About Arne Bier

Arne Bier · ‎11-20-2018

If you have witnessed this yourself while trying to authenticate such a client, then I would say there might be a wireless issue, because ISE didn't get the response from the supplicant (client) after sending the EAP Challenge. This typically is a normal thing when users move out of range of a wireless signal in the middle of an EAP authentication. But if you test this with a stationary device then that's not normal (unless clients are roaming abnormally)

Arne Bier · ‎11-15-2018

Hi @CA_HA I can only speak about how the Cisco WLC works, since that is the one I understand the best. The problem is that the WLC WLAN has to be set to be of a certain type/mode. You cannot configure the WLAN profile to be MAB & 802.1X. And when the WLAN is configured as 802.1X then it will only authenticate the client session if, and only if, the Radius server returns an EAP Success in the final Radius Access-Accept EAP payload. If it doesn't, then the client session remains in 802.1X_REQD state, waiting for a miracle to happen. So let's assume you have a wireless client that does not have a supplicant configuration. In most cases it won't be able to even attempt to connect to the 802.1X SSID. Windows 10 for example will try PEAP by default, but that is not MAC auth either. The comms will break down due to things like TLS establishment failures etc. You can't short circuit an EAP conversation. In wired world there is no requirement to have a supplicant in order to send an Ethernet frame to a switch port. The switch (configured primarily for 802.1X will wait patiently for an EAPOL message, and also send EAPOL START frames - depending on your timers (say 30 seconds) this song and dance will lead nowhere and the switch will eventually give up. And if you configured MAB as the next auth method, then the switch will pass on your Ethernet frame to the AAA for MAC authentication. This concept does not work in the wireless domain because OSI Layer 1 and 2 work differently. Having two SSIDs would do the trick - you can try cool stuff like Identity PSK on Cisco controllers where each wireless client can potentially have different pre-shared key depending on their MAC address.

Arne Bier · ‎11-15-2018

This document provides the configuration required to allow a H3C Wireless controller to be integrated with ISE for the purpose of Central Web Authentication (Guest portals). Some historical background may be found in an earlier Community forum posting found here. Some years ago, this product did not support URL redirection or CoA, and this meant that it could not be integrated directly with ISE for Central Web Auth. The configurations below were supplied from a real world test but some understanding of the Comware product is required in order to interpret it exactly. If you are familiar with the Comware style of configuration then you'll know what you're looking for. Test Controller Hardware: H3C WX5004 Test Controller Software: Comware Software, Version 5.20, Release 2509P51 Tested with ISE 2.4 patch 1 (but any ISE version will do) ISE PSNs are behind a load balancer – the Virtual IP for the PSN’s is 10.10.10.10 Guest FQDN is guest.mycompany.com Auth VLAN is VLAN 5 Guest VLAN is VLAN 8 (after guest has authenticated on ISE Guest Portal) The portal free-rule is not 100% water proof – take it with a pinch of salt – it can be improved upon The ACL 3001 is also not 100% - it can be improved Please note that this product only supports ONE IP address for portal and CoA. In my case I point to a VIP, therefore I can still use many PSN's behind that load balancer VIP. But if you wanted to span this across more than one data centre, then you may need to devise a Global Load Balancer (e.g. F5 GTM) or something along those lines. HA is still possible, but the H3C does not make your life easy! The salient/relevant config pieces are shown below (you may need to use the horizontal scroll bars at the bottom of this window to scroll across depending on your screen resolution. If you copy and past the text then you'll get it all) # radius dynamic-author client trusted ip 10.10.10.10 # # portal server ISE-PORTAL ip 10.10.10.10 port 8443 key cipher $c$3$PcVSv9uEi2mmgGOp5cDg/dskhKJHKJG^tYTR url https://guest.mycompany.com:8443/portal/g?p=GplpylYLW4Y5Vc4vLE6xYvRG5N server-type imc portal free-rule 1 source ip any destination ip 10.10.10.10 mask 255.255.255.255 tcp 8443 portal free-rule 2 source ip any destination ip any udp 53 portal free-rule 3 source interface GigabitEthernet1/0/1 destination any portal local-server http # mac-authentication user-name-format mac-address with-hyphen # acl number 3001 description *** Guest Internet ACL *** rule 0 permit udp destination-port eq bootpc rule 5 permit udp destination-port eq bootps rule 10 permit udp destination-port eq dns rule 15 permit tcp destination-port eq dns rule 20 deny ip destination 10.0.0.0 0.255.255.255 rule 25 deny ip destination 172.16.0.0 0.0.63.255 rule 30 deny ip destination 192.168.0.0 0.0.255.255 rule 35 permit ip rule 40 permit icmp vlan 5 description GUEST_AUTH_VLAN arp fast-reply enable igmp-snooping enable vlan 8 description GUEST_INTERNET_VLAN igmp-snooping enable radius scheme ISE_VIP server-type extended primary authentication 10.10.10.10 key cipher $c$3$qYbRp6pq8WYRZD/wDVuCtOiD7f4E5yhEOSON primary accounting 10.10.10.10 key cipher $c$3$7okf10lpSYLBcE8/UyJzXoP1naa0nYz6qK5c key authentication cipher $c$3$hpBR47fHh3IqW1cqhCDr06YYvVI7/MH/HrgK key accounting cipher $c$3$hQoryn6Ex0zRTSGk2/Y06DFXYcQgRIUzbrYo user-name-format without-domain nas-ip 10.100.100.100 accounting-on enable domain ISE-GUEST-ALLOWED authentication default radius-scheme ISE_VIP authorization default radius-scheme ISE_VIP accounting default radius-scheme ISE_VIP access-limit disable state active idle-cut enable 60 10240 self-service-url disable domain ISE-GUEST-REDIRECT authentication portal radius-scheme ISE_VIP authorization portal radius-scheme ISE_VIP accounting portal radius-scheme ISE_VIP access-limit disable state active idle-cut enable 60 10240 self-service-url disable wlan service-template 1 clear ssid GUEST bind WLAN-ESS 1 service-template enable interface Vlan-interface5 ip address 10.100.5.1 255.255.252.0 portal server ISE-PORTAL method direct portal domain ISE-GUEST-REDIRECT interface WLAN-ESS1 port link-type hybrid undo port hybrid vlan 1 port hybrid vlan 5 8 10 untagged port hybrid pvid vlan 5 mac-vlan enable port-security port-mode mac-authentication mac-authentication guest-vlan 5 mac-authentication domain ISE-GUEST-ALLOWED The logic in ISE is very simple. Add the H3C device to the Network Devices list and assign it the standard Device profile of HP Wireless (at least as found in ISE 2.2/3/4 etc.) - the key thing is that HPE/H3C supports very basic CoA. Perform MAB authentication and in the Authorization rules always send an Access-Accept back in both cases MAC Address not found in Internal Endpoints: return VLAN 5 to H3C to ensure guest is forced into portal redirection mode. No ACLs are returned here because the H3C automatically applied its portal free-rules MAC Address found in Internal Endpoints: return VLAN 8 to H3C to ensure guest lands in Guest VLAN. Also return Filter-ID attribute containing the ACL that allows the guest to browse internet (and block RFC1918 etc.)

