Purpose
This document details the steps for using ISE to authenticate eduroam users.
Three rules cover the authentication scenarios which will be encountered:
Rule 1 : User is not a member of the home institution. Authentication will be proxied to eduroam RADIUS Servers.
Rule 2 : User is a member of the home institution but is located at another institution. Authentication will be sourced from the eduroam RADIUS Servers.
Rule 3 : User is a member of the home institution and the request will be sourced locally.
Regarding authorization, we are simply aiming for PermitAccess, but will break the Authorization rules down to give granularity to the reporting.
Prerequisites
eduroam
Register the IP Addresses of your Policy Service Nodes as AAA Servers with eduroam.
Wireless LAN Controller
On all Wireless LAN Controllers (WLC) configured to offer the SSID 'eduroam' to AP Groups, make sure that WLAN ID is the same on all WLCs and that all ISE Policy Service Nodes (PSN) are being used for authentication.
Policy Sets
This guide shows the configuration of eduroam with the use of Policy Sets. ISE 2.3 uses Policy Sets by default and they cannot be turned off. If you are currently not using them, the configuration can be done without the use of Policy Sets. If you would like to enable Policy Sets, navigate to Administration > System > Settings > Policy Sets. Select Enabled and Save.
You will be logged out of ISE. Once you log back in, you will notice the Policy menu is different. There is an option for Policy Sets while the Authentication and Authorization entries are no longer there. Any policies you had already created are in the Default Policy Set.
Active Directory
ISE needs to be joined to your Active Directory Domain to authenticate local users. Of course you can use any of the Identity Sources supported by ISE, but for this document we will focus on Active Directory (AD).
If you have not already joined ISE to you Active Directory Domain, do so now by navigating to Administration > Identity Management > External Identity Sources > Active Directory.
Create a service account in AD and use it to create a connection to your AD Domain.
eduroam Configuration
Add eduroam RADIUS servers
Eduroam External User Server Setup
In this step, we will configure the external eduraom RADIUS Servers to which ISE will authenticate users that are visiting the Home Institution. First, navigate to Administration > Network Resources > External RADIUS sources.
Configure each of the eduroam RADIUS Servers which will be used for authenticating users from external realms. The specific IP Address and Shared Secret will be provided to you by eduroam. You can name these entries however you would like.
Then, navigate to Administration > Network Resources > Network Device List > RADIUS Server Sequences.
This is where you create a sequence which lists the access order of the external eduroam RADIUS servers.
From here, select the Advanced Attribute Settings tab and enable the
On Access-Accept, continue to Authorization Policy checkbox, then click Save.
Eduroam Internal User Server Setup
Now we will configure the access for internal users that are visiting a different eduroam member Institution. Navigate to Administration > Network Resources > Network Device Groups.
Under All Device Types, create a group for the eduroam RADIUS Servers and for your Wireless Controllers. In the figure below they are named 'eduroam' and 'WLC' accordingly.
The Network Device Groups page view in ISE 2.2 and below
The Network Device Groups page view in ISE 2.3 and above
Now that the groups are created, go to Administration > Network Resources > Network Devices to add the eduroam RADIUS Servers and Wireless Controllers to ISE.
Remember to ensure your WLCs are part of the group WLC, and the eduroam RADIUS Servers servers are part of the Eduroam group. This is done in the Network Device Group section.
Create the eduroam Policy Conditions
Authentication Conditions
This step will create the conditions used to authenticate through the eduroam system while keeping your Authentication Policy clean. Navigate to Policy > Policy Elements > Conditions > Library Conditions.
Create a new condition, eg: 'Eduroam_User_External', this will be used to identify RADIUS requests that need to be handed off to the eduroam RADIUS Servers. In the event of receiving just a username we want to be able to handle that. We will make the assumption that such a user belongs to our own AD. As such we need to ensure that a 'foreign' username does not contain our realm but does contain the '@' symbol which we will infer means an alternative domain is provided.
Configure the following attributes:
Radius: User-Name NOT ENDS WITH @<your_domain> AND
Radius: User-Name CONTAINS @ AND
Radius: Service-Type EQUALS Framed AND
Radius: NAS-Port-Type EQUALS Wireless – IEEE 802.11
Click Save and save it as Eduroam_User_External.
