BYOD without ISE?

Hi guys,
Can you suggest any other products/solutions if ISE is just too much expensive or just does not scale?
For example if we have 5-10 APs and we want to use BYOD services, use secure EAP-TLS tunnel on our WiFi network. How to get yours iPad secure?

Just use radius... You can use either Microsoft Radius or even ACS to do EAP-TLS or any EAP type security. I use PEAP because I don't want to install a cert on my iPad:). Radius would tie into AD and you can set your policies there. You will not have any profiling, so radius will not know what device is what. That is what ISE does.
Sent from Cisco Technical Support iPhone App

Similar Messages

WLAN anchoring not working for BYOD and ISE?

Anyone set up 802.1x authenication (Radius/ISE) in lieu with wlan anchoring and got it working?
Looking in the docs doesn't give much clues why this fails, but web-auth and achoring works excellent on another wlan.
We need to move all BYOD devices to the datacenter for termination, so using anchoring would solve all our needs.
And yes, all interfaces and security settings are identical on all wlc's. The s/w is 7.0.116 and all controllers are 5508's
Isn't 802.1x and anchoring supported?
BTW - looking on the debug outputs it seems that the remote controllers do initiate radius auth instead of the anchor controller.
Any ideas?
Sincere Regards
/Mats

I was hoping that I did't have to open a TAC case regarding this issue.
Since the setup is very simple - a SSID with wpa2/aes and 802.1x and tied to a interface present and active an well as specific radius server for auth on both remote and anchor controller. The tunnel is up between remote and anchor. The anchor also terminates an SSID with web auth that works fine. Why doesn't this work?
Best Regards
Mats Nilson

Is it possible to run Posture using ISE 1.2 without NAC Agent provisioning?

Is it possible to run Posture using ISE 1.2 without NAC Agent provisioning?
-My customer does not want to push NAC Agent installation on BYOD type of computers (non-managed by the company computers).
-The requirement is to check for posture only company owned wired, wireless, and VPN connected Windows computers. The rest of the endpoints should be considered as posture incompliant, and limited access to the network should be allowed.
-No certificates are used.
-I’ve configured the required posture check, and it all works fine if a PC has NAC Agent manually installed (without ISE Client Provisioning). However, when I use a PC without NAC Agent, it is redirected to Client Provisioning Portal and is stuck there as Client Provisioning is deliberately not configured in ISE.
-If I remove Posture Remediation Authorization Profile that does URL redirect, the posture does not work.
-For now I'm testing it on wired endpoints.
Is there a way to configure ISE to fulfill the listed above requirements?
Any ideas would be appreciated.
Thanks,
Val Rodionov

Everyone who finds reads this article,
I'm answering my own quesiton "Is it possible to run Posture using ISE 1.2 without NAC Agent provisioning?"
The answer is Yes.
After doing research and configuration testing I came up with a solution, and it works fine for wired and VPN connections. I expect it to work on wireless endpoints as well.
ISE configuration:
Posture General Settings - Default Posture Status = NonCompliant
Client Provisioning Policy - no rules defined
Posture Policy - configured per requirements
Client Provisioning (under Administration > Settings) - Enable Provisioning = Enable (it was disabled in my first test)
Authorization Policies configured as regular posture policies
The result:
After successful dot1x authentication posture redirect happens. If the PC does not have NAC Agent preinstalled, the browser is redirected to Client Provisioning Portal and a default ISE message is displayed (ISE is not able to apply and access policy... wait one minute and try to connect again...). At the same time, the endpoint is assigned NonCompliant posture status and proper authorization policy is applied. This is what I wanted to achieve.
If NAC Agent was preinstalled on the PC, after successful dot1x authentication the NAC Agent pops up and performs posture check. If posture is successful, posture compliant authorization policy is applied. If posture check fails, NonCompliant posture status is assigned and posture non-compliant authorization policy is applied. Which is the expected and needed result.
The only part that is not perfect it the message displayed to the end-user when posture is about to fail. I did not find a place to change the text of that message. I might need to open TAC case, so this file can be manually found and edited from CLI (root access).
Best,
Val Rodionov

