Cisco Identity Services Engine Administrator Guide, Release 2.2

Defining Network Devices in Cisco ISE

A network device, such as a switch or a router, is an authentication, authorization, and accounting (AAA) client through which AAA service requests are sent to Cisco ISE. Defining network devices in Cisco ISE enables interactions between Cisco ISE and network devices.

Configure network devices for RADIUS or TACACS AAA, and Simple Network Management Protocol (SNMP) for the Profiling service to collect Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) attributes for profiling endpoints, and TrustSec attributes for Cisco TrustSec devices. A network device that is not defined in Cisco ISE cannot receive AAA services from Cisco ISE.

From the Cisco ISE main menu, choose Administration > Network Resources > Network Devices, and click Add. In the New Network Device window that is displayed, enter the following details to define a network device:

Select the vendor profile that fits the network device. The profile includes predefined configurations for the device, such as settings for URL redirect and change of authorization.
Configure the RADIUS protocol for RADIUS authentications. When Cisco ISE receives a RADIUS request from a network device, it looks for the corresponding device definition to retrieve the configured shared secret. If Cisco ISE finds the device definition, it obtains the configured shared secret on the device and matches it against the shared secret in the request to authenticate access. If the shared secrets match, the RADIUS server processes the request further based on the policy and configuration. If the shared secrets do not match, a reject response is sent to the network device. A failed authentication report is generated, which provides the failure reason.
Configure the TACACS+ protocol for TACACS+ authentications. When Cisco ISE receives a TACACS+ request from a network device, it looks for the corresponding device definition to retrieve the shared secret that is configured. If it finds the device definition, it obtains the shared secret that is configured on the device and matches it against the shared secret in the request to authenticate access. If the shared secrets match, the TACACS+ server processes the request further based on the policy and configuration. If they do not match, a reject response is sent to the network device. A failed authentication report is generated, which provides the failure reason.
You can configure the Simple Network Management Protocol (SNMP) in the network device definition for the Profiling service to communicate with the network devices and profile endpoints that are connected to the network devices.
You must define Cisco TrustSec-enabled devices in Cisco ISE to process requests from TrustSec-enabled devices that can be part of the Cisco TrustSec solution. Any switch that supports the Cisco TrustSec solution is a Cisco TrustSec-enabled device.

Cisco TrustSec devices do not use IP addresses. Instead, you must define other settings so that Cisco TrustSec devices can communicate with Cisco ISE.

Cisco TrustSec-enabled devices use the TrustSec attributes to communicate with Cisco ISE. Cisco TrustSec-enabled devices, such as the Cisco Nexus 7000 Series Switches, Cisco Catalyst 6000 Series Switches, Cisco Catalyst 4000 Series Switches, and Cisco Catalyst 3000 Series Switches are authenticated using the Cisco TrustSec attributes that you define while adding Cisco TrustSec devices.

Note

When you configure a network device on Cisco ISE, we recommend that you do not include a backslash (\) as part of the shared secret. This is because when you upgrade Cisco ISE, the backslash will not appear in the shared secret. However, if you reimage Cisco ISE instead of upgrading it, the backslash appears in the shared secret.

Support for Session Aware Networking (SAnet)

Cisco ISE provides limited support for Session Aware Networking (SAnet). SAnet is a session management framework that runs on many Cisco switches. SAnet manages access sessions, including visibility, authentication, and authorization. SAnet uses a service template, which contains RADIUS authorization attributes. Cisco ISE includes a service template inside an authorization profile. Cisco ISE identifies service templates in an authorization profile using a flag that identifies the profile as “Service Template” compatible.

Cisco ISE authorization profiles contain RADIUS authorization attributes that are transformed into a list of attributes. SAnet service templates also contain of RADIUS authorization attributes, but those attributes are not transformed into a list.

For SAnet devices, Cisco ISE sends the name of the service template. The device downloads the content of the service template, unless it already has that content in a cache or statically defined configuration. Cisco ISE sends a CoA notification to the device when a service template changes RADIUS attributes.

Define a Default Network Device in Cisco ISE

Cisco ISE supports the default device definition for RADIUS and TACACS authentications. You can define a default network device that Cisco ISE can use if it does not find a device definition for a particular IP address. This feature enables you to define a default RADIUS or TACACS shared secret and the level of access for newly provisioned devices.

Note

We recommend that you add the default device definition only for basic RADIUS and TACACS authentications. For advanced flows, you must add a separate device definition for each network device.

Cisco ISE looks for the corresponding device definition to retrieve the shared secret that is configured in the network device definition when it receives a RADIUS or TACACS request from a network device.

Cisco ISE performs the following procedure when a RADIUS or TACACS request is received:

Looks for a specific IP address that matches the one in the request.
Looks up the ranges to see if the IP address in the request falls within the range that is specified.
If both step 1 and 2 fail, it uses the default device definition (if defined) to process the request.

Cisco ISE obtains the shared secret that is configured in the device definition for that device and matches it against the shared secret in the RADIUS or TACACS request to authenticate access. If no device definitions are found, Cisco ISE obtains the shared secret from the default network device definition and processes the RADIUS or TACACS request.

Add a Network Device in Cisco ISE

You can add a network device in Cisco ISE or use the default network device.

You can also add a network device in the Network Devices (Work Centers > Device Administration > Network Resources > Network Devices) window.

Before you begin

The AAA function must be enabled on the network device to be added. See Command to Enable AAA Functions.

Procedure

Step 1	Choose Administration > Network Resources > Network Devices.
Step 2	Click Add.
Step 3	Enter the corresponding values in the Name, Description, and IP Address fields.
Step 4	Choose the required values from the Device Profile, Model Name, Software Version, and Network Device Group drop-down lists.
Step 5	(Optional) Check the RADIUS Authentication Settings check box to configure the RADIUS protocol for authentication.
Step 6	(Optional) Check the TACACS Authentication Settings check box to configure the TACACS protocol for authentication.
Step 7	(Optional) Check the SNMP Settings check box to configure SNMP for the Cisco ISE profiling service to collect information from the network device.
Step 8	(Optional) Check the Advanced Trustsec Settings check box to configure a Cisco TrustSec-enabled device.
Step 9	Click Submit.

Import Network Devices into Cisco ISE

To enable Cisco ISE to communicate with network devices, you must add device definitions of the network devices in Cisco ISE. Import device definitions of network devices into Cisco ISE through the Network Devices window (From the main menu, choose Administration > Network Resources > Network Devices).

Import a list of device definitions into a Cisco ISE node using a comma-separated value (CSV) file. A CSV template file is available when you click Import in the Network Devices window. Download this file, enter the required device definitions, and then upload the edited file through the Import window.

You cannot execute multiple imports of the same resource type at the same time. For example, you cannot concurrently import network devices from two different import files.

When you import a CSV file of device definitions, you can either create new records or update existing records by clicking the Overwrite Existing Data with New Data option.

Import templates may vary in each Cisco ISE. Do not import CSV files of network devices that have exported from a different Cisco ISE release. Enter the details of the network devices in the CSV template file for your release, and import this file into Cisco ISE.

Procedure

Step 1	Choose Administration > Network Resources > Network Devices.
Step 2	Click Import.
Step 3	Click Browse to choose the CSV file from the system that is running the client browser.
Step 4	(Optional) Check the for Overwrite Existing Data with New Data and Stop Import on First Errorcheck boxes, as required.
Step 5	Click Import. After the file import is complete, Cisco ISE displays a summary message. This message includes the import status (successful or unsuccessful), number of errors encountered, if any, and the total processing time taken for the file import process.

Export Network Devices from Cisco ISE

You can export the device definitions of the network devices that are available in a Cisco ISE node in the form of a CSV file. You can then import this CSV file into another Cisco ISE node so that the device definitions are available to the required Cisco ISE nodes.

Procedure

Step 1	Choose Administration > Network Resources > Network Devices.
Step 2	Click Export.
Step 3	Export the device definitions for the network devices added to the Cisco ISE node by performing one of the following actions. Check the check boxes next to the devices that you want to export, choose Export Selected from the Export drop-down list. Choose Export All from the Export drop-down list to export all the network devices that are added to the Cisco ISE node.
Step 4	In both cases, a CSV file of device definitions is downloaded to your system.

Third-Party Network Device Support in Cisco ISE

Cisco ISE supports third-party network access devices (NADs) by using network device profiles. A NAD profile defines the capabilities of a third-party device with a simplified policy configuration, regardless of the vendor-side implementation. A network device profile contains the following:

The protocols that the network device supports, such as RADIUS, TACACS+, and Cisco TrustSec. You can import into Cisco ISE any vendor-specific RADIUS dictionaries that exist for the network device.
The attributes and values that the device uses for various authentication flows such as Wired MAB and 802.1X. These attributes and values allow Cisco ISE to detect the right authentication flow for your device according to the attributes that the network device uses.
The Change of Authorization (CoA) capabilities of the network device. While the RADIUS protocol RFC 5176 defines a CoA request, the attributes used in a CoA request vary depending on the network device. Most non-Cisco devices with RFC 5176 support will support the Push and Disconnect functions. For devices that do not support the RADIUS CoA type, Cisco ISE also supports SNMP CoA.
The attributes and protocols that the network device uses for MAB flows. Network devices from different vendors perform MAB authentication differently.
The VLAN and ACL permissions that are used by the device. When you save the profile, Cisco ISE automatically generates authorization profiles for each configured permission.
URL redirection technique information. URL redirection is necessary for advanced flows such as Bring Your Own Device (BYOD), guest access, and posture services. Two types of URL redirections are found on a network device—static and dynamic. For static URL redirection, you can copy and paste the Cisco ISE portal URL into the configuration. For dynamic URL redirection, Cisco ISE uses a RADIUS attribute to tell the network device where to redirect to.

If the network device does not support both dynamic and static URL redirects, Cisco ISE provides an Auth VLAN configuration by which URL redirect is simulated. The Auth VLAN configuration is based on DHCP and DNS services running in Cisco ISE.

After you have defined your network devices in Cisco ISE, configure these device profiles or use the preconfigured device profiles that are offered by Cisco ISE in order to define the capabilities that Cisco ISE uses to enable basic authentication flows, and advanced flows such as Profiler, Guest, BYOD, MAB, and Posture.

URL Redirect Mechanism and Auth VLAN

When a third-party device is used in the network and the device does not support dynamic or static URL redirect, Cisco ISE simulates the URL redirect flow. The URL redirect simulation flow for such devices is operated by running a DHCP or DNS service on Cisco ISE.

The following is an example of an Auth VLAN flow:

A guest endpoint connects to the NAD.
The network device sends the RADIUS or MAB request to Cisco ISE.
Cisco ISE runs the configured authentication and authorization policy and stores the user accounting information.
Cisco ISE sends the RADIUS access accept message that contains the Auth VLAN ID.
The guest endpoint receives network access.
The endpoint broadcasts a DHCP request, and obtains a client IP address and the Cisco ISE DNS sinkhole IP address from the Cisco ISE DHCP service.
The guest endpoint opens a browser that sends a DNS query and receives the Cisco ISE IP address.
The endpoint HTTP and HTTPS requests are directed to Cisco ISE.
Cisco ISE responds with an HTTP 301 Moved message with a guest portal URL. The endpoint browser redirects to the guest portal window.
The guest endpoint user logs in for authentication.
Cisco ISE validates endpoint compliance and then responds to the NAD. Cisco ISE sends the CoA, authorizes the endpoint, and bypasses the sinkhole.
The guest user receives the appropriate access based on the CoA, and the endpoint receives an IP address from an enterprise DHCP. The guest user can now use the network.

You can separate the Auth VLAN from the corporate network to prevent unauthorized network access by a guest endpoint before the endpoint passes authentication. Configure the Auth VLAN IP helper to point to the Cisco ISE machine, or connect one of the Cisco ISE network interfaces to the Auth VLAN.

