Sem cis ise

Building an Enterprise
Access Control
Architecture Using ISE
and TrustSec

Agenda
• What is ISE?
• Visibility
• Guest Access
• Secure Access
• BYOD
• Compliance
• TrustSec
• Device Administration
• Additional Features
• 3rd Party NAD Support
• Location BasedAuthorisation

Identity Profiling Access Policy Network Resources
and Posture
Traditional
Cisco
TrustSec®
BYOD Access
Threat Containment
Guest Access
Role-Based
Access
Who
 Compliant
What
When
Where
How
A centralised security solution that automates context-aware access to network resources and shares
contextual data
Network
Door
Physical or VM
Controller
Context
ISE pxGrid
7

The Different Ways Customers Use ISE
Guest Access Management
Easily provide visitors secure guest Internet access
BYOD and Enterprise Mobility
Seamlessly classify & securely onboard devices with the right levels ofaccess
Secure Access across the Entire Network
Streamline enterprise network access policy over wired, wireless, & VPN
Software-Defined Segmentation with Cisco TrustSec®
Simplify Network Segmentation and Enforcement to Contain Network Threats
Visibility & Context Sharing with pxGrid
Share endpoint and user context to Cisco and 3rd party system
Network Device Administration
Device administration and Network Access on a single platform

With Cisco Identity Services Engine You Can
6
See and share rich user Stop and contain threats
and device details
Control all access
throughout the network
from one place

IT Requirements  ISE Capabilities
Access
Control
Authentication
on wired &
wireless
networks as
well as VPN BYOD
Support Trusted
Device
Standard and
enable BYOD
Profiling
Ability to
identify
users and
devices on
our network
Endpoint
Protection
Protect the
network
from
infected
devices
GuestAccess
Restrict
unauthorized
devices &
users to
Internet
access only
Device Control
Secure network
while allowing
mobile device
access*
* Cisco IT uses a 3 different Device ManagementProducts
11
Contextual Data
Cross-platform
contextual data
sharing across
the entire IT
infrastructure

• Identity of a
device on the
network
• Quantify the risk
1. Profiling
• User and end
device attribution
• Identification of
endpoints on
Wireless/Wired
connections
2.Authentication
• Device security
posture
identification
• Allows for better
policy & security
decisions
3. Posture
• Ability to enforce
policy decisions
based on context
• Untrusted
devices have
restricted access
4. Enforcement
The Four Stages of a Secure Network
ISE 1.2
Profiling
ISE 1.2
802.1XAuth
WLAN,CVO
ISE 1.3/1.4
802.1XAuth
CVO, Wired, VPN, MDM
ISE 2.1
802.1X Wired AuthMode
MDM
√ √ √
12

ISE Guest ION:
GuestAccess
ISE 802.1xAuth:
Wireless,CVO
ISE 802.1x + MAB
Monitor Mode:
Wired (Limited)
ISE 802.1xAuth:
VPN + AnyConnect:
• Mobile Devices with
Certificate
• Laptops with OTP
ISE/MDM Integration:
Afaria, Casper
ISE SGT:
TrustSec Limited
Deployment
ISE/MDM:
Posture Enforcement
ISE 802.1xAuth:
Xtranet/Partners
ISE SGT:
Network
Segmentation&
Optimization
ISE TACACS+:
Device Administration
ACS + NACs:
Guest Access
ACS Auth:
Wireless,CVO
AD Auth + One-
Time-Password:
VPN
Open Access:
Wired
Assured Network Access Roadmap
Start
ACS 5.x
NAC
Active
Directory
ISE 1.2
ISE 1.3
ISE 1.4
ISE 2.1
Continue
ISE 802.1xAuth:
Wired(Global)
ISE/MDM Integration:
Afaria, Casper, SCCM
Posture Assessment
Endpoint Protection:
Quarantine/Remediate
√
√
√
√
13