Arne Bier · ‎11-15-2018

Nope - at least not on a Cisco WLC. The Cisco WLC with 802.1X enabled will always send EAP frames to ISE because the WLC does not have a fallback to MAB auth (like a Cisco switch does). The client has to be configured with a supplicant in order to get any attention from the SSID configured with 802.1X. It's not technically possible to associate to an 802.1X SSID if you're not using a supplicant. In the wired world this is different. Client can have no supplicant, but because it causes a link-up on a switch, it can pass frames to the switch port for analysis. This is the key deifference. On a Cisco switch you can specify that 802.1X is tried first, and if Radius does not respond positively, then try MAB next, and failing that, chuck the user in a guest VLAN.

Arne Bier · ‎11-15-2018

If you intend on having multiple PSN's spread over multiple regions, but the entire deployment managed by two PAN nodes, then I am pretty sure you cannot perform RBAC (Role Based Access Control) down to PSN level. I have only seen menu options that can be customised, and then the data access (read/write type of access) - but this applies to particular functions that span across all PSN's. You're thinking of how Prime Infrastructure does its hierarchical access using Operations Centre, and then using Virtual-Domains etc. That concept does not apply to ISE. I would hazard a guess and say you'd need to deploy multiple PAN/MnT/PSN pairs all over the place if you want that sort of role based segregation.

Arne Bier · ‎11-14-2018

The Cisco WLC won't allow sending Radius Accounting to more than one server in parallel. Aruba and others do support this, so it's not a technical impossibility. We had this problem as well and we solved it using a load balancer. We send the Radius Accounting to a VIP (Virtual IP) and then the load balancer has the brains to send one copy to ISE, and another copy to a web proxy (in our case). If you don't have the spare cash for an F5/Citrix solution, then you could probably build your own load balancer using nginx (I did this once based on some google searches). I reckon that perhaps using a Freeradius server would also do the trick. Send your accounting records to a Freeradius server, and then have it proxy the traffic to multiple destinations.

