Cisco Identity Services Engine User Guide, Release 1.2
Managing Network Devices
Downloads: This chapterpdf (PDF - 634.0KB) The complete bookPDF (PDF - 16.6MB) | Feedback

Table of Contents

Managing Network Device s

N etwork D evice s Definitions in Cisco ISE

Default Network Device Definition in Cisco ISE

Creating a Network Device Definition in Cisco ISE

Importing Network Devices into Cisco ISE

Exporting Network Devices from Cisco ISE

Network Device Groups

Network Device Attributes Used By Cisco ISE in Policy Evaluation

Importing Network Device Groups in to Cisco ISE

Exporting Network Device Groups from Cisco ISE

Import Templates in Cisco ISE

Network Devices Import Template Format

Network Device Groups Import Template Format

Mobile Device Manager Interoperability with Cisco ISE

Supported MDM Use Cases

Supported MDM Servers

Ports Used by the MDM Server

MDM Dictionary Attributes

MDM Integration Process Flow

Setting Up MDM Servers With Cisco ISE

Importing MDM Server Certificate into Cisco ISE

Creating Mobile Device Manager Definitions

Configuring an Authorization Profile for Redirecting Nonregistered Devices

Configuring Authorization Policy Rules for the MDM Use Cases

Wiping or Locking a Device

Viewing Mobile Device Manager Reports

Viewing Mobile Device Manager Logs

Network Devices Definitions in Cisco ISE

A network device such as a switch or a router is an authentication, authorization, and accounting (AAA) client through which AAA service requests are sent to Cisco ISE. You must define network devices for Cisco ISE to interact with the network devices. You can configure network devices for RADIUS authentication, Simple Network Management Protocol for the Profiling service to collect Cisco Discovery Protocol and Link Layer Discovery Protocol attributes for profiling endpoints, and Security Group Access (SGA) attributes for SGA devices. A network device that is not defined in Cisco ISE cannot receive AAA services from Cisco ISE.

In the network device definition:

  • You can configure the RADIUS protocol for RADIUS authentications. When Cisco ISE receives a RADIUS request from a network device, it looks for the corresponding device definition to retrieve the shared secret that is configured. If it finds the device definition, it obtains the shared secret that is configured on the device and matches it against the shared secret in the request to authenticate access. If the shared secrets match, network access is granted. A passed authentication report is generated. If they do not match, a reject response is sent to the network device. A failed authentication report is generated, which provides the failure reason.
  • You can configure the Simple Network Management Protocol (SNMP) in the network device definition for the Profiling service to communicate with the network devices and profile endpoints that are connected to the network devices.
  • You must define Security Group Access (SGA)-enabled devices in Cisco ISE to process requests from SGA-enabled devices that can be part of the Cisco SGA solution. Any switch that supports the Security Group Access solution is an SGA-enabled device.

SGA devices do not use the IP address. Instead, you must define other settings so that SGA devices can communicate with Cisco ISE.

SGA-enabled devices use the Security Group Access attributes to communicate with Cisco ISE. SGA-enabled devices, such as the Nexus 7000 series switches, Catalyst 6000 series switches, Catalyst 4000 series switches, and Catalyst 3000 series switches are authenticated using the SGA attributes that you define while adding SGA devices.

Related topics

Default Network Device Definition in Cisco ISE

Cisco ISE supports the default device definition for RADIUS authentications. You can define a default network device that Cisco ISE can use if it does not find a device definition for a particular IP address. This feature enables you to define a default RADIUS shared secret and the level of access for newly provisioned devices.

Cisco ISE looks for the corresponding device definition to retrieve the shared secret that is configured in the network device definition when it receives a RADIUS request from a network device.

Cisco ISE performs the following procedure when a RADIUS request is received:

1. Looks for a specific IP address that matches the one in the request.

2. Looks up the ranges to see if the IP address in the request falls within the range that is specified.

3. If both step 1 and 2 fail, it uses the default device definition (if defined) to process the request.

Cisco ISE obtains the shared secret that is configured in the device definition for that device and matches it against the shared secret in the RADIUS request to authenticate access. If no device definitions are found, Cisco ISE obtains the shared secret from the default network device definition and processes the RADIUS request.