Multiple VLANs may be connected to one network interface card by configuring a VLAN IP helper from the NAD configuration. For more information about configuring an IP helper, see the administration guide for the network device for instructions. For guest access flows that include VLANs with IP helpers, define a guest portal, and select that portal in an authorization profile that is bound to MAB authorization. For more information about guest portals, see Cisco ISE Guest Services.

The following diagram displays a basic network setup when an Auth VLAN is defined (the Auth VLAN is connected directly to a Cisco ISE node).

Figure 1. Auth VLAN Connected to Cisco ISE Node

The following diagram displays a network with Auth VLAN and an IP helper.

Figure 2. Auth VLAN Configured with IP Helper

CoA Types

Cisco ISE supports both RADIUS and SNMP CoA types. RADIUS or SNMP CoA type support is required for the NAD to work in complex flows, while it is not mandatory for basic flows.

Define the RADIUS and SNMP settings that are supported by the network device when configuring the NAD in Cisco ISE, and indicate the CoA type to be used for a specific flow when configuring the NAD profile. For more information about defining protocols for your NADs, see Network Device Definition Settings. Check with your third-party supplier to verify which CoA type your NAD supports before creating the device profile and NAD profile in Cisco ISE.

Network Device Profiles

Cisco ISE supports some third-party NADs by using network device profiles. These profiles define the capabilities that Cisco ISE uses to enable basic flows, and advanced flows such as Guest, BYOD, MAB, and Posture.

Cisco ISE includes predefined profiles for network devices from several vendors. Cisco ISE 2.1 and later releases have been tested with the network devices listed in the following table.

Table 1. Vendor Devices Tested with Cisco ISE 2.1 and Later Releases
Device Type	Vendor	CoA Type	URL Redirect Type	Supported or Validated Use Cases
Device Type	Vendor	CoA Type	URL Redirect Type	802.1X and MAB Flows	Profiler without CoA	Profiler with CoA	Posture	Guest and BYOD Flows
Wireless	Aruba 7000, InstantAP	RADIUS	Static URL	Yes	Yes	Yes	Yes	Yes
	Motorola RFS 4000	RADIUS	Dynamic URL	Yes	Yes	Yes	Yes	Yes
	HP 830	RADIUS	Static URL	Yes	Yes	Yes	Yes	Yes
	Ruckus ZD 1200	RADIUS	—	Yes	Yes	Yes	Yes	Yes
Wired	HP A5500	RADIUS	Auth VLAN provided by ISE	Yes	Yes	Yes	Yes	Yes
	HP 3800 and 2920 (ProCurve)	RADIUS	Auth VLAN provided by ISE	Yes	Yes	Yes	Yes	Yes
	Alcatel 6850	SNMP	Dynamic URL	Yes	Yes	Yes	Yes	Yes
	Brocade ICX 6610	RADIUS	Auth VLAN provided by ISE	Yes	Yes	Yes	Yes	Yes
	Juniper EX3300-24p	RADIUS	Auth VLAN provided by ISE	Yes	Yes	Yes	Yes	Yes
For other third-party NADs, you must identify the device properties and capabilities, and create custom NAD profiles in Cisco ISE.				Yes	Yes	Requires CoA support	Requires CoA support. If a wired device does not support URL redirect, Cisco ISE utilizes Auth VLAN. Wireless devices have not been tested with Auth VLAN.

You must create custom NAD profiles for other third-party network devices that do not have a predefined profile. For advanced workflows such as Guest, BYOD, and Posture, the network device must support the RADIUS protocol RFC 5176, which pertains to CoA support for these flows. See the device's administration guide for information on the attributes that are required to create network device profiles in Cisco ISE.

If you upgrade from Cisco ISE Release 2.0 or earlier to Cisco ISE Release 2.1 or later, the authentication policy rules and RADIUS dictionaries created in the earlier release to communicate with non-Cisco NADs will continue to work in Cisco ISE after the upgrade.


ISE Community Resource For information about third-party NAD profiles, see ISE Third-Party NAD Profiles and Configs.

Configure a Third-Party Network Device in Cisco ISE

Cisco ISE supports third-party NADs by using network device profiles. These profiles define the capabilities that Cisco ISE uses to enable flows such as Guest, BYOD, MAB, and Posture.

Before you begin

See Network Device Profiles.

Procedure

Step 1	Add the third-party network device to Cisco ISE (See Import Network Devices into Cisco ISE. If you are configuring Guest, BYOD, or Posture workflows, ensure that CoA is defined and the NAD’s URL redirect mechanism is configured to point to the relevant Cisco ISE portal. To configure the URL redirect, copy the Cisco ISE portal URL from the portal’s landing page. For more information about configuring CoA types and URL redirects for the NAD in Cisco ISE, see Network Device Definition Settings. In addition, see the third party device’s administration guide for instructions.
Step 2	Ensure that an appropriate NAD profile for your device is available in Cisco ISE. To view the existing profiles, choose Administration > Network Resources > Network Device Profiles. If an appropriate profile does not exist in Cisco ISE, create a custom profile. See Create a Network Device Profile for information on how to create custom profiles.
Step 3	Assign a NAD profile to the NAD that you want to configure. Choose Administration > Network Resources > Network Devices. Open the device to which you want to assign a profile, and from the Device Profile drop-down list, choose the profile that you want to assign.
Step 4	When you configure your policy rules, the authorization profile should be explicitly set to the NAD profile in step 1, or Any if you are just using VLAN or ACL, or if you have different devices from different vendors in your network. To set the NAD profile for the authorization profile, choose Policy > Policy Elements > Results > Authorization > Authorization Profiles. Open the relevant authorization profile and from Network Device Profile drop-down list, choose the relevant NAD profile. When using Auth VLAN for Guest flows, you should also define a guest portal and select that portal in an Authorization profile that is bound to MAB authorization—similar to regular Guest flows. For more information about guest portals, see the "Cisco ISE Guest Services" section in see Cisco ISE Guest Services.

Create a Network Device Profile

Before you begin

Most NADs have a vendor-specific RADIUS dictionary that provides several vendor-specific attributes, apart from the standard IETF RADIUS attributes. If the network device has a vendor-specific RADIUS dictionary, import it into Cisco ISE. See the third-party device’s administration guide for instructions on which RADIUS dictionary is required. In Cisco ISE, choose Policy > Policy Elements > Dictionaries > System > Radius > RADIUS Vendors. To import RADIUS dictionaries, see Create RADIUS-Vendor Dictionaries.
For complex flows such as Guest and Posture, the network device must support the CoA types that are defined in RFC 5176
For information about the fields and possible values for creating a network device profile, see Network Device Profiles Settings.

Procedure

Step 1	Choose Administration > Network Resources > Network Device Profiles.
Step 2	Click Add.
Step 3	In the New Network Device Profile window that is displayed, enter the corresponding values in the Name and Description fields for the network device.
Step 4	From the Vendor drop-down list, choose the vendor of the network device.
Step 5	In the Icon area, click Change Icon... to upload an icon for the network device from your system. Alternatively, in the Icon area, click Set To Default to use the default icon provided by Cisco ISE.
Step 6	In the Supported Protocols area, check the check boxes for the protocols that the device supports. Check the check boxes only for the protocols you want to actually use. If the network device supports the RADIUS protocol, choose the RADIUS dictionary to be used in the device from RADIUS Dictionaries drop-down list.
Step 7	In the Templates area, enter relevant details: Click Authentication/Authorization to configure the network device's default settings for flow types, attribute aliasing, and host lookup. In the new Flow Type Conditions area that is displayed, enter the attributes and values that your device uses for various authentication and authorization flows such as Wired MAB or 802.1X. This enables Cisco ISE to detect the correct flow type for your device according to the attributes it uses. There is no IETF standard for MAB, and different vendors use different values for Service Type. See the device's user guide or use a sniffer trace of a MAB authentication to determine the correct settings. In the Attribute Aliasing area, map device-specific attribute names to common names to simplify policy rules. Currently, only the Service Set Identifier (SSID) is defined. If the network device has the concept of wireless SSID, then set this to the attribute it uses. Cisco ISE maps this to an attribute called SSID in the Normalized RADIUS dictionary. This simplifies policy rule configuration because you can refer to SSID in one rule, and it works for multiple devices even if the underlying attributes are different. In the Host Lookup area, check the Process Host Lookup check box and select the relevant MAB protocols and attributes for your device, based on the instructions provided by the third-party device vendor. Click Permissions to configure the network device's default settings for VLAN and ACL. These are automatically mapped based on the authorization profiles you create in Cisco ISE. Click Change of Authorization (CoA) to configure the network device's CoA capabilities . Click Redirect to configure the network device's URL-redirect capabilities. URL redirection is necessary for guest, BYOD, and posture services.
Step 8	Click Submit.

Export Network Device Profiles from Cisco ISE

Export single or multiple network device profiles that are configured in Cisco ISE in the form of an XML file. The XML file can then be edited and imported into Cisco ISE file as new network profiles.

Before you begin

See How to Create ISE Network Access Device Profiles.

Procedure

Step 1	Choose Administration > Network Resources > Network Device Profiles.
Step 2	Check the check boxes next to the devices that you want to export, and click Export Selected.
Step 3	A file named DeviceProfiles.xml downloads to your local hard disk.

Import Network Device Profiles into Cisco ISE

Import a single or multiple network device profiles into Cisco ISE using a single XML file with the Cisco ISE XML structure. Note that you cannot concurrently import network device profiles from multiple import files.

Typically, you should first export an existing profile from the Cisco ISE administrator portal to use as a template. Enter your device profile details in the file, and save it as an XML file. Then, import the edited file back into Cisco ISE. To work with multiple network device profiles, export multiple profiles that are structured together as a single XML file, edit the file, and then import the profiles together to create multiple profiles in Cisco ISE.

When you import network device profiles, you can only create new records. You cannot overwrite an existing profile. To update an existing network device profile, export the existing profile from Cisco ISE, delete the profile from Cisco ISE, and then import the profile after you edit it accordingly.

Before you begin

See How to Create ISE Network Access Device Profiles.

Procedure

Step 1	Choose Administration > Network Resources > Network Device Profiles.
Step 2	Click Import.
Step 3	Click Browse to choose the XML file from the system that is running the client browser.
Step 4	Click Import.

Network Device Groups

Cisco ISE allows you to create hierarchical network device groups. Use network device groups to logically group network devices based on various criteria, such as geographic location, device type, or its relative place in the network (such as Access Layer or Data Center).

To view the Network Device Groups window, choose Administration > Network Resources > Network Device Groups.

For example, to organize your network devices based on geographic location, group them by continent, region, or country:

Africa > Southern > Namibia
Africa > Southern > South Africa
Africa > Southern > Botswana

Group the network devices based on the device type:

Africa > Southern > Botswana > Firewalls
Africa > Southern > Botswana > Routers
Africa > Southern > Botswana > Switches

Assign network devices to one or more hierarchical network device groups. When Cisco ISE processes the ordered list of configured network device groups to determine the appropriate group to assign to a particular device, it may find that the same device profile applies to multiple device groups. In this case, Cisco ISE will apply the first device group that is matched.

There is no limit on the maximum number of network device groups that can be created. There is no restriction on the maximum number of hierarchy levels.

The device group hierarchy is displayed in two views, Tree Table and Flat Table. Click Tree Table or Flat Table above the list of network device groups to organize the list into the corresponding view.

In the Tree Table view, the root node appears at the top of the tree followed by the child groups in hierarchical order. Click Expand All to view all the device groups in each root group. Click Collapse All to view a list of only the root groups.

In the Flat Table view, the hierarchy of each device group is displayed in the Group Hierarchy column.

