Ensure that you include the following commands in your switch configuration to enable standard web authentication functions for Cisco ISE, including provisions for URL redirection upon authentication:

ip classless


ip route 0.0.0.0 0.0.0.0 10.1.2.3


ip http server

! Must enable HTTP/HTTPS for URL-redirection on port 80/443

ip http secure-server 

Enter the following command to enable the switch to talk to the Cisco ISE node as though it is the RADIUS server for this network segment:

username test-radius password 0 abcde123 

Ensure that you specify the same NTP server on the switch as you have set in Cisco ISE by entering the following command:

ntp server <IP_address>|<domain_name> 

Enter the following commands on the switch to enable the various AAA functions between the switch and Cisco ISE, including 802.1X and MAB authentication functions:

aaa new-model

! Creates an 802.1X port-based authentication method list

aaa authentication dot1x default group radius

! Required for VLAN/ACL assignment

aaa authorization network default group radius

! Authentication & authorization for webauth transactions

aaa authorization auth-proxy default group radius

! Enables accounting for 802.1X and MAB authentications

aaa accounting dot1x default start-stop group radius

!

aaa session-id common

!

aaa accounting update periodic 1440


! Update AAA accounting information periodically every 1440 minutes


aaa accounting system default start-stop group radius

!

 

Configure the switch to interact with Cisco ISE as the RADIUS source server by entering the following commands:

!
radius-server <ISE Name> 

! ISE Name is the name of the ISE PSN

address ipv4 <ip address> auth-port 1812 acct-port 1813  

! IP address is the address of the PSN. This example uses the standard RADIUS ports. 

key <passwd> 

! passwd is the secret password confiugured in Cisco ISE

exit 

Note	We recommend that you configure a dead-criteria time of 30 seconds with 3 retries to provide longer response times for RADIUS requests that use Active Directory for authentication.

Specify the settings to ensure the switch can appropriately handle RADIUS CoA behavior and related posture functions on Cisco ISE by entering the following commands:

aaa server radius dynamic-author client <ISE-IP> server-key 0 abcde123 

Note

Cisco ISE uses port 1700 (Cisco IOS software default) versus RFC default port 3799 for CoA. Existing Cisco Secure ACS 5.x customers may already have this set to port 3799 if they use CoA as part of an existing ACS implementation. secret key should be the same as the one configured on Cisco ISE while adding a network device and the IP address should be a PSN IP address.

! Optional
 ip dhcp snooping

! Required!

! Configure Device Tracking Policy!device-tracking policy <DT_POLICY_NAME>no protocol ndp tracking enable

! Bind it to interface!interface <interface_id>device-tracking attach-policy<DT_POLICY_NAME> 

In RADIUS accounting, the DHCP attributes are not sent by the IOS sensor to Cisco ISE even when DHCP snooping is enabled. In such cases, DHCP snooping should be enabled on the VLAN to make the DHCP active.

Use the following commands to enable DHCP snooping on VLAN:

ip dhcp snooping 

ip dhcp snooping vlan 1-100 

Enter the following commands to turn on 802.1X authentication for switch ports, globally:

dot1x system-auth-control 

To support supplicant authentication requests over the LAN, enable EAP for critical authentications (Inaccessible Authentication Bypass) by entering the following command:

dot1x critical eapol 

In the case of a critical authentication recovery, configure the switch to automatically introduce an authentication delay (in milliseconds) to ensure Cisco ISE can launch services again after recovery. Use the following command:

authentication critical recovery delay 1000 

Enter the following commands to define the VLAN names, numbers, and Switch Virtual Interfaces (SVIs) based on known enforcement states in your network. Create the respective VLAN interfaces to enable routing between networks. This can be especially helpful to handle multiple sources of traffic passing over the same network segments from both the endpoints (such as PC, laptop) and the IP phone through which the endpoint is connected to the network, for example:

 

vlan <VLAN_number> 
name ACCESS!
vlan <VLAN_number> 
name VOICE

!
interface <VLAN_number> 
description ACCESS 
ip address 10.1.2.3 255.255.255.0 
ip helper-address <DHCP_Server_IP_address> 
ip helper-address <Cisco_ISE_IP_address>

!
interface <VLAN_number> 
description VOICE 
ip address 10.2.3.4 255.255.255.0 
ip helper-address <DHCP_Server_IP_address>   

Enable these functions on older switches (with Cisco IOS software releases earlier than 12.2(55)SE) to ensure Cisco ISE is able to perform the dynamic ACL updates required for authentication and authorization by entering the following commands:

ip access-list extended ACL-ALLOW

 permit ip any any

!

ip access-list extended ACL-DEFAULT

  remark DHCP

  permit udp any eq bootpc any eq bootps

  remark DNS

  permit udp any any eq domain

  remark Ping

  permit icmp any any

  remark Ping

  permit icmp any any

  remark PXE / TFTP

  permit udp any any eq tftp

  remark Allow HTTP/S to ISE and WebAuth portal 
permit tcp any host <Cisco_ISE_IP_address> eq www 

permit tcp any host <Cisco_ISE_IP_address> eq 443 

permit tcp any host <Cisco_ISE_IP_address> eq 8443 

permit tcp any host <Cisco_ISE_IP_address> eq 8905 

permit udp any host <Cisco_ISE_IP_address> eq 8905 

permit udp any host <Cisco_ISE_IP_address> eq 8906 

permit tcp any host <Cisco_ISE_IP_address> eq 8080 

permit udp any host <Cisco_ISE_IP_address> eq 9996 

remark Drop all the rest

  deny ip any any log 


!

