Cisco ISE profiling policy

Similar Questions

• Cisco ISE profiling - Split-Corporate/guest access

  Hi all

  I currently deploying a Cisco ISE for my wireless network and I would like to divide my WLAN in two different "authorisation profile": comments and Corporate.

  For now, I use my active Directory to authenticate users and profiling to authorize the device with the host name. I would like to sort by domain name with DHCP probe but I can't because there is always an answer of DHCP message with the domain given by the DHCP server, you have a solution to separate unit with domain name or other attributes?

  Thanks in advance for your answer!

  You can create different authorization profile based on the identity group they belong to, therefore, make two profiles based on two membership group (guests / corporate AD users) and assign them different access. consult the ISE 1.2 config guide.

• Cisco ISE - authentication policy

  Hello guys,.

  Hold the opinions of a scalable strategy for authentication of users and / or the workstations in Cisco's ISE for the following scenario:

  Customer with some 130 branch offices. Each branch has an another AD domain without trust with the HQ and with the other branches.

  Knowing that the ISE supports integration with up to 50 domains, what suggestion for this case?

  Kind regards
  Daniel Stefani

  Stefani,

  Of course it will work, you can even use a centralized architecture CA, make sure just that you can distribute these certificates at endpoints...

  Another option is to check if the AD user account is limited (disabled, locked, has expired, password has expired and so on) via LDAP, but you need the username is equal to some field in the certificate (CN or SAN).

  Kind regards

  Fabio

• Group of endpoint Cisco ISE 1.4 hotspot

  Patch 1.4 Cisco ISE 6

  Cisco WLC 8.0.121

  Setup

  the WLC has a named Hotspot SSID. It uses mac auth with radius of the NAC to redirect to the Hotspot portal of reviews on the ISE.

  drops flexconnect users in vlan 401 (with preAuthAcl), after the PSU, it is initially a COA to move users to VLANs 413 with permitInternetAcl

  Description of the problem:

  users connect to the SSID of the access point and get an IP address valid in vlan 401

  redirected to the page of the hotspot on the ISE with a PSU and the PIN code request.

  are they disconnect from the network and reconnect, the ISE sends a certificate of authenticity to move to 413 without the Hotspot portal.

  what I've noticed, is that as soon as users get the redirect of the original Web page, they are moved to the endpoint group defined in the hotspot portal.

  What I've read about this behavior makes me understand that it is a default behavior, but if that's the case then I'm not sure on how I can make my font to check if the PSU has been accepted.

  Thank you

  Maarten

  Portal.PNG

  

  Policy.PNG

  

  Profile.PNG

  

  Cisco WLC 8.2.100

  Patch 1.4 ISE 6

  Similar Hotspot ISE installation, of similar rules except change VLAN. I have observed the same behavior.

  This configuration was working on patch 5.

  Update:

  I found a solution based on the following bug. Use the following attribute in the authorization rule. The success page remains but no Instant Internet access is available using this workaround solution.

  https://Tools.Cisco.com/bugsearch/bug/CSCux22558/?referring_site=bugquic...

  ' Workaround:
  "Use the LEAST 24 endpoints: LastAUPAcceptanceHours for example (means PUA agreed less than 24 hours ago).

• That treats the assignment do VLAN authorization Cisco ISE?

  Hello

  When I create an authorization policy in Cisco ISE, under common tasks, it is the assignment of VLANS. What makes that? Is it puts the user on this VLAN?

  Thank you.

  Yes, this will overwrite the VLAN configured on the switch port/SSID or wireless. For example, all ports can be configured to be part of VLAN 10, but you want users to finances in VLAN 20. You can use the profile of EHT permission to do exactly this.

  Thank you for evaluating useful messages!

• Cisco ISE 1.2 and the ad group

  Hello

  I have Cisco ISE installed on my EXSi server for my test pilot. I added several ad groups at ISE as well.

  I created a condition of authorization policy, that is WIRELESS_DOT1X_USERS (see screenshot)
  Basically, I just replicate the default Wireless_802.1X and added Network Access: EapAuthentication, Equals, EAP - TLS.

  My problem is, I have been unable to join the wireless network, if I added my ad group to the authorization strategy (see screenshot). The user I is a member of WLAN USERS. If I removed the authorization policy group, the use is able to join the wireless network.

  I have attached the screenshot of ISE newspapers as well. I checked the ISE, AD/NPS, WLC, laptop computer time and date, and they are all in sync.

  I also have the WLC added as NPS client on my network.

  I checked the newspaper AD and I found it, it was the local management user WLCs trying to authenticate. It is supposed to be my wireless user Credential is not the WLC.

