Cisco-AP-Aironet-3800 Device Profile ... View more

Cisco-AP-Aironet-2800 Device Profile ... View more

This will be a short document, but since I have a lot of people asking about the contents, I assume that there are others that could benefit from an easy to read matrix for this. The question is "If I have ISE version X, can I upgrade to version X.X directly?" ***EDIT: Remember, this is the same matrix to use to know if you can restore a backup from a previous version to a newer. This table shows the starting version and to which newer versions can be directly upgraded Upgrade From Latest Version to Directly Upgrade Patch Required on Orig Version? 1.2* 1.4* 14 1.2.1* 1.4* 5 1.3* 2.1 1.4* 2.2 2.0 2.4 2.0.1 2.4 2.1 2.4 2.2 2.4 2.3 2.4 This table shows the desired version and from which older versions can be directly upgraded Upgrade To Minimum Version to Directly Upgrade 2.0 1.3* 2.0.1 1.3* 2.1 1.3* 2.2 1.4* 2.3 2.0 2.4 2.0 *Denotes EoL (End of Life) versions and the recommendation is to upgrade to a current, supported version. I kept version 1.2 in the Matrix to show that keeping an older version well beyond its designated End of Life date can lead to complexities in upgrading later on.  In this case, 1.2 would have to be upgraded to 1.4, then to 2.1 and finally 2.3 to get to the latest version of ISE.  1.2.1 would be the same. As you can see, the supported upgrades go back at least four versions, so if you or one of your customers are close to that threshold, it may be time to plan an upgrade.  Look at the new features offered in the more recent versions, read the ISE Community Page, and make an informed decision about which version is right for you. The information in the tables above can be found here: Cisco Identity Services Engine Upgrade Guide, Release 1.4 - Before You Begin [Cisco Identity Services Engine] - Cisco Cisco Identity Services Engine Upgrade Guide, Release 2.0 - Before You Begin [Cisco Identity Services Engine] - Cisco Cisco Identity Services Engine Upgrade Guide, Release 2.0.1 - Cisco ISE Upgrade Overview [Cisco Identity Services Engi… Cisco Identity Services Engine Upgrade Guide, Release 2.1 - Cisco ISE Upgrade Overview [Cisco Identity Services Engine… Cisco Identity Services Engine Upgrade Guide, Release 2.2 - Upgrade a Cisco ISE Deployment from the GUI [Cisco Identit… Cisco Identity Services Engine Upgrade Guide, Release 2.3 - Cisco ISE Upgrade Overview [Cisco Identity Services Engine]… End-of-Sale and End-of-Life Announcement for the Cisco Identity Services Engine Software Release 1.2 - Cisco Cisco Identity Services Engine Software Version 1.3 - Cisco Cisco Identity Services Engine Software Version 1.4 - Cisco ... View more