Simple Web Auth policy and simple posture assessment policy in ISE

G'day All,
I've just finished reading through the Cisco BYOD with ISE document and it's left me a little more confused than when I started.
I completely understand the onboarding process and the different policy elements that make up the self registration/onboarding configuration.
What I'd like to do is put together an ISE configuration that is a lot simpler for the BYOD user.
Is anyone able to advise if it is possible to have a single dot1x SSID with ISE that has a policy for Window Laptops using AD authentication for the user and Posture assessment and a policy for all smart devices (iOS and Android) that is just AD authentication of the user, without the need for device registration?
The target user demographic for my deployment are really not technical so having to go through the onboarding process, especially for the Android devices, with the pre-installation of the cisco app, etc, really isn't what they are looking for.
Huge thanks for any assistance.
Cheers,
JS

Yes, that's possible. But without "device registration" then you need to configure Wireless 802.1x manually in every Android device.
Please rate if that helps.

Get-Member not working in ISE

When i try to use Ge-member command in ISE it not work but it work without ISE ...?
PS C:\> Get-WindowsFeature | Get-Member
Get-WindowsFeature : The target of the specified cmdlet cannot be a Windows client-based operating system.
At line:1 char:1
+ Get-WindowsFeature | Get-Member
+ ~~~~~~~~~~~~~~~~~~
+ CategoryInfo : DeviceError: (localhost:String) [Get-WindowsFeature], Exception
+ FullyQualifiedErrorId : WindowsClient_NotSupported,Microsoft.Windows.ServerManager.Commands.GetWindowsFeatureCommand

when i try to access my core server from my domain using power shell i get error
PS C:\> Enter-PSSession -ComputerName WIN-CORE -Credential 0SGMS\bhagwatritesh
Enter-PSSession : Connecting to remote server WIN-CORE failed with the following error message : WinRM cannot process
the request. The following error with errorcode 0x80090311 occurred while using Kerberos authentication: There are
currently no logon servers available to service the logon request.
Possible causes are:
-The user name or password specified are invalid.
-Kerberos is used when no authentication method and no user name are specified.
-Kerberos accepts domain user names, but not local user names.
-The Service Principal Name (SPN) for the remote computer name and port does not exist.
-The client and remote computers are in different domains and there is no trust between the two domains.
After checking for the above issues, try the following:
-Check the Event Viewer for events related to authentication.
-Change the authentication method; add the destination computer to the WinRM TrustedHosts configuration setting or
use HTTPS transport.
Note that computers in the TrustedHosts list might not be authenticated.
-For more information about WinRM configuration, run the following command: winrm help config. For more
information, see the about_Remote_Troubleshooting Help topic.
At line:1 char:1
+ Enter-PSSession -ComputerName WIN-CORE -Credential 0SGMS\bhagwatritesh
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (WIN-CORE:String) [Enter-PSSession], PSRemotingTransportException
+ FullyQualifiedErrorId : CreateRemoteRunspaceFailed

BYOD at SMB

Any SMB security solution for BYOD, like ISE?
Sent from Cisco Technical Support iPhone App

Hello Lam Ho Yin Bosco,
My name is Diego and I am part of the Small business Support community. I have seen your post and would like to assist the list of BYOD security devices.
Best regards,
Diego Rodriguez
Cisco Small Business Community Engineer Best regards,

BYOD and free personal use licensing

A few other things to keep in mind:Office 365 allows staff to install the company-licensed version of Microsoft Office on up to 5 devices, including those owned by the user. Office licensing, done.
Avast offers a free business antivirus product. But, honestly, who the [redacted] can't afford $30 a year to put a paid security product on a $400-$1,200 laptop?!
Unreimbursed business expenses may be tax deductible. Check with your finance department/company accountant to verify whether staff can claim some or all of the costs related to BYOD.
Remember that you cannot require BYOD without reasonable compensation. BYOD is not a way to completely offload equipment and software costs onto your employees. Also, that's just a dick move. Nobody wants to work for companies which pull crap like that.

Hi all
Something that came into thought recently. What happens with free personal use only licensing and BYOD's
A good example for this would be AVG free licensing on some ones personal laptop but they then bring this to the office (say a company of 50+ users) to work on.
So a simple question with a potentially complicated answer. What should we be doing?
Other questions to go with this;To what extent do this go to?Are there exclusions (for example someone using remote desktop over vpn to a work machine)?What if that person has unlicensed software on their personal device, are we as a company now responsible?