Make Fully Informed Decisions with Rich
Contextual Awareness
Poor Context Awareness Extensive ContextAwareness
BobIP address 192.168.1.51
Context:
Who
TabletUnknownWhat
Building 200, first floorUnknownWhere
11:00 a.m. EST on April 10UnknownWhen
WirelessUnknownHow
The right user, on the right device, fromthe
right place is granted the rightaccess
Any user, any device, anywhere gets on
the network
Result

Many Different Visibility Variables
Trust Gradient
•Authentication
•Certificate
•Managed/Unmanaged
•Compliance/Posture
Threat/Risk
•Threat score
•Fidelity
Reach
•What services can be
accessed
•What other entities
can be impacted
Behaviour
•Historical versus
active. Now or before
•Was I doingthe
expected or
unexpected
Users
•Role
•Permissions/rights
•Importance
Devices
•Ownership – managed
or unmanaged
•Type of device
•Function
•Applications
Connectivity
• Medium
(Wired/Wireless/VPN)
•NAD/NAD Details
•State (active session)
Location
•Physical
•Logical
Time
•Time of Day
•Day of week
•Connection duration

Visibility Technologies
ISE Description
Technology and Use Cases
Profiling Technology Device Identification by Cisco ISE
SIEM -- Threat Detection with a
NetflowAnalyser
SIEM and threat detection analyses network traffic and
tells ISE to take action
NaaS/ NaaE Network as a Sensor
Network as an Enforcer
Rapid Threat Containment
Firepower and Identity Services
Engine
ISE can take action on Threats detected by Source Fire
TheArchitecture
PxGrid - SACM
(Security Automation and ContinuousMonitoring)
Cisco pxGrid provides a unified framework that enables
ecosystem partners to integrate.

Better with Cisco Router and
Switches Device Sensor
• The Network IS the Collector!
• Automatic discovery for most common devices (printers, phones, Cisco devices)
• Collects the data at point closest to endpoint
• Topology independent
• Profiling based on:
• CDP/LLDP
• DHCP
• HTTP (WLC only)
• mDNS, H323,
MSI-Proxy (4k only)
Device Sensor Distributed Probes
ISE
Device Sensor Support
3k/4k/WLC
DHCP HTTPCDP/LLDP/DHCP/CDP/LLDP/DHCP CDP/LLDP/DHCP

IPv6 Device Sensor
RADIUS HTTP SENSOR DHCP SENSOR
IPv6 Device Sensor is supported
• RADIUS i.e. Framed-IPv6-Address accounting
• HTTP sensor – e.g. REMOTE_HOST, REMOTE_ADDR
• DHCP sensor - DHCPv6 options

See How Endpoints Act On The Network With
Better Visibility
Network as a Sensor
• Cisco ISE
• Cisco Networking Portfolio
• Cisco NetFlow
• Lancope StealthWatch
Data

ADMIN
ZONE
ENTERPRISE
ZONE
POS
ZONE
VENDOR
ZONE
And Make Visibility Actionable Through
Segmentation And Automation
Network as an Enforcer
• Cisco ISE
• Cisco Networking Portfolio
• Cisco NetFlow
• Lancope StealthWatch
• Cisco TrustSec Software-Defined
Segmentation
EMPLOYEE
ZONE
DEV
ZONE

Enable Unified Threat Response By Sharing Contextual Data
Cisco Platform Exchange Grid (pxGrid)
Cisco and Partner
Ecosystem
When
Where
Who
How
What
32
1
ISE
45
Cisco Network
pxGrid
controller
1 ISE collects contextual
data fromnetwork
Contextual data is
2 shared via pxGrid
technology
Partners use ISEdata
3 to quickly identify and
classify threats
Partners take
4 remediation actions
throughISE
ISE fine tunesaccess
5 policies with security
event data
Context

Improve Guest Experiences Without
Compromising Security
Guest
Guest
GuestSponsor
Internet
Internet
Internet and
Network
Immediate, Uncredentialed
InternetAccess
with Hotspot
SimpleSelf-Registration
Role-Based Accesswith
Employee Sponsorship