Related Topics

When an endpoint performs MAB using Password Authentication Protocol (PAP) and the default network device is configured in Cisco ISE, there is a security risk that any network access Device (NAD) can be used to connect the endpoint to the network. We recommend MAB using EAP-MD5 for such cases to increase protection. EAP-MD5 obligates the usage of Message-Authentication RADIUS attribute that will cause incoming RADIUS MAB request dropping in case of wrong shared secret configured in Cisco ISE.

Creating a Network Device Definition in Cisco ISE

You can create a network device definition in Cisco ISE and use the default network device definition when there is no network device definition in Cisco ISE.

A network device definition must include the following:

• Device name

  • IP address and subnet mask
  • Model name (Optional)
  • Version name (Optional)
  • Network device group by location and device type
  • Authentication settings
  • SNMP settings
  • Security Group Access attributes settings

Step 1 Choose Administration > Network Resources > Network Devices .

Step 2 Click Add .

Step 3 Enter the name and description of the network device that you want to add.

Step 4 Enter a single IP address and a subnet mask.

Step 5 Click the arrow next to the Model Name drop-down list to choose the network device model.

Step 6 Click the arrow next to the Software Version drop-down list to choose the Cisco Internetwork Operating System (Cisco IOS) version.

Step 7 Choose the Network Device Group from the Location drop-down list and the Device Type drop-down list.

Step 8 Check the Authentication Settings check box to configure the RADIUS protocol for authentication.

Step 9 Check the SNMP Settings check box to configure the Simple Network Management Protocol for the Profiling service to collect device information.

Step 10 Check the Advanced Trustsec Settings check box to configure an SGA-enabled device.

Step 11 Click Submit .


 

Related Topics

Importing Network Devices into Cisco ISE

You can import a list of device definitions into a Cisco ISE node using a comma-separated value (CSV) file. You must first update the imported template before you can import network devices into Cisco ISE. You cannot run an import of the same resource type at the same time. For example, you cannot concurrently import network devices from two different import files.

You can download the CSV template from the Admin portal, enter your device definition details in the template, and save it as a CSV file, which you can then import this back in to Cisco ISE.

While importing devices, you can create new records or update existing records. Cisco ISE displays the summary of the number of devices that are imported and also reports any errors that were found during the import process. When you import devices, you can also define whether you want Cisco ISE to overwrite the existing device definitions with the new definitions or stop the import process when Cisco ISE encounters the first error.

You cannot import network devices in Cisco ISE, Release 1.2 that are exported in previous Cisco ISE, Releases 1.1 and 1.1.x as the import template for these releases are different.


Step 1 Choose Administration > Network Resources > Network Devices .

Step 2 Click Import .

Step 3 Click Browse to choose the CSV file from the system that is running the client browser.

Step 4 Check the Overwrite Existing Data with New Data check box.

Step 5 Check the Stop Import on First Error check box.

Step 6 Click Import .


 

Related Topics

Exporting Network Devices from Cisco ISE

You can export network devices configured in Cisco ISE in the form of a CSV file that you can use to import these network devices into another Cisco ISE node.


Step 1 Choose Administration > Network Resources > Network Devices .

Step 2 Click Export .

Step 3 To export network devices, you can do one of the following:

    • Check the check boxes next to the devices that you want to export, and choose Export > Export Selected .
    • Choose Export > Export All to export all the network devices that are defined.

Step 4 Save the export.csv file to your local hard disk.


 

Related Topics

Importing Network Devices into Cisco ISE

Network Device Groups

Cisco ISE allows you to create hierarchical Network Device Groups (NDGs) that contain network devices. NDGs logically group network devices based on various criteria such as geographic location, device type, and the relative place in the network (like “Access Layer” or “Data Center,” for example).

