Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Arne Bier
Arne Bier
Member since
02-23-2017
.jpg){kind=icon}
VIP Collaborator
I have been working in the IT industry since 1996 as a graduate out of university. I have worked for IBM, Cisco Systems, Dimension Data and I am currently working at IPTel Solutions in Brisbane, Australia.
I have held my CCIE #6282 since 2000 and keep re-certifying in whatever my current job requires - currently it's Security.
My professional career has taken me all around the world and exposed me to Enterprise and Service Provider customers. When I am not analysing Wireshark trace files, you might find me riding my mountain bike, or taking a walk, listening to my favourite podcasts.
My main work centers around AAA, particularly with Cisco ISE, Free Radius and Aruba Clearpass. I have some years of experience with Cisco Prime Access Registrar, which is the Service Provider AAA platform. I like to think along vendor neutral lines because if I understand the theory, then I should theoretically be able to apply this to any vendor. But at the end of the day I spend the majority of my time working with Cisco customer environments.
I am currently cross-skilling over to add Wireless LAN to my portfolio (CWNP track).
I have been working in the IT industry since 1996 as a graduate out of university. I have worked for IBM, Cisco Systems, Dimension Data and I am currently working at IPTel Solutions in Brisbane, Australia.
I have held my CCIE #6282 since 2000 and keep re-certifying in whatever my current job requires - currently it's Security.
My professional career has take
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
03-19-2019
02:51 PM
03-19-2019
02:51 PM
Hey @bern81 - thanks for the feedback. I am glad I am not alone in this boat. There will always be someone (like us) who is new to the party - but IBNS is not new and I found a nice Cisco Live presentation from Hari Hola (BRKSEC-2691) that goes a little in the right direction. It's a great intro into the subject (just what I needed)
https://www.ciscolive.com/global/on-demand-library.html?search=IBNS#/session/1467135309591001h5tu
But I am still stuck on the actual execution. And yes concurrent auth sounds great but have a look at the LiveLogs as a result - messy. Hari says that it will only create one session in ISE (I guess that means two success auths == one license count? - keep an eye on that too - I didn't even think of that).
What is needed here is a state machine diagram that explains all the possible states and their transitions. It would explain it graphically instead of with words (which can make things confusing). When I see looping constructs like "do-until-failure" then it implies there is a state machine in play. I am sure Cisco has documented this somewhere.
Once I understand what state changes there are, and how to handle them, then building the IBNS 2.0 syntax for "policy-map type control subscriber" should make more sense.
I suppose most folks just use dot1x first because that is the preferred use case. But when you have devices like Avaya/Mitel phones that boot up and stop doing DHCP soon after, then having dot1x mab order can cause issues.
I will try dot1x mab concurrent today to see if that works well for the Phone (MAB), PC (EAP-TLS), Printer(MAB) and AP (EAP-FAST) use cases. I don't like the fact that if I put MAB first, then I can also fill my LiveLog with lots of Failed auths because the devices that connect are not in the MAB Endpoint Group ... 5 seconds later they send an EAPOL and connect.
Thanks for the links. The more I look at this stuff the more questions I have. It's anything but intuitive. If it were done in a structured procedural language (like Python or whatever) then it would make sense to me. When I read these statements I don't know what the switch will do next. Will it stop? Will it repeat? Where does the processing end/stop/repeat? It's giving me a headache now.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
03-18-2019
09:27 PM
03-18-2019
09:27 PM
Hi there
I am after some best practice advice please - excuse my novice question here but I have tried to cobble together a wired 802.1X policy for a Cat9300 switch for a customer who needs the following logic:
Priority should be 802.1X over MAB (if the client sends EAPOL then perform 802.1X auth)
Start switch auth with MAB first (not 802.1X - this is due to some phones that give up on DHCP)
If MAB failed then try 802.1X
If MAB fails then drop into a fixed VLAN
I thought the requirements were pretty straighforward, but I cannot get my head around the "control policy language" - and in particular, in which cases does one terminate and stop, and when does one terminate and then restart in x seconds?
I think a flow chart for this would explain it all.