In both views, the number of network devices that are assigned to each child group is displayed in the corresponding No. of Network Devices column. Click the number to launch a dialog box that lists all the network devices that are assigned to that device group. The dialog box that is displayed also contains two buttons to move network devices from one group to another. Click Move Devices to Another Group to move network devices from the current group to another. Click Add Devices to Group to move a network device into the chosen network device group.

To add a network device group in the Network Device Groups window, click Add. In the Parent Group drop-down list, choose the parent group to which the network device group must be added, or choose the Add As Root Group option to add the new network device group as the parent group.

Note

You cannot delete a device group if any devices are assigned to that device group. Before deleting a device group, you must move all the existing devices to another device group.

Root Network Device Groups

Cisco ISE includes two predefined root network device groups, All Device Types and All Locations. You cannot edit, duplicate, or delete these predefined network device groups, but you can add new device groups under them.

You can create a root Network Device Group (network device group), and then create child network device groups under the root group in the Network Device Groups window, as described earlier.

Network Device Attributes Used by Cisco ISE in Policy Evaluation

When you create a new network device group, a new network device attribute is added to the Device dictionary in System Dictionaries (Policy > Policy Elements > Dictionaries). The added device attributes are then used in policy definitions.

Cisco ISE allows you to configure authentication and authorization policies using Device dictionary attributes such as the device type, location, model name, or software version that is running on the network device.

Import Network Device Groups into Cisco ISE

You can import network device groups into a Cisco ISE node using a comma-separated value (CSV) file. Not that you cannot concurrently import network device groups from two different import files.

Download a CSV template from the Cisco ISE administrator portal, enter your network device group details in the template, save the template as a CSV file, and then import the edited file into Cisco ISE.

When importing device groups, you can create new records or update existing records. When you import device groups, you can also define whether you want Cisco ISE to overwrite the existing device groups with the new groups or stop the import process when Cisco ISE encounters the first error.

Procedure

Step 1	Choose Administration > Network Resources > Network Device Groups.
Step 2	Click Import.
Step 3	In the dialog box that is displayed, click Browse to choose the CSV file from the system that is running the client browser. To download a CSV template file for adding network device groups, click Generate a Template.
Step 4	To overwrite the existing network device groups, check the Overwrite Existing Data with New Data check box.
Step 5	Check the Stop Import on First Error check box.
Step 6	Click Import.

Export Network Device Groups from Cisco ISE

You can export network device groups that are configured in Cisco ISE in the form of a CSV file. You can then import these network device groups into another Cisco ISE node.

Procedure

Step 1

Choose Administration > Network Resources > Network Device Groups > All Groups.

Step 2

To export the network device groups, you can do one of the following:

Check the check boxes next to the device groups that you want to export, and choose Export > Export Selected.
Choose Export > Export All to export all the network device groups that are defined.

A CSV file is downloaded into your local hard disk.

Import Templates in Cisco ISE

Cisco ISE allows you to import a large number of network devices and network device groups using CSV files. The template contains a header row that defines the format of the fields. You must not edit this header row.

Use the Generate a Template link in the relevant import flow for network devices and network device groups to download a CSV file in the Microsoft Office Excel application and save the file format locally on your system. When you click the Generate a Template link, the Cisco ISE server displays the Opening template.csv dialog. This dialog allows you to open the template.csv file and save the template.csv file locally on your system with an appropriate name for network devices and network device groups. If you choose to open the template.csv file from the dialog, the file opens in the Microsoft Office Excel application by default.

Network Devices Import Template Format

The following table lists and describes the fields in the header of the import network device CSV template file.

Table 2. CSV Template Fields and Descriptions for Network Devices
Field	Usage Guidelines
Name:String(32)	Enter a name for the network device. The name must be an alphanumeric string with a maximum of 32 characters.
Description:String(256)	(Optional) Enter a description for the network device with a maximum of 256 characters.
IP Address:Subnets(a.b.c.d/m\|...)	Enter the IP address and subnet mask of the network device. You can enter more than one value separated by a pipe (\|) symbol. IPv4 addresses are supported for network device (TACACS and RADIUS) configurations and for external RADIUS server configurations.
Model Name:String(32)	Enter the network device's model name with a maximum of 32 characters.
Software Version:String(32)	Enter the network device's software version with a maximum of 32 characters.
Network Device Groups:String(100)	Enter the names of existing network device groups. If it is a subgroup, it must include both the parent and subgroup separated by a space. The string must be a maximum of 100 characters, for example, Location>All Location>US.
Authentication:Protocol:String(6)	Enter the authentication protocol that you want to use. The only valid value is RADIUS (not case-sensitive).
Authentication:Shared Secret:String(128)	(Required only if you enter a value in the Authentication:Protocol:String(6) field) Enter a string with a maximum of 128 characters.
EnableKeyWrap:Boolean(true\|false)	This field is enabled only if KeyWrap is supported in the network device. You must enter true or false.
EncryptionKey:String(ascii:16\|hexa:32)	(Required if you enable KeyWrap) Enter the encryption key that is used for session encryption. ASCII values: 16 characters (bytes) long. Hexadecimal values: 32 characters (bytes) long.
AuthenticationKey:String(ascii:20\|hexa:40)	(Required if you enable KeyWrap.) Enter the keyed Hashed Message Authentication Code (HMAC) calculation over RADIUS messages. ASCII values: 20 characters (bytes) long. Hexadecimal values: 40 characters (bytes) long.
InputFormat:String(32)	Enter the encryption and authentication keys input format. ASCII and hexadecimal values are accepted.
SNMP:Version:Enumeration (\|2c\|3)	Enter the version of the SNMP protocol that the profiler service must use—1, 2c, or 3.
SNMP:RO Community:String(32)	(Required if you enter a value in the SNMP:Version:Enumeration (\|2c\|3) field). Enter a string for Read Only Community with a maximum of 32 characters
SNMP:RW Community:String(32)	(Required if you enter a value in the SNMP:Version:Enumeration (\|2c\|3) field). Enter a string for Read Write Community with a maximum of 32 characters.
SNMP:Username:String(32)	Enter a string with a maximum of 32 characters.
	(Required if you enter SNMP version 3 in the SNMP:Version:Enumeration (\|2c\|3) field) Enter Auth, No Auth, or Priv.
SNMP:Authentication Protocol:Enumeration(MD5\|SHA)	(Required if you have entered Auth or Priv for the SNMP security level.) Enter MD5 or SHA.
SNMP:Authentication Password:String(32)	(Required if you have entered Auth in the SNMP:Security Level:Enumeration(Auth\|No Auth\|Priv) field.) Enter a string with a maximum of 32 characters.
SNMP:Privacy Protocol:Enumeration(DES\|AES128\|AES192\|AES256\|3DES)	(Required if you have entered Priv in the SNMP:Security Level:Enumeration(Auth\|No Auth\|Priv) field.) Enter DES, AES128, AES192, AES256, or 3DES.
SNMP:Privacy Password:String(32)	(Required if you have entered Priv in the SNMP:Security Level:Enumeration(Auth\|No Auth\|Priv) field.) Enter a string with a maximum of 32 characters.
SNMP:Polling Interval:Integer:600-86400 seconds	Enter the SNMP polling interval, in seconds. A valid value is an integer from 600 to 86400.
SNMP:Is Link Trap Query:Boolean(true\|false)	Enable or disable the SNMP link trap by entering true or false.
SNMP:Is MAC Trap Query:Boolean(true\|false)	Enable or disable the SNMP MAC trap by entering true or false.
SNMP:Originating Policy Services Node:String(32)	Indicate which Cisco ISE server must be used to poll for SNMP data. It is automatic by default, but you can overwrite the setting by assigning different values in this field.
Trustsec:Device Id:String(32)	Enter a Cisco Trustsec device ID, which is a string with a maximum of 32 characters.
Trustsec:Device Password:String(256)	(Required if you have entered a Cisco TrustSec device ID.) Enter a Cisco TrustSec device password, which is a string with a maximum of 256 characters.
Trustsec:Environment Data Download Interval:Integer:1-2147040000 seconds	Enter the Cisco TrustSec environment data download interval. A valid value is an integer from 1 to 2147040000.
Trustsec:Peer Authorization Policy Download Interval:Integer:1-2147040000 seconds	Enter the Cisco TrustSec peer authorization policy download interval. A valid value is an integer from 1 to 2147040000.
Trustsec:Reauthentication Interval:Integer:1-2147040000 seconds	Enter the Cisco TrustSec reauthentication interval. A valid value is an integer from 1 to 2147040000.
Trustsec:SGACL List Download Interval:Integer:1-2147040000 seconds	Enter the Cisco TrustSec security group ACL list download interval. A valid value is an integer from 1 to 2147040000.
Trustsec:Is Other Trustsec Devices Trusted:Boolean(true\|false)	Indicate whether a Cisco TrustSec device is trusted by entering true or false.
Trustsec:Notify this device about Trustsec configuration changes:String(ENABLE_ALL\|DISABLE_ALL)	Notify Cisco TrustSec configuration changes to the Cisco TrustSec device by entering ENABLE_ALL or DISABLE_ALL .
Trustsec:Include this device when deploying Security Group Tag Mapping Updates:Boolean(true\|false)	Indicate if the Cisco TrustSec device is included in security group tag by entering true or false.
Deployment:Execution Mode Username:String(32)	Enter the user name that has privileges to edit the network device configuration. It is a string with a maximum of 32 characters.
Deployment:Execution Mode Password:String(32)	Enter the device password, which is a string with a maximum of 32 characters.
Deployment:Enable Mode Password:String(32)	Enter the password of the device that allows you to edit its configuration. It is a string with a maximum of 32 characters.
Trustsec:PAC issue date:Date	Enter the issuing date of the last Cisco TrustSec PAC that was generated by Cisco ISE for the Cisco TrustSec device.
Trustsec:PAC expiration date:Date	Etner the expiration date of the last Cisco TrustSec PAC that was generated by Cisco ISE for the Cisco TrustSec device.
Trustsec:PAC issued by:String	Enter the name of the issuer (a Cisco TrustSec administrator) of the last Cisco TrustSec PAC that was generated by Cisco ISE for the Cisco TrustSec device. It must be a string value.

Network Device Groups Import Template Format

The following table lists the fields in the template header and provides a description of the fields in the Network Device Group CSV file.

Table 3. CSV Template Fields and Description for Network Device Groups
Field	Description
Name:String(100):	(Required) This field is the network device group name. It is a string with a maximum of 100 characters in length. The full name of an NDG can have a maximum of 100 characters in length. For example, if you are creating a subgroup India under the parent groups Global > Asia, then the full name of the NDG that you are creating would be Global#Asia#India and this full name cannot exceed 100 characters in length. If the full name of the NDG exceeds 100 characters in length, the NDG creation fails.
Description:String(1024)	This is an optional network device group description. It is a string, with a maximum of 1024 characters in length.
Type:String(64):	(Required) This field is the network device group type. It is a string, with a maximum of 64 characters in length.
Is Root:Boolean(true\|false):	(Required) This is a field that determines if the specific network device group is a root group. Valid value is true or false.

IPsec Security to Secure Communication Between Cisco ISE and NAD

IPsec is a set of protocols that provides security to IP. The AAA, RADIUS, and TACACS+ protocols use the MD5 hashing algorithm. For greater security, Cisco ISE offers the IPsec feature. IPsec provides secure communication by authenticating the sender, discovering any changes in data during transmission, and encrypting the data that is sent.

Cisco ISE supports IPsec in tunnel and transport modes. When you enable IPsec on a Cisco ISE interface and configure the peers, an IPsec tunnel is created between Cisco ISE and the NAD to secure the communication.