For example, to organize your network devices by geographic location, you can group them by continent, region, and country:

  • Africa -> Southern -> Namibia
  • Africa -> Southern -> South Africa
  • Africa -> Southern -> Botswana

You can also group network devices by device type:

  • Africa -> Southern -> Botswana -> Firewalls
  • Africa -> Southern -> Botswana -> Routers
  • Africa -> Southern -> Botswana -> Switches

Network devices can be assigned to one or more hierarchical NDGs. Thus, when Cisco ISE passes through the ordered list of configured NDGs to determine the appropriate group to assign to a particular device, it may find that the same device profile applies to multiple Device Groups, and will apply the first Device Group matched.

Root Network Device Groups

Cisco ISE includes two predefined root NDGs: All Device Types and All Locations. You cannot edit, duplicate, or delete these predefined NDGs, but you can add new device groups under them.

You can also create a root Network Device Group (NDG), and then create child NDGs under the root group in the Network Device Groups page. When you create a new root NDG, you must provide the name and type of the NDG. This information is not required when you create a child under the root NDG.

Related Topics

Network Device Group Settings

Network Device Attributes Used By Cisco ISE in Policy Evaluation

When you create a new network device group, a new network device attribute is added to the Device dictionary defined in the system, which you can use in policy definitions. Cisco ISE allows you to configure authentication and authorization policies based on Device dictionary attributes, such as device type, location, model name, and software version that is running on the network device.

Related Topics

System Defined Dictionaries and Dictionary Attributes

Importing Network Device Groups in to Cisco ISE

You can import network device groups in to a Cisco ISE node using a comma-separated value (CSV) file. You cannot run import of the same resource type at the same time. For example, you cannot concurrently import network device groups from two different import files.

You can download the CSV template from the Admin portal, enter your device group details in the template, and save the template as a CSV file, which you can then import back into Cisco ISE.

While importing device groups, you can create new records or update existing records. When you import device groups, you can also define whether you want Cisco ISE to overwrite the existing device groups with the new groups or stop the import process when Cisco ISE encounters the first error.


Step 1 Choose Administration > Network Resources > Network Device Groups > Groups .

Step 2 Click Import .

Step 3 Click Browse to choose the CSV file from the system that is running the client browser.

Step 4 Check the Overwrite Existing Data with New Data check box.

Step 5 Check the Stop Import on First Error check box.

Step 6 Click Import or click the Network Device Groups List link to return to the Network Device Groups list page.


 

Related Topics

Exporting Network Device Groups from Cisco ISE

You can export network device groups configured in Cisco ISE in the form of a CSV file that you can use to import these network device groups into another Cisco ISE node.


Step 1 Choose Administration > Network Resources > Network Device Groups > Groups .

Step 2 To export the network device groups, you can do one of the following:

    • Check the check boxes next to the device groups that you want to export, and choose Export > Export Selected .
    • Choose Export > Export All to export all the network device groups that are defined.

Step 3 Save the export.csv file to your local hard disk.


 

Related Topics

Importing Network Device Groups in to Cisco ISE

Import Templates in Cisco ISE

Cisco ISE allows you to import a large number of network devices and network device groups using comma-separated value (CSV) files. The template contains a header row that defines the format of the fields. The header row should not be edited, and should be used as is.

By default, you can use the Generate a Template link to download a CSV file in the Microsoft Office Excel application and save the file format locally on your system. When you click the Generate a Template link, the Cisco ISE server displays the Opening template.csv dialog. This dialog allows you to open the template.csv file and save the template.csv file locally on your system with an appropriate name for network devices and network device groups. If you choose to open the template.csv file from the dialog, the file opens in the Microsoft Office Excel application by default.

Related Topics

Network Devices Import Template Format

Table 9-1 lists the fields in the template header and provides a description of the fields in the Network Device CSV file.