If anyone can shed some light on this I would be very grateful
My current config below
show policy-map type control subscriber PORT-AUTH-POLICY-I
PORT-AUTH-POLICY-I
event session-started match-all
10 class always do-until-failure
10 authenticate using mab priority 10
20 authenticate using dot1x priority 20
event authentication-failure match-first
10 class MAB_FAILED do-until-failure
10 terminate mab
20 authenticate using dot1x priority 10
20 class DOT1X_FAILED do-until-failure
10 terminate dot1x
30 class AAA_SVR_DOWN_UNAUTHD_HOST do-until-failure
10 clear-authenticated-data-hosts-on-port
20 activate service-template CRITICAL_AUTH_ACCESS
30 authorize
40 pause reauthentication
40 class AAA_SVR_DOWN_AUTHD_HOST do-until-failure
10 pause reauthentication
20 authorize
50 class DOT1X_NO_RESP do-until-failure
10 terminate dot1x
20 authentication-restart 60
60 class MAB_FAILED do-until-failure
10 terminate mab
20 authenticate using dot1x priority 10
70 class always do-until-failure
10 terminate dot1x
20 terminate mab
30 authentication-restart 60
event agent-found match-all
10 class always do-until-failure
10 terminate mab
20 authenticate using dot1x priority 10
event aaa-available match-all
10 class IN_CRITICAL_AUTH do-until-failure
10 clear-session
20 class NOT_IN_CRITICAL_AUTH do-until-failure
10 resume reauthentication
event inactivity-timeout match-all
10 class always do-until-failure
10 clear-session
event authentication-success match-all
10 class always do-until-failure
10 activate service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
03-10-2019
04:39 AM
03-10-2019
04:39 AM
Yip it's not an ISE issue. I have customers that back up 2.5GiB quite regularly. It does pain me though to think that the bulk of that backup file does not contain anything useful at all. If you examine the contents you'll mostly find junk files and logs. The actual configuration files are tiny by comparison. I have ranted about this before but seems nothing gets done about it.
Instead of SolarWinds, why not deploy a free CentOS server and use its sftpd process? Works all the time.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
02-26-2019
04:48 PM
02-26-2019
04:48 PM
Hello
I was testing the Device Admin using Radius (instead of TACACS+) and I was quite impressed with how well it works. For customers who only have a few devices and don't want to shell out the big bucks for a Device Admin license. And it kind of makes sense for a simple use case where a user just wants to get to priv exec (lvl15) mode - it's what the customer is used to. They can of course make it more complex than this using the Cisco AVPair.
My only issue is that I was unable to tell the IOS-XE router (a CSR1000) that I want to log every command that the user entered. This is very easy with TACACS. Anyone does this with Radius? I don't mean command Authorization ... I am specifically talking about logging (or accounting) the commands that have been entered during that session.
I have setup Radius Accounting at the start of the session, and also at the end of the Session, to ensure that the ISE Base Licenses are handled correctly.
[abier@centos ~]$ ssh bob@172.16.1.240
Password:
CSR1#show run aaa
!
aaa authentication login default group radius-ise local
aaa authorization exec default group radius-ise if-authenticated
aaa accounting exec default start-stop group radius-ise
aaa accounting update newinfo
!
radius server ise02
address ipv4 192.168.21.101 auth-port 1812 acct-port 1813
key 7 15355B000079252370
!
!
aaa group server radius radius-ise
server name ise02
mac-delimiter colon
!
aaa new-model
I decided to place the Policy Rule at the end of the other stuff to avoid confusion - I check for NAS Port Type = Virtual, and NAS Port Id prefix "tty"
Some wireshark analysis of the authentication
... View more
- Tags:
- Device admin
- radius
Labels:
Created by
Arne Bier
in Security Blogs
Arne Bier
in Security Blogs
02-07-2019
03:37 AM
02-07-2019
03:37 AM
Nice one! I will have to re-visit my last F5 deployment and see whether the customer implemented this - it was handled by a 3rd party and I never saw the details under the hood. Thanks for the details!
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-31-2019
01:50 PM
01-31-2019
01:50 PM
Looks alright to me so far. Very similar to a Guest Portal redirection ACL on the Cisco WLC.
It might be that the client is unable to resolve the FQDN of the ISE node. Is the client able to ping the PSN?
Do a nslookup on the client to see what happens when you try to resolve the FQDN (https://ip:port) - that means you're not using a static FQDN on the portal. Hence, ISE substitutes the FQDN of the PSN that sent the redirect. e.g. https://ise01.net.local:8443 ) - if client cannot resolve ise01.net.local then it won't establish a TCP connection to ISE portal.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-31-2019
04:52 AM
01-31-2019
04:52 AM
I think you are the proud owner of a new ISE bug :-)
I am also on ISE 2.4 patch 5 and I can reproduce it. So the expiration time does play a role and there is a workaround to stop annoying your people. Just set the "Disable user account after" to 3650 days and tick the box. And then set the "Display reminder" to 1 and tick the box. That will buy you some sanity and some time to get the bug raised and hopefully resolved (in ten years time!)