  It's the paper I received from the AD/NPS

  Access denied to user network policy server.

  Contact the server administrator to strategy network for more information.

  User:

  Security ID: NULL SID

  Account name: admin

  Domain account: AAENG

  Account name: AAENG\admin

  Client computer:

  Security ID: NULL SID

  Account name: -.

  Full account name: -.

  OS version: -.

  Called Station identifier: -.

  Calling the Station identifier: -.

  NAS:

  NAS IPv4 address: 172.28.255.42

  NAS IPv6 address: -.

  NAS identifier: RK3W5508-01

  NAS Port Type: -.

  NAS Port:                              -

  RADIUS client:

  Friendly name of client: RK3W5508-01

  The client IP address: 172.28.255.42

  Information about authentication:

  Connection request policy name: Windows authentication for all users use

  The network policy name: -.

  Authentication provider: Windows

  Authentication server: WIN - RSTMIMB7F45.aaeng.local

  Authentication type: PAP

  EAP Type:                              -

  Identifier for account: -.

  Results of logging: Accounting Information was written in the local log file.

  Reason code: 16

  Reason: Authentication failed due to incompatibility of user credentials. The provided username is not mapped to an existing user account or the password is incorrect.

  Hello

  The problem is with what ISE name, it's choosing to search of the AD. If you look in the ISE newspapers down, you'll see the username that use ISE (firstname, lastname) to search for the AD.

  In your certificate template see what attribute containst name AD (possibly the dns name or email or the name of principle of RFC 822 NT), go to your profile to authenticate cerificate and use this attribute for the user name.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Cisco ISE and Meraki RADIUS

  I am very new to Cisco ISE and Meraki.  I try to get the Radius configuration for wireless authentication.  When I do a test of the Meraki to ISE, it passes.

  When I try to connect from my laptop, I look at the logs of the Radius and it passes; However, it does not connect me to good policy.  I keep hitting the default policy.  I have my Meraki police above the default policy in the strategy defined in article.  I have attached what looks like my strategy game.

  Devices does not really matter. Here is what I see when I create a device group (where you add the access point to this group), and then create the condition:

  networkdevicegroups.PNG

  

  And here is where I create the condition of strategy game and you should be able to select the Meraki access points:

  devicecondition.PNG

  

  This will give you the condition similar to what I posted above. This is perhaps why you aren't hit that is not matching the condition for this game.

• Cisco ISE comments Sponsor Isssue Portal

  Hi all

  We have insatalled 5 boxes of ise 3315 IOS 1.0.4 in our network where in two of them are admin node, two services strategy and has a node mnt. We using sponsor portal for guest user wirless comments where we integrated WLC 5508 with ise and using weblogin for guest users.

  We have created open ssid wlc and external aid redirected url to ise for the login page of comments.

  But when we create a guest in the sponsor for guest user connection, user that we faced after publication

  (1) when guest user gets connected to WiFi and connect to the portal of comments with credentials after putting the credentials then his new redirect to the same login page

  wihout invites successful connection.

  Can us guest login successful after comments connect to the portal of reviews or redirect any other link as google.com for guest user will be done the knowledge he is able to access the internet now

  (2) we have appointed time profile 8hours first user login guest. When the guest user gets connected while putting in credentials on the portal of comments.

  But we are facing problem after about 20 mins enhanced disconnects Internet and comments again Gets the login page of the portal of the guest and if we put the same credentials, then his work but after about 20 min interval disconnected Internet user.

  Can someone help me resolved on observation about covers them cisco ise comments sponsor Portal

  Thank you & best regards

  Pranav Gade

  Pranav your answers are online,

  (1) when guest user gets connected to WiFi and connect to the portal of comments with credentials after putting the credentials then his new redirect to the same login page

  wihout invites successful connection. When you use CWA (Central web authentication) there is no way we can redirect users by using the redirect url because it will always redirect users for each time they start a web request. There is no other cost functionality that will remove this condition because they have already been authenticated.  Here is a guide that explains the user experience when using web Central auth -

  http://www.Cisco.com/en/us/docs/security/ISE/1.1.1/user_guide/ise_guest_pol.html#wp1296954

  Can us guest login successful after login guest Portal comments or redirect any other link as google.com for guest user will be acquainted with it is able to access the internet now This is not possible, you can change the verbage and force the AUP to be displayed to users informing them that they can start their web request after hitting the button I accept.

  Here's to justify it experience, once users go through the process of reviews-

  http://www.Cisco.com/en/us/products/ps11640/products_configuration_example09186a0080ba6514.shtml#final

  (2) we have appointed time profile 8hours first user login guest. When the guest user gets connected while putting in credentials on the portal of comments.