 

Table 9-1 CSV Template Fields and Description for Network Devices

Field
Description

Name:String(32):

(Required) This field is the network device name. It is an alphanumeric string, with a maximum of 32 characters in length.

Description:String(256)

This field is an optional description for the network device. A string, with a maximum of 256 characters in length.

IP Address:Subnets(a.b.c.d/m|...)

(Required) This field is the IP address and subnet mask of the network device. (It can take on more than one value separated by a pipe “|” symbol).

Model Name:String(32):

(Required) This field is the network device model name. It is a string, with a maximum of 32 characters in length.

Software Version:String(32):

(Required) This field is the network device software version. It is a string, with a maximum of 32 characters in length.

Network Device Groups:String(100):

(Required) This field should be an existing network device group. It can be a subgroup, but must include both the parent and subgroup separated by a space. It is a string, with a maximum of 100 characters, for example, Location#All Location#US

Authentication:Protocol:String(6)

This is an optional field. It is the protocol that you want to use for authentication. The only valid value is RADIUS (not case sensitive).

Authentication:Shared Secret:String(128)

(Required, if you enter a value for the Authentication Protocol field) This field is a string, with a maximum of 128 characters in length.

EnableKeyWrap:Boolean(true|false)

This is an optional field. It is enabled only when it is supported on the network device. Valid value is true or false.

EncryptionKey:String(ascii:16|hexa:32)

(Required, if you enable KeyWrap) Indicates the encryption key that is used for session encryption.

ASCII—16 characters (bytes) long

Hexadecimal—32 characters (bytes) long.

AuthenticationKey:String(ascii:20|hexa:40)

(Required, if you enable KeyWrap). Indicates the keyed Hashed Message Authentication Code (HMAC) calculation over RADIUS messages.

ASCII—20 characters (bytes) long

Hexadecimal—40 characters (bytes) long.

InputFormat:String(32)

Indicates encryption and authentication keys input format. Valid value is ASCII or Hexadecimal.

SNMP:Version:Enumeration (|2c|3)

This is an optional field, used by the Profiler service. It is the version of the SNMP protocol. Valid value is 1, 2c, or 3.

SNMP:RO Community:String(32)

(Required, if you enter a value for the SNMP Version field) SNMP Read Only community. It is a string, with a maximum of 32 characters in length.

SNMP:RW Community:String(32)

(Required, if you enter a value for the SNMP Version field) SNMP Read Write community. It is a string, with a maximum of 32 characters in length.

SNMP:Username:String(32)

This is an optional field. It is a string, with a maximum of 32 characters in length.

SNMP:Security Level:Enumeration(Auth|No Auth|Priv)

(Required if you choose SNMP version 3) Valid value is Auth, No Auth, or Priv.

SNMP:Authentication Protocol:Enumeration(MD5|SHA)

(Required if you have entered Auth or Priv for the SNMP security level) Valid value is MD5 or SHA.

SNMP:Authentication Password:String(32)

(Required if you have entered Auth for the SNMP security level) It is a string, with a maximum of 32 characters in length.

SNMP:Privacy Protocol:Enumeration(DES|AES128|AES192|AES256|3DES)

(Required if you have entered Priv for the SNMP security level) Valid value is DES, AES128, AES192, AES256, or 3DES.

SNMP:Privacy Password:String(32)

(Required if you have entered Priv for the SNMP security level) It is a string, with a maximum of 32 characters in length.

SNMP:Polling Interval:Integer:600-86400 seconds

This is an optional field to set the SNMP polling interval. Valid value is an integer between 600 and 86400.

SNMP:Is Link Trap Query:Boolean(true|false)

This is an optional field to enable or disable the SNMP link trap. Valid value is true or false.

SNMP:Is MAC Trap Query:Boolean(true|false)

This is an optional field to enable or disable the SNMP MAC trap. Valid value is true or false.

SNMP:Originating Policy Services Node:String(32)

This is an optional field. Indicates which ISE server to be used to poll for SNMP data. By default, it is automatic, but you can overwrite the setting by assigning different values.