You can define a pre-shared key or use X.509 certificates for IPsec authentication. IPsec can be enabled on Gigabit Ethernet 1 through Gigabit Ethernet 5 interfaces. You can configure IPsec on only one Cisco ISE interface per PSN.

IPsec cannot be enabled on Gigabit Ethernet 2 as the smart license is enabled (e0/2—> eth2) by default. However, if you are required to enable IP Security, you have to choose a different interface for smart licensing.

Note

Gigabit Ethernet 0 and Bond 0 (when Gigabit Ethernet 0 and Gigabit Ethernet 1 interfaces are bonded) are management interfaces in the Cisco ISE CLI. IPsec is not supported on Gigabit Ethernet 0 and Bond 0.

Required components include:

Cisco ISE Release 2.2 and later.

Cisco IOS Software, C5921 ESR Software (C5921_I86-UNIVERSALK9-M): The ESR 5921 configuration, by default, supports IPsec in tunnel and transport modes. Diffie-Hellman Group 14 and Group 16 are supported.

Note

The C5921 ESR software is bundled with Cisco ISE, Releases 2.2 and later. You need an ESR license to enable it. See Cisco 5921 Embedded Services Router Integration Guide for ESR licensing information.

Configure RADIUS IPsec on Cisco ISE

To configure RADIUS IPsec on Cisco ISE, you must:

Procedure

Step 1

Configure IP address on the interface from the Cisco ISE CLI.

Gigabit Ethernet 1 through Gigabit Ethernet 5 interfaces (Bond 1 and Bond 2) support IPsec. However, IPsec can be configured only on one interface in a Cisco ISE node.

Step 2

Add a directly connected network device to the IPsec network device group.

Note

RADIUS IPsec requires the static route gateway to be directly connected through an interface of the device.

Choose Administration > Network Resources > Network Devices.
In the Network Devices window, click Add.
Enter the name and IP address and subnet of the network device that you want to add in the corresponding fields.
From the IPSEC drop-down list, choose Yes.
Check the RADIUS Authentication Settings check box.
In the Shared Secret field, enter the shared secret key that you have configured on the network device.
Click Submit.

Step 3

(Optional; required only for Smart Licensing) Add a separate management interface to interact with the Cisco Smart Software Manager (CSSM). See Smart Software Manager satellite for information on Embedded Services Router (ESR). To do this, from the Cisco ISE CLI, run the following command to select the corresponding management interface (Gigabit Ethernet 1 to 5 (or Bond 1 or 2)):

ise/admin# license esr smart {interface}

This interface must be able to reach Cisco.com to access the Cisco online licensing server.

Step 4

Add a network device to a directly connected gateway from the Cisco ISE CLI.

ip route [ destination network] [ network mask] gateway [ next-hop address]

Step 5

Activate IPsec on Cisco ISE nodes.

Choose Administration > System > Settings > Protocols > IPSec.

All the Cisco ISE nodes in the deployment are listed in this window.
Check the check box next to the Cisco ISE node on which you want to activate IPsec, and then click the Enable radio button.
Choose the interface that you want to use for IPsec communication from the IPSec Interface for selected nodes: drop-down list.
Click the radio button for one the following authentication type for the selected Cisco ISE node:
- Pre-shared Key: If you choose this option, you must enter the pre-shared key and configure the same key on the network device. Use alphanumeric characters for the pre-shared key. Special characters are not supported. For instructions on how to configure the pre-shared key on the network device, see the network device documentation. For an example of the pre-shared key configuration output, see Example: Output of Pre-shared Key Configuration on Cisco Catalyst 3850 Series Switches.
- X.509 Certificates: If you choose this option, from the Cisco ISE CLI, go to the ESR shell and configure and install X.509 Certificates for ESR 5921. Then, configure the network device for IPsec. For instructions, see Configure and Install X.509 Certificates on ESR-5921.
Click Save.

Note

You cannot modify IPsec configurations directly. To modify the IPsec tunnel or authentication when IPsec is enabled, disable the current IPsec tunnel, modify the IPsec configuration, and then re-enable the IPsec tunnel with a different configuration.

Note

When enabled, IPsec removes the IP address from the Cisco ISE interface and shuts down the interface. When the user logs in from Cisco ISE CLI, the interface is displayed with no IP address and in shutdown state. This IP address will be configured on the ESR-5921 interface.

Step 6

Type esr to enter into the ESR shell.

ise/admin# esr
% Entering ESR 5921 shell
% Cisco IOS Software, C5921 Software (C5921_I86-UNIVERSALK9-M), Version 15.5(2)T2, RELEASE SOFTWARE (fc3)
% Technical Support: http://www.cisco.com/techsupport
% Copyright (c) 1986-2015 Cisco Systems, Inc.

Press RETURN to get started, CTRL-C to exit

ise-esr5921>
ise-esr5921>

Note

For FIPS compliance, you must configure a secret password that is at least eight characters in length. Enter the Enable secret level 1 command to specify the password:

ise-esr5921(config)#enable secret level 1 ?
0 Specifies an UNENCRYPTED password will follow
5 Specifies a MD5 HASHED secret will follow
8 Specifies a PBKDF2 HASHED secret will follow
9 Specifies a SCRYPT HASHED secret will follow
LINE The UNENCRYPTED (cleartext) 'enable' secret

Note

If you configure customized RADIUS ports from the GUI (other than 1645, 1646, 1812, and 1813), you must enter the following CLI command in the ESR shell to accept the configured RADIUS ports:

ip nat inside source static udp 10.1.1.2 [port_number] interface Ethernet0/0 [port_number]

Step 7

(Optional; required only if you have not enabled Smart Licensing in Step 3) Add a Cisco ISE Classic license or an Evaluation license (that is valid for 90 days) to the Cisco ISE appliances.

Run the following command from the Cisco ISE CLI to download the license file:
```
ise/admin# license esr classic import esr.lic repository esrrepo
```
For more information on Cisco ISE Classic licensing, see the section: Licensing the Software with Classic Licensing in Cisco 5921 Embedded Services Router Integration Guide.

Step 8

Verify IPsec tunnel and RADIUS authentication over IPsec tunnel.

Add a user in Cisco ISE and assign the user to a user group (Administration > Identity Management > Identities > Users).

Carry out the following steps to verify if the IPsec tunnel is established between Cisco ISE and the NAD:

Use the ping command to test if the connection between Cisco ISE and the NAD is established.

Run the following command from the ESR shell or the NAD CLI to verify if the connection is in the active state:

show crypto isakmp sa

ise-esr5921#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
192.168.30.1    192.168.30.3    QM_IDLE           1001 ACTIVE

Run the following command from the ESR shell or the NAD CLI to verify if the tunnel is established:

show crypto ipsec sa

ise-esr5921#show crypto ipsec sa

interface: Ethernet0/0
    Crypto map tag: radius, local addr 192.168.30.1 

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (192.168.30.1/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (192.168.30.2/255.255.255.255/0/0)
   current_peer 192.168.30.2 port 500
     PERMIT, flags={}
    #pkts encaps: 52, #pkts encrypt: 52, #pkts digest: 52
    #pkts decaps: 57, #pkts decrypt: 57, #pkts verify: 57
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 192.168.30.1, remote crypto endpt.: 192.168.30.2
     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
     current outbound spi: 0x393783B6(959939510)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x8EA0F6EE(2392913646)
        transform: esp-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 99, flow_id: SW:99, sibling_flags 80000040, crypto map: radius
        sa timing: remaining key lifetime (k/sec): (4237963/2229)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x393783B6(959939510)
        transform: esp-aes esp-sha256-hmac ,
        in use settings ={Tunnel, }
        conn id: 100, flow_id: SW:100, sibling_flags 80000040, crypto map: radius
        sa timing: remaining key lifetime (k/sec): (4237970/2229)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:

Verify the RADIUS authentication using one of the following methods:
- Log in to the network device using the credentials of the user that you created in Step 8 (a). The RADIUS authentication request is sent to the Cisco ISE node. View the details in the Live Authentications window.
- Connect the end host with the network device and configure 802.1X authentication. Log in to the end host using the credentials of the user that you created in Step 8 (a). The RADIUS authentication request is sent to the Cisco ISE node. View the details in the Live Authentications window.

Configure and Install X.509 Certificates on ESR-5921

Procedure

Step 1

Type esr to enter into the ESR shell.

ise/admin# esr
% Entering ESR 5921 shell
% Cisco IOS Software, C5921 Software (C5921_I86-UNIVERSALK9-M), Version 15.5(2)T2, RELEASE SOFTWARE (fc3)
% Technical Support: http://www.cisco.com/techsupport
% Copyright (c) 1986-2015 Cisco Systems, Inc.

Press RETURN to get started, CTRL-C to exit

ise-esr5921>
ise-esr5921>

Note

For FIPS compliance, you must configure a secret password that is at least eight characters in length. Enter the Enable secret level 1 command to specify the password:

ise-esr5921(config)#enable secret level 1 ?
0 Specifies an UNENCRYPTED password will follow
5 Specifies a MD5 HASHED secret will follow
8 Specifies a PBKDF2 HASHED secret will follow
9 Specifies a SCRYPT HASHED secret will follow
LINE The UNENCRYPTED (cleartext) 'enable' secret

Note

If you configure customized RADIUS ports from the GUI (other than 1645, 1646, 1812, and 1813), you must enter the following CLI command in the ESR shell to accept the RADIUS ports that are configured:

ip nat inside source static udp 10.1.1.2 [port_number] interface Ethernet0/0 [port_number]

Step 2

Generate an RSA key pair using the following command:

Example:

crypto key generate rsa label rsa2048 exportable modulus 2048

Step 3

Create a trustpoint using the following command:

Example:

crypto pki trustpoint trustpoint-name

enrollment terminal
serial-number none
fqdn none
ip-address none
subject-name cn=networkdevicename.cisco.com
revocation-check none
rsakeypair rsa2048

Step 4

Generate a certificate signing request using the following command:

Example:

crypto pki enroll rsaca-mytrustpoint

Display Certificate Request to terminal? [yes/no]: yes

Step 5

Copy the output of the certificate signing request to a text file, submit it to an external CA for signing, and obtain the signed certificate and the CA certificate.

Step 6

Import the Certificate Authority (CA) certificate using the following command:

Example:

crypto pki authenticate rsaca-mytrustpoint

Copy and paste the contents of the CA certificate, including the "—BEGIN—" and "—-End—" lines.

Step 7

Import the signed certificate using the following command:

Example:

crypto pki import rsaca-mytrustpoint

Copy and paste the contents of the signed certificate, including the "—BEGIN—" and "—-End—" lines.