  But we are facing problem after about 20 mins enhanced disconnects Internet and comments again Gets the login page of the portal of the guest and if we put the same credentials, then his work but after about 20 min interval disconnected Internet user. Check advance timer on your SSID you can be hitting the session on the WLC timeout. Please disable this option and let the functionality of COA ISE at expiration of the user on the controller sessions of.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• Cisco ISE 1.3 disable "Identity Resolve" step?

  Currently, I am working for a client with a Cisco ISE 1.3 deployment.

  The Cisco access point are currently authenticated by MAB, the customer wants to improve that I proposed to implement EAP-FAST speed of the MAB for the AP for a quick and easy solution.

  I work in the test and production environment, but I was cycling through the authentication process and found something strange.

  I created a rule that if the Tunnel network protocol is EAP-FAST are authenticated by internal users.

  It works very well, the ISE recognizes the flow and internal users through authenticatie.

  15041 assessment political identity
  15048 questioned PIP - Network Access.EapAuthentication
  15048 questioned PIP - Network Access.EapTunnel
  15004 Matched rule - EAP-FAST
  15013 selected identity Source - internal users
  24210 Looking user in IDStore of internal users - >
  24212 found user in internal users IDStore
  Authentication 22037 spent

  On the way he also decided to search for the user in Active Directory.

  Given that the user has not been created in Active Directory, that it does not.

  Looking 24432 user in Active Directory - >
  Identity resolution 24325 - >
  Search 24313 of corresponding accounts at the junction - >
  24318 no corresponding account found in the forest - >
  24322 identity resolution detected no corresponding case
  Failure of the 24352 - ERROR_NO_SUCH_USER identity resolution
  24412 not found user in Active Directory - >
  15048 questioned PIP - >. ExternalGroups
  15048 questioned PIP - Network Access.EapTunnel
  15004 Matched rule - AP_EAPFAST
  15016 selected the authorization - AP_Lan profile
  11002 returned access RADIUS acceptance

  So the authentication and authorization is successful but he try's to resolve the user in active directory.

  I checked the authentication for MAB process, and here I see the same error.

  The MAC address of the device used to MAB also is added to the ISE, then authentication through internal users, authentication and authorization is successful, but ISE wants to solve the (MAC address of the device) user in Active Directory.

  We also see this step for the flow of EAP - TLS, and in this case the identity stage via resolution is successful.

  Is it possible that I can disable the resolution of identity through AD when the internal user group? (or in the world?)

  I did some research and found this (search for LDAP users)

  http://www.Cisco.com/en/us/docs/security/ISE/1.0/user_guide/ise10_man_id...

  When I look at our deployment, it is nothing configured under LDAP.

  If you have rules in your authorization rules that use ad groups that are in front of your MAB or the EAP-FAST rules, ISE will do a search to see if it needs to match this rule. Put your MAB and EAP-FAST rules about AD membership rules, and it won't do the research.

• Access VPN ASA and cisco ISE Admin

  Hello

  Currently I'm deployment anyconnect VPN Solution for my client on ASA 9.2 (3). We use the ISE 1.3 to authenticate remote users.

  In the policy stipulates the conditions, I put the condition as below.

  Policy name: Anyconnect

  Condition: DEVICE: Device Type Device Type #All Device Types #Dial - in access EQUALS AND
  RADIUS: NAS-Port-Type is equal to virtual

  I'm authenticating users against the AD.

  I am also restrict users based on group membership in authorization policies by using the OU attributes.

  This works as expected for remote users.

  We also use the ISE to authenticate administrators to connect to the firewall. Now what happens is, Cisco ASA valid also against policy, administrators and their default name Anyconnect.

  Now the question is, how to set up different political requirement for access network admin and users the same Firewall VPN.

  Any suggestions on this would be a great help.

  See you soon,.

  Sri

  You can get some ideas from this article of mine:

  http://ltlnetworker.WordPress.com/2014/08/31/using-Cisco-ISE-as-a-generic-RADIUS-server/

• Cisco Ise 1.3 with Flex to connect wireless supported function

  Hello

  My environment is formed ROUND of flex-mode connection wireless and cisco Ise 1.3, these features are supported?
  Basic functions of the AAA
  profiling
  posturing
  Substitution VLAN
  Substitution of the ACL
  Comments commissioning

  TrustSec 2.0 this MDC is not supported? someone try this feature?

  These all work with ISE 1.3 and FlexConnect WLAN.