SGA:Device Id:String(32)

This is an optional field. It is the security group access device ID, and is a string, with a maximum of 32 characters in length.

SGA:Device Password:String(256)

(Required if you have entered SGA device ID) This is the security group access device password and is a string, with a maximum of 256 characters in length.

SGA:Environment Data Download Interval:Integer:1-2147040000 seconds

This is an optional field. It is the security group access environment data download interval. Valid value is an integer between 1 and 24850.

SGA:Peer Authorization Policy Download Interval:Integer:1-2147040000 seconds

This is an optional field. It is the security group access peer authorization policy download interval. Valid value is an integer between 1 and 24850.

SGA:Reauthentication Interval:Integer:1-2147040000 seconds

This is an optional field. It is the security group access reauthentication interval. Valid value is an integer between 1 and 24850.

SGA:SGACL List Download Interval:Integer:1-2147040000 seconds

This is an optional field. It is the security group access SGACL list download interval. Valid value is an integer between 1 and 24850.

SGA:Is Other SGA Devices Trusted:Boolean(true|false)

This is an optional field. Indicates whether security group access is trusted. Valid value is true or false.

SGA:Notify this device about SGA configuration changes:String(ENABLE_ALL|DISABLE_ALL)

This is an optional field. Notifies SGA configuration changes to the SGA device. Valid value is ENABLE_ALL or DISABLE_ALL

SGA:Include this device when deploying Security Group Tag Mapping Updates:Boolean(true|false)

This is an optional field. It is the security group access device included on SGT. Valid value is true or false.

Deployment:Execution Mode Username:String(32)

This is an optional field. It is the username that has privileges to edit the device configuration. It is a string, with a maximum of 32 characters in length.

Deployment:Execution Mode Password:String(32)

This is an optional field. It is the device password and is a string, with a maximum of 32 characters in length.

Deployment:Enable Mode Password:String(32)

This is an optional field. It is the enable password of the device that would allow you to edit its configuration and is a string, with a maximum of 32 characters in length.

SGA:PAC issue date:Date

This is the field that displays the issuing date of the last SGA PAC that has been generated by Cisco ISE for the SGA device.

SGA:PAC expiration date:Date

This is the field that displays the expiration date of the last SGA PAC that has been generated by Cisco ISE for the SGA device.

SGA:PAC issued by:String

This is a field that displays the name of the issuer (an SGA administrator) of the last SGA PAC that has been generated by Cisco ISE for the SGA device. It is a string.

Network Device Groups Import Template Format

Table 9-2 lists the fields in the template header and provides a description of the fields in the Network Device Group CSV file.

 

Table 9-2 CSV Template Fields and Description for Network Device Groups

Field
Description

Name:String(100):

(Required) This field is the network device group name. It is a string with a maximum of 100 characters in length. The full name of an NDG can have a maximum of 100 characters in length. For example, if you are creating a subgroup India under the parent groups Global > Asia, then the full name of the NDG that you are creating would be Global#Asia#India and this full name cannot exceed 100 characters in length. If the full name of the NDG exceeds 100 characters in length, the NDG creation fails.

Description:String(1024)

This is an optional network device group description. It is a string, with a maximum of 1024 characters in length.

Type:String(64):

(Required) This field is the network device group type. It is a string, with a maximum of 64 characters in length.

Is Root:Boolean(true|false):

(Required) This is a field that determines if the specific network device group is a root group. Valid value is true or false.

Mobile Device Manager Interoperability with Cisco ISE

Mobile Device Management (MDM) servers secure, monitor, manage, and support mobile devices deployed across mobile operators, service providers, and enterprises. MDM servers consist of a policy server that controls the use of some applications on a mobile device (for example, an e-mail application) in the deployed environment. However, the network is the only entity that can provide granular access to endpoints based on ACLs, SGTs, etc. To do its job, Cisco ISE queries the MDM servers for the necessary device attributes to ensure it is then able to provide network access control for those devices.