ISE Built-in Portal Customisation?
CreateAccounts
Print Email SMS
Mobile and
DesktopPortals
Notifications
Approved! credentials
username: trex42
password: littlearms

Which Portals Are Customisable
All Except The Admin Portal
1. Guest
2. Sponsor
3. BYOD (Device Registration)
4. My Devices
5. Client Provisioning (Desktop Posture)
6. MDM (Mobile Device Management)
7. Blacklist
8. Certificate Provisioning Portal

Access your portals to
manage and share
Choose from Pre-Built
Portal Layouts

ISE Express offers the same
dynamic Guest features of the
market-leading Cisco ISE in an
entry-level bundle at an aggressive
70-80% discount over the
competition.

Features / Capabilities?
Platform Included w/Licensing?
List Price?
Cisco ISE Base vs. Cisco ISE Express
 Same
 YES – Bundle includes 1
ISE VM + 150 Licenses
 $2,500 US
Cisco ISE Express
 Guest Access; RADIUS/AAA
 NO – Purchase HW or VM
and licensing
 $6,990 US
(ISE VM:$5,990 + Base:
$1,000, for 200 licenses)
Cisco ISE Base

What’s New
 ISE Express Installation Wizard
 Free, downloadable application
 Simplifies ISE and wireless controller
installation
 Provisions Hotspot, Self-Registered or
Sponsor services
 Modifies guest portals with logo and
colours
 Go to ISE Cisco Software Download
on CCO

Secure Access Use Cases
• MacAuthentication
Bypass (MAB)
• Whitelist
• Central Web
Authentication
(CWA)
• No supplicant
Good Better
• Roll out 802.1x in
Phases (Monitor
Mode)
Best
• 802.1x (Low
Impact, Closed
Mode)
• Certificates
• EAP etc..
• Supplicant on
endpoint
• Switch
configuration

ISE is a Standards-Based AAAServer
Access Control System Must Support All Connection Methods
ISE PolicyServer
VPN
CiscoPrime
Wireless
VPN
Supports Cisco and 3rd-Party solutions via
standard RADIUS, 802.1X, EAP, and VPN
Protocols .. more to come …
RADIUS
Wired
802.1X = EAPoLAN
802.1X = EAPoLAN
SSL / IPsec

Building the Architecture in Phases
47
 Access-Prevention Technology
– A Monitor Mode is necessary
– Must have ways to implement and see who will succeed and who will fail
 Determine why, and then remediate before taking 802.1X into astronger
enforcementmode.
 Solution = Phased Approach to Deployment:
Monitor Mode Low Impact Mode Closed Mode
What part of the
network does phased
deployment apply?

Internal
Employee
Intranet
Enable Faster and Easier Device Onboarding
Without Any IT Support
Confidential
HR Records
?
Device Profiling
www
Employee
Simplified Device Management
from Self-Service Portal
Automated Authentication and
Access to BusinessAssets
Rapid Device Identification with
Out-of-the-Box Profiles
ITStaff

Streamlining BYOD and Enterprise Mobility
Reducing the Complexity of Managing BYOD and Device Onboarding
Improved Device Recognition Desktop
& Mobile
Ready!
Integrated Native Certificate Authority for Devices
Customisable Branded Experiences
Easy User Onboarding with Self-Service Device Portals
Comprehensive Device Security with Posture and EMM
Supports 1M Registered Endpoints and 250K ACTIVE, Concurrent Endpoints

Single Versus Dual SSID Provisioning
• Single SSID
• Start with 802.1X on one SSID
using PEAP
• End on same SSID with 802.1X
using EAP-TLS
• Dual SSID
• Start with CWA on one SSID
• End on different SSID with 802.1X
using PEAP or EAP-TLS
SSID = BYOD-Open
(MAB / CWA)
SSID = BYOD-Closed (802.1X)
WLAN Profile
SSID = BYOD-Closed
PEAP or EAP-TLS
(Certificate=MyCert)
SSID = BYOD-Closed (802.1X)
WLAN Profile
SSID = BYOD-Closed
EAP-TLS
Certificate=MyCert
Which flow
provides better
user experience?

