Cisco ISE for BYOD and Secure Unified Access

Aaron Woland, CCIE No. 20113, is a Principal Engineer in Cisco’s Security Group and works with Cisco’s largest customers all over the world. His primary job responsibilities include Secure Access and Identity deployments with ISE, solution enhancements, standards development, Advanced Threat Security and solution futures. Aaron joined Cisco in 2005 and is currently a member of numerous security advisory boards and standards body working groups. Prior to joining Cisco, Aaron spent 12 years as a consultant and technical trainer. His areas of expertise include network and host security architecture and implementation, regulatory compliance, and route-switch and wireless.Aaron is the author of many Cisco white papers and design guides and is co-author of CCNP Security SISAS 300-208 Official Cert Guide; Cisco Next-Generation Security Solutions: All-in-one Cisco ASA Firepower Services, NGIPS, and AMP; and CCNA Security 210-260 Complete Video Course.Aaron is one of only five inaugural members of the Hall of Fame Elite for Distinguished Speakers at Cisco Live, and is a security columnist for Network World, where he blogs on all things related to secure network access. His other certifications include GHIC, GSEC, Certified Ethical Hacker, MCSE, VCP, CCSP, CCNP, CCDP, and many other industry certifications. You can follow Aaron on Twitter: @aaronwoland.Jamey Heary, CCIE No. 7680, is a Distinguished Systems Engineer at Cisco Systems, where he leads the Global Security Architecture Team, GSAT. Jamey and his GSAT team work as trusted security advisors and architects to Cisco’s largest customers worldwide. Jamey sits on the PCI Security Standards Council’s Board of Advisors, where he provides strategic and technical guidance for future PCI standards. Jamey is the author of Cisco NAC Appliance: Enforcing Host Security with Clean Access. He also has a patent on a new DDoS mitigation and firewall IP reputation technique. Jamey blogged for many years on Network Worldon security topics and is a Cisco Live Distinguished Speaker. Jamey sits on numerous security advisory boards for Cisco Systems and was a founding member of several Cisco security customer user groups across the United States. His other certifications include CISSP, and he is a Certified HIPAA Security Professional. He has been working in the IT field for 24 years and in IT security for 20 years. You can contact Jamey at jheary@appledreams.com.

• Introduction xxixPart I Identity-Enabled Network: Unite!Chapter 1 Regain Control of Your IT Security 1Security: Still a Weakest-Link Problem 2Cisco Identity Services Engine 3Sources for Providing Identity and Context Awareness 5Unleash the Power of Centralized Policy 6Summary 8Chapter 2 Fundamentals of AAA 9Triple-A 10Compare and Select AAA Options 10Device Administration 11Network Access 12TACACS+ 13TACACS+ Authentication Messages 14TACACS+ Authorization and Accounting Messages 15RADIUS 17AV Pairs 20Change of Authorization 20Comparing RADIUS and TACACS+ 21Summary 21Chapter 3 Introducing Cisco Identity Services Engine 23Architecture Approach to Centralized and Dynamic Network Security Policy Enforcement 23Cisco Identity Services Engine Features and Benefits 26ISE Platform Support and Compatibility 30Cisco Identity Services Engine Policy Construct 30ISE Authorization Rules 33Summary 34Part II The Blueprint, Designing an ISE-Enabled NetworkChapter 4 The Building Blocks in an Identity Services Engine Design 35ISE Solution Components Explained 35Infrastructure Components 36Policy Components 42Endpoint Components 42ISE Personas 43ISE Licensing, Requirements, and Performance 45ISE Licensing 45ISE Requirements 46ISE Performance 47ISE Policy-Based Structure Explained 48Summary 49Chapter 5 Making Sense of the ISE Deployment Design Options 51Centralized Versus Distributed Deployment 52Centralized Deployment 52Distributed Deployment 55Summary 58Chapter 6 Quick Setup of an ISE Proof of Concept 59Deploy ISE for Wireless in 15 Minutes 59Wireless Setup Wizard Configuration 60Guest Self-Registration Wizard 61Secure