WIXLIB

Cisco Expo2012Bezpečný přístupve WLANT-SECA5Jaroslav Čížek, CiscoCisco Expo 2012 Cisco and/or its affiliates. All rights reserved.Cisco Public1

TrustSec, ISE, SGT, BYOD WLAN (& WIRED) 802.1X with Cisco ISE WLAN (& WIRED) Guest Access with Cisco ISE-Guest Access NeedsManaging and Provisioning Guest AccountsGuest PortalGuest Access DeploymentMonitoring SummaryAnotace: Zabezpečení přístupu do sítě by mělo být řešeno univerzálně pro LAN iWLAN. Jak lze využít centralizovaných nástrojů ISE pro aplikaci bezpečnostníchpolitik na bezdrátové síti pro trvalé i dočasné přístupy.CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public2

Brief summary of previous sessionsCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public3

TrustSec, ISE, SGT, BYOD WLAN (& WIRED) 802.1X with Cisco ISE WLAN (& WIRED) Guest Access with Cisco ISE-Guest Access NeedsManaging and Provisioning Guest AccountsGuest PortalGuest Access DeploymentMonitoring SummaryAnotace: Zabezpečení přístupu do sítě by mělo být řešeno univerzálně pro LAN iWLAN. Jak lze využít centralizovaných nástrojů ISE pro aplikaci bezpečnostníchpolitik na bezdrátové síti pro trvalé i dočasné přístupy.CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public4

Identifying a User or EndpointActive Directory,Generic LDAP, PKIUserISEAND/ORMachineEAPoLRADIUS, e.g.Safeword Token ServerRADIUSlocal DBuser1C#2!ç@ E(User/PasswordRSA SecureIDCertificateTokenIdentity Source SequencesBackend DatabaseCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public5

Port-Based Access Control Using AuthenticationLayer 2 Point-to-PointSupplicantLayer 3 LinkAuthenticatorEAP over LAN(EAPoL)RADIUSAuth ServerISE / ACSEAPoL StartBeginningEAPoL Request IdentityEAP-Response Identity: AliceRADIUS Access Request[AVP: EAP-Response: Alice]MiddleRADIUS Access-ChallengeEAP-Request: PEAP[AVP: EAP-Request PEAP]EAP-Response: PEAPRADIUS Access Request[AVP: EAP-Response: PEAP]EndEAP DIUS Access-Accept[AVP: EAP Success][AVP: VLAN 10, dACL-n] 802.1X (EAPOL) is a delivery mechanism and it doesn't provide the actualauthentication mechanisms. When utilizing 802.1X, you need to choose an EAP type, such as Transport LayerSecurity (EAP-TLS) or PEAP, which defines how the authentication takes place.CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public6

RFC 3576 (obsolete) and 5176Layer 2 Point-to-PointSupplicantAuthenticatorEAP over LAN(EAPoL)InitialAuthenticationLayer 3 LinkEAP SuccessRADIUSAuth ServerRADIUS Access-Accept[AVP: EAP Success][AVP: VLAN 10, dACL-n]RADIUS CoA-Request[VSA: subscriber: reauthenticate]Change ofAuthorizationRADIUS CoA-AckEAPoL Request IdentityEAP-Response Identity: AliceRADIUS Access Request[AVP: EAP-Response: Alice]ReAuthenticationEAP-Request: PEAPRADIUS Access-Challenge[AVP: EAP-Request PEAP]EAP-Response: PEAPRADIUS Access Request[AVP: EAP-Response: PEAP]CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All ssibleCisco Public7

ConfigurationCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public8

Default Network Access: Policy Policy Elements Results AuthenticationCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public9

Policy - AuthorizationCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public10

ISE 1.1Best Practice: Use RADIUS Attributes to Set VLAN (IETF Attributes)WLC Interfaces/ VLANNamemust matchTunnel-Private-Grp-Id3560X#sh vlan 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All tchVLAN Name-------- ase Sensitive onSwitch, but not WLCCiscoExpoExpoCiscoWLCUse same IETF attributesto set VLAN for wired andwirelessCisco Public11

Use VSA to Enforce ACL Name on WLCWLCVSAAttributeSwitchIETFAttributeACL NameMust matchACL can be pre-configured or downloadeddynamicallyACL mustbe preconfiguredCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public12