Onboarding Personal Devices
Registration, Certificate and Supplicant Provisioning
Device
Onboarding
Certificate
Provisioning
Supplicant
Provisioning
Self-
Service
Model
iOS
Android
Windows
MAC OS
MyDevices
Portal
 Provisions device Certificates.
‒ Based on Employee-ID &Device-ID.
 Provisions Native Supplicants:
‒ Windows: XP, Vista, 7, 8, 8.1, 10
‒ Mac: OS X 10.6, 10.7, 10.8, 10.9, 10.10.
10.11
‒ iOS: 4, 5, 6, 7, 8, 9
‒ Android – 2.2 and above
‒ 802.1X + EAP-TLS, PEAP & EAP-FAST
 Employee Self-Service Portal
‒ Lost Devices are Blacklisted
‒ Self-Service Model reduces ITburden

What Makes a BYOD Policy?
Sample Complete BYOD Policy
Internet Only
Employee Guest
Access-Reject
i-Device Registered?
Access-Accept
MAC address lookup to AD/LDAP
Profiling
Posture
Machine certificates
Non-exportable user certificate
Machine auth with PEAP-
MSCHAPv2’
EAP chaining
Y
N
N
Y
Y
N

What Is the Cisco ISE Posture Service?
PSN
MnT
ISE Node
PANPosture Service in ISE allows you to check the state
(posture) forALL the endpoints that are connecting to your
ISE-enabled network.
The Posture Agents, which are installed on the clients,
interact with the Posture Service to enforce security
policies on all the endpoints that attempt to gain access to
your protected network.
Posture Agents enforce security policies on noncompliant endpoints by blocking
network access to your protected network.
Must have Apex licensing enabled on your ISE devices

Posture Assessment
Does the Device Meet Security Requirements?
• Posture = The state-of-compliance with the company’s security policy.
• Extends the user / system Identity to include Posture Status.
Posture
Microsoft Updates Antivirus/
Antispyware
Misc
Service Packs
Hotfixes
OS/Browser
versions
Installation/Signatures File data
Services
Applications / Processes
Registry Keys
Patch Management
Disk Encryption
What is the main
difference
between Profiling
& Posture?

Posture Enhancements
Mac OSx SupportAdded for Custom Checks: File / Service /Application / Disk Encryption
• File, Service (daemon,
User Agent), and
Application (process)
checks
• File condition, file path
can have home or root
follow with path.
• SHA 256 Check
• Property List (plist) Check
NOTE: Disk Encryption new for ISE 2.0

Posture Enhancements - OSx Daemon Check
• A daemon is a program that runs in
the background as part of the overall
system (not tied to user)
• A user agent is a process that runs in
the background on behalf of a
particular user.
• ISE 2.0 supports feature to check user
agent as well as the daemon

Posture for all Devices
Desktop Posture vs Mobile Posture
Focused on Mobile Devices Posture ONLY
Requires devices to comply with MDM policy
PINLock, JailBroken,APP check and More …
ISE + MDM
Together
Mobile Posture
SOLUTION
Desktop Compliance checks for Windows and OSx
Variety of Checks ranging from OS, Hotfix, AV / AS,
Patch Management andMore…
ISE can enforce
Network Access based onCompliance
Desktop Posture
ISE can enforce
Network Access based on MDMCompliance

Multiple MDM Support
Multiple MDM Vendors Can Be Added To ISE And Used Simultaneously In Policy

