You are here
SEC0189 - ISE 1.3 BYOD Wireless Onboarding with Single SSID (Internal CA) (Part 1)
Difficulty Level:
Lab Document:
<Please login to see the content>
Category:
Security
The video demonstrates wireless device onboarding with single SSID and Cisco ISE 1.3 Internal CA. With the internal CA configured in the previous video, we continues to complete the remaining configuration to provide wireless BYOD solution including; BYOD portal, required authentication, authorization, and client provisioning policies. We will step through the entire onboarding process and test device management via MyDevices portal on iPad, Android and Windows computer.
Part 1 of this video focuses on the configuration on ISE
Topic:
- Active Directory User Group Selection
- ISE Internal CA
- WLAN SSID Configuration
- BYOD Portal
-
Policy Element Result
-
Authorization (Authorization Profile)
- Native Supplicant Provisioning
- Airspace ACL
- Client Provisioning (Native Supplicant Profile)
-
Authorization (Authorization Profile)
- Authentication Policy
- Authorization Policy
- Client Provisioning Policy
- My Devices Portal (Lost and Stolen Device)
- Blacklist Portal
Relevant Videos:
About Author
Metha Chiewanichakorn, CCIE#23585 (Ent. Infra, Sec, SP), is a Cisco networking enthusiast with years of experience in the industry. He is currently working as a consulting engineer for a Cisco partner. As a founder of and an instructor at labminutes.com, Metha enjoys learning and challenges himself with new technologies.
18 comments
How do we do Posture on BYOD ?
Hi Metha,
How can we do posture on this Scenario ? can we do along with client provisioning or do we have to do another re-direction for posture ?
How do we do Posture on BYOD ?
You can either let the device onboard then redirect it to a posture page, or perform posture check before allowing the device to onboard. Either way, it will be separate redirection processes. Also, this is assume it is a Windows or Mac OSX device that support Posture Agent.
AD login to PEAP
Hi,
We are seeing a security vulnerability on authenticating the onboarding SSID with PEAP using AD users. We see that it could happen that someone could try to Lock internal AD users since they have the chance to try multiple times user/password authentication on the onboarding SSID.
Is this correct? If it is, do you see a workaround?
Thanks,
AD login to PEAP
Good point.. If the AD takes a fail auth form ISE as a fail login attempt and count towards fail login, then it is probably possible for someone to have their AD acocunt locked out. Although if that is the case, the same could also happen using web portal with Dual SSID. ISE has internal function to suppress an endpoint if it fail authentication too many time. May be you can set the suppress timeout so it is longer than that of AD for fail auth interval. By default on ISE it is 60 min.
AD login to PEAP
Thanks. And in the case of dual SSID, a workaround that we've found is protecting the onboarding SSID with a WPA2 PSK and then the AD web Auth. Doing this, the "hacker" first need to get the psk before trying AD user/passwords.
Do you see it as a prevention control?
AD login to PEAP
Using PSK to protect onboarding SSID should be fine except that it add one additional step to the process. As long as it is well documented for the user to follow, there should be no problem.
ISE 2.0 SP 3
I configured ISE 2.0 patch 3 for using the ISE 1.3 BYOD with 1 SSID. WLC is 2504 running 8.0.133
IPhone or Mac OS get a certificate. When the IPhone and Mac OS re authenticate using EAP-TLS the ISE Radius Live shows the client associated with the permit-all. The the client IPhone or Mac OS can't connect back to SSID. It shows the client on the WLC with 0.0.0.0 but doesn' connect
ISE 2.0 SP 3
Could it be something related to SSID config? If you remove .1x on SSID and leave it open, can client get IP?
Onboarding using EAP-PEAP
HI Metha,
Thanks for the great instructional videos. I would like to know if we can achieve the BYOD onboarding by only using EAP-PEAP protocol. I am referring to the video where we are installing EAP-TLS certificate during supplicant provisioning, can we use the same EAP PEAP here ?if yes, then what will change.
Onboarding using EAP-PEAP
You can configure client to use PEAP after onboarding by changing from EAP-TLS to PEAP under the client provisioning profile. This usually only make sense if you do dual-SSID onboarding. Keep in mind the user may still be prompted to login once onboarded and this is why EAP-TLS is preferred especially that ISE can be used to issued client certificate.
Onboarding using EAP-PEAP
Thanks for the clarification Mehta, I tried to uses these steps and am getting stuck in the first BYOD webauth page.
I am unable to proceed further as it says browser not supported on IOS device or any device for that matter.
I am unable to proceed to step 2 after initial 802.1x authentication.
I am seeing the devices under endpoints after authentication but unable to call it in authorisation rules.
Onboarding using EAP-PEAP
What version of ISE are you running? Are you still trying to have client use PEAP at the end? If so, you might be better of with dual-SSID, where client do a webauth first, and once onboarded, connected to .1x SSID.
Onboarding using EAP-PEAP
Hi,
I am using ISE 1.4 and yes, I am still trying with EAP-PEAP. I tried using dual SSID and have a few queries around the open SSID configuration on WLC.
-LM_BYOD SSID shows selecting mac-filtering under L2 policies ..I am unable to get the redirect through ISE.
Are you entering the device MAC address on WLC? I assume no.
I am unsure what should be the condition under Wireless MAB that is called out in Authentication policy set.
Appreciate your suggestions
Cheers
Onboarding using EAP-PEAP
With MAC-filter enabled on SSID with RADIUS server, WLC will grab client MAC address and send to ISE as username via MAB. You need to have a auth policy created to match wireless MAB and auth profile that send them to a CWA login page. Please check out video SEC0190 on dual-SSID config.
BYOD SSID
hello Metha,
thanks for the great videos
I'm new to the BYOD concepts so bear with me please
so in my place we use two SSIDs as of now, one that's 802.1x with PEAP for employees and the other is MAB with CWA for guests
so if we're using single SSID BYOD On-boarding does that need to create new SSID for or it will work on the same 802.1x SSID [the employees SSID]?
if yes what about corporate devices that's already using PEAP will they get into the same process and onboard etc next time they log in ? or do we need to change them to EAP TLS now ?
how can we differentiate between corporate devices and personal devices if we're using the same SSID ?
ty
BYOD SSID
That is always the challenge with Single SSID. For Windows, you can use machine auth to differentiate domain computer but that's pretty much it. Everything else needs certificate as identifier. You are probably better off having users onboard through guest SSID using their AD to login and reconnect to corp SSID once onboarded. Better yet, use MDM to onboard.
BYOD SSID
thanks for the answers
so if we used single or dual SSID on-boarding we have to use EAP TLS for everything? [employees and personal devices] ?
BYOD SSID
Not necessarily. For both methods, employees can still use PEAP while BYOD devices use EAP-TLS.