This topic first appeared in the Spiceworks Community

How can i add a library on an ipa file ?

the solution from www.mocana.com allows for maximum user flexibility and native experience, while not risking corporate intellectual property.
* Increase productivity by fully supporting bring your own device (BYOD)
* Embrace Bring Your Own Device (BYOD) without additional IT burden or privacy issues
* Use best-in-class, military-grade security methods by a company known for its security legacy
* Highest level of security protecting corporate data
* No programmatic effort to secure the apps - MAP is automated and can take prior written apps and secure them in under 5 seconds
can someone tell me how this works?

it works ... but i don't know how ... example :
the solution from www.mocana.com allows for maximum user flexibility and native experience, while not risking corporate intellectual property.
* Increase productivity by fully supporting bring your own device (BYOD)
* Embrace Bring Your Own Device (BYOD) without additional IT burden or privacy issues
* Use best-in-class, military-grade security methods by a company known for its security legacy
* Highest level of security protecting corporate data
* No programmatic effort to secure the apps - MAP is automated and can take prior written apps and secure them in under 5 seconds
i hope someone can tell me how....

Wireless guest access

Hi Guys, I have a wireless requirement from a customer and the customer is looking for the below: 1. Wireless guest access that requires user to input email into the captive portal. But the email address must be verified that it contains certain selected domain names (e.g. example.com or example.org). Any other domain names will be rejected. 2. Customer is looking to add their own logo and change the formatting of the captive portal. Questions: 1. For email verification, does this feature come straight from the WLC standalone box or must ISE be purchased? 2. If the WLC is able to do this without ISE, any online guides that is able to do this? 3. For security reasons, am I able to limit the number of concurrent users using this captive portal? 4. How do a configure the age-out for each connected users after they have successfully logged into the captive portal? 5. Can I customize the captive portal page on the WLC and how do I go about doing it?

Hi Mohanak,
It looks like the formatting ran out. Anyway, not sure if we are on the right topic here but let me get this straight. Customer has a Cisco 2504 Wireless LAN Controller. So, they would like to achieve the below features:
1. Wireless guest access that requires user to input email into the captive portal. But the email address must be verified that it contains certain selected domain names (e.g. example.com or example.org). Any other domain names will be rejected.
2. Customer is looking to add their own logo and change the formatting of the captive portal.
So, some of the questions I have are:
Questions:
1. There is a configuration on the WLC that allows guest users to login using email verification only. Does this feature come straight from the WLC standalone box or must ISE be purchased.
2. If the WLC is able to do this without ISE, is the WLC able to check if the inputted field is a valid email? And can I configure in such a way a particular domain is allowed? (e.g. example.com is permitted but example.org and anything else is reject).
3. For security reasons, am I able to limit the number of concurrent users using this captive portal?
4. How do a configure the age-out for each connected users after they have successfully logged into the captive portal?
5. Can I customize the captive portal page on the WLC and how do I go about doing it?

How to detect stolen personal?

My iphone 3gs were stolen by someone.how do i detect location stolen guy area @ location without ised find my iphone.

If you didn't activate/turn on Find My Phone, BEFORE your phone was lost/stolen, there is no way to locate it now.

BYOD Authentication on ISE

I have a slightly left-field requirement that I'm not sure how to achieve: I have a standard Wireless setup with Cisco APs and 5508 controllers, with all the usual constraints for the "corporate" WLAN, and a standard "Guest" setup, with identity management handled by ISE 1.3. However, I've been asked to come up with a "loose" BYOD configuration.
What is required is that BYOD devices (that will be restricted to Internet Access only) can self-provision. It's their authentication that I'm not sure of: I've been asked to make it so the first time a user's device connects to the wireless, (s)he gets redirected to an auto-provisioning page, and during provisioning, the user-device's MAC address is harvested and stored, so that on subsequent connections to the network, the user device connects using MAB with no user intervention.
That concerns me, as it appears from the description that anyone could self-provision, so running the risk of rogue devices using the Internet illicitly.