MDM Flow
86
ISE Policy
Server
VPN
 If MDM Registration Status EQUALS UnRegistered, then Redirect to MDM for Enrollment
 If MDM Compliance Status EQUALS NonCompliant, then Redirect to MDM for Compliance
Authentication
MDM Compliance Status != Compliant
Redirect to ISE landing page for MDM
enrollment or compliance status
https://ise.company.com:8443/guestportal/gateway?sessionId=0A010A...73691A&action=mdm
MDMAPI
Connect to WLAN=Corp
Redirect browser to ISE
Cloud MDM
Google
Play/AppStore

MDM Remediation
87
ISE Policy
Server
VPN
 CoA allows re-authentication to
be processed based on new
endpoint identity context (MDM
enrollment/compliance status).
ReAuth
MDM Status = Compliant
Remove Redirection and apply access
permissions for compliant endpoints
CoA
 MDM Agents downloaded directly from MDM
Server or Internet App Stores
 Periodic recheck via API; CoA if not compliant
ASA
MDMAPI
Cloud MDM
ReAuth after Comply
Compliant = Full Access

Campus & DC
Segmentation
User to DC
Access Control
How TrustSec/ SGT is used today
Server
Segmentation
Application
Protection
Secure
ContractorAccess
BYOD
Security
Machine-
Machine Control
Threat DefenceFast Server
Provisioning
Firewall Rule
Reduction
PCI & PHI
Compliance
Network & Role
Segmentation

Segmentation with Security Group
Data CentreFirewall
Voice Data Suppliers Guest Quarantine
Retaining initial VLAN/Subnet Design
Regardless of topology or location,
policy (Security Group Tag) stays
with users, devices, and servers
Access Layer
Data Tag
Supplier Tag
Guest Tag
Quarantine Tag
Aggregation Layer
DC-RTP (VDI)
Production
Servers
DC-MTV (SRV1)
DC-MTV (SAP1)
DC-RTP (SCM2)
Destination

Enforcing Policy Downstream
Context Telemetry:
• Manager
• Windows PC
• Compliant
Timecard
application
server
Credit Card
transaction serverFirewall
Enforcement
Cisco ISE
Classify Mark, Propagate, Enforce
• IP Precedence and DiffServ code points
• 802.1Q User Priority
• MPLS VPN
• TrustSec
Classify
&
Mark
EnforcePropagation

Static Classification
• IPAddress
• VLANs
• Subnets
• L2 Interface
• L3 Interface
• Virtual Port Profile
• Layer 2 Port Lookup
Pre-fix learning
Common Classification for Servers,
Topology-based policy, etc.
802.1X/ RAS VPNAuthentication
WebAuthentication
MAC Auth Bypass
Common Classification for Mobile
Devices
SGT
Classification Summary
SGTAssignment
Dynamic Classification
Classification

Dynamic Classification Process in Detail
Layer 2
Supplicant Switch / WLC ISE
Layer 3
Authorisation
DHCP
EAPoLTransaction RADIUS Transaction
EAPTransaction
SGT
Authenticated
Authorised
0 Policy
Evaluation
DHCP Lease:
10.1.10.100/24
ARP Probe IP Device
Tracking
Authorised MAC:
00:00:00:AB:CD:EF
SGT =5
Binding:
00:00:00:AB:CD:EF = 10.1.10.100/24
1
2
3
SRC: 10.1.10.1 = SGT 5
00:00:00:AB:CD:EF
cisco-av-pair=cts:security-group-tag=0005-01
Make sure that IP
Device Tracking
is TURNED ON
3560X#show cts role-based sgt-map all details
Active IP-SGT Bindings Information
IP Address Security Group Source
=============================================
10.1.10.1
10.1.10.100
3:SGA_Device
5:Employee
INTERNAL
LOCAL
Classification

Traditional TrustSec Tag Assignment & SXP
Propagation
Access
Switch
Router DC FW DC Switch
HR Servers
Fin Servers
ISE Directory
Enforcement
Classification
User /
Endpoint
Propagation

ISE as SXP Speaker
Access
Switch
DC Switch
HR Servers
Fin Servers
ISE Directory
Classification
User /
Endpoint
SXP
Tag
IP Addr
5 10.10.10.10
5 Fin Servers
10 HR Servers
Propagation
Enforcement
SXP
Propagation
Router DC FW
Does Access Switch needto
understandTrustSec?

