iPSK and Anchored SSIDs

[KevinR99]

Hi

I'm testing iPSK with ISE.  I can get it working on a single controller.  Depending on the device and the endpoint group it's in I assign a PSK and a vlan and it works fine.  Now I want to do the same but with an anchor controller.

From doing anchored setups previously without iPSK I know the SSIDs need to be the same.  However, as I understand, the Foreign controller that manages the AP handles the iPSK/ISE part.  Without iPSK/MAB/ISE I can anchor the client to the anchor controller successfully but using iPSK/MAB/ISE it fails to connect and gives an incorrect PSK message.  The client is then put in the exclusion list.  When I look at the ISE logs the request is indeed coming from my foreign controller but it is successful and I can see the PSK it returns which matches the one I put on the client.

 I have the SSIDs configured the same but although I point the Anchor SSID to ISE for MAB that WLC doesn't contact ISE as expected.  It is the foreign controller that does.

Anyone done this type of setup before? 

Thanks, Kev.

[Scott Fella]

I don't think that will work and or supported.  You are authenticating from the foreign controller which would not pass that info to the anchor controller.  I think you have discovered this already.  Search the forum as other have already ran into this and from what I have seen, there has not been a solution.  You can always open a TAC case too just to see what they say.

Search, "cisco iPSK Anchor controller" to find other forum posts and guides which do not show configurations for a foreign anchor setup.

[KevinR99]

Thanks Scott.  This is what I suspected.  For this to work the foreign controller, which does the iPSK/ISE part and gets the vlan assignment from ISE, would need to pass that info to the Anchor to act on.  However, all that I believe is passed to the Anchor is client info and the SSID they connect to.  The Anchor then attaches them to the interface their SSID is attached to and the client gets an IP address based on that.  It has no way of knowing the VLAN supplied in the radius response from ISE to Foreign controller.

mPSK doesn't provide enough functionality to do what we need to do.  Nor does it allow us to put the different clients with different PSK's onto different vlans.

Thanks for your input, Kev.

[Scott Fella]

I understand, didn’t really know what you were trying to accomplish. The foreign and anchor as you know was really for guest but later folks started to use psk also. Is there a reason why you want to use an anchor? You could probably just use a foreign controller and then use vrfs to send the traffic to the location you want. Just thinking out loud.

[Scott Fella]

If you have 9800's you can try using mPSK, this doesn't use ISE.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/ewc/17-2/config-guide/ewc_cg_17_2/multi_preshared_key.html

[Haydn Andrews]

really wish Cisco would just implement MPSK with ability for the WLC to assign the VLAN based on the PSK provided and get rid of the iPSK requirement of each mac needing to be in ISE.

[Rich R]

@Haydn Andrews they did - it's called EasyPSK - but ..... it was initially publicised in the release notes and then when we started asking about it it got removed from (almost) all available documentation but the feature is there, and supported, from IOS-XE 17.5.1 up.  The reason for "hiding" it is apparently because they developed it specifically for a single customer who gained exclusive rights over the feature for a few years! So no change/update/improvement can be made to the feature until the contract with that customer expires.  The feature is only supported on local mode APs - it is not supported at all on an AP in flexconnect mode!  We were forced to use another vendor which has this feature for a large project because Cisco could not/would not consider supporting it on flex.  At least one wireless platform provider already supports the Cisco solution in their radius key matching service and has a setup guide for it (in fact they alerted us to the feature when the Cisco account team didn't).

[handrews4]

You seen anything on what is needed on the RADIUS side?

[Rich R]

The WLC config guide is at: https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-6/config-guide/b_wl_17_6_cg/m_epsk.html
No, we didn't set the radius up ourselves - we tested it with the Eleven service. Their config guides:
ElevenOS Setup: https://eleven.zendesk.com/hc/en-us/articles/360058743511
9800 Setup: https://eleven.zendesk.com/hc/en-us/articles/4407461199501
PPK-C EKMS New Resident Onboarding Flow: https://eleven.zendesk.com/hc/en-us/articles/4408023532813

[KevinR99]

The config guide linked to in the response just does the WLC which is pretty straight forward.  Enable Easy-PSK and use MAC filtering to point it to your radius server.  The radius server seems to be the significant part here.  What do we configure on the ISE to then return a vlan to the client based on the PSK they enter?  I thought Easy-PSK was going to allow us to onboard unknown clients.  The way I have it setup just now is pretty much like iPSK.  A MAB is done for a client and based on some info from that client I return a PSK.  So I took the 1st part of the MAC and matched it to a vendor.  Then I returned a vlan and PSK.  However, I thought the point of this was not needing to know the client or their MAC beforehand.  Depending on the PSK the client submits I thought we could get the ISE to return a vlan.  So I issue PSK-1 to company A.  They use that, a MAB request is done and based on the provided PSK I return the vlan.  No previous knowledge of the client or the vendor of their device.  I can then issue further PSK's do different companies and when they use their key they get a different vlan.  Is that how Easy-PSK is supposed to work ?

What do we match on in the radius rule to then return a vlan (and PSK) to the WLC/client?

[casanavep]

EasyPSK works and I have been using it for nearly a year now.  The problem is the need for something other than ISE to handle the dynamic registration MAC addresses to user IDs and to enforce PSK uniqueness.  There are third-party radius products that can do this when integrated with Cisco IOS-XE 17.6+ based controllers.

[Rich R]

@casanavep I already mentioned the service we tested it with above (Eleven).

As far as I know Cisco don't natively support the solution on ISE and if they do it's not documented anywhere.  As I said above I don't believe the customer they developed it for was using it with ISE so Cisco probably never tested it with ISE, only with the customer's 3rd party platform.

[Rich R]

Yes your understanding of the feature is correct.

I've not used ISE for radius before (only TACACS) and because Cisco are keeping this feature low profile they don't seem to have documented it either.  I suspect the client they did this for wasn't using ISE either.

So I guess look at what options you have which you could use.  We often use the NAS-ID as an arbitrary field which we can use for identifying different types of clients so maybe try using that?  I don't know whether ISE will let you do that but I know Free Radius will.

[handrews4]

Cisco ISE cant do it. It was done for a single client using a 3rd party radius server. Requested why ISE cant do it and had crickets from the SEs and AMs at Cisco

[Rich R]

As I explained earlier in the thread!  They're in an exclusive contract with the customer they developed it for and will not make any changes or development for the feature for anybody else for the duration of that contract.  And as with any such agreement, they will not discuss the details with other customers.  Your AM and SE's hands are tied - there's nothing they can do or say about it.

Now you could have a separate discussion about poor decision making/bad choices by the WNBU...  I have expressed my views on that to AM's and SE's a number of times already.   I think it's one of those embarrassing things they can't talk about because it will only make a bad situation worse.