I wondered about the possibility of a user with access to the corporate WLAN being able to access a page that would allow them to configure their MAC address, but that is not without its problems, since they would have to manually obtain and input their MAC address, and I don't want to trust users either to be able to input their MAC accurately or not to authenticate a "friend's" device as well as their own.
Another option (without the user having to re-authenticate manually every time they associate) is to manually harvest all the MAC addresses and configure them into an identity store, (the ISE itself, in this case) but the user wants to avoid the effort and hassle of manual collection and configuration and the associated opportunity for error.
I've read
http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_ISE.html
which seems to suggest that what I want to achieve may need 2 SSIDs, one for provisioning (using AD credentials for security) which allows for automatic MAC address harvesting, and a second "working" SSID for use once provisioned, but I'm not sure if I've understood the description correctly
We are talking in the mid hundreds in terms of BYOD devices.
Is there a proper way of doing what I'm trying to do? Its simple enough to make "tight" or "loose" security, but this "intermediate" level has me scratching my head!
Thanks for any advice
Jim

I think you are talking about LWA .Following link may help you.
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080ba6514.shtml

ISE used for BYOD and Corporate

Hello
I have a customer currently using EAP-PEAP on both their coporate laptop and wireless phones on different SSIDs, the radius servers are a pair of IAS servers. We have recently deployed ISE BYOD for them with a single BYOD SSID. Now they want to completely get rid of the IAS and move all Radius to ISEs but want to keep EAP-PEAP for laptops and phones.
I am thinking about the authorization rules in the ISE, now they have 3 types of access using EAP-PEAP, a user must at least belong to the Employee AD group, but he may or may not belong to BYOD or/and PHONE groups as well. The authentiation results should be something like:
1. if Corporate Laptop then Permit Access
2. if BYOD then NSP
3. if Phone then Permit Access
I am just wondering what is the best way to classify the devices (to decide the following action) without relying on profiling, Surely they all come from different SSIDs so I could check the WLAN ID to determine what action to follow, but that will need to make sure all the WLCs have the same WLAN ID for each SSID. Is there any better or neater way of doing this? What is the best practice for this kind of senario?
Thanks

If we're talking purely SSIDs, you can match the name of SSID
For example here, I'm matching a SSID of "mlatosie".

ISE BYOD Onboarding

Hi,
I have a Lab setup with ISE 1.3, WLC 5508 7.6.130.0. I have setup the ISE using Setup Assistant as a base point and have managed to get a couple of things working, such as the Guest Portal with Self Registration, standard Wireless dot1x authentication and authorizations for notebooks using AD. I have also setup a separate Wifi network for Mobile devices using AD authentication.
All 3 scenarios work with a bit of fine tuning and with the following configurations.
Separate Guest-Wifi - Self registration - Works
Separate Corporate Wifi - AD Authentication - profiling and posture check - Works
Separate BYOD Wifi - AD Authentication - Works.
The problem I have is that when I enable device registration on the BYOD Wi-Fi, I get intermittent issues as follows:
1 Ipad connects and registers without failure, iOS 8.1.1.
other Ipad with same iOS, connects but cannot register, gets BYOD Portal page, but after accepting AUP gives error about unsupported browser.
Iphone 5s, iOS 8.1.1 connects and registers intermittently, and when it fails, it gets BYOD Portal page, but after accepting AUP gives error about unsupported browser.
Iphone 4s, iOS 8.1.1 connects but cannot register, gets BYOD Portal page, but after accepting AUP gives error about unsupported browser.
Can someone please advise why this is happening as I cannot see how its configuration error. I have checked the supported OS and Browsers for the portal and although the highest supported iOS is 8.0, why does the 1 Ipad work everytime and the Iphone 5s intermittently.
thanks.
Julian.

Supported IOS versions in ise 1.3 :http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/compatibility/ise_sdt.html#49426
Client Machine Operating System
Web Browser
Supplicants (802.1X)
Apple iOS 8.0
Safari
Apple iOS Supplicant 8.0
Apple iOS 7.x11
Safari
Apple iOS Supplicant 7.x
Apple iOS 6.x
Safari
Apple iOS Supplicant 6.x
Apple iOS 5.1
Safari
Apple iOS Supplicant 5.1
Apple iOS 5.0.1
Safari
Apple iOS Supplicant 5.0.1

ISE, BYOD: win clients reject ISE local-certificate

Hello!
We are deploying BYOD with Cisco ISE 1.1.2 and WLC (5508) using 802.1x authentication.
Windows clients cannot connect to 802.1x SSID with the following error on ISE:
Authentication failed : 12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
The client doesn't have preconfigured wifi profile or root certificate installed.
The concept of BYOD suppose that you can connect your device without any installed certