ISE 2.4 Posture using SNMP COA with extreme switches

ahmad_nahawi · ‎03-07-2018

ISE 2.4 Posture using SNMP COA with extreme switches

introduction:

This document describes the posture configuration with 3rd party switches (Extreme switch ).

Prerequisites

Cisco recommends that you have knowledge of these topics:

• Basic knowledge of SNMP Protocol

• Prior knowledge of regular expressions

• Prior knowledge of Cisco Identity Service Engine (ISE)

• Identity Service Engine 2.4.

• Anyconnect 4.5.03040.

• SNMP Supported Switches

• Extreme Switch.

Components Used

The information in this document is based on ISE Version 2.4 & extreme switch X440-48p version 16.2.

The information in this document was created from the devices in a specific lab environment. All of the devices

used in this document started with a cleared (default) configuration. If your network is live, ensure that you

understand the potential impact of any command.

Background Information

Two new feature had been used to get the posture work with extreme switches :

1. Call home list in ISE 2.2 and later :

Extremes switches don't support the URL redirection , so we used this feature to allow AC posture to discover

the PSN and to make a connection with it.

2. SNMP COA separate request in ISE 2.4 :

this feature has been developed in ISE version 2.4 to fix BUG CSCvd06733.

current SNMP CoA sends both values (disable/enable) in same request. The Extreme switch can not perform this request. it requests each value in different request, and this feature fix the compatibility issue with extreme switches.

Configure Switch:

Step.1 AAA & Dot1X configuration:

- configure radius netlogin primary server (PSN IP address) 1812 client-ip (Switch IP address) vr VR-Default

- configure radius netlogin primary shared-secret (plain text)

- enable radius netlogin

- configure netlogin vlan (VLAN name )

- enable netlogin dot1x

- configure netlogin dynamic-vlan enable

- configure netlogin dynamic-vlan uplink-ports 48

- enable netlogin ports 1-40 dot1x

Step.2 SNMP configurations:

- configure snmpv3 add user snmp authentication md5 v3adminauth privacy des v3adminpriv

- configure snmpv3 add group v3group user snmp sec-model usm

- configure snmpv3 add access v3group sec-model usm sec-level priv read-view defaultAdminView write-view defaultAdminView notify-view defaultAdminView

- disable snmp access snmp-v1v2c

- disable snmpv3 default-user

- disable snmpv3 default-group

Configure ISE:

Step.1 add the device profile & enable SNMP separate request :

Administration > Network Resources > Network Device profile > Add

in the attachment a NAD profile for extreme switches has been attached

Step.2 add the network device and assign the device profile:

Administration > Network Resources > Add

Step.3 Add Extreme attributes:

we added Extreme VLAN tag attribute and below all extreme attributes

Policy > Policy Elements > Dictionaries > System> Radius > Radius Vendor

Step.4 Client Provisioning :

a. add AnyConnect PKG & and AnyConnect compliance module :

Policy> Result> Client Provisioning> Resources> Add>

b. Create & Upload NAM Profile :

we created the NAM profile using the NAM profile editor.

Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 3.0 - Configuring Network Access Manager [Cisco Any…

c. Create Posture Profile :

d. Create AnyConnect configuration:

we configured two profiles ( the first one based on AnyConnect compliance module 4.X & and the second one for version 3.X )

Step.5 Client Provisioning Policy:

Step.6 Posture Conditions:

Anti-virus Condition has been tested.

Step.7 Posture requirement:

Step.8 Posture Policy:

Step.9 Authorization profile:

Step.10 Policy Set :

Deploy NAM module:

the NAM module had been installed on windows 7 from Cisco AnyConnect pre-deploy file.

Created by Ahmad Al-Nahawi

System Engineer at BMBGroup

Muhannad Abu Shamma · ‎03-08-2018

This is a great document with very helpful information.

Thanks Ahmad to share the knowledge.

ayousef · ‎03-11-2018

Thanks Ahmad for sharing this document,

Way to go my friend

osama_masoud · ‎03-14-2018

Well done Ahmad. Liked your explanation and screenshots showing everything step by step. A valuable addition to the community. Keep it up buddy

mcrukshanfernando · ‎03-18-2018

Thank you.. Ahmad for sharing all the details

and can you please share the UnComp-AuthZ authorization profile details as well

ahmad_nahawi · ‎03-19-2018

Thank you Fernando.

the UnComp-AuthZ profile is the same of the Comp-AuthZ profile , I just restrict the user access by push the VLAN TAG in the Un-CompAUthZ profile.

this VLAN have access to the PSN and to the DNS server , also we don't use the Web-redirection because its not supported and we used Call-home list instead of it.

mcrukshanfernando · ‎03-19-2018

Thank you.. Ahmad

sajid231088 · ‎08-16-2018

Hi All,

Could you please help me in configuring Posture for ise 2.4 using SNMP COA with CIsco 2960L switches.

Thanks in advance.

Craig Hyps · ‎08-16-2018

See https://community.cisco.com/t5/security-documents/cisco-snmp-coa-nad-profile-zip/ta-p/3637330

sajid231088 · ‎08-16-2018

Dear Craig,

Thanks for your reply.

Actually i am a new bee on Cisco ISE, Could you please share configuration required on Cisco 2960 switch and on ISE for Posturing using SNMP.

