BYOD Setup

[jain.manish94]

Hello team,

Can any one help me to setup BYOD using ISE from starting point by point.

Plz if any good documents.

[balaji.bandi]

start from here :

https://community.cisco.com/t5/security-documents/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867

https://community.cisco.com/t5/security-documents/ise-byod/ta-p/3641689

[jain.manish94]

what is the configuration from wlc end. 

in this link there is only ise configuration. 

[ammahend · Accepted solution]

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216535-configure-single-ssid-wireless-byod-on-w.html#anc12

hope this helps.

[jain.manish94]

can i use foreign and anchor setup on this. ?

i have two wlc one is my primary and second one is my anchor wlc. 

can i use this kind of setup if yes then what would be configuration and where need to be done. 

mean to say on primary or anchor wlc. ?

[ammahend]

I have not done it myself and can't find a document specifically for BYOD in Foreign-Anchor setup.

keep in mind that different people perceive BYOD in different ways, I have seen countless people call guest devices as BYOD (which is not incorrect)

In Cisco's terms, BYOD is when internal users bring their own devices and as organizations want to give flexibility to work and access internal resources on some well provisioned personal devices, that's why it involves certificate provisioning for these devices via ISE and integration with some form of MDM to ensure device check.

Guest is a different case and it makes sense to tunnel all traffic to Anchor in DMZ, because you don't want guest devices to access anything internal, not even DHCP or DNS, once tunnel to DMZ,  traffic can not come back in to inside (low to high) unless allowed explicitly and can only go out to internet (high to low).

So its important to know if you are planning to deploy BYOD or Guest with Anchor setup in DMZ.

if you are trying to do guest here is a link.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html

if you still plan to do BYOD with anchor setup, you can try the flow logic is still same. I haven't tried it myself yet.

hope this helps.