Cat3750X Cat6500 Nexus 2248
WLC5508 ASA5585
Enterprise
Backbone
Cat6500 Nexus 7000 Nexus 5500
End user authenticated
Classified as Employee (5)
FIB Lookup
Destination MAC/Port SGT 20
ISE
SRC: 10.1.10.220
5
SRC:10.1.10.220
DST: 10.1.100.52
SGT:5
Web_Dir
DST: 10.1.100.52
SGT: 20
Nexus 2248
CRM
DST: 10.1.200.100
SGT: 30
SRCDST
Web_Dir
(20) CRM (30)
Employee (5) SGACL-A SGACL-B
BYOD(7) Deny Deny
Destination Classification
Web_Dir: SGT 20
CRM: SGT 30
How is Policy Enforced with SGACL
Enforcement

Anatomy of a Typical Device Administration
Session with TACACS+
• TACACS+ Separates
Authentication,
Authorisation and
Accounting
• Flexible and extensible
• TCP for more reliable
accounting
• Built-in Goodies such as
User Change Password

Refresh on a Typical TACACS+ Session
• Two Main Authorisation
stages
• SESSION:
What can user do duringthis
session?
• COMMAND:
Can the user performthis
command?
Which TCPport
does T+ listen
on as default?

TACACS+ Authorisation: Protocol Level
• Authorisation is a single request/response: Header + Attributes
Device ISE
• Result is FAIL, PASS_ADD, PASS_REPLACE
• Fail: Request is not Permitted
• PASS_ADD: The permissions asked for are valid, but the operation must also apply
these extra attributes (Response Profile)
• PASS_REPLACE: The request is permitted, but with this alternative attribute profile
Type Author
user admin
rem_add
r
office
Result PASS_AD
D
priv-lvl 15

• Policy Service Node for Protocol
Processing
• Session Services (e.g. Network
Access/RADIUS) On by default
• Device Admin Service (e.g. TACACS+)
MUST BE ENABLED
FOR DEVICE ADMINISTRATION!!
142
ISE Deployment Node
Configuration

Supported Migration paths using Migration Tools
Path Segments Tools
ACS 4.x to ISE ACS 4.x -> ACS 5.6 ACS 4 Migration Tool
ACS 5.6 -> ISE ACS 5 Migration Tool
ACS 5.0 – ACS 5.4 to ISE ACS 5.x -> ACS 5.6 ACS 4 Migration Tool
ACS 5.6 -> ISE ACS 5 Migration Tool
ACS 5.5 - ACS 5.6 to ISE ACS 5.5 - ACS 5.6 to ISE ACS 5 Migration Tool
Consider options carefully, especially if migrating from ACS4

3rd Party Device (NAD) Support
Customers can now deploy ISE services such as Profiling, Posture,
Guest and BYOD (on top of the already-working 802.1x) with Network
Access Devices (NADs) manufactured by non-Cisco third party
vendors.

Cisco Session ID & Redirect
NAD: “show authentication session”
ISE: Detailed Authentication Report
https://ise14.example.com:8443/guestportal/gateway?C0A8013C00000618B3C1CAFB&portal=&action=cwa
Browser: URL-redirect for Web Auth
C0A8013C00000618B3C1CAFB
NAS IPAddress Session Count Time Stamp

• Type: None / Static / Dynamic
• None – NAD does not have usable redirection
method
• Static – NAD requires ISE generated URL tobe
applied to local device config
• Dynamic – NAD can receive redirect via RADIUS
authorisation
URL Parameter Names
• Defines the format of
vendor redirect
• Allows ISE to parse
needed information from
redirected requests
URL Redirection
Static URL, Dynamic URL and URL Format