Access Wizard 65Bring Your Own Device (BYOD) Wizard 67Deploy ISE to Gain Visibility in 15 Minutes 69Visibility Setup Wizard 69Configuring Cisco Switches to Send ISE Profiling Data 73Summary 75Part III The Foundation, Building a Context-Aware Security PolicyChapter 7 Building a Cisco ISE Network Access Security Policy 77Components of a Cisco ISE Network Access Security Policy 78Network Access Security Policy Checklist 79Involving the Right People in the Creation of the Network Access Security Policy 79Determining the High-Level Goals for Network Access Security 81Common High-Level Network Access Security Goals 82Network Access Security Policy Decision Matrix 84Defining the Security Domains 85Understanding and Defining ISE Authorization Rules 87Commonly Configured Rules and Their Purpose 88Establishing Acceptable Use Policies 89Host Security Posture Assessment Rules to Consider 91Sample NASP Format for Documenting ISE Posture Requirements 96Common Checks, Rules, and Requirements 97Method for Adding Posture Policy Rules 98Research and Information 98Establishing Criteria to Determine the Validity of a Security Posture Check, Rule, or Requirement in Your Organization 99Method for Determining What Posture Policy Rules a Particular Security Requirement Should Be Applied To 100Method for Deploying and Enforcing Security Requirements 101Defining Dynamic Network Access Privileges 102Enforcement Methods Available with ISE 102Commonly Used Network Access Policies 103Summary 105Chapter 8 Building a Device Security Policy 107ISE Device Profiling 107ISE Profiling Policies 109ISE Profiler Data Sources 110Using Device Profiles in Authorization Rules 111Threat-Centric NAC 111Using TC-NAC as Part of Your Incident Response Process 113Summary 116Chapter 9 Building an ISE Accounting and Auditing Policy 117Why You Need Accounting and Auditing for ISE 117Using PCI DSS as Your ISE Auditing Framework 118ISE Policy for PCI 10.1: Ensuring Unique Usernames and Passwords 126ISE Policy for PCI 10.2 and 10.3: Audit Log Collection 128ISE Policy for PCI 10.5.3, 10.5.4, and 10.7: Ensure the Integrity and Confidentiality of Audit Log Data 129ISE Policy for PCI 10.6: Review Audit Data Regularly 130Cisco ISE User Accounting 131Summary 132Part IV Let's Configure!Chapter 10 Profiling Basics and Visibility 133Understanding Profiling Concepts 133ISE Profiler Work Center 137ISE Profiling Probes 137Probe Configuration 138DHCP and DHCPSPAN Probes 140RADIUS Probe 142Network Scan (NMAP) Probe 143DNS Probe 147SNMPQUERY and SNMPTRAP Probes 148Active Directory Probe 149HTTP Probe 150HTTP Profiling Without Probes 152NetFlow Probe 152Infrastructure Configuration 153DHCP Helper 153SPAN Configuration 156VLAN ACL Captures 157Device Sensor 157VMware Configurations to Allow Promiscuous Mode 159Profiling Policies 160Profiler Feed Service 160Configuring the Profiler Feed Service 160Verifying the Profiler Feed Service 162Offline Manual Update 164Endpoint Profile Policies 167Context Visibility 169Logical Profiles 178ISE Profiler and CoA 179Global CoA 180Per-Profile CoA 181Global Profiler Settings 182Configure SNMP Settings for Probes 182Endpoint Attribute Filtering 182NMAP Scan Subnet Exclusions 183Profiles in Authorization Policies 183Endpoint Identity Groups 183EndPointPolicy 187Importing Profiles 187Verifying Profiling 189The Dashboard 189Endpoints Dashboard 189Context Visibility 190Device Sensor Show Commands 191Triggered NetFlow: A Woland-Santuka Pro Tip 191Summary 194Chapter 11 Bootstrapping Network Access Devices 195Cisco Catalyst Switches 195Global Configuration Settings for Classic IOS and IOS 15.x Switches 196Configure Certificates on a Switch 196Enable the Switch HTTP/HTTPS Server 197Global AAA Commands 198Global RADIUS Commands 199Create Local Access Control Lists for Classic IOS and IOS 15.x 202Global 802.1X Commands 204Global Logging Commands (Optional) 204Global Profiling Commands 205Interface Configuration Settings for Classic IOS and IOS 15.x Switches 207Configure Interfaces as Switch Ports 208Configure Flexible Authentication and High Availability 208Configure Authentication Settings 