I am pretty sure this is a bug because it makes no sense otherwise.
I even deleted the user bob and it still happens. It's not tied to the user - it's as if the password expiration just has a mind of its own. Once it has calculated a password expiration event, it will latch that event, even if the display reminder option is then subsequently turned off. But by toggling the value to 10 years seems to do the trick
I'd say raise a TAC case anyway.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-31-2019
02:54 AM
01-31-2019
02:54 AM
This is a function of the TACACS (Device Admin) and not the ISE admin (which your screen captures are showing).
I tested this in my lab and I was able to reproduce your issue. There is a checkbox to enable the password expiration reminder - and I think there is a bug because if you uncheck that box, then the reminder is still displayed. No way around it it.
of course, this only happens if there is an actual password expiration set on those local users. I have not tested this with AD (not sure if this also works if the accounts live in AD - I only tested with ISE internal user accounts)
Oh and, if you want to stop this password expiration stuff, then just untick the box "Disable user account after"
TACACS Username:bob
TACACS Password:
Authentication succeeded. Your password will expire in 1 weeks + 2 days + 23 hours + 49 Minutes
router01#
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-31-2019
02:24 AM
01-31-2019
02:24 AM
Hi @dgaikwad
That's an interesting observation. Here's the deal. If you're only checking for BYODRegistration in your AuthZ rules, then the client will always authenticate, as long as the certificate is valid (I am assuming this is cert based BYOD ... )
In most implementations you should provide a MyDevicesPortal for the BYOD users so that they can manage their endpoints. If they report a device "Lost" then the Endpoint is removed from Registered Endpoints and your AuthZ rules should check for that and redirect the user to a web page telling them the device is reported Lost. When user finds device again, he can re-instate the device in the MyDevicesPortal and then he is back in business.
If they report the device as stolen, then the Endpoint is also deleted, but you cannot re-instate it on the Portal. That means that this device needs to onboard again. In that case the AuthZ rule should also catch this.
Blacklisting is another case - if Endpoints are blacklisted then the appropriate AuthZ rule should redirect them to a web page telling them they have been barred.
What I am trying to illustrate is that the existence of the Endpoint in various Endpoint Identity Groups is a far more useful indicator of the current status of the client. The BYODRegistration is an OVERALL status indicator that simply tells ISE that this client went through BYOD onboarding once upon a time. it's a special attribute for BYOD status.
I would recommend watching the BYOD series of videos from www.labminutes.com - that guy explains all this very well with nice examples too.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-29-2019
04:02 PM
01-29-2019
04:02 PM
You can use the default self-signed ISE cert for the EAP role. But I would still create a new CSR for a self-signed cert and make it valid for 5 years or so. Because out of the box, ISE certs are only valid for 1 year. Just do it now and save yourself the toruble later on. Remember that the EAP cert can be handled separately from the other roles like Admin, Web Portals etc. Creating a new EAP cert won't restart any services.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-29-2019
02:09 PM
01-29-2019
02:09 PM
Hi @bberry
It's not an issue. if you type https://ise-admin.corp.com into your browser because that is a host in your SAN's *.corp.com wildcard SAN field, then all will be well. The FQDN doesn't re-write itself to ise01.net.local or whatever. But at the network layer, DNS has figured out that you need to build a TCP connection to 172.16.1.1 (your ISE node) and that's what happens. The FQDN entered into the browser is not directly related to the eventual IP address.
If that thought fills you with dread, then you can always create a self-signed ISE wildcard cert and then install that on each node for the Admin role. I have done this for some customer too, while they wait for the Public CA cert for EAP and Guest Web Portals etc. It means that your ISE admins get a browser warning when they connect to https://ise01.net.local but that's pretty acceptable these days for internal tools.