Regards,

thomas · ‎08-16-2018

Sajid, please review all of the Identity Services Engine (ISE) Community Resources @ https://community.cisco.com/t5/security-documents/identity-services-engine-ise-community-resources/ta-p/3621621 Specifically, under Secure Wired Access see the ISE Wired Access Deployment Guide @ https://community.cisco.com/t5/security-documents/cisco-ise-wired-access-deployment-guide/ta-p/3641515

Daniel Stefani · ‎08-23-2018

Hello Ahmad, thank you for your contribution.

I am implementing using your instructions, but I am getting a loop situation after SNMP CoA, Endpoint restart new authentication process and consequently a new posture process that do a new SNMP CoA. Do you have some tip for my behavior?

Best Regards,

Daniel Stefani

Daniel Stefani · ‎09-04-2018

Hello all,

Was missing the following accounting configurations:

"configure radius-accounting netlogin primary server <PSN-IP-Address> 1813 client-ip <Switch-IP-Address> vr VR-Default"
"configure radius-accounting netlogin primary shared-secret <Plain Text>"
"enable radius-accounting netlogin"

Now it's working.

Best Regards,

Daniel Stefani

CSCO12550173 · ‎12-20-2018

Hi all, im getting the following error from ise

Event 5400 Authentication failed
Failure Reason 11014 RADIUS packet contains invalid attribute(s)

in the extreme device the lines that you put in are::

configure radius netlogin primary server 10.8.54.120 1812 client-ip 10.8.54.121 vr VR-Default

configure radius netlogin primary shared-secret encrypted "Didata2019"

enable radius netlogin
configure netlogin vlan cisco

configure netlogin dynamic-vlan enable

configure netlogin dynamic-vlan uplink-ports 48

enable ports 11-24 dot1x

configure netlogin ports 2 mode port-based-vlans
configure netlogin ports 2 no-restart

and snmp is configure

so, i have a few questions, it's imperative to have the snmpv3 or can be the snmpv2 to work with?

but the devices and users are not going to the check, when a take a tcp dump

do you know which more attribute do we have to put in the ISE device?

this is the tcp and the radius challenge

18:27:16.482677 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 134)
X.X.X.X.41884 > srv-ise-: RADIUS, length: 106
Access-Request (1), id: 0x5c, Authenticator: 4222cceb304c20525556ce28010d3cf6
User-Name Attribute (1), length: 8, Value: srojas
EAP-Message Attribute (79), length: 13, Value: ..
NAS-IP-Address Attribute (4), length: 6, Value: 10.8.54.121
Service-Type Attribute (6), length: 6, Value: Login
Calling-Station-Id Attribute (31), length: 19, Value: E8-6A-64-2E-6D-3A
NAS-Port-Id Attribute (87), length: 4, Value: 21
NAS-Port Attribute (5), length: 6, Value: 1021
NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
Message-Authenticator Attribute (80), length: 18, Value: {....w..]...._.c
18:27:16.486793 IP (tos 0x0, ttl 64, id 11075, offset 0, flags [DF], proto UDP (17), length 180)
srv-ise > X,X,X,X 1884: RADIUS, length: 152
Access-Challenge (11), id: 0x5c, Authenticator: 4a5051e21408fcb0f25eb794f08b3998
State Attribute (24), length: 106, Value: 64CPMSessionID=0a083678VsRdGYwkon5XnlXinUbVtE4xg2G5Jp9VYxWEH0/ql2U;34SessionID=srv-ise-poc/334695666/92;
EAP-Message Attribute (79), length: 8, Value: .d
Message-Authenticator Attribute (80), length: 18, Value: .M>F.
18:27:16.491115 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 355)
X.X.X.X.41884 > srv-ise: RADIUS, length: 327
Access-Request (1), id: 0x5d, Authenticator: 34a2b32737e5e7c059c32f31161a99b3
User-Name Attribute (1), length: 8, Value: srojas
EAP-Message Attribute (79), length: 168, Value: .d
NAS-IP-Address Attribute (4), length: 6, Value: 10.8.54.121
Service-Type Attribute (6), length: 6, Value: Login
Calling-Station-Id Attribute (31), length: 19, Value: E8-6A-64-2E-6D-3A
NAS-Port-Id Attribute (87), length: 4, Value: 21
NAS-Port Attribute (5), length: 6, Value: 1021
NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
State Attribute (24), length: 66, Value: 64CPMSessionID=0a083678VsRdGYwkon5XnlXinUbVtE4xg2G5Jp9VYxWEH0/ql
Message-Authenticator Attribute (80), length: 18, Value: <.1.B.^.w....n..
18:27:16.494422 IP (tos 0x0, ttl 64, id 11077, offset 0, flags [DF], proto UDP (17), length 66)
srv-ise > X.X.X.X.41884: RADIUS, length: 38
Access-Reject (3), id: 0x5d, Authenticator: a7b41552a449bf5985ff3ec0b104379e
Message-Authenticator Attribute (80), length: 18, Value: p.......3.@E^.$.

hanguye3 · ‎06-05-2019

Hi bros,

I am having the integration between ISE (2.4 Patch 8) with the ExtremeSW (15.3.4) and need your advise when you define the flow conditions:

- RADIUS: NAS Identifier X440-48p

Correct me if I am wrong that we have to define manually the highlighted item (X440-48p) as it does not exist in the ISE Database, right?

Highly appreciated for any quick response. thanks in advanced.

Br,

hainm

rajczmic · ‎12-05-2022

Hi all;

does anyone have experience with MAB working on Extreme EXOS switches? 802.1X works fine, but I am missing some setting that will make the cisco IP phone go to the appropriate vlan using the MAB function. The policy for MAB authentication is the first one, but nothing falls into it... I have ISE 3.1

Best regards

Michal