What is Change of Authorisation
(CoA)
The EndPoint needs a new Policy ( ISE 2.0 = RFC 3576 & RFC5176)
Example Cisco CoA operations
 Terminatesession
 Terminate session with port bounce
 Re-authenticate session
 Disable host port
 Session Query
– For Active Services
– For Complete Identity
– Service Specific
 Service Activate
 Service De-activate
 Service Query
CoA options are
NAD-specific
COAPorts
Port 1700, type = Cisco COA
Port 3799, type = RFC 5176

RFC 5176
What is Change of Authorisation (CoA)
The EndPoint needs a new Policy (RFC 3576 & RFC 5176)
• Disconnect Message (DM)
• Also known as “Packet of Disconnect (PoD)” or “CoA Session
Terminate”
• Terminate user session(s) on a NAS and discard all associated session
context.
Disconnect-Request
Disconnect-ACK/NAK
• Change-of-Authorisation (CoA) Messages
• Also known as “Authorise Only” or “CoA Push”
• CoA-Request packets contain information for dynamically changing session
authorisations.
CoA-Request
CoA-ACK/NAK

My 3rd Party NAD does not support COA ReAuth/ COA Push
ISE 2.0 can perform “COAStiching”
Web Auth: EnterCredentials
Full Access
PSN
CWASuccess
CoATerminate
New Auth Request
EmployeeAccess
Hold session open
for 20 seconds
Matching request
received < 20 sec;
return policy for
employee user
Session 002
Session 001
Accntg Stop
1
2
3
4
5
6

3rd-Party NADs – Supported Features
• AAA
• 802.1X (since 1.0)
• MAB (since 1.2.)
• LWA to local portal (since 1.0)
• CoA
• Profiling (with CoA)
• Guest
• Hotspot
• Central Web Authentication (CWA)
• Sponsored guest flow
• Self-Registration guest flow
• ISE hosted portals
Features Vary By Vendor, Platform, and Versions!
 Posture
 BYOD
 Device registration
 Supplicant Provisioning
 Certificate Provisioning
 Self-Service device management
(MyDevices)
 Single/Dual SSID
 TrustSec
 Dynamic SGT and SXP Listener

Adding 3rd-Party NADS
to facilitate policy management
Network Access Device Configuration
• Administration > Network Resource > Network
Devices
• Be sure to set the Device Profile correctly !!
• Enter Network Device Type and Location info
Optional:
Override default
CoA Port per
NAD

Current Vendor Test Results
Vendor Verified Series Tested Model /
Firmware
Supported / Validated use cases
CoA Profiler Posture Guest
/BYOD
Aruba Wireless 7000, InstantAP 7005-US/6.4.1.0 ✔ ✔ ✔ ✔
Motorola Wireless RFS 4000 Wing v5.5 ✔ ✔ ✔ ✔
HP Wireless 830 (H3C) 8P/3507P35 ✔ ✔ ✔ ✔
HP Wired HP 5500 HI Switch
Series (H3C)
A5500-24G-4SFP
HI/5.20.99
✔ ✖ ✖ ✖
HP Wired HP 3800 Switch
Series (ProCurve)
3800-24G-POE-2SFP
(J9573A)
KA.15.16.000. 6
✖ ✖ ✖ ✖
Brocade Wired ICX 6610 24/08.0.20aT7f3 ✔ ✔ ✖ ✖
Ruckus Wireless ZD1200 9.9.0.0 build 205 ✔ ✔ ✖ ✖
Additional 3rd party NAD Support:
 Requires identification of device properties/capabilities and to creation of a
custom NAD profile in ISE. More detailed guide to be published.
✔ Requires
CoA
support
Requires
CoA & url-
redirect
support
Requires
CoA & url-
redirect
support

Sem cis ise

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Sem cis ise

Similaire à Sem cis ise (20)

Dernier

Dernier (12)

Sem cis ise