Figure 9-1 MDM Interoperability with Cisco ISE

 

Table 9-3 lists the components that are used in the MDM setup.

 

Table 9-3 Components Used in the MDM Setup

Component
Specification

Cisco Identity Services Engine, Release 1.2

Any of the following: ISE 3315, 3355, 3395, 3415, 3495, or VMware

MDM Server

( Optional ) Certificate Authority Server

As per Microsoft specification (Windows 2008 R2 Enterprise SP2)

Wireless LAN Controller (WLC)

  • Hardware: 5500 Series, 2500 Series, WLSM-2
  • Software: Unified Wireless Network Software, Release 7.2

Mobile Devices

Devices supported by the MDM vendor. See Supported MDM Servers for a list of supported MDM vendors.

For example, Apple iOS 5.0 and higher, Google Android 2.3.

In Figure 9-1, Cisco ISE is the enforcement point while the MDM policy server is the policy information point. Cisco ISE obtains data from the MDM server to provide a complete solution.

You can configure Cisco ISE to interoperate with an external Mobile Device Manager (MDM) server. By setting up this type of third-party connection, you can leverage the detailed information available in the MDM database. Cisco ISE uses REST API calls to pull the various pieces of information from the external MDM server. Cisco ISE applies appropriate access control policies to switches, access routers, wireless access points, and other network access points to achieve greater control of remote device access to your Cisco ISE network.

The following sections describe only the MDM configuration. For detailed ISE and WLC configuration, refer to the design documents that are available at:

http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html

Supported MDM Use Cases

The functions Cisco ISE performs in conjunction with the external MDM server are as follows:

  • Facilitating device registration—Unregistered endpoints accessing the network are redirected to a registration page hosted on the MDM server for registration based on user role, device type, and so on.
  • Handling device remediation—Endpoints are granted only restricted access after becoming noncompliant.
  • Augmenting endpoint data—Update the endpoint database with information from the MDM server that you cannot gather using the Cisco ISE Profiler. Cisco ISE uses six device attributes you can view using the Administration > Identity Management > Identities > Endpoints page if an endpoint is a MDM monitored device. For example:

MDMImei: 99 000100 160803 3

MDMManufacturer: Apple

MDMModel: iPhone

MDMOSVersion: iOS 6.0.0

MDMPhoneNumber: 9783148806

MDMSerialNumber: DNPGQZGUDTF9

  • Periodically checking compliance—Cisco ISE polls the MDM server once every four hours for device compliance data.
  • Issuing device instructions through the MDM server—Issues remote actions for users’ devices through the MDM server.

Cisco ISE allows you to configure MDM policy based on the following attributes:

  • DeviceRegisterStatus
  • DeviceCompliantStatus
  • DiskEncryptionStatus
  • PinLockStatus
  • JailBrokenStatus
  • Manufacturer
  • IMEI
  • SerialNumber
  • OsVersion
  • PhoneNumber

Supported MDM Servers

Supported MDM servers include products from the following vendors:

  • Airwatch, Inc.
  • Good Technology
  • MobileIron, Inc.
  • Zenprise, Inc.
  • SAP Afaria
  • Fiberlink MaaS

Ports Used by the MDM Server

Table 9-4 lists the ports that must be open between the Cisco ISE and the MDM server to enable them to communicate with each other. Refer to the MDM Server Documentation for a list of ports that must be open on the MDM agent and server.

 

Table 9-4 Ports Used by the MDM Server

MDM Server
Ports

Mobile Iron

443

Zenprise

443

Good

19005

Airwatch

443

Afaria

443

Fiberlink MaaS

443

MDM Dictionary Attributes

After you add the MDM server definition in Cisco ISE, the MDM dictionary attributes are available in Cisco ISE that you can use in authorization policies. You can view the dictionary attributes that are available for use in authorization policies (Policy > Policy Elements > Dictionaries > MDM > Dictionary Attributes).