Allow ISE to Actively Enforce Policy Over Connected Endpointsaaa server radius dynamic-authorclient 10.100.7.20 server-key xxxxxxxCoA is triggered dynamically when a scenario is matched :- Endpoint is profiled for the 1st time.- Endpoint is statically assigned with a new Policy- Endpoint is deleted from ISE DB.CoACiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public13

TrustSec, ISE, SGT, BYOD WLAN (& WIRED) 802.1X with Cisco ISE WLAN (& WIRED) Guest Access with Cisco ISE-Guest Access NeedsManaging and Provisioning Guest AccountsGuest PortalGuest Access DeploymentMonitoring SummaryAnotace: Zabezpečení přístupu do sítě by mělo být řešeno univerzálně pro LAN iWLAN. Jak lze využít centralizovaných nástrojů ISE pro aplikaci bezpečnostníchpolitik na bezdrátové síti pro trvalé i dočasné přístupy.CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public14

The company needs to provide guest access for visitors, both for the wiredand wireless infrastructure. Particular restrictions need to be assigned to guest contractors, with accessto specific resources onlyWLCWirelessAPsGuest authenticationportalInternetLAN switchesCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public15

Redirection of theguest Web sessionto ISE guest portalfor authenticationAccessauthorized forguest userISEPolicy serverWLCswitchesOpen SSID« guest »with WebauthenticationGuest account needsto be created: via a sponsor or self serviceGuest userCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public16

Identity ServiceEngineInternal DB Static entries Bulk import Enabled /disabledCiscoExpoExpoCiscoGuest DB Created bysponsors (bulkoption) Guest ‘selfservice’ Restrictedaccess duration 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.DatabaseExternal DB LDAP / AD Managedexternally Enabled/disabledCisco Public17

If Need for Different Policies Based on User Role‘Guest ‘‘Contractor’ Internet access only Created by any user Limited connection time:½ day, one dayCiscoExpoExpoCisco Internet access Created by select users Access to selected resources Longer connection time:one week, one month 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public18

Identity ServiceEngineExternalDatabase External groups mappedin ISE Multiple groups can be created in ISE Each group can contain: Guest users (created by Sponsor andSelf-service) Internal users (created byAdministrators)Mapping example for ADThose groups can be used in different authorizationrules to differentiate network accessCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public19

Two ways to populate ISE Internal guest DB:Self-ServiceOption on ISE ‘Guest Portal’Sponsoringvia ISE ‘Sponsor Portal’CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public20

CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public21

Customizablesponsor pages Sponsor privilegestied to definedsponsor policy Roles sponsor cancreate Time profiles can beassigned Management ofother guestaccounts Single or bulkaccount creationCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public22

Customizable fields Define if mandatoryor optional can add up to 5 othercustom attributesGuest roles and timeprofiles Pre-defined by adminCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public23

Username configuration Created from ‘first & last name’ or‘email’Password configuration Generated automatically Configurable password complexityCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public24

Sponsor Will Have Three Ways to Inform Guest1. Printing the details2. Sending the details via e-mail3. Sending the details via SMSCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public25

CiscoExpoExpoCiscoSponsor ‘AllAccounts’Sponsor ‘OwnAccounts’ Can create user in groups:‘contractor’ and ‘guest’ Can use time profiles up toone week Can see all accounts in group Can create user in group‘guest’ only Can use time profiles up to oneday Cannot do bulk creation 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public26

CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public27

The sponsor account can be a Local ISE user LDAP user Active Directory user DB checking order can beconfigured via ‘Identity SourceSequence’ in ISEIn above example we interrogate the ISE DBfirst and then the ADCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public28

You can map any group: internal, AD, LDAP to a sponsor privilege group All users mapped to that group will log in with similar sponsor privileges asdefined in the selected sponsor groupMap internal groups tosponsor privilege groupsMap internal groupsMap AD groupsCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public29

CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public30

Several Languages areSupportedNatively in ISE 1.1All guest user pages aretranslated: Authentication page Acceptable usage policy Success/failure page CiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public31

Portal allowing users to register theirown devicesAccess can be granted to guest,employees, studentsCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public32

Multiple portal might be neededbased on: Location / countryWhen several organizational entitiesType of device: WLC, switchesFor local language supportISE allows for : Default portalPortals customizationSimultaneous use of several portalsfor user authenticationSample customized portalCiscoExpoExpoCisco 2011Ciscoand/orits affiliates.All rightsreserved. 2012Ciscoand/orits affiliates.All rightsreserved.Cisco Public33