The following is an example of the output that is displayed when you configure and install X.509 Certificates on Cisco 5921 ESR:

ise-esr5921#show running-config
!
hostname ise-esr5921
!
boot-start-marker
boot host unix:default-config
boot-end-marker
!
no aaa new-model
bsd-client server url https://cloudsso.cisco.com/as/token.oauth2
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
call-home
! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
profile "CiscoTAC-1"
  active
  destination transport-method http
  no destination transport-method email
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
!
crypto pki trustpoint rsaca-mytrustpoint
enrollment terminal
serial-number none
fqdn none
ip-address none
subject-name cn=ise-5921.cisco.com
revocation-check none
rsakeypair rsa2048
!
crypto pki certificate chain SLA-TrustPoint
certificate ca 01
  30820321 30820209 A0030201 02020101 300D0609 2A864886 F70D0101 0B050030
  32310E30 0C060355 040A1305 43697363 6F312030 1E060355 04031317 43697363
  6F204C69 63656E73 696E6720 526F6F74 20434130 1E170D31 33303533 30313934
  3834375A 170D3338 30353330 31393438 34375A30 32310E30 0C060355 040A1305
  43697363 6F312030 1E060355 04031317 43697363 6F204C69 63656E73 696E6720
  526F6F74 20434130 82012230 0D06092A 864886F7 0D010101 05000382 010F0030
  82010A02 82010100 A6BCBD96 131E05F7 145EA72C 2CD686E6 17222EA1 F1EFF64D
  CBB4C798 212AA147 C655D8D7 9471380D 8711441E 1AAF071A 9CAE6388 8A38E520
  1C394D78 462EF239 C659F715 B98C0A59 5BBB5CBD 0CFEBEA3 700A8BF7 D8F256EE
  4AA4E80D DB6FD1C9 60B1FD18 FFC69C96 6FA68957 A2617DE7 104FDC5F EA2956AC
  7390A3EB 2B5436AD C847A2C5 DAB553EB 69A9A535 58E9F3E3 C0BD23CF 58BD7188
  68E69491 20F320E7 948E71D7 AE3BCC84 F10684C7 4BC8E00F 539BA42B 42C68BB7
  C7479096 B4CB2D62 EA2F505D C7B062A4 6811D95B E8250FC4 5D5D5FB8 8F27D191
  C55F0D76 61F9A4CD 3D992327 A8BB03BD 4E6D7069 7CBADF8B DF5F4368 95135E44
  DFC7C6CF 04DD7FD1 02030100 01A34230 40300E06 03551D0F 0101FF04 04030201
  06300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 1449DC85
  4B3D31E5 1B3E6A17 606AF333 3D3B4C73 E8300D06 092A8648 86F70D01 010B0500
  03820101 00507F24 D3932A66 86025D9F E838AE5C 6D4DF6B0 49631C78 240DA905
  604EDCDE FF4FED2B 77FC460E CD636FDB DD44681E 3A5673AB 9093D3B1 6C9E3D8B
  D98987BF E40CBD9E 1AECA0C2 2189BB5C 8FA85686 CD98B646 5575B146 8DFC66A8
  467A3DF4 4D565700 6ADF0F0D CF835015 3C04FF7C 21E878AC 11BA9CD2 55A9232C
  7CA7B7E6 C1AF74F6 152E99B7 B1FCF9BB E973DE7F 5BDDEB86 C71E3B49 1765308B
  5FB0DA06 B92AFE7F 494E8A9E 07B85737 F3A58BE1 1A48A229 C37C1E69 39F08678
  80DDCD16 D6BACECA EEBC7CF9 8428787B 35202CDC 60E4616A B623CDBD 230E3AFB
  418616A9 4093E049 4D10AB75 27E86F73 932E35B5 8862FDAE 0275156F 719BB2F0
  D697DF7F 28
        quit
crypto pki certificate chain rsaca-mytrustpoint
certificate 39
  30820386 3082026E A0030201 02020139 300D0609 2A864886 F70D0101 0B050030
  61310B30 09060355 04061302 5553310B 30090603 5504080C 024E4331 0C300A06
  03550407 0C035254 50310E30 0C060355 040A0C05 43495343 4F310C30 0A060355
  040B0C03 53544F31 19301706 03550403 0C107273 6163612E 65726368 616F2E63
  6F6D301E 170D3136 30393031 32313037 34335A17 0D313730 39303132 31303734
  335A301D 311B3019 06035504 03131269 73652D35 3932312E 63697363 6F2E636F
  6D308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201 0A028201
  0100EE87 CABFBA18 7E0405A8 ACAAAB23 E7CB6109 2CF98BAE 8EE93536 BF1EBBD3
  73E60BE7 F430B5AF EBF8B0C5 969B2828 A6783BB4 64E333E4 29C8744E 6E783617
  194AF1B0 7F04B4EA B89FD6EB F9C4F2DD 196DC6E0 CAA49B8B 665B6E0D 2FBC1D2F
  8E8181B9 60FAE126 D1B2E4E4 1F321A97 10C1B76A C2BB3174 361B13FA 2CB7BDFE
  22C0C33F 2792D714 C41E2237 00B1AE49 6593DCC3 A799D526 D81F9706 A71DA14E
  5ED76038 7A2C84B4 C668E35C 337BA1DC 9CA56AC2 C8E0059F 660CE39C 925310A0
  F9A21FFB 3C3C507A 20B924F7 E0125D60 6552321C 35736079 42449401 15E68DA6
  B4776DAA FB5AFDF8 59E31373 263175E3 1F14416A 24C21D69 A46173B6 96CC84FB
  5B9D0203 010001A3 818C3081 89300906 03551D13 04023000 302C0609 60864801
  86F84201 0D041F16 1D4F7065 6E53534C 2047656E 65726174 65642043 65727469
  66696361 7465301D 0603551D 0E041604 146DD31C 03690B98 330B67FA 6EDC7B20
  F99FB924 60301F06 03551D23 04183016 8014966A 0C21AF96 3E827690 423599CC
  EE8087A1 2909300E 0603551D 0F0101FF 04040302 05A0300D 06092A86 4886F70D
  01010B05 00038201 0100C0B9 D2845D97 6FFC16DB 01559659 BC1DECA6 E1A01965
  1F6CD459 E03D7ABE 91179FEB 08BF5B9B 84B62C36 236F528E E30C921C 81DA29E1
  EA3DFDC1 B0B0EEBA 14EADAEC 078576E4 D643A0EF 7D8E0880 C5FC3965 811B08C0
  5696DBF5 FADA4092 ACF549B8 2257F508 636D52AA 6CDC9596 AB43313F 6C33C9C1
  2CFDDBE3 EA9D407C 8D1B0F49 BBACD0CD 2832AC12 CD3FEFC8 501E1639 A4EFDC27
  69CA0147 971A1B2D DB2758E6 A84AFC86 4F9A4942 3D7EDBCC 7BDCC1BB 61F69B31
  BF13E39B 10AAC31C 55E73C8B C30BE516 7C506FF4 AC367D94 814A6880 EF201A6D
  CD2E1A95 7BBEC982 01CE867D 931F56E1 1EF1C457 9DC9A0BE 9DB2DC9B 19873585
  89AE82F6 A37E51D6 EECD
        quit
certificate ca 008DD3A81106B14664
  308203A2 3082028A A0030201 02020900 8DD3A811 06B14664 300D0609 2A864886
  F70D0101 05050030 61310B30 09060355 04061302 5553310B 30090603 5504080C
  024E4331 0C300A06 03550407 0C035254 50310E30 0C060355 040A0C05 43495343
  4F310C30 0A060355 040B0C03 53544F31 19301706 03550403 0C107273 6163612E
  65726368 616F2E63 6F6D301E 170D3135 31303231 32313135 34335A17 0D323531
  30313832 31313534 335A3061 310B3009 06035504 06130255 53310B30 09060355
  04080C02 4E43310C 300A0603 5504070C 03525450 310E300C 06035504 0A0C0543
  4953434F 310C300A 06035504 0B0C0353 544F3119 30170603 5504030C 10727361
  63612E65 72636861 6F2E636F 6D308201 22300D06 092A8648 86F70D01 01010500
  0382010F 00308201 0A028201 0100CB82 2AECEE38 1BCB27B9 FA5F2FBD 8609B190
  16A6F741 5BEC18B8 8B260CAF 190EA1CE 063BC558 556DC085 6FAC5425 14AFE225
  0E9E3A12 05F3DA7E D17E03F2 7FFE92FB 38D67027 DBC5C175 EB53E96B 66C20D11
  B4C32D38 AE04385C 8FD4CB74 31A97824 CA1CAFD5 091806C3 6F9CBF8D DC42DD5B
  D985703D F3BB9ED1 7DE99614 422D765C 86AB25CD E80008C5 22049BE8 66D1CA27
  E1EB6D4F 4FD3CC18 E091BBF0 6FE0EB52 B33F231A 6D6B7190 4196C929 D22E2C42
  B9CD2BBD 24550E82 8CD8838F C41B4DAD 2FA1636A 5787BBB2 F21E4718 335B005B
  DFBE6EA7 56EBE30B D52DE85F FFAF0189 E372CBFC 44BFF235 4DA7C9EF DAAC6D0A
  A196DA5A 1B525175 C26B3581 EA4B0203 010001A3 5D305B30 1D060355 1D0E0416
  0414966A 0C21AF96 3E827690 423599CC EE8087A1 2909301F 0603551D 23041830
  16801496 6A0C21AF 963E8276 90423599 CCEE8087 A1290930 0C060355 1D130405
  30030101 FF300B06 03551D0F 04040302 02A4300D 06092A86 4886F70D 01010505
  00038201 01002334 A3F0E5D3 4D229985 67A07754 73EC52E3 05B7D05F 926CC863
  220F849B 861C36B2 EF7C3485 474D4EF0 73895879 CAE08BBB 183B7CFA A20C4354
  86C6D9DF D445DACE C252C608 236F6673 F3F3C329 474B22E8 660BF91E 41054B8D
  43B80E44 AE69C164 2C9F41A2 8284F577 21FFAB8E A6771A5E DD34EBE4 A0DC2EAD
  95702010 02964566 478DA90F 5E134643 81A5F5EA 362D0394 1F9F23D1 DEE50B07
  12938299 1AF11A36 82DAFC6A 164B2F66 8B0AB7CC 9A723EBC B50E740B 0A9270E3
  60E2ED42 7F10D1A6 F6735144 AE93BF86 3D5A0502 6811D2BD 6E694693 28DE84C5
  3747CF0A D2B8D6C9 6CBEBA0A D1137CF8 E31CBF6B 437D82DD D74A4A9F 3557B3D9
  D0BD055F 65A8
        quit
license udi pid CISCO5921-K9 sn 9XG4481W768
username lab password 0 lab
!
redundancy
!
crypto keyring MVPN-spokes
rsa-pubkey address 0.0.0.0
  address 0.0.0.0
  key-string
  quit
!     
crypto isakmp policy 10
encr aes
hash sha256
group 16
!
crypto isakmp policy 20
encr aes
hash sha256
group 14
crypto isakmp profile MVPN-profile
   description LAN-to-LAN for spoke router(s) connection
   keyring MVPN-spokes
   match identity address 0.0.0.0
!
crypto ipsec transform-set radius esp-aes esp-sha256-hmac
mode tunnel
crypto ipsec transform-set radius-2 esp-aes esp-sha256-hmac
mode transport
!
crypto dynamic-map MVPN-dynmap 10
set transform-set radius radius-2
!
crypto map radius 10 ipsec-isakmp dynamic MVPN-dynmap
!
interface Ethernet0/0
description e0/0->connection to external NAD
ip address 192.168.20.1 255.255.255.0
ip nat outside
ip virtual-reassembly in
no ip route-cache
crypto map radius
!
interface Ethernet0/1
description e0/1->tap0 internal connection to ISE
ip address 10.1.1.1 255.255.255.252
ip nat inside
ip virtual-reassembly in
no ip route-cache
!
interface Ethernet0/2
no ip address
shutdown
!
interface Ethernet0/3
no ip address
shutdown
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface Ethernet0/0 overload
ip nat inside source static udp 10.1.1.2 1645 interface Ethernet0/0 1645
ip nat inside source static udp 10.1.1.2 1646 interface Ethernet0/0 1646
ip nat inside source static udp 10.1.1.2 1812 interface Ethernet0/0 1812
ip nat inside source static udp 10.1.1.2 1813 interface Ethernet0/0 1813
!
access-list 1 permit 10.1.1.0 0.0.0.3
!
control-plane
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
transport input none
!
end

The following is an example of the output that is displayed when you configure and install X.509 certificates on Cisco Catalyst 3850 Series Switches:

cat3850#show running-config

enable password lab
!
username lab password 0 lab
aaa new-model

!