  You need the right license ISE - the type of mobility (wireless) license will cover everything. If you have wired and wireless, then you must have basic (for most features) + more (for profiling) + Apex (for Posturing).

• Authentication (Windows Server 2013) AD Cisco ISE problem

  Background:

  Has deployed two Cisco ISE 1.1.3. ISE will be used to authenticate users wireless access admin WLC and switches. Database backend is Microsoft running on Windows Server 2012 AD. Existing Cisco ACS 4.2 still running and authenticate users. There are two Cisco WLCs version 7.2.111.3.

  Wireless users authenticates to AD, through works of GBA 4.2. Access admin WLC and switches to the announcement through ISE works. Authentication with PEAP-MSCHAPv2 access and admin PAP/ASCII wireless.

  Problem:

  Wireless users cannot authenticate to the announcement through ISE. This is the error message '11051 RADIUS packet contains invalid state attribute' & '24444 Active Directory failed because of an error that is not specified in the ISE'.

  

  Conducted a detailed test of the AD of the ISE. The test was a success and the result seems fine except for the below:

  xxdc01.XX.com (10.21.3.1)

  Ping: 0 Mins Ago

  Status: down

  xxdc02.XX.com (10.21.3.2)

  Ping: 0 Mins Ago

  Status: down

  xxdc01.XX.com

  Last success: Thu Jan 1 10:00 1970

  March 11 failure: read 11:18:04 2013

  Success: 0

  Chess: 11006

  xxdc02.XX.com

  Last success: Fri Mar 11 09:43:31 2013

  March 11 failure: read 11:18:04 2013

  Success: 25

  Chess: 11006

  Domain controller: xxdc02.xx.com:389

  Domain controller type: unknown functional level DC: 5

  Domain name: xx.COM

  IsGlobalCatalogReady: TRUE

  DomainFunctionality: 2 = (DS_BEHAVIOR_WIN2003)

  ForestFunctionality: 2 = (DS_BEHAVIOR_WIN2003)

  Action taken:

  Log Cisco ISE and WLC by using the credentials of the AD. This excludes the connection AD, clock and AAA shared secret as the problem.

  (2) wireless authentication tested using EAP-FAST, but same problem occurs.

  (3) detailed error message shows below. This excludes any authentication and authorization policies. Even before hitting the authentication policy, the AD search fails.

  12304 extract EAP-response containing PEAP stimulus / response

  11808 extracted EAP-response containing EAP - MSCHAP VERSION challenge response to the internal method and accepting of EAP - MSCHAP VERSION such as negotiated

  Evaluate the politics of identity

  15006 set default mapping rule

  15013 selected identity Store - AD1

  24430 Authenticating user in Active Directory

  24444 active Directory operation failed because of an error that is not specified in the ISE

  (4) enabled the registration of debugging AD and had a look at the logging. Nothing significant, and no clue about the problem.

  (5) wireless tested on different mobile phones with the same error and laptos

  (6) delete and add new customer/features of AAA Cisco ISE and WLC

  (7) ISE services restarted

  (8) join domain on Cisco ISE

  (9) notes of verified version of ISE 1.1.3 and WLC 7.2.111.3 for any open caveats. Find anything related to this problem.

  10) there are two ISE and two deployed WLC. Tested a different combination of ISE1 to WLC1, ISE1 to WLC2, etc. This excludes a hardware problem of WLC.

  Other possibilities/action:

  1) test it on another version WLC. Will have to wait for approval of the failure to upgrade the WLC software.

  (2) incompatibility between Cisco ISE and AD running on Microsoft Windows Server 2012

  Did he experienced something similar to have ideas on why what is happening?

  Thank you.

  Update:

  (1) built an another Cisco ISE 1.1.3 sever in another data center that uses the same domain but other domain controller. Thai domain controller running Windows Server 2008. This work and successful authentication.

  (2) my colleague tested in a lab environment Cisco ISE 1.1.2 with Windows Server 2012. He has had the same problem as described.

  This leads me to think that there is a compatibility issue of Cisco ISE with Windows Server 2012.

  
  

  
  

  Yes, it seems that 1.1.3 doesn't support Server 2012 as of yet.

