Allow only Corporate Mobile devices

[ittechk4u1]

Hello Experts,

Could you please tell me the way in which I can allow on corporate mobile devices to my wireless network to use internet access.

Corporate devices: Apple, Samsung,...windows phone..etc

Devices am using to provide WLAN: Cisco WLC, ISE, Cisco AP, CA server...etc

Thanks in advance

[Karsten Iwen]

If you already have the ISE (and a CA), then you can enroll all your corporate devices to either the ISE-CA or your internal CA. These devices connect to an SSID that is configured for 802.1x/EAP and get the right to use the internet assigned by the ISE. This can be done by assigning a VLAN and filtering upstream or by assigning an ACL that you have on the WLC.

For enrolling you could use the ISE internal BYOD workflow (if you have the proper licensing) or a mobile device management.

[ittechk4u1]

Thank you for reply! do you have any config guide of it ? If yes then please provide me.

[Karsten Iwen]

Well, there are tons of documents and in the end you probably need to go on an ISE-traiining or get some help from your cisco partner. But as a starting point, here are the design guide:

https://communities.cisco.com/docs/DOC-64012#jive_content_id_BYOD

[ittechk4u1]

Thank you. I will try to do as per the document and let you know the status.

[Sp@wn]

Hello Karsten,

How can I separate company mobile device and personal mobile device during BYOD process? I would like to grant access to vlan 10 for corporate mobile devices (android, ipad) and grant access to vlan 20 for personal mobile devices (android, ipad).

[patoberli]

You can do that by using an MDM solution and putting a trusted client certificate on the corp mobile devices and use this for authentication on the ISE. So devices with a valid corporate certificate get policy 10 and the others get policy 20.

[Sp@wn]

Yes you are right but we don't have MDM device.

[patoberli]

Then you don't have many options. You somehow need to be able to differentiate the devices, the best and most secure way to do this, is with an MDM solution.