aaa group server radius ise
server name ise-vm
deadtime 60
!
aaa authentication login default group radius local

aaa authentication enable default group radius enable

!

crypto isakmp policy 10

encr aes

hash sha256
authentication rsa-sig
group 16       
!
crypto ipsec security-association lifetime seconds 86400
!
crypto ipsec transform-set radius esp-aes esp-sha256-hmac 
mode tunnel

!

crypto ipsec profile radius-profile

!

crypto map radius 10 ipsec-isakmp 
set peer 192.168.20.1
set transform-set radius 

match address 100 

!

interface GigabitEthernet1/0/1
no switchport
ip address 192.168.20.2 255.255.255.0

crypto map radius 

!
access-list 100 permit ip host 192.168.20.2 host 192.168.20.1
!
snmp-server community public RO
snmp-server community private RW
!
radius server rad-ise
address ipv4 192.168.20.1 auth-port 1645 acct-port 1646

key secret

Example: Output of Pre-shared Key Configuration on Cisco Catalyst 3850 Series Switches

The following is an example of the output that is displayed when you configure the pre-shared key on Cisco Catalyst 3850 Series Switches:

cat3850#show running-config

enable password lab
 !
 username lab password 0 lab
 aaa new-model
 !
 aaa group server radius ise
 server name ise-vm
 deadtime 60
 !
 aaa authentication login default group radius local

 aaa authentication enable default group radius enable

!

crypto isakmp policy 10

 encr aes

 hash sha256
 authentication pre-share
 group 16
 crypto isakmp key 123456789 address 0.0.0.0        
 !
 crypto ipsec security-association lifetime seconds 86400
 !
 crypto ipsec transform-set radius esp-aes esp-sha256-hmac 
 mode tunnel
 !
 crypto ipsec profile radius-profile
 !
 crypto map radius 10 ipsec-isakmp 
 set peer 192.168.20.1
 set transform-set radius 
 match address 100 
!
interface GigabitEthernet1/0/1
 no switchport
 ip address 192.168.20.2 255.255.255.0

 crypto map radius 
!
 access-list 100 permit ip host 192.168.20.2 host 192.168.20.1
 !
 snmp-server community public RO
 snmp-server community private RW
 !
 radius server rad-ise
 address ipv4 192.168.20.1 auth-port 1645 acct-port 1646

 key secret

Mobile Device Manager Interoperability with Cisco ISE

Mobile Device Management (MDM) servers secure, monitor, manage, and support mobile devices that are deployed across mobile operators, service providers, and enterprises. Traditionally, MDM servers have only supported mobile devices. Some MDM servers now manage all types of devices in a network (mobile phones, tablets, laptops, and desktops) and are called Unified Endpoint Management (UEM) servers. MDM servers act as a policy server that controls the use of some applications on a mobile device (for example, an email application) in the deployed environment. Cisco ISE queries a connected MDM server for information about various attributes that you can use to create network authorization policies.

You can run multiple active MDM servers on your network, from different vendors. This allows you to route different endpoints to different MDM servers based on device factors such as location or device type.

Cisco ISE also integrates with MDM servers using the Cisco MDM Server Info APIs, Version 2 and later versions, to allow devices to access the network over VPN via Cisco AnyConnect 4.1 and Cisco Adaptive Security Appliances 9.3.2 or later.

In the following illustration, Cisco ISE is the enforcement point and the MDM policy server is the policy information point. Cisco ISE obtains data from the MDM server to provide a complete solution.

Figure 3. MDM Interoperability with Cisco ISE

Configure Cisco ISE to interoperate with one or more external MDM servers. By setting up this type of third-party connection, you can use the detailed information available in the MDM database. Cisco ISE uses REST API calls to retrieve information from the external MDM server. Cisco ISE applies the appropriate access control policies to switches, access routers, wireless access points, and other network access points. The policies give you greater control of the remote devices that are accessing the Cisco ISE-enabled network.

For a list of the MDM vendors supported by Cisco ISE, see Supported Unified Endpoint Management and Mobile Device Management Servers.

Supported Mobile Device Management Use Cases

Cisco ISE performs the following functions with external MDM servers:

Manages device registration: Unregistered endpoints that access the network are redirected to a registration page that is hosted on the MDM server. Device registration includes the user role, device type, and so on.
Handles device remediation: Endpoints are granted restricted access during remediation.
Augments endpoint data: The endpoint database is updated with information from the MDM server that you cannot gather using the Cisco ISE profiling services. Cisco ISE uses multiple device attributes that you can view in the Endpoints window. Choose Work Centers > Network Access > Identities > Endpoints.

The following are examples of the device attributes available.

MDMImei: xx xxxxxx xxxxxx x
MDMManufacturer: Apple
MDMModel: iPhone
MDMOSVersion: iOS 6.0.0
MDMPhoneNumber: 5550100
MDMSerialNumber: DNPGQZGUDTFx

Polls the MDM server every four hours for device compliance data. Configure the polling interval in the External MDM Servers window. (To view this window, choose Work Centers > Network Access > Network Resources > External MDM Servers.
Issues device instructions through the MDM server: Cisco ISE issues remote actions for user devices through the MDM server. Initiate remote actions from the Cisco ISE administration portal through the Endpoints window. To view this window, choose Context Visibility > Endpoints. Check the check box next to the MDM server and click MDM Actions. Choose the required action from the drop-down list displayed.

Vendor MDM Attributes

When you configure an MDM server in Cisco ISE, Cisco ISE queries the MDM server for device attribute information and adds the information to the MDM system dictionary. The following attributes are used for registration status, and are commonly supported by MDM vendors.

Cisco ISE uses APIs to query MDM servers for the required device attributes. Cisco ISE Release 3.1 and later releases support MDM APIs Version 3. The Version 3 APIs include APIs that allow Cisco ISE to send queries to MDM servers for device attributes that help Cisco ISE identify endpoints that use MAC address randomization. Cisco ISE queries the MDM server for the following attributes:

GUID: A unique device identifier that replaces the use of MAC address to identify a device.
MAC addresses: The list of MAC addresses that a UEM or MDM server has recorded for a particular device. A maximum of five MAC addresses are shared for a device.

If an MDM server does not provide values for the required attributes, Cisco ISE fills the attributes fields with the default values that are mentioned in the following table.

Table 4. MDM Attributes and Values
Attribute Name	Attribute Dictionary	Default Value	Data That is Expected From UEM or MDM Servers	Data That is Expected From Microsoft SCCM Servers
DaysSinceLastCheckin Supported from MDM API Version 3	MDM	None	The number of days since a user has last checked in or synchronized a device with the UEM or MDM server. The valid range is 1–365 days.	The number of days since a user has last checked in or synchronized a device with the SCCM server. The valid range is 1–365 days.
DeviceCompliantStatus	MDM	NonCompliant	Compliant or NonCompliant.	Compliant or NonCompliant.
DeviceRegisterStatus	MDM	UnRegistered	Registered or UnRegistered.	Registered or UnRegistered.
DiskEncryptionStatus	MDM	Off	On or Off.	On or Off.
IMEI	MDM	None	The IMEI number of the device.	Not applicable.
JailBrokenStatus	MDM	Unbroken	Reachable or UnReachable.	Reachable or UnReachable.
MDMFailureReason	MDM	None	The device failure reason.	The device failure reason.
MDMServerName	MDM	None	The name of the server.	The name of the server.
MDMServerReachable	MDM	Reachable	Reachable or UnReachable.	Reachable or UnReachable.
MEID	MDM	None	The MEID value of the device.	Not applicable.
Manufacturer	MDM	None	The name of the device manufacturer.	Not applicable.
Model	MDM	None	The name of the device model.	Not applicable.
OsVersion	MDM	None	The operating system version of the device.	Not applicable.
PhoneNumber	MDM	None	The phone number of the device.	Not applicable.
PinLockStatus	MDM	Off	On or Off.	Not applicable.
SerialNumber	MDM	None	The serial number of the device.	Not applicable.
ServerType	MDM	None	MDM for a Mobile Device Manager server. DM for Desktop Device Manager server.	DM for Desktop Device Manager server.
UDID	MDM	None	The UDID number of the device.	Not applicable.
UserNotified	MDM	No	Yes or No	Not applicable.

If a vendor's unique attributes are not supported, you may be able to use ERS APIs to exchange vendor-specific attributes. Check the vendor's documentation for information on the ERS APIs that are supported.

The new MDM dictionary attributes are available for use in authorization policies.

Supported Unified Endpoint Management and Mobile Device Management Servers

Supported MDM servers include products from the following vendors:

Absolute
Blackberry - BES
Blackberry - Good Secure EMM
Cisco Meraki Systems Manager
Citrix XenMobile 10.x (On-prem)
Globo
IBM MaaS360

Ivanti (previously MobileIron UEM), core and cloud UEM services

Note

Some versions of MobileIron do not work with Cisco ISE. MobileIron is aware of this problem, and have a fix. Please contact MobileIron for more information.

JAMF Casper Suite
Microsoft Endpoint Configuration Manager
Microsoft Endpoint Manager Intune
Mosyle
SAP Afaria
Sophos
SOTI MobiControl
Symantec
Tangoe
VMware Workspace ONE (earlier known as AirWatch)
42 Gears

For the configurations that you must perform in your endpoint management servers to integrate the servers with Cisco ISE, see Integrate UEM and MDM Servers With Cisco ISE.

ISE Community Resource

How To: Meraki EMM / MDM Integration with ISE

Ports Used by the Mobile Device Management Server

The following table lists the ports that must be open between Cisco ISE and an MDM server to enable them to communicate with each other. See the documentation from the MDM vendor for a list of ports that must be open on the MDM agent and server.

Table 5. Ports Used by the MDM Server
MDM Server	Ports
MobileIron	443
Zenprise	443
Good	19005
Airwatch	443
Afaria	443
Fiberlink MaaS	443
Meraki	443
Microsoft Intune	80 and 443
Microsoft SCCM	80 and 443

Mobile Device Management Integration Process Flow

The user associates a device with an SSID.
Cisco ISE makes an API call to the MDM server.

This API call returns a list of devices for the user and the posture statuses for the devices.

Note

The input parameter is the MAC address of the endpoint device. For off-premise Apple iOS devices , the input parameter is the UDID.

If the user’s device is not on this list, it means that the device is not registered. Cisco ISE sends an authorization request to the NAD to redirect to Cisco ISE. The user is presented with the MDM server page.

Note

You must register a device that is enrolled on the MDM server outside of a Cisco ISE network via the MDM portal. This is applicable for Cisco ISE Release 1.4 and later. Earlier Cisco ISE versions allow devices that are enrolled outside the Cisco ISE-enabled network to be automatically enrolled if they are compliant with the posture policies.

Cisco ISE uses MDM to provision the device and presents the appropriate window for the user to register the device.
The user registers the device in the MDM server, and the MDM server redirects the request to Cisco ISE through automatic redirection or manual browser refresh.
Cisco ISE queries the MDM server again for the posture status.
If the user’s device is not compliant with the posture (compliance) policies that are configured on the MDM server, the user is notified that the device is out of compliance. The user must take the necessary action to ensure that the device is compliant.
When the user’s device is compliant, the MDM server updates the device's state in its internal tables.
If the user refreshes the browser now, the control is transferred back to Cisco ISE.
Cisco ISE polls the MDM server once every four hours to get compliance information and issues the appropriate Change of Authorization (CoA). You can configure the polling interval. Cisco ISE also checks the MDM server every five minutes to make sure that it is available.

The following figure illustrates the MDM process flow.

Note

A device can only be enrolled in a single MDM server at a time. If you want to enroll the same device to an MDM service from another vendor, the previous vendor's profiles must be removed from the device. The MDM service usually offers a "corporate wipe", which only deletes the vendor's configuration from the device (not the whole device). The user can also remove the files. For example, on an iOS device, the user can go to the Settings > General >Device management window, and click Remove Management. Or the user can go to the MyDevices portal in Cisco ISE and click Corporate Wipe.