When you are using these MDM dictionary attributes in policies, you cannot delete the MDM server configuration from Cisco ISE. To remove the MDM server configuration, you must first remove the MDM dictionary attributes from policies, and then remove the MDM server from Cisco ISE.

MDM Integration Process Flow

This section describes the MDM integration process:

1. The user associates a device to SSID.

2. (Optional) If the device is not registered, the user goes through the device on-boarding flow.

3. Cisco ISE makes an API call to the MDM server.

4. This API call returns a list of devices for this user and the posture status for the devices.


Note The input parameter is the MAC address of the endpoint device.


5. If the user’s device is not in this list, it means the device is not registered. Cisco ISE sends an authorization request to the NAD to redirect to Cisco ISE. The user is presented the MDM server page.

6. Cisco ISE uses MDM to provision the device and presents an appropriate page for the user to register the device.

7. The user registers the device in the MDM server, and the MDM server redirects the request to Cisco ISE (through automatic redirection or manual browser refresh).

8. Cisco ISE queries the MDM server again for the posture status.

9. If the user’s device is not compliant to the posture (compliance) policies configured on the MDM server, the user is notified that the device is out of compliance and must be compliant.

10. After the user’s device becomes compliant, the MDM server updates the device state in its internal tables.

11. If the user refreshes the browser now, the control is transferred back to Cisco ISE.

12. Cisco ISE polls the MDM server once every four hours to get compliance information and issues Change of Authorization (CoA) appropriately.

The following figure illustrates the MDM process flow.

 

Setting Up MDM Servers With Cisco ISE

To set up MDM servers with Cisco ISE, you must perform the following tasks:

1. Importing MDM Server Certificate into Cisco ISE

2. Creating Mobile Device Manager Definitions

3. Configure ACLs on the Wireless LAN Controllers. See “Configure ACLs on the Wireless LAN Controller for MDM Interoperability” section for more information.

4. Configuring an Authorization Profile for Redirecting Nonregistered Devices

5. Configuring Authorization Policy Rules for the MDM Use Cases

Importing MDM Server Certificate into Cisco ISE

For Cisco ISE to connect with the MDM server, you must import the MDM server certificate into the Cisco ISE Certificate Store. If your MDM server has a CA-signed certificate, you must import the root CA into the Cisco ISE Certificate Store.


Step 1 Export the MDM server certificate from your MDM server and save it on your local machine.

Step 2 Choose Administration > Certificates > Certificate Store > Import .

Step 3 Click Browse to select the MDM server certificate that you obtained from the MDM server.

Step 4 Add a friendly name.

Step 5 Click Submit .

Step 6 Verify that the Certificate Store list page lists the MDM server certificate.


 

Creating Mobile Device Manager Definitions

You can create one or more Mobile Device Manager (MDM) definitions for external MDM servers to help ensure Cisco ISE is able to obtain the most up-to-date device connection status from logged-in user devices as possible on demand. (Although you can configure multiple MDM server definitions, you can activate only one MDM server with which Cisco ISE interoperates at a time.)

Before You Begin

Ensure that you have imported the MDM server certificate into Cisco ISE. For more information, see Importing MDM Server Certificate into Cisco ISE.


Step 1 Choose Administration > Network Resources > MDM .

Step 2 Click Add .

Step 3 Enter the name and description of the MDM server that you want to add.

Step 4 Check (or uncheck) the Status check box to indicate which MDM server should be Active. Cisco ISE can communicate with only one MDM server at a time.

Step 5 Enter the MDM server IP address or hostname (FQDN) in the MDM server host field.

Step 6 Specify the network/proxy port through which Cisco ISE must communicate with the MDM server.

Step 7 Specify a server instance if you are using a multitenant cloud-based MDM service.

Step 8 Specify the MDM server administrator username and password so that Cisco ISE can log in to and interoperate with the MDM server database.