  External identity Source OS/Version

  Microsoft Windows Active Directory 2003 R2 32-bit and 64-bit

  Active Directory Microsoft Windows 2008 32-bit and 64-bit

  Microsoft Windows Active Directory 2008 R2 64-bit only

  Microsoft Windows Active Directory 2003 32-bit only

  http://www.Cisco.com/en/us/docs/security/ISE/1.1/compatibility/ise_sdt.PDF

• Cisco ISE comments Portal - DNS problem - External area

  Hello

  I have a client that has the following sceanrio:

  In a wireless deployment and deployment Cisco ISE 1.1.3 with CWA, when the wireless client receives the URL ISE redictect (URL to access the portal of ISE comments), this URL is based on the ISE DNS name, not on its IP address. Thus, the PC cannot solve this problem by DNS name because there is no DNS in the external area (for the guets) or by using the addresses of servers DNS ISP provided by the DHCP server, and therefore it cannot access the portal comments at all;

  I know that in an attempt to manually code the IP address - it doesn't (IE in the authorization profile CWA, the equivalent URL redirection via the pair av CISCO as follows:)

  Cisco-AV-Paire = redirect url =https://10.10.10.10:8443/guestportal/gateway? sessionId = sessionIdValue & action = cwa,)

  given that the sessionIdValue variable is not replaced by its real value when sending to the wireless client)

  My question is: this question has been addressed in version 1.2 of Cisco of ISE - has anyone tried it if has been processed? If not in Cisco 1.2 - does anyone know iof this feature will become available?

  Thanks in advance for your answers.

  Robert C.

  Robert,

  Manual assignment has been made available in version 1.2 of the ISE.

  M.

  

• Cisco ISE CLI and GUI password expires

  I got Cisco ISE version 1.1 I am facing a problem with the password CLI and GUI, it expires and I can not connect, I do password reset using the DVD of the ISE.

  I naviguer navigate to the CLI of ISE, then perform the following commands:

  conf t

  password policy

  no password-expiration-enable

  and reset the password of admin GUI, using the command:

  # reset-passwd ise admin request

  from the interface of ISE I delete option for the devil admin account after 45 days.

  but after 60 days, the password expire again.

  kindly advise what to check for this question expires.

  Hello Mostafa,

  Yes, the last answer was more towards past-mgmt GUI because in the majority of cases, it happens with the administrator account on the user interface. I need to know if you've restarted the ISE after disabling the expiration of the CLI, because what I read a few weeks in an internal fault which password policy settings are not preserved on cli after restart so just to check could please check current on CLI w settings / help to see the race. in the password policy.

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• Cisco ISE 1.1.1 with Windows posturing

  Hello

  We tired for configured windows posturing here's the scenario

  We saw five ise boxes 3315 with version 1.1.1 off them 2 is admin, 2 is PS and 1 MNT

  and we have local Symantec and WSUS Server.

  We make posturing for Windows where I have a few questions

  (1) is there an integration here of the local WSUS server with Cisco ISE where Cisco ISE can automatically take all the mandatory WSUS update according to the crititcality of the WSUS server.

  (2) what is advised to set up the strategy of the Posture of the posture of windows in Cisco ISE and if manually configure windows political posture using specific KB and if there is an update available on Microsoft will we be able to configure the policy for the new update.

  (3) we have configured authentication dot1x in cisco ise and asked as well as on switch port where once the user must be connected to dot1x port of the switch it invites username and password dot1x and therefore, authorization policy, it gives vlan appropriate dynamics.

  But what are the ways where we can restrict the machine which is rather than the assets of the company and even if the user's user name and password in short any employee aware how we can restrict the user making the machine rather than the assets of the company?

  (4) can configure US policy posture for antivirus which will keep us in normal mode and at the same time, we can put posturing for windows which monioring mode which only monitor policy posture and reflected in the monitoring, log in which does not restrict the network for windows posturing

  That will be great if any one can please help me to get the issues

  Thank you

  Pranav

  What follows is under the POLICY-OF ELEMENTS of STRATEGY-POSTURE-> REQUIREMENTS > >

  

  What follows is located under

  POLICY OF-> ELEMENTS OF STRATEGY-> POSTURE->

  REPAIR-> WINDOWS SERVER UPDATE SERVICES REMEDIATION ACTIONS

  

  What follows is part POLICY-> POSTURE

  

  These settings work ALMOST flawlessly for me by forcing her we approved on our WSUS server for our group of workstations updated (all of our laptops are members of the) which meet the criteria of severity EXPRESS (critical and Important). Now, what I've discovered in the last few days is that... MS seems a bit random in their identification of what severity level they assign to their updates. For example... I think that a service pack of the operating system would be considered IMPORTANT if not CRITICAL... however... Look at this from the identification of the server WSUS from Windows 7 Service Pack 1:

  

  Thus, those who updates you deleted, I'd go throgh your WSUS server to identify how they are identified by gravity, then according to your needs set the parameters of the ISE accordingly to ensure that you get updates you plan.

  Hope this helps everyone out there who has similar problems.

  Thank you

  Dirk