Arne Bier · ‎11-13-2018

Did you mean the IP address in URL of Gig1 or Gig0 works? In your portal config did you put a tick against Gig1 interface? Stupid question - just checking .. Could it be that the client is somehow not resolving the DNS entry for that FQDN? e.g. I had cases where I was testing something specific and I had to hard code my etc\hosts file for a while. Other than that I can't think why this wouldn't work. Does adding an IP host command require application restart (or reboot)?

Arne Bier · ‎11-08-2018

Hi @kamil.swedrak Not sure what you're asking. When I reproduced this in the lab, I did not need to make any changes in ISE. I was testing with a Linux supplicant called wpa_supplicant. And it allows me to play around with EAP parameters. In ISE there is no special tricks that you need to be aware of. Any standard 802.1X EAP-TLS authentication example that you find with google searches (or via www.labminutes.com) will work.

Arne Bier · ‎11-08-2018

Do you know what is required from your VPN application to achieve this? If you can figure this out then the job for ISE will be a simple one. For example, it may be that your VPN concentrator has a Radius interface (to ISE) and ISE needs to authenticate the username/password that the VPN user enters. If ISE authentication passes, then ISE can authorize the user in various ways - one way might be to pass attributes like Framed-IP-Address and Subnet etc. You can do that by adding custom attributes to local ISE accounts, or if these attributes are available in AD/LDAP, then you can retrieve them there and pass them to the VPN server.

Arne Bier · ‎11-05-2018

Hi @kvenkata1 Do you have updated links for those two WLC-ISE documents, because they are pointing to the defunct Communities page :-( regards

Arne Bier · ‎11-01-2018

ISE just keeps on processing and you will receive Alarms about exceeding your licenses. You will see the Alarms in the dashboard and also via SYSLOG. If you are consistently over your license limits then ISE will nag you every time you log in - after 45 days (I think) it will eventually constrain your GUI to the licensing page to force you to install more licenses (I think this is explained in the Admin Guide) - but all the while the processing continues as normal Your endpoints are safe.

Arne Bier · ‎10-31-2018

that's an interesting observation about the Digicert CA certs. Yes it could cause a backdoor into ISE if not careful. Might be worth deleting these certs - they serve no purpose.

Arne Bier · ‎10-29-2018

Hi @kamil.swedrak I have reproduced your issue in my lab. There is an anonymous identity component in the EAP request that cannot be blank when talking to ISE. You can make it whatever you like, and it won't have any bearing on your results, other than to make ISE happy to continue. So put a static value in there like "PolycomVVX" - you will not see this anonymous username in the logs - you will see the Subject CN in the logs.

Arne Bier · ‎10-29-2018

Hi @fdharmawan You don't need another SSID, nor do you need another PSN. Your PSN supports up to 600 Guest Portals (as far as Cisco have told us). ISE is clever in this way, because it will allow you to have this many portals answering on TCP/8443 using virtual http servers. They only differ by their URL. And of course when you redirect the "MAC not found" MAB auth to a Guest Portal, then have to create a new Authorization Profile containing this second portal for you special users. That portal will also use its own Identity Group for "employees" (users authenticating with AD creds). And you'd ensure that you never use this Identity Group in any decisions - just keep purging the MAC addresses daily to keep the house tidy. The Session-Timeout does all the rest. I think that would work.

Arne Bier · ‎10-29-2018

Perhaps you could chose not to store those three MAC addresses, and rather just assign a Session-Timeout = 14400 (4 hours) to the session. How do users authenticate on those three devices (do they have AD accounts?) If they also use AD accounts then you may have to redirect them to another Guest Portal - one which does not store the MAC address (or at least, does not store the MAC address in the same Identity Group as your primary Guest Portal page). In your authorization Policy, you can then match higher up in the Rules, for Calling-Station-ID == (PC 1 OR PC 2 OR PC 3) AND "Guest Flow" THEN AuthZProfile = "Allow4hours" else .... existing logic applies where you check the Identity Group containing AD authenticated users ... etc.

Date Registered	‎02-23-2017 06:57 PM
Date Last Visited	‎11-20-2018 01:15 PM
Total Messages Posted	824
Total Helpful Votes Received	804

Re: Cisco-ISE

Re: WLC MAB with 802.1x Authentication

ISE Guest Portal integration with H3C W...

Re: WLC MAB with 802.1x Authentication

Re: Regional Admin delegation for ISE d...

Re: Hi tony

Re: ISE 2.4 CWA Guest portal redirectio...

Re: Wired 802.1X + EAP + ISE + AD crede...

Re: Assign fixed public to users connec...

Re: ISE Authorization faild on Wireless

Re: Cisco ISE - License consumption

Re: ISE default trusted CA certificates

Re: Wired 802.1X + EAP + ISE + AD crede...

Re: Treat Specific MAC Address on ISE P...

Re: Treat Specific MAC Address on ISE P...