211Configure Authentication Timers 212Apply the Initial ACL to the Port and Enable Authentication 213Configuration Settings for C3PL Switches 213Why Use C3PL? 213Global Configuration for C3PL 216Global RADIUS Commands for C3PL 217Configure Local ACLs and Local Service Templates 219Global 802.1X Commands 220C3PL Fundamentals 221Configure the C3PL Policies 222Cisco Wireless LAN Controllers 225AireOS Features and Version History 225Configure the AAA Servers 226Add the RADIUS Authentication Servers 226Add the RADIUS Accounting Servers 227Configure RADIUS Fallback (High Availability) 229Configure the Airespace ACLs 229Create the Web Authentication Redirection ACL 230Add Google URLs for ACL Bypass 231Create the Dynamic Interfaces for the Client VLANs 232Create the Employee Dynamic Interface 233Create the Guest Dynamic Interface 234Create the Wireless LANs 236Create the Guest WLAN 236Create the Corporate SSID 240Summary 245Chapter 12 Network Authorization Policy Elements 247ISE Authorization Policy Elements 247Authorization Results 251Configuring Authorization Downloadable ACLs 251Configuring Authorization Profiles 253Summary 256Chapter 13 Authentication and Authorization Policies 257Relationship Between Authentication and Authorization 257Enable Policy Sets 258Authentication Policy Goals 261Accept Only Allowed Protocols 261Route to the Correct Identity Store 261Validate the Identity 261Pass the Request to the Authorization Policy 262Understanding Authentication Policies 262Conditions 263Allowed Protocols 266Authentication Protocol Primer 268Identity Store 271Options 272Common Authentication Policy Examples 272Using the Wireless SSID 272Remote-Access VPN 277Alternative ID Stores Based on EAP Type 278Authorization Policies 280Goals of Authorization Policies 280Understanding Authorization Policies 280Role-Specific Authorization Rules 286Authorization Policy Example 286Employee and Corporate Machine Full-Access Rule 286Internet Only for Mobile Devices 288Employee Limited Access Rule 292Saving Attributes for Reuse 295Summary 297Chapter 14 Guest Lifecycle Management 299Overview of ISE Guest Services 301Hotspot Guest Portal Configuration 302Sponsored Guest Portal Configuration 304Create an Active Directory Identity Store 304Create ISE Guest Types 305Create Guest Sponsor Groups 307Authentication and Authorization Guest Policies 310Guest Pre-Authentication Authorization Policy 310Guest Post-Authentication Authorization Policy 312Guest Sponsor Portal Configuration 313Guest Portal Interface and IP Configuration 313Sponsor and Guest Portal Customization 313Sponsor Portal Behavior and Flow Settings 313Sponsor Portal Page Customization 315Guest Portal Behavior and Flow Settings 316Guest Portal Page Customization 317Creating Multiple Guest Portals 318Guest Sponsor Portal Usage 318Sponsor Portal Layout 319Creating Guest Accounts 320Managing Guest Accounts 320Configuration of Network Devices for Guest CWA 321Wired Switches 321Wireless LAN Controllers 322Summary 325Chapter 15 Client Posture Assessment 327ISE Posture Assessment Flow 329Configure Global Posture and Client Provisioning Settings 331Posture Client Provisioning Global Setup 331Posture Global Setup 335Posture General Settings 335Posture Reassessments 336Posture Updates 337Acceptable Use Policy Enforcement 338Configure the AnyConnect and NAC Client Provisioning Rules 339AnyConnect Agent with ISE Compliance Module 339AnyConnect Posture Profile Creation 340AnyConnect Configuration File Creation 341AnyConnect Client Provisioning Policy 343Configure the Client Provisioning Portal 343Configure Posture Elements 345Configure Posture Conditions 345Configure Posture Remediations 349Configure Posture Requirements 353Configure Posture Policy 355Configure Host Application Visibility and Context Collection (Optional) 357Enable Posture Client Provisioning and Assessment in Your ISE Authorization Policies 359Posture Client Provisioning 359Authorization Based On Posture Compliance 360Posture Reports and Troubleshooting 361Enable Posture Assessment in the Network 362Summary 363Chapter 16 Supplicant Configuration 