Set Up Mobile Device Management Servers with Cisco ISE

To set up MDM servers with Cisco ISE, you must perform the following high-level tasks:

Procedure

Step 1	Import the MDM server certificate into Cisco ISE, except for Intune, where you import the Policy Administration node's (PAN) certificate into Azure.
Step 2	Create mobile device manager definitions.
Step 3	Configure ACLs on the Wireless LAN Controllers.
Step 4	Configure an authorization profile that redirects nonregistered devices to the MDM server.
Step 5	If there are multiple MDM servers on the network, configure separate authorization profiles for each vendor.
Step 6	Configure authorization policy rules for the MDM use cases.

Import Mobile Device Management Server Certificate into Cisco ISE

For Cisco ISE to connect with the MDM server, you must import the MDM server certificate into the Cisco ISE Trusted Certificates store. If your MDM server has a CA-signed certificate, you must import the root certificate into the Cisco ISE Trusted Certificates store.

Note

For Microsoft Azure, import the Cisco ISE certificate into Azure. See Connect Microsoft Intune to Cisco ISE as a Mobile Device Management Server.

Procedure

Step 1	Export the MDM server certificate from your MDM server and save it on your local machine.
Step 2	Choose Administration > System > Certificates > Trusted Certificate > Import.
Step 3	In the Import a new Certificate into the Certificate Store window, click Browse to select the MDM server certificate that you obtained from the MDM server.
Step 4	Add a name for the certificate in the Friendly Name field.
Step 5	Check the Trust for authentication within ISE check box.
Step 6	Click Submit.
Step 7	Verify that the Trust Certificates window lists the newly added MDM server certificate.

Define Device Management Servers in Cisco ISE

Define mobile and desktop device management servers in Cisco ISE to allow Cisco ISE to communicate with the required servers. You can configure the authentication type used to communicate with the servers, the frequency at which Cisco ISE requests device information from a device management server, and so on.

To define a mobile management server, see Configure Mobile Device Management Servers in Cisco ISE.

To define a Microsoft System Center Configuration Manager (SCCM) server, see Define Microsoft System Center Configuration Manager Servers in Cisco ISE.

Define Microsoft System Center Configuration Manager Servers in Cisco ISE

Procedure

Step 1	Choose Administration > Network Resources > External MDM > MDM Servers.
Step 2	In the MDM Servers window, click Add.
Step 3	Choose Desktop Device Manager from the Server Type drop-down list.
Step 4	In the Host Name / IP Address field, enter the hostname or IP address of the Microsoft SCCM server.
Step 5	In the Instance Name field, if the Microsoft SCCM server has several instances, enter the instance that you want to connect to.
Step 6	In the Username field, enter the username that must be used to connect to the Microsoft SCCM server.
Step 7	In the Password field, enter the password that must be used to connect to the Microsoft SCCM server.
Step 8	In the Time Interval For Compliance Device ReAuth Query field, enter a value from 1 to 1440 minutes. The default value is one minute. When an endpoint is authenticated or reauthenticated, Cisco ISE uses a cache to get the MDM variables for that endpoint. If the age of the cached value is higher than the value configured in this field, Cisco ISE sends a new device query to the MDM server to get new values. If the compliance status has changed, then Cisco ISE triggers the appropriate CoA.
Step 9	Choose Enabled from the Status drop-down list.
Step 10	Click Test Connection to check if Cisco ISE can connect to the defined Microsoft SCCM server.
Step 11	Click Save.

Configure Mobile Device Management Servers in Cisco ISE

The following image displays the Cisco ISE GUI fields that you must work with during this task. The numbers in the image correspond to the step numbers in the following task.

Figure 4. Add an MDM Server in Cisco ISE

Procedure

Step 1

Choose Administration > Network Resources > External MDM.

Step 2

In the MDM Servers window, click Add.

Step 3

Enter the name and description of the MDM server that you want to add in the corresponding fields.

Step 4

From the Server Type drop-down list, choose Mobile Device Manager.

Step 5

From the Authentication Type drop-down list, choose either Basic or OAuth - Client Credentials.

If you choose the Basic authentication type, the following fields are displayed:

Host Name / IP Address: Enter the hostname or IP address of the MDM server.
Port: Specify the port to be used when connecting to the MDM server, which is usually 443.
Instance Name: If this MDM server has several instances, enter the instance that you want to connect to.
Username: Enter the username that must be used to connect to the MDM server.
Password: Enter the password that must be used to connect to the MDM server.

If you choose the OAuth - Client Credentials authentication type, the following fields are displayed:

From the Auto Discovery drop-down list, choose Yes or No.
Auto Discovery URL: Enter the value of Microsoft Azure AD Graph API Endpoint from the Microsoft Azure management portal. This URL is the endpoint at which an application can access directory data in your Microsoft Azure AD directory using the Graph API. For more information, see Integrate MDM and UEM Servers with Cisco ISE.
Client ID: The unique identifier for your application. Use this attribute if your application accesses data in another application, such as the Microsoft Azure AD Graph API, Microsoft Intune API, and so on.
Token Issuing URL: Enter the value of the Oauth2.0 Authorization Endpoint. This is the endpoint from which Cisco ISE obtains an access token using OAuth2.0.
Token Audience: The recipient resource that the token is intended for, which is a public, well-known APP ID URL to the Microsoft Intune API.

Time Interval For Compliance Device ReAuth Query: When an endpoint is authenticated or reauthenticated, Cisco ISE uses a cache to get the MDM variables for that endpoint. If the age of the cached value is higher than the value configured in this field, Cisco ISE sends a new device query to the MDM server to get new values. If the compliance status has changed, then Cisco ISE triggers the appropriate CoA. The valid range is from 1 to 1440 minutes. The default value is one minute.

Polling Interval: Enter the polling interval, in minutes, for Cisco ISE to poll the MDM server for noncompliant endpoints. Set this value to match the polling interval on your MDM server. The valid range is from 15 to 240 minutes.The default value is 240 minutes. We recommend that you set the polling interval more than 60 minutes in production environments to minimize any performance impact that might occur due to large numbers of noncompliant endpoints.

If you set the polling interval to 0, Cisco ISE disables polling with the MDM server.

Note

If the external MDM server receives requests from more than 20000 noncompliant endpoints, the external MDM server polling interval is automatically set to 0. You also receive the following alarm on Cisco ISE:

MDM Compliance Polling Disabled: Reason is Periodic Compliance Polling received huge non-compliance device information.

Step 6

From the Status drop-down list, choose Enabled.

Step 7

To verify whether the MDM server is connected to Cisco ISE, click Test Connection. Note that Test Connection is not intended to check permissions for all the use cases (get baselines, get device information, and so on). These are validated when the server is added to Cisco ISE.

Step 8

Click Save.

Cisco ISE Mobile Device Management Support for Microsoft Intune and Microsoft System Center Configuration Manager

Microsoft Intune: Cisco ISE supports Microsoft Intune device management as a partner MDM server to manage mobile devices.

Configure Cisco ISE as an OAuth 2.0 client application on the Microsoft Intune server managing mobile devices. Cisco ISE gets a token from Azure to establish a session with the Cisco ISE Intune application.

For information about how Microsoft Intune communicates with a client application, see https://msdn.microsoft.com/en-us/library/azure/dn645543.aspx.
Desktop Device Manager (Microsoft SCCM): Cisco ISE supports the Microsoft System Center Configuration Manager (SCCM) as a partner MDM server for managing Windows computers. Cisco ISE retrieves compliance information from the Microsoft SCCM server using WMI, and uses that information to grant or deny network access to a user's Windows device.

Microsoft SCCM Workflow

Cisco ISE retrieves information from the Microsoft SCCM server about whether a device is registered, and if it is registered, if it is compliant. The following diagram shows the workflow for devices that are managed by Microsoft SCCM.

When a device connects to the network and a Microsoft SCCM policy is matched, Cisco ISE queries the SCCM server that is specified in the authorization policy to retrieve compliance and last login (check-in) time. With this information, Cisco ISE updates the compliance status and the lastCheckinTimeStamp of the device in the Endpoint list.

If the device is not compliant or not registered with Microsoft SCCM, and a redirect profile is used in the authorization policy, a message is displayed to the user that the device is not compliant, or is not registered with the Microsoft SCCM. After the user acknowledges the message, Cisco ISE can issue a CoA to the Microsoft SCCM registration site. Users are granted access based on the authorization policy and profile.

Microsoft SCCM Server Connection Monitoring

You cannot configure polling intervals for Microsoft SCCM.

Cisco ISE runs an MDM HeartBeat job that verifies connection with the Microsoft SCCM server, and raises alarms if Cisco ISE loses the connection to the Microsoft SCCM server. The HeartBeat job interval cannot be configured.

Policy Set Example for Microsoft System Center Configuration Manager

The following new dictionary entries are used in policies to support Microsoft SCCM.

MDM.DaysSinceLastCheckin: The number of days since a user last checked in or synchronized a device with Microsoft SCCM. The value may range from 1 to 365 days.
MDM.UserNotified: The valid values are Y or N. The value indicates whether the user was notified that their device is not registered. You can then allow the user limited access to the network and then redirect them to the registration portal, or deny them access to the network.
MDM.ServerType: The valid value is MDM for MDM servers and DM for desktop device management.

The following is an example of a policy set that supports Microsoft SCCM.


Policy Name	If	Then
SCCM_Comp	Wireless_802.1X AND MDM:MDMServerName EQUALS SccmServer1 AND MDM:DeviceRegisterStatus EQUALS Registered	PermitAccess
SCCM_NonComp_Notify	Wireless_802.1X AND MDM:MDMServerName EQUALS SccmServer1 AND MDM:DeviceCompliantStatus EQUALS NonCompliant AND MDM:UserNotified EQUALS 28	PermitAccess
SCCM_NonComp_Days	Wireless_802.1X AND MDM:MDMServerName EQUALS SccmServer1 AND MDM:MDMDeviceCompliantStatus EQUALS Registered AND MDM:DaysSinceLastCheckin EQUALS 28	SCCMRedirect
SCCM_NonComp	Wireless_802.1X AND MDM:MDMServerName EQUALS SccmServer1 AND MDM:DeviceCompliantStatus EQUALS NonCompliant AND MDM:DeviceRegisterStatus EQUALS Registered	SCCMRedirect
SCCM_UnReg_Notify	Wireless_802.1X AND MDM:DeviceRegisterStatus EQUALS Registered AND MDM:UserNotified EQUALS Yes	PermitAccess

Configure the Microsoft System Center Configuration Manager Server for Cisco ISE

Cisco ISE communicates with the Microsoft SCCM server using Windows Management Instrumentation (WMI). Configure WMI on the Windows server running Microsoft SCCM.

Note

The user account that you use for Cisco ISE integration must either:

Be a member of the SMS Admins user group.
Have the same permissions as the SMS object under the WMI namespace:
```
root\sms\site_<sitecode>
```
where sitecode is the Microsoft SCCM site.

Set Permissions when Microsoft Active Directory Users are in Domain Admin Group

For Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2, the Domain Admin group does not have full control of certain registry keys in the Windows operating system by default. The Microsoft Active Directory administrator must give the Microsoft Active Directory user full control permissions on the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}
HKLM\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

The following Microsoft Active Directory versions require no registry changes:

Windows 2003
Windows 2003R2
Windows 2008

To grant full control, the Microsoft Active Directory admin must first take ownership of the key:

Procedure

Step 1	Right-click the key icon and choose the Owner tab.
Step 2	Click Permissions.
Step 3	Click Advanced.