... View more
Created by
Arne Bier
in Wireless Security and Network Management
Arne Bier
in Wireless Security and Network Management
01-29-2019
02:44 AM
01-29-2019
02:44 AM
You can create a totally new VLAN just for guests and ensure that this is the Interface Group/VLAN that unauthenticated users get placed into when they associate with your open SSID (Guest). The WLC will send Radius requests to ISE via the managament VLAN and this will arrive at Gig0 on the ISE node (ISE listens to Radius/TACACS on all active interfaces). And then the security advice I can give you is that you host your guest portal on a different ISE interface - e.g. Gig1. This is easily done from the ISE GUI when you create the portal. This means that ISE won't listen on tcp/443&8443 on Gig0 - hence, guests won't be able to attack your ISE node kill your managment interface. Of course if you're not careful, they can still DOS ISE on Gig1. But you should be very restrictive in your Cisco WLC ACL's for portal user roles, and authenticated user roles. Portal users should only be allowed to perform DNS queries and talk tcp/8443 to ISE. Be as explicity as you can and even nail down the exact DNS servers in your ACLs!
For authenticated users you allow DNS, ISE and then block RFC1918 addresses, and finally, allow all the rest. That should ensure that Guests only get to internet. If you have a web proxy in your design, then the rule is a bit different - you don't allow all, but you simply allow all traffic to the proxy only, and then block the rest.
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-28-2019
09:43 PM
01-28-2019
09:43 PM
I am moving this topic because I had intended to create it under the Security/ISE category.
Labels:
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-28-2019
09:04 PM
01-28-2019
09:04 PM
The ise node FQDN that is configured on the node CLI does not have to match what is displayed in the certificate SAN. You can have a DNS CNAME entry that points to the real A PRT record.
e.g.
Your ISE node CLI says: ise01.internal.net
But the cert says: ise01.mycompany.com
Then this is not a problem if your DNS is setup correctly.
DNS records:
ise01.mycompany.com CNAME ise01.internal.net
ise01.internal.net A 192.168.1.2
Hostname resolution finally resolves to an IP address, which is then used for the TCP connection establishment. You can abstract the ise node name from the FQDN in the certificate.
e.g. quick test below in the lab
[admin-biera@iptel-centos-01 ~]$ nslookup arneise.milton.iptel.com.au
arneise.milton.iptel.com.au canonical name = ise01.net.local.
Name: ise01.net.local
Address: 172.16.1.1
... View more
Created by
Arne Bier
in Policy and Access
Arne Bier
in Policy and Access
01-26-2019
01:16 AM
01-26-2019
01:16 AM
Yes you can use public CA cert for everything. Wildcard certs are more expensve upfront but worth it. Just don’t put wildcard in the Subject CN! That will break Windows supplicant. Put the wildcard in the SAN only.
... View more
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
Good question. I am wondering why this even happens in the first place.
Strange that it only happens...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
Just out of interest, when you return an Authorization Profile
containing the Idle-Timeout value, do...
yesterday
the first place to look is in ISE under LiveLogs (or in Reports) to see
why ISE had to fail the auth...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
I hear what you're saying - it would be handy to be able to retrieve the
contents of the "show appli...
yesterday
Check with the ISE PM what their plans are to have ISE 2.4 run on the
newer hardware. My understandi...
yesterday
Yeah - it's easiest via the CIMC CLI ssh to the CIMC and then change the
scope to /cimc/power-restor...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
What Paul says is true but only if you are using the Endpoint Identity
Group as an Authorization rul...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
throwing something out there ... non Cisco phone means no CDP. I have a
vague recollection about CDP...
yesterday
On a VM you should be able to create a user defined MAC address in the
vNIC, but in ISE hardware app...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
Sadly impossible. Only one host/ip allowed. Cisco might tell you to use
DNS instead. Perhaps point t...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
Installing System certs can be done in two ways (this applies to any
device that requires a system c...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
sounds bizarre. I have never seen this before. That might be a 2.3
"feature" .. if you know what I m...
yesterday
The license count will decrease when the NAS sends a Radius accounting
stop for the sessions that we...
Created by
Arne Bier
in Identity Services Engine (ISE)
yesterday
yesterday
ISE doesn't purge endpoints unless you manually delete them or run a
Purge job based on certain crit...
Created by
Arne Bier
in Policy and Access
Tuesday
Tuesday
Hey @bern81 - thanks for the feedback. I am glad I am not alone in this
boat. There will always be s...
Public Statistics
| Date Registered | 02-23-2017 06:57 PM |
| Date Last Visited | 03-21-2019 05:22 AM |
| Total Messages Posted | 1,024 |
| Total Helpful Votes Received | 1059 |
Helpful Votes Given To
Helpful Votes From
Awards
Cisco Designated VIPs
2019 ISE
