Contents

Introduction

Prerequisites

Requirements

Components Used

DNS Based ACL Process Flow

Configure

WLC Configuration

ISE Configuration

Verify

References

Introduction

This document describes a configuration example for the use of DNS Based access lists (ACLs), Fully Qualified Domain Name (FQDN) domain list to allow access to specific domain lists during Web-authentication/Client Bring Your Own Device (BYOD) provisioning state on Converged Access Controllers.

Prerequisites

Requirements

This document assumes that you already know how to configure basic Central Web Authentication (CWA), this is just an addition to demonstrate the use of FQDN domain lists to faciltate BYOD. CWA and ISE BYOD configuration examples are referenced at the end of this document.

Components Used

The information in this document is based on these software and hardware versions:

Cisco Identity Services Engine Software Release 1.4

Cisco WLC 5760 Software Release 3.7.4

DNS Based ACL Process Flow

Upon Identity Services Engine (ISE) returning the redirect ACL name (name of ACL used to determine which traffic is to be redirected to ISE and which will not) and FQDN domain list name (name of ACL that is mapped to FQDN URL list on the controller to be allowed for access before authentication), the flow will be as such:

1. Wireless LAN Controller (WLC) will send capwap payload to access point (AP) to enable DNS snooping for the URLs.

2. AP snoops for the DNS query from the client.

- If the domain name matches the allowed URL, AP will forward the request to the DNS server, will wait for the response from the DNS server and will parse the DNS response and forward it with only the first IP address resolved.

- If the domain name does not match, then the DNS response is forwarded as is (without modification) back to the client.

3. In case the domain name matches, the first resolved IP address will be sent to the WLC in the capwap payload. WLC implicitly updates the ACL mapped to the FQDN domain list with the resolved IP address it got from the AP using the following approach:

- The resolved IP address will be added as a destination address on each rule of ACL mapped to the FQDN domain list.

- Each rule of ACL gets reversed from permit to deny and vice versa then the ACL will gets applied to the client.
Note: With this mechanism we can't map the domain list to CWA redirect ACL, because reversing the redirect ACL rules will result into changing them to permit which means that traffic should be redirected to ISE. Therfore FQDN domain list will be mapped to a seperate "permit ip any any" ACL in the configuration part.

- To clarify that point, assume the network admin has configured FQDN domain list with cisco.com url in the list, and mapped that domain list to the following ACL:

ip access-list extended FQDN_ACL

permit ip any any
Upon client requesting cisco.com, AP resolves domain name cisco.com to IP address 72.163.4.161 and send it to the contoller, the ACL will be modified to be as below and gets applied to the client:

ip access-list extended FQDN_ACL

deny ip any host 72.163.4.161

4. When client sends HTTP "GET" request:

- The client will get redirected in case the ACL permits the traffic.

- With denied IP address the http traffic will be allowed.

5. Once the App is downloaded on the client and provisioning is complete, the ISE server sends CoA session terminate to the WLC.

6. Once the client is de-authenticated from the WLC, the AP will remove the flag for snooping per client and disable snooping.

Configure

WLC Configuration

1. Create redirect ACL:

This ACL is used to define which traffic shouldn't be redirected to ISE (denied in the ACL) and which traffic should be redirected (Permitted in the ACL).

ip access-list extended REDIRECT_ACL

deny udp any eq bootps any

deny udp any any eq bootpc

deny udp any eq bootpc any

deny udp any any eq domain

deny udp any eq domain any

deny ip any host 10.48.39.228

deny ip host 10.48.39.228 any

permit tcp any any eq www

permit tcp any any eq 443
In this access list 10.48.39.228 is the ISE server IP address.

2. Configure the FQDN domain list:

This list contains the domain names that client can access before provisioning or CWA authentication.

passthru-domain-list URLS_LIST

match play.google.*.*

match cisco.com

3. Configure an access list with permit ip any any to be combined with the URLS_LIST:

This ACL is needed to be mapped to the FQDN domain list because we must apply an actual IP access-list to the client (we can't apply standalone FQDN domain list).

ip access-list extended FQDN_ACL

permit ip any any

4. Map the URLS_LIST domain list to the FQDN_ACL:

access-session passthru-access-group FQDN_ACL passthru-domain-list URLS_LIST

5. Configure the Onboarding CWA SSID:

This SSID will be used for client central web authentication and client provisioning , the FQDN_ACL and REDIRECT_ACL will be applied to this SSID by ISE

wlan byod 2 byod

aaa-override

accounting-list rad-acct

client vlan VLAN0200

mac-filtering MACFILTER

nac

no security wpa

no security wpa akm dot1x

no security wpa wpa2

no security wpa wpa2 ciphers aes

no shutdown
In this SSID configuration MACFILTER method list is the method list pointing to ISE radius group and rad-acct is the accounting method list that points to the same ISE radius group.

Summary of method list configuration used in this example:

aaa group server radius ISEGroup

server name ISE1

aaa authorization network MACFILTER group ISEGroup

aaa accounting network rad-acct start-stop group ISEGroup

radius server ISE1

address ipv4 10.48.39.228 auth-port 1812 acct-port 1813

key 7 112A1016141D5A5E57

aaa server radius dynamic-author

client 10.48.39.228 server-key 7 123A0C0411045D5679

auth-type any

ISE Configuration

This section assumes that you are familar with CWA ISE configuration part, ISE configuration is nearly the same with the following modifications.

Wireless CWA Mac address Authentication Bypass (MAB) authentication result should return the following attributes along with the CWA redirect URL:

cisco-av-pair = fqdn-acl-name=FQDN_ACL

cisco-av-pair = url-redirect-acl=REDIRECT_ACL

Where FQDN_ACL is the name of the IP access list that is mapped to the domain list and REDIRECT_ACL is the normal CWA redirect access list.

Thefore CWA MAB authentication result should be configured as in below:

Verify

To verify that FQDN domain list is applied to the client use below command:

show access-session mac <client_mac> details

Example of the command outputs showing permitted domain names:

5760-2#show access-session mac 60f4.45b2.407d details

Interface:  Capwap7

IIF-ID:  0x41BD400000002D

Wlan SSID:  byod

AP MAC Address:  f07f.0610.2e10

MAC Address:  60f4.45b2.407d

IPv6 Address:  Unknown

IPv4 Address:  192.168.200.151

Status:  Authorized

Domain:  DATA

Oper host mode:  multi-auth

Oper control dir:  both

Session timeout:  N/A

Common Session ID:  0a30275b58610bdf0000004b

Acct Session ID:  0x00000005

Handle:  0x42000013

Current Policy:  (No Policy)

Session Flags:  Session Pushed

Server Policies:

FQDN ACL: FQDN_ACL

Domain Names: cisco.com play.google.*.*

URL Redirect:  https://bru-ise.wlaaan.com:8443/portal/gateway?sessionId=0a30275b58610bdf0000004b&portal=27963fb0-e96e-11e4-a30a-005056bf01c9&action=cwa&token=fcc0772269e75991be7f1ca238cbb035

URL Redirect ACL:  REDIRECT_ACL

Method status list: empty

References

Central Web Authentication on the WLC and ISE Configuration Example

BYOD Wireless Infrastructure Design

Configure ISE 2.1 for Chromebook Onboarding