Permissions for Microsoft Active Directory Users Not in Domain Admin Group

For Windows Server 2012 R2, give the Microsoft AD user full control permissions on the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}
HKLM\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

Use the following commands in Windows PowerShell to check if full permission is given to the registry keys:

get-acl -path "Microsoft.PowerShell.Core\Registry::HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}" | format-list
get-acl -path "hklm:\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}" | format-list

The following permissions are required when a Microsoft AD user is not in the Domain Admin group, but is in the Domain Users group:

Add registry keys to allow Cisco ISE to connect to the domain controller.
Permissions to Use DCOM on the Domain Controller
Set Permissions for Access to WMI Root and CIMv2 Namespace

These permissions are only required for the following Microsoft AD versions:

Windows 2003
Windows 2003R2
Windows 2008
Windows 2008 R2
Windows 2012
Windows 2012 R2
Windows 2016

Add Registry Keys to Allow Cisco ISE to Connect to the Domain Controller

You must manually add some registry keys to the domain controller to allow Cisco ISE to connect as a domain user, and retrieve login authentication events. An agent is not required on the domain controllers or on any machines in the domain.

The following registry script shows the keys to add. You can copy and paste this into a text file, save the file with a .reg extension, and double click the file to make the registry changes. To add registry keys, the user must be an owner of the root key.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}]
"AppID"="{76A64158-CB41-11D1-8B02-00600806D9B6}"

[HKEY_CLASSES_ROOT\AppID\{76A64158-CB41-11D1-8B02-00600806D9B6}]
"DllSurrogate"="  "

[HKEY_CLASSES_ROOT\Wow6432Node\AppID\{76A64158-CB41-11D1-8B02-00600806D9B6}]
"DllSurrogate"="  "

Make sure that you include two spaces in the value of the DllSurrogate key. If the registry is manually updated, you must include only the two spaces and do not include the quotes. While updating the registry manually, ensure that quotes are not included for AppID, DllSurrogate, and its values.

Retain the empty lines as shown in the preceding script, including the empty line at the end of the file.

Use the following commands in the Windows command prompt to confirm if the registry keys are created and have the correct values:

reg query "HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}" /f "{76A64158-CB41-11D1-8B02-00600806D9B6}" /e

reg query HKEY_CLASSES_ROOT\AppID\{76A64158-CB41-11D1-8B02-00600806D9B6} /f "  " /e

reg query HKEY_CLASSES_ROOT\Wow6432Node\AppID\{76A64158-CB41-11D1-8B02-00600806D9B6} /f "  " /e

Permissions to Use DCOM on the Domain Controller

The Microsoft Active Directory user who is used for Cisco ISE Passive Identity service must have the permissions to use DCOM on the domain controller server. Configure permissions with the dcomcnfg command line tool.

Procedure

Step 1	Run the dcomcnfg tool from the command line.
Step 2	Expand `Component Services`.
Step 3	Expand Computers > My Computer.
Step 4	Choose Action from the menu bar, click Properties, and click COM Security.
Step 5	The account that Cisco ISE uses for both access and launch must have Allow permissions. Add the Microsoft Active Directory user to all the four options, Edit Limits and Edit Default for both Access Permissions and Launch and Activation Permissions.
Step 6	Allow all local and remote accesses for both Access Permissions and Launch and Activation Permissions. Figure 6. Local and Remote Accesses for Access Permissions Figure 7. Local and Remote Accesses for Launch and Activation Permissions

Set Permissions for Access to WMI Root and CIMv2 Namespace

By default, Microsoft Active Directory users do not have permissions for the Execute Methods and Remote Enable. You can grant access using the wmimgmt.msc MMC console.

Procedure

Step 1	Choose Start > Run and enter `wmimgmt.msc`.
Step 2	Right-click WMI Control and click Properties.
Step 3	Under the Security tab, expand Root and choose CIMV2.
Step 4	Click Security.
Step 5	Add the Microsoft Active Directory user, and configure the required permissions as shown in the following image.

Open Firewall Ports for WMI Access

The firewall software on the Microsoft Active Directory domain controller may block access to WMI. You can either turn off the firewall, or allow access on a specific IP address (Cisco ISE IP address) to the following ports:

TCP 135: General RPC Port. When performing asynchronous RPC calls, the service listening on this port tells the client which port the component servicing this request is using.
UDP 138: NetBIOS Datagram Service
TCP 139: NetBIOS Session Service

TCP 445: SMB

Note

Cisco ISE supports SMB 2.0.

Higher ports are assigned dynamically, or you can configure them manually. We recommend that you add %SystemRoot%\System32\dllhost.exe as a target. This program manages ports dynamically.

All firewall rules can be assigned to a specific IP address (Cisco ISE IP).

Configure an Authorization Profile for Redirecting Nonregistered Devices

You must configure an authorization profile in Cisco ISE to redirect nonregistered devices for each external MDM server.

Before you begin

Ensure that you have created an MDM server definition in Cisco ISE. Only after you successfully integrate Cisco ISE with the MDM server is the MDM dictionary populated and you can create an authorization policy using the MDM dictionary attributes.
Configure ACLs on the Wireless LAN Controller for redirecting unregistered devices.
If you are using a proxy for Internet connection and the MDM server is part of the internal network, then you have to put the MDM server name or its IP address in the Proxy-Bypass list. Choose Administration > System > Settings > Proxy to perform this action.

Procedure

Step 1	Choose Policy > Policy Elements > Results > Authorization > Authorization Profiles > Add.
Step 2	Create an authorization profile for redirecting nonregistered devices that are not compliant or registered.
Step 3	Enter a name for the authorization profile that matches the MDM server name, in the Name field.
Step 4	Choose ACCESS_ACCEPT from the Access Type drop-down list.
Step 5	In the Common Tasks section, check the Web Redirection check box and choose MDM Redirect from the drop-down list.
Step 6	Choose the name of the ACL that you configured on the wireless LAN controller from the ACL drop-down list.
Step 7	Choose the MDM portal from the Value drop-down list.
Step 8	Choose the MDM server that you want to use from the MDM Server drop-down list.
Step 9	Click Submit.

What to do next

Configure Authorization Policy Rules for MDM.

Configure Authorization Policy Rules for the Mobile Device Management Use Cases

You must configure authorization policy rules in Cisco ISE to complete the MDM configuration.

Before you begin

Add the MDM server certificate to the Cisco ISE certificate store.
Ensure that you have created the MDM server definition in Cisco ISE. Only after you successfully integrate Cisco ISE with the MDM server does the MDM dictionary get populated, and you can create an authorization policy using the MDM dictionary attributes.
Configure ACLs on the Wireless LAN Controller for redirecting unregistered or noncompliant devices.

Procedure

Step 1

Choose Policy > Authorization > Insert New Rule Below.

Step 2

Choose Policy > Policy Sets, and expand the policy set to view the authorization policy rules.

Step 3

Add the following rules:

MDM_Un_Registered_Non_Compliant: For devices that are not yet registered with an MDM server or noncompliant with MDM policies. Once a request matches this rule, the Cisco ISE MDM window is displayed to a user, with information on registering the device with the MDM server.

Note

Do not use the MDM.MDMServerName condition in this policy. When this condition is used, an endpoint matches the policy only if the endpoint is registered with the MDM server.

PERMIT: If the device is registered with Cisco ISE, registered with MDM, and is compliant with Cisco ISE and MDM policies, it is granted access to the network based on the access control policies configured in Cisco ISE.

The following illustration shows an example of this configuration.

Figure 8. Authorization Policy Rules for the MDM Use Cases

Step 4

Click Save.

Wipe or Lock a Device

Cisco ISE allows you to wipe or turn on pin lock for a lost device. You can configure this from the Endpoints window.

Procedure

Step 1	Choose Work Centers > Network Access > Identities > Endpoints.
Step 2	Check the check box next to the device that you want to wipe or lock.
Step 3	From the MDM Actions drop-down list, choose one of the following options: Full Wipe: Depending on the MDM vendor, this option either removes the corporate apps or resets the device to the factory settings. Corporate Wipe: This option removes applications that you have configured in the MDM server policies. PIN Lock: This option locks the device.
Step 4	Click Yes to wipe or lock the device.

View Mobile Device Management Reports

Cisco ISE records all additions, updates, and deletions of MDM server definitions. You can view these events in the Change Configuration Audit report, which displays all the configuration changes from any system administrator for a selected time period.

Choose Operations > Reports > Reports > Audit > Change Configuration Audit. Check the entries in the Object Type and Object Name columns for the MDM server you want to review, and click the corresponding Event value to view the details of the configuration event.

View Mobile Device Management Logs

You can use the Debug Log Configurationwindow to view Mobile Device Management log messages. Choose Administration > System > Logging > Debug Log Configuration. Click the radio button next to a Cisco ISE node and click Edit. In the new window displayed, click the radio button next to the component name external-mdm, and click Edit. The default log level for this component is INFO. Choose DEBUG or TRACE from the corresponding Log Level drop-down list, and click Save.

Bias-Free Language

Results

Chapter: Manage Network Devices

Manage Network Devices

Defining Network Devices in Cisco ISE

Support for Session Aware Networking (SAnet)

Define a Default Network Device in Cisco ISE

Add a Network Device in Cisco ISE

Before you begin

Procedure

Import Network Devices into Cisco ISE

Procedure

Export Network Devices from Cisco ISE

Procedure

Third-Party Network Device Support in Cisco ISE

URL Redirect Mechanism and Auth VLAN

CoA Types

Network Device Profiles

Configure a Third-Party Network Device in Cisco ISE

Before you begin

Procedure

Create a Network Device Profile

Before you begin

Procedure

Export Network Device Profiles from Cisco ISE

Before you begin

Procedure

Import Network Device Profiles into Cisco ISE

Before you begin

Procedure

Network Device Groups

Root Network Device Groups

Network Device Attributes Used by Cisco ISE in Policy Evaluation

Import Network Device Groups into Cisco ISE

Procedure

Export Network Device Groups from Cisco ISE

Procedure

Import Templates in Cisco ISE

Network Devices Import Template Format

Network Device Groups Import Template Format

IPsec Security to Secure Communication Between Cisco ISE and NAD

Configure RADIUS IPsec on Cisco ISE

Procedure

Configure and Install X.509 Certificates on ESR-5921

Procedure

Example:

Example:

Example:

Example:

Example:

Example: Output of Pre-shared Key Configuration on Cisco Catalyst 3850 Series Switches

Mobile Device Manager Interoperability with Cisco ISE

Supported Mobile Device Management Use Cases

Vendor MDM Attributes

Supported Unified Endpoint Management and Mobile Device Management Servers

Ports Used by the Mobile Device Management Server

Mobile Device Management Integration Process Flow

Set Up Mobile Device Management Servers with Cisco ISE

Procedure

Import Mobile Device Management Server Certificate into Cisco ISE

Procedure

Define Device Management Servers in Cisco ISE

Define Microsoft System Center Configuration Manager Servers in Cisco ISE

Procedure

Configure Mobile Device Management Servers in Cisco ISE

Procedure

Cisco ISE Mobile Device Management Support for Microsoft Intune and Microsoft System Center Configuration Manager

Microsoft SCCM Workflow

Microsoft SCCM Server Connection Monitoring

Policy Set Example for Microsoft System Center Configuration Manager

Configure the Microsoft System Center Configuration Manager Server for Cisco ISE

Set Permissions when Microsoft Active Directory Users are in Domain Admin Group

Procedure

Permissions for Microsoft Active Directory Users Not in Domain Admin Group

Add Registry Keys to Allow Cisco ISE to Connect to the Domain Controller

Permissions to Use DCOM on the Domain Controller

Procedure

Set Permissions for Access to WMI Root and CIMv2 Namespace

Procedure