ISE Dynamic Variables

Using Cisco ISE you can apply variables such Downloadable ACL (DACL) or VLAN from an External Identity Source (e.g Active Directory) and apply these values during authorization. For example instead of defining multiple authorization rules such as – If AD:ExternalGroup membership equals “GroupName” then assign static attributes”DACL_1″ and “VLAN_1”.


The same can be achieved by extracting the attributes from an External Identity Source such as AD, resulting in 1 authorization rule instead of multiple.


Continue reading “ISE Dynamic Variables”

Advertisements

MACsec with Cisco AnyConnect and ISE

MACsec provides secure communication on wired networks; it encrypts each packet on the wire so that communication cannot be monitored. There are 2 deployment types:- User facing/downlink MACsec or switch-to-switch MACsec.

When using downlink MACsec a supplicant that supports 802.1x with MACsec is required, Cisco AnyConnect version 3.0+ supports this functionality. When AnyConnect is configured with MACsec it authenticates the user/computer using 802.1x and then encrypts all traffic using MACsec that is sent to the directly attached Access Layer switch. Once the packet has been received by the Access Layer switch the packet is decrypted, this allows the possibility to apply QoS polices or monitor with Netflow. The switch could then route packet in clear text or if switch-to-switch MACsec is enabled re-encrypt the traffic.

Switch-to-Switch MACsec secures the packets on a hop by hop basis, decrypting and encrypting on each network device (meaning all traffic inside the switches are in clear text). The MACsec sessions are completely independent as they are routed through the network.

Continue reading “MACsec with Cisco AnyConnect and ISE”

Cisco ISE pxGrid integration with Firepower

Cisco ISE and Firepower can exchange attributes such as TrustSec SGT (Security Group Tag), endpoint profile information and IP address via pxGrid. These attributes can then be used in Firepower Access Control Policies to permit/deny access as required. In addition, this integration can also be used to quarantine users/hosts in the event the user performs a malicious activity. When Firepower detects the malicious activity this will match a correlation rule on the FMC, which instructs ISE to perform a remediation action such as sending a CoA (Change of Authorization) and quarantining the user by apply a DACL and/or applying a new SGT.

This post will describe how to configure the pxGrid integration between the FMC and ISE, it is assume that you already have a working ISE environment with users/computers authenticating using dot1x and a working Firepower FMC/FTD environment.

Refer to these previous ISE posts on how to configure ISE, dot1x authentication and more information about configuring TrustSec.

The following software versions were used:-

  • Firepower Management Centre 6.2.2.2
  • Firepower Threat Defence Virtual 6.2.2.2
  • Identity Services Engine 2.4
  • Windows Server 2008 R2 (Domain Controller and PKI)
  • Windows 7 Enterprise

Continue reading “Cisco ISE pxGrid integration with Firepower”

Wireless 802.1x authentication with Cisco ISE

The purpose of this blog post is to document the configuration steps required to configure Wireless 802.1x authentication on a Cisco vWLC v8.3 using Cisco ISE 2.4 as the RADIUS server.

WLC Configuration

Define AAA Servers

Cisco ISE Adaptive Network Control (ANC)

Adaptive Network Control (ANC) is a feature of Cisco ISE that can be used to monitor and control network access of authenticated (via ISE) endpoints. With ANC you have the ability to quarantine and endpoint by restricting access with a DACL or shutting down the interface. ANC is a manual process that can be triggered by an administrator. ANC requires ISE Plus License, the Base license is also required.

This post covers only the configuration of ANC and assumes Cisco ISE and 802.1x is setup and working. The posts below maybe useful to assist when configuring Cisco ISE and Cisco switches in order to authenticate users/computers with 802.1x.

Continue reading “Cisco ISE Adaptive Network Control (ANC)”

EAP Chaining with Cisco ISE

EAP-FAST is a Cisco proprietary EAP authentication method. It provides the ability to chain user and machine authentications together, this is called EAP Chaining. The major advantage of using this protocol is ensuring that only corporate users can authenticate to the network using a corporate issued computer. EAP-FAST is only supported when using Cisco AnyConnect as the dot1x supplicant.

ISE Configuration

This post will cover the configuration of EAP-Chaining on Cisco ISE, using EAP-FAST with EAP-TLS (certificates) as an inner authentication method for both Machine and User authentication. In this lab Cisco ISE version 2.4 and Cisco AnyConnect v4.6 is used.
Continue reading “EAP Chaining with Cisco ISE”

Upgrading Cisco ISE via CLI

When you install an ISE patch from the WebGUI of the Primary PAN (in a distributed deployment), the patch installs the patch on the P-PAN and if successful continues to install the patch on the remaining nodes automatically. Alternatively you can install the patch from the CLI, on each node individually. This will allow you to control when the patches are installed and therefore when the nodes are rebooted an inactive.

If the PAN auto-failover is enabled this must be disabled before installing the patch.

This post will describe will demonstrate how to install ISE 2.3 patch 2 via the CLI.
Continue reading “Upgrading Cisco ISE via CLI”