365Comparison of Popular Supplicants 366Configuring Common Supplicants 367Mac OS X 10.8.2 Native Supplicant Configuration 367Windows GPO Configuration for Wired Supplicant 369Windows 7, 8/8.1, and 10 Native Supplicant Configuration 373Cisco AnyConnect Secure Mobility Client NAM 377Summary 382Chapter 17 BYOD: Self-Service Onboarding and Registration 383BYOD Challenges 384Onboarding Process 386BYOD Onboarding 386Dual SSID 387Single SSID 387Configuring NADs for Onboarding 388ISE Configuration for Onboarding 392End-User Experience 393Configuring ISE for Onboarding 408BYOD Onboarding Process Detailed 423MDM Onboarding 429Integration Points 430Configuring MDM Integration 431Configuring MDM Onboarding Policies 433The Opposite of BYOD: Identify Corporate Systems 435EAP Chaining 436Summary 437Chapter 18 Setting Up and Maintaining a Distributed ISE Deployment 439Configuring ISE Nodes in a Distributed Environment 439Make the Policy Administration Node a Primary Device 440Register an ISE Node to the Deployment 442Ensure the Persona of All Nodes Is Accurate 445Understanding the HA Options Available 446Primary and Secondary Nodes 446Monitoring & Troubleshooting Nodes 446Policy Administration Nodes 448Policy Service Nodes and Node Groups 450Create a Node Group 451Add the Policy Service Nodes to the Node Group 452Using Load Balancers 453General Guidelines 454Failure Scenarios 455Anycast HA for ISE PSNs 456Cisco IOS Load Balancing 459Maintaining ISE Deployments 460Patching ISE 460Backup and Restore 462Summary 463Chapter 19 Remote Access VPN and Cisco ISE 465Introduction to VPNs 465Client-Based Remote Access VPN 468Configuring a Client-Based RA-VPN on the Cisco ASA 469Download the Latest AnyConnect Headend Packages 470Prepare the Headend 471Add an AnyConnect Connection Profile 473Add the ISE PSNs to the AAA Server Group 478Add a Client Address Pool 481Perform Network Reachability Tasks 484Configure ISE for the ASA VPN 487Testing the Configuration 488Perform a Basic AAA Test 488Log In to the ASA Web Portal 490Connect to the VPN via AnyConnect 492Remote Access VPN and Posture 494RA-VPN with Posture Flows 495Adding the Access Control Lists to ISE and the ASA 496Adding Posture Policies to the VPN Policy Set 499Watching It Work 501Extending the ASA Remote Access VPN Capabilities 507Double Authentication 507Certificate-Based Authentication 509Provisioning Certificates 509Authenticating the VPN with Certificates 515Connecting to the VPN via CertProfile 518Summary 519Chapter 20 Deployment Phases 521Why Use a Phased Approach? 521A Phased Approach 523Authentication Open Versus Standard 802.1X 524Monitor Mode 526Prepare ISE for a Staged Deployment 527Create the Network Device Groups 528Create the Policy Sets 529Low-Impact Mode 530Closed Mode 532Transitioning from Monitor Mode to Your End State 534Wireless Networks 535Summary 535Part V Advanced Secure Access FeaturesChapter 21 Advanced Profiling Configuration 537Profiler Work Center 537Creating Custom Profiles for Unknown Endpoints 538Identifying Unique Values for an Unknown Device 539Collecting Information for Custom Profiles 541Creating Custom Profiler Conditions 542Creating Custom Profiler Policies 543Advanced NetFlow Probe Configuration 544Commonly Used NetFlow Attributes 546Example Profiler Policy Using NetFlow 546Designing for Efficient Collection of NetFlow Data 547Configuration of NetFlow on Cisco Devices 548Profiler CoA and Exceptions 550Types of CoA 551Creating Exceptions Actions 552Configuring CoA and Exceptions in Profiler Policies 552Profiler Monitoring and Reporting 553Summary 556Chapter 22 Cisco TrustSec AKA Security Group Access 557Ingress Access Control Challenges 558VLAN Assignment 558Ingress Access Control Lists 560What Is TrustSec? 562So, What Is a Security Group Tag? 562Defining the SGTs 564Classification 565Dynamically Assigning an SGT via 802.1X 566Manually Assigning an SGT at the Port 567Manually Binding IP Addresses to SGTs 568Access Layer Devices That Do Not Support SGTs 569Transport: SGT eXchange Protocol (SXP) 569SXP Design 570Configuring SXP on IOS Devices 572Configur

Select Guide Rating