Step 9 Enter the polling interval in minutes for Cisco ISE to poll the MDM server for compliance check information. This value should be the same as the polling interval on your MDM server. The default value is 240 minutes.

We recommend that you set the polling interval below 60 minutes only for testing a few active clients on your network. If you set this value below 60 minutes for a production environment with many active clients, the system’s load increases significantly and might negatively impact its performance.

Step 10 Check the Enable check box to activate the MDM server connection with Cisco ISE.

Step 11 Click Test Connection to test Cisco ISE’s connection to the MDM server.

If Cisco ISE displays a connection error, delete the definition that you created, ensure that your MDM server is reachable, and re-create the MDM server definition in Cisco ISE.

Step 12 Click Submit to save the MDM server definition. Only after you successfully connect Cisco ISE with the MDM server, the MDM dictionary gets populated in Cisco ISE.


 

Configuring an Authorization Profile for Redirecting Nonregistered Devices

You must configure an authorization profile in Cisco ISE to redirect nonregistered devices.

Before You Begin

Ensure that you have created the MDM server definition in Cisco ISE. Only after you successfully integrate ISE with the MDM server, the MDM dictionary gets populated and you can create authorization policy using the MDM dictionary attributes. See Creating Mobile Device Manager Definitions.

Configure ACLs on the Wireless LAN Controller for redirecting unregistered devices. See “Configure ACLs on the Wireless LAN Controller for MDM Interoperability” section.


Step 1 Choose Policy > Policy Elements > Results > Authorization > Authorization Profiles > Add .

Step 2 Create an authorization profile for redirecting nonregistered devices that are not compliant or registered.

Step 3 Enter a name for the authorization profile.

Step 4 Choose ACCESS_ACCEPT as the Access Type.

Step 5 Check the Web Redirection check box and choose MDM Redirect from the drop-down list.

Step 6 Enter the name of the ACL that you configured on the wireless LAN controller in the ACL field.

Step 7 Click Submit .


 

Configuring Authorization Policy Rules for the MDM Use Cases

You must configure authorization policy rules in Cisco ISE to complete the MDM configuration in Cisco ISE.

Before You Begin


Step 1 Choose Policy > Authorization > Insert New Rule Below .

Step 2 Add the following rules:

    • MDM_Un_Registered_Non_Compliant—For devices that are not yet registered with an MDM server or compliant with MDM policies. Once a request matches this rule, the ISE MDM page appears with information on registering the device with MDM.
    • PERMIT—If the device is registered with Cisco ISE, registered with MDM, and is compliant with Cisco ISE and MDM policies, it will be granted access to the network based on the access control policies configured in Cisco ISE.

Figure 9-2 shows an example of this configuration.

Figure 9-2 Authorization Policy Rules for the MDM Use Cases

 

Step 3 Click Save .


 

Wiping or Locking a Device

Cisco ISE allows you to wipe or turn on pin lock for a device that is lost. You can do this from the Endpoints page.


Step 1 Choose Administration > Identity Management > Identities > Endpoints.

Step 2 Check the check box next to the device that you want to wipe or lock.

Step 3 From the MDM Access drop-down list, choose any one of the following options as shown in :

    • Full Wipe—Removes all information from the device
    • Corporate Wipe—Removes applications that you have configured in the MDM server policies
    • PIN Lock—Locks the device

Figure 9-3 Locking a Device

 

Step 4 Click Yes to wipe or lock the device.


 

Viewing Mobile Device Manager Reports

Cisco ISE records all additions, updates, and deletions of MDM server definitions. You can view these event in the “Change Configuration Audit” report, which provides all the configuration changes from any system administrator for a selected time period.

Choose Operations > Reports > Change Configuration Audit > MDM , and specify the period of time to display in the resulting report.

Related Topics

Viewing Mobile Device Manager Logs

You can use the Message Catalog page to view Mobile Device Manager log messages. Choose Administration > System > Logging > Message Catalog. The default reporting level for MDM log entries is “INFO.”

Related Topics