! The ACL to allow URL-redirection for WebAuth
 ip access-list extended ACL-WEBAUTH-REDIRECT 

 permit tcp any any eq www

 permit tcp any any eq 443  

Note	This configuration on the Wireless Controller may increase CPU utilization and raises the risk of system instability. This is an IOS issue and does not adversely affect Cisco ISE.

The following example shows a control policy that is configured to allow sequential authentication methods using 802.1X, MAB, and web authentication.

class-map type control subscriber match-all DOT1X
 match method dot1x
!
class-map type control subscriber match-all DOT1X_FAILED
 match method dot1x
 match result-type method dot1x authoritative
!
class-map type control subscriber match-all DOT1X_NO_RESP
 match method dot1x
 match result-type method dot1x agent-not-found
!
class-map type control subscriber match-all MAB
 match method mab
!
class-map type control subscriber match-all MAB_FAILED
 match method mab
 match result-type method mab authoritative
!
!


policy-map type control subscriber DOT1XMAB
 event session-started match-all
  10 class always do-until-failure
   10 authenticate using dot1x retries 2 retry-time 0 priority 10
 event authentication-failure match-first
  10 class DOT1X_NO_RESP do-until-failure
   10 terminate dot1x
   20 authenticate using mab priority 20
  20 class DOT1X_FAILED do-until-failure
   10 terminate dot1x
   20 authenticate using mab priority 20
   30 authorize
  40 class always do-until-failure
   10 terminate dot1x
   20 terminate mab
   30 authentication-restart 60
 event agent-found match-all
  10 class always do-until-failure
   10 terminate mab
   20 authenticate using dot1x retries 2 retry-time 0 priority 10
!

The following example shows a control policy that is configured to allow sequential authentication methods using MAB, 802.1X, and web authentication.

policy-map type control subscriber MABDOT1X
 event session-started match-all
  10 class always do-until-failure
   10 authenticate using mab priority 20
   20 authenticate using dot1x priority 10
 event authentication-failure match-first
  10 class ALL_FAILED do-until-failure
   10 authentication-restart 60
 event authentication-success match-all
  10 class DOT1X do-until-failure
   10 terminate mab
 event agent-found match-all
  10 class always do-until-failure
   10 authenticate using dot1x priority 10

Applying the service policy on the interface:

interface GigabitEthernet1/0/4
 switchport mode access
 device-tracking attach-policy pol1
 ip access-group sample in
 authentication timer reauthenticate server
 access-session port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10
 dot1x timeout auth-period 10
 spanning-tree portfast
 service-policy type control subscriber DOT1XMAB

Set up standard logging functions on the switch to support possible troubleshooting and recording for Cisco ISE functions:

epm logging 

Ensure the switch can receive SNMP trap transmissions from Cisco ISE over the appropriate VLAN in this network segment:

snmp-server community public RO 
snmp-server trap-source <VLAN_number> 

Configure the switch to ensure SNMP v3 polling takes place as intended to support Cisco ISE profiling services using the following commands. Before that configure the SNMP settings in the Cisco ISE GUI in the SNMP Settings window. To view this window, click the Menu icon () and chooseAdministration > Network Resources > Network Devices > Add | Edit > SNMP Settings.

Snmp-server user <name> <group> v3 auth md5 <string> priv des <string> 
snmp-server group  <group> v3 priv 
snmp-server group <group> v3 priv contextvlan-1  

Note	The snmp-server group <group> v3 priv context vlan-1 command must be configured for each context. The snmp show context command lists all the context information.

If the SNMP request times out and there is no connectivity issue, then you can increase the timeout value.

Configure your switch to transmit the appropriate MAC notification traps so that the Cisco ISE profiler function can collect information on network endpoints:

mac address-table notification change 
mac address-table notification mac-move 
snmp trap mac-notification change added 
snmp trap mac-notification change removed 

To configure the RADIUS idle-timeout on a switch, use the following command:

Switch(config-if)# authentication timer inactivity 

where inactivity is the interval of inactivity in seconds, after which the client activity is considered unauthorized.

In Cisco ISE, you can enable this option for any authorization policies to which such a session inactivity timer should apply. In the Cisco ISE GUI, click the Menu icon () and choose Policy > Policy Elements > Results > Authorization > Authorization Profiles.

For Single SSID

To support Apple iOS-based devices (iPhone or iPad) switching from one SSID to another on the same wireless access point, configure the Wireless Controller to enable the FAST SSID change function. This function helps ensure iOS-based devices can switch between SSIDs quickly.

For Dual SSID BYOD

Fast SSID must be enabled to support dual SSID BYOD. When fast SSID changing is enabled, the Wireless Controller allows clients to move faster between SSIDs. When fast SSID is enabled, the client entry is not cleared and the delay is not enforced. For more information about configuring fast SSID on a Cisco Wireless Controller, see the Cisco Wireless Controller Configuration Guide.

Example Wireless Controller Configuration

WLC (config)# FAST SSID change 

You might see the following error message while trying to connect to a wireless network for some of the Apple iOS-based devices:

You can ignore this error message because this does not affect the authentication of the device.