Create another condition 'Eduroam_User_Traveling' similar to the condition created above, but without the User-Name element. Since this condition will be used to identify eduroam traffic that must be sent to the eduroam RADIUS Servers, we will include a check for the WLAN-ID (this document uses WLAN ID of 6, please ensure you are using the WLAN ID that corresponds to your eduroam SSID):
Radius: Service-Type EQUALS Framed AND
Radius: NAS-Port-Type EQUALS Wireless – IEEE 802.11 AND
Airespace: Airespace-Wlan EQUALS 6
Authorization Condition
This step will create the conditions used to authorize local users at their Home Institution through the eduroam system while keeping your Authorization Policy clean. Stay at Policy > Policy Elements > Conditions > Library Conditions
Identify Authorization requests coming from the eduroam SSID and check the user names against AD. Name it 'Eduroam_User_Local':
Radius: Service-Type EQUALS Framed AND
Radius: NAS-Port-Type EQUALS Wireless – IEEE 802.11 AND
Airespace: Airespace-Wlan EQUALS 6
AD1:ExternalGroups EQUALS <your_domain>/Users/Domain Users
Create the eduroam Policy Sets
ISE introduced a new Policy Engine in version 2.3 and with that came changes to how RADIUS Proxy Sequences are used for authentication. Because of this change in behavior, this guide will break the Policy Sets section into sections detailing the configurations necessary for versions 2.2 and lower as well as 2.3 and above.
ISE Policy Sets in versions 2.2 and below
Navigate to Policy > Policy Sets and create a new Policy Set named 'Eduroam Wireless'
Set the Policy Set filter as:
Airespace:Airespace-Wlan-Id EQUALS 6 OR
Radius:Called-Station-ID ENDS WITH eduroam OR
DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam
Authentication Policy
Create three rules to handle the different authentication directions: inbound, outbound, and local.
Name
If
Allow Protocols
Default
Eduroam External User
Eduroam_User_External
Use Proxy Service: Eduroam
Eduroam Traveling User
DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam
PEAP-Auth
AD1
Eduroam Local User
Airespace:Airespace-Wlan_Id EQUALS 6 OR Radius:Called-Station-ID ENDS WITH eduroam
PEAP-Auth
AD1
Authorization Policy
Create two rules to handle the different authorization methods: external and local.
Rule Name
Conditions
Permissions
Eduroam External
DEVICE:Device Type EQUALS All Device Types#Eduroam
GUEST-ACCESS
Eduroam Local
Eduroam_User_Local
GUEST-ACCESS
ISE Policy Sets in versions 2.3 and newer
Eduroam External Users
Navigate to Policy > Policy Sets and create a new Policy Set named 'Eduroam External Users'
Set the Policy Set filter as:
Airespace:Airespace-Wlan-Id EQUALS 6 OR
Radius:Called-Station-ID ENDS WITH eduroam OR
DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam
The reason we need to create two separate Policy Sets is that in ISE 2.3 and above, the RADIUS Proxy Sequence is selected at the same top level filter as the Allowed Protocols. Since we are choosing the RADIUS Proxy Sequence, we cannot also choose an Allowed Protocol to be used by the same Policy Set.
Authentication Policy
The Eduroam External Users can use the Default Authentication Policy since this will be handled by the Proxy Sequence.
Authorization Policy
Create a rules to handle the external authorization.
Rule Name
Conditions
Permissions
Eduroam External
DEVICE:Device Type EQUALS All Device Types#Eduroam
GUEST-ACCESS
Eduroam Internal Users
Set the Policy Set filter as:
Airespace:Airespace-Wlan-Id EQUALS 6 OR
Radius:Called-Station-ID ENDS WITH eduroam OR
DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam
Authentication Policy
Create two rules to handle the different authentication directions: inbound, and local.
Name
If
Allow Protocols
Default
Eduroam Traveling User
DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam
PEAP-Auth
AD1
Eduroam Local User
Airespace:Airespace-Wlan_Id EQUALS 6 OR Radius:Called-Station-ID ENDS WITH eduroam
PEAP-Auth
AD1
Authorization Policy
Create two rules to handle the different authorization methods: external and local.
Rule Name
Conditions
Permissions
Eduroam External
DEVICE:Device Type EQUALS All Device Types#Eduroam
GUEST-ACCESS
Eduroam Local
Eduroam_User_Local
GUEST-ACCESS
References
Configuring eduroam on Cisco Identity Services Engine (ISE) 2.1
Configuring Eduroam on Cisco ISE 1.4
Eduroam Wiki
Operator-Name on Cisco ISE 2
... View more