      Purpose This document details the steps for using ISE to authenticate eduroam users.   Three rules cover the authentication scenarios which will be encountered: Rule 1 : User is not a member of the home institution.   Authentication will be proxied to eduroam RADIUS Servers. Rule 2 : User is a member of the home institution but is located at another institution. Authentication will be sourced from the eduroam RADIUS Servers. Rule 3 : User is a member of the home institution and the request will be sourced locally.   Regarding authorization, we are simply aiming for PermitAccess, but will break the Authorization rules down to give granularity to the reporting.     Prerequisites   eduroam Register the IP Addresses of your Policy Service Nodes as AAA Servers with eduroam.   Wireless LAN Controller On all Wireless LAN Controllers (WLC) configured to offer the SSID 'eduroam' to AP Groups, make sure that WLAN ID is the same on all WLCs and that all ISE Policy Service Nodes (PSN) are being used for authentication.   Policy Sets This guide shows the configuration of eduroam with the use of Policy Sets.   ISE 2.3 uses Policy Sets by default and they cannot be turned off.  If you are currently not using them, the configuration can be done without the use of Policy Sets.    If you would like to enable Policy Sets, navigate to   Administration > System > Settings > Policy Sets. Select   Enabled   and   Save.     You will be logged out of ISE. Once you log back in, you will notice the Policy menu is different.    There is an option for Policy Sets while the Authentication and Authorization entries are no longer there.    Any policies you had already created are in the Default Policy Set.   Active Directory ISE needs to be joined to your Active Directory Domain to authenticate local users.   Of course you can use any of the Identity Sources supported by ISE, but for this document we will focus on Active Directory (AD).   If you have not already joined ISE to you Active Directory Domain, do so now by navigating to Administration > Identity Management > External Identity Sources > Active Directory. Create a service account in AD and use it to create a connection to your AD Domain. eduroam Configuration   Add eduroam RADIUS servers   Eduroam External User Server Setup In this step, we will configure the external eduraom RADIUS Servers to which ISE will authenticate users that are visiting the Home Institution.  First, navigate to Administration > Network Resources > External RADIUS sources.   Configure each of the eduroam RADIUS Servers which will be used for authenticating users from external realms. The specific IP Address and Shared Secret will be provided to you by eduroam.   You can name these entries however you would like. Then, navigate to Administration > Network Resources > Network Device List > RADIUS Server Sequences.   This is where you create a sequence which lists the access order of the external eduroam RADIUS servers.   From here, select the Advanced Attribute Settings tab and enable the    On Access-Accept, continue to Authorization Policy  checkbox, then click Save. Eduroam Internal User Server Setup Now we will configure the access for internal users that are visiting a different eduroam member Institution. Navigate to Administration > Network Resources > Network Device Groups.   Under All Device Types, create a group for the eduroam RADIUS Servers and for your Wireless Controllers. In the figure below they are named 'eduroam' and 'WLC' accordingly.   The Network Device Groups page view in ISE 2.2 and below   The Network Device Groups page view in ISE 2.3 and above Now that the groups are created, go to Administration > Network Resources > Network Devices to add the eduroam RADIUS Servers and Wireless Controllers to ISE. Remember to ensure your WLCs are part of the group WLC, and the eduroam RADIUS Servers servers are part of the Eduroam group.   This is done in the Network Device Group section.   Create the eduroam Policy Conditions   Authentication Conditions This step will create the conditions used to authenticate through the eduroam system while keeping your Authentication Policy clean.   Navigate to Policy > Policy Elements > Conditions > Library Conditions.   Create a new condition, eg: 'Eduroam_User_External', this will be used to identify RADIUS requests that need to be handed off to the eduroam RADIUS Servers. In the event of receiving just a username we want to be able to handle that. We will make the assumption that such a user belongs to our own AD. As such we need to ensure that a 'foreign' username does not contain our realm but does contain the '@' symbol which we will infer means an alternative domain is provided.   Configure the following attributes:   Radius: User-Name NOT ENDS WITH @<your_domain> AND Radius: User-Name CONTAINS @ AND Radius: Service-Type EQUALS Framed AND Radius: NAS-Port-Type EQUALS Wireless – IEEE 802.11 Click Save and save it as Eduroam_User_External.   Create another condition 'Eduroam_User_Traveling' similar to the condition created above, but without the User-Name element. Since this condition will be used to identify eduroam traffic that must be sent to the eduroam RADIUS Servers, we will include a check for the WLAN-ID (this document uses WLAN ID of 6, please ensure you are using the WLAN ID that corresponds to your eduroam SSID): Radius: Service-Type EQUALS Framed AND Radius: NAS-Port-Type EQUALS Wireless – IEEE 802.11 AND Airespace: Airespace-Wlan EQUALS 6 Authorization Condition This step will create the conditions used to authorize local users at their Home Institution through the eduroam system while keeping your Authorization Policy clean.   Stay at Policy > Policy Elements > Conditions > Library Conditions   Identify Authorization requests coming from the eduroam SSID and check the user names against AD. Name it 'Eduroam_User_Local':   Radius: Service-Type EQUALS Framed AND Radius: NAS-Port-Type EQUALS Wireless – IEEE 802.11 AND Airespace: Airespace-Wlan EQUALS 6 AD1:ExternalGroups EQUALS <your_domain>/Users/Domain Users   Create the eduroam Policy Sets ISE introduced a new Policy Engine in version 2.3 and with that came changes to how RADIUS Proxy Sequences are used for authentication.  Because of this change in behavior, this guide will break the Policy Sets section into sections detailing the configurations necessary for versions 2.2 and lower as well as 2.3 and above. ISE Policy Sets in versions 2.2 and below Navigate to   Policy > Policy Sets   and create a new Policy Set named 'Eduroam Wireless'   Set the Policy Set filter as: Airespace:Airespace-Wlan-Id EQUALS 6 OR Radius:Called-Station-ID ENDS WITH eduroam OR DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam   Authentication Policy   Create three rules to handle the different authentication directions: inbound, outbound, and local.           Name If Allow   Protocols Default Eduroam External User Eduroam_User_External Use Proxy Service: Eduroam Eduroam Traveling User DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam PEAP-Auth AD1 Eduroam Local User Airespace:Airespace-Wlan_Id EQUALS 6 OR Radius:Called-Station-ID ENDS WITH eduroam PEAP-Auth AD1   Authorization Policy Create two rules to handle the different authorization methods: external and local.   Rule Name Conditions Permissions Eduroam   External DEVICE:Device   Type EQUALS All Device Types#Eduroam GUEST-ACCESS Eduroam Local Eduroam_User_Local GUEST-ACCESS     ISE Policy Sets in versions 2.3 and newer Eduroam External Users   Navigate to Policy > Policy Sets and create a new Policy Set named 'Eduroam External Users'   Set the Policy Set filter as: Airespace:Airespace-Wlan-Id EQUALS 6 OR Radius:Called-Station-ID ENDS WITH eduroam OR DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam The reason we need to create two separate Policy Sets is that in ISE 2.3 and above, the RADIUS Proxy Sequence is selected at the same top level filter as the Allowed Protocols.  Since we are choosing the RADIUS Proxy Sequence, we cannot also choose an Allowed Protocol to be used by the same Policy Set.   Authentication Policy   The Eduroam External Users can use the Default Authentication Policy since this will be handled by the Proxy Sequence.   Authorization Policy   Create a rules to handle the external authorization.   Rule Name Conditions Permissions Eduroam External DEVICE:Device  Type EQUALS All Device Types#Eduroam GUEST-ACCESS   Eduroam Internal Users   Set the Policy Set filter as: Airespace:Airespace-Wlan-Id EQUALS 6 OR Radius:Called-Station-ID ENDS WITH eduroam OR DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam Authentication Policy   Create two rules to handle the different authentication directions: inbound, and local.           Name If Allow  Protocols Default Eduroam Traveling User DEVICE:Device Type EQUALS Device Type#All Device Types#Eduroam PEAP-Auth AD1 Eduroam Local User Airespace:Airespace-Wlan_Id EQUALS 6 OR Radius:Called-Station-ID ENDS WITH eduroam PEAP-Auth AD1     Authorization Policy Create two rules to handle the different authorization methods: external and local.   Rule Name Conditions Permissions Eduroam  External DEVICE:Device  Type EQUALS All Device Types#Eduroam GUEST-ACCESS Eduroam Local Eduroam_User_Local GUEST-ACCESS         References   Configuring eduroam on Cisco Identity Services Engine (ISE) 2.1 Configuring Eduroam on Cisco ISE 1.4 Eduroam Wiki Operator-Name on Cisco ISE 2 ... View more