Provision OrgInfo.json and AnyConnect via ISE for Umbrella

Introduction

This document describes how to provision the OrgInfo.json profile and AnyConnect client using Identity Services Engine (ISE) for Umbrella integration.

Prerequisites

• Access to the Umbrella dashboard
• Access to the ISE dashboard
• Umbrella Module Profile (OrgInfo.json)
• AnyConnect Headend Deployment Package (Windows or macOS)
• ISE Posture Compliance Library (Windows or macOS)
• Latest ISE patch installed (to avoid Cisco bug ID CSCvz01485 )

Not Covered:

• ISE Authentication and Authorization policies
• ISE Client Provisioning Portal and client redirection

Preparation Steps

1. Access the Umbrella dashboard and download the Umbrella Module Profile (OrgInfo.json) fromDeployments > Roaming Computers > Download > Download Module Profile.
   13294624684052
2. Download the AnyConnect Headend Deployment Package from the Cisco Software Download page, selecting the version appropriate for your deployment.
   1329506842024413295069069716
3. Download the ISE Posture Compliance Library from the Cisco Software Download page, selecting the version appropriate for your deployment.
   1329516471771613295155874580
   
   

ISE Configuration

1. Access the ISE dashboard and navigate toWork Centers > Posture > Client Provisioning > Resources > Add > Agent resources from local disk.
   13296001416212
   
   
2. SelectCisco Provided Package > Choose File, upload the AnyConnect Headend Deployment Package, and clickSubmitandConfirm.
   13296134663316
   
   
3. Repeat the process to upload the ISE Posture Compliance Library:
   • SelectCisco Provided Package > Choose File, upload the ISE Posture Compliance Library, and clickSubmitandConfirm.13296424126484
4. Upload the OrgInfo.json profile:
   • SelectCustomer Created Package > Select AnyConnect Profile > Add Name > Choose File > OrgInfo.json > Submit.
     13296644513172
     
     
5. Add the AnyConnect Posture Profile:
   • Go toWork Centers > Posture > Client Provisioning > Resources > Add > AnyConnect Posture Profile.
     13296771328020
     
     
   • Add a profile name and server name rules (wildcarded, comma-separated names that define the servers that the agent can connect to for example,*.cisco.com), then clickSubmit.
     13296832646420
     13298487677972
     
     
6. Add AnyConnect Configuration:
   • Navigate toWork Centers > Posture > Client Provisioning > Resources > Add > AnyConnect Configuration.13297194126612
     
     
   • Select the AnyConnect Package, add a configuration name, select the Compliance Package, choose the AnyConnect Modules (Umbrella and Diagnostic), select the ISE Profile, select the Umbrella Profile, and clickSubmit.13297382333588
7. Assign the AnyConnect Configuration to the Client Provisioning Policy:
   • Go toWork Centers > Posture > Client Provisioning > Client Provisioning Policy.
     13297993535508
     
     
   • Edit the policy and underResults, add the AnyConnect Configuration, then clickSave.
8. Create an Authorization Policy to redirect clients to the Client Provisioning Portal. (This step is outside the scope of this guide.)

13380169470868

Client side Configuration

1. Once the client is able to get the redirection from the Client Provisioning Portal click Start: 13380233607956
2. Select This is my first time here and it begins downloading AnyConnect: 13380334336020
3. Open/run the downloaded file and it starts the process:
   13380212207508
4. When "Trusted and Secure Connection" message appears click Connect if the ISE information is correct: 13380233399956
5. Once the "Installation is completed" message appears click Quit:
   
   13380233308820
   
   
6. You can close all other windows. Umbrella has been installed, plus the ISE Posture module:
   13380212092308