device supports RADIUS and/or TACACS+ then ISE can support it!

There are many reasons why both Cisco and non-Cisco devices may not be listed:

  1. Our QA team cannot afford to test every single hardware and software combination with every ISE release
  2. New  hardware platforms must be acquired and tested which usually occurs within 6-9 months after the hardware release
  3. Every model of a hardware family are not validated - we pick one model and use that to represent the hardware family
  4. Every software release is not validated - we pick one released platform software version recommended by the platform team a few months before the actual ISE release for QA validation planning
  5. Older ISE releases will not be tested with newer Network Device software but still should per standards.

Exactly what you can do with ISE is then determined by your network device's hardware and software capabilities. We always recommend trying your network device hardware and software in your lab with ISE before deploying to production so you are confident that is will behave as expected.

 

ISE Network Access Device (NAD) Profiles

If you have :

  • non-Cisco hardware
  • inexpensive, low-end network device hardware
  • older network device hardware
  • older network device software

then you can use our ISE Third-Party NAD Profiles and Configs or create your own custom NAD profile. Using a NAD profile, you can completely customize how ISE communicates with your network device whether it is on custom ports for RADIUS CoA or if you need to use Authentication VLANs instead of URL Redirection.

 

How does an Authentication VLAN work?

image.png

For more information, see Third-Party Network Device Support in Cisco ISE in the ISE Administrators Guides.

 

Problems with Using Authentication VLANs

  • you cannot control multiple devices per port
  • traffic filtering is very crude with L2 VLANs - no L3/4 IP/protocol/port control except with a VACL or VRF
  • no East/West segmentation within a VLAN means malware is easily spread to other endpoints within VLANs, whether untrusted or trusted

 

Network Device Validation Requests

If you do not see a particular hardware family listed and would like to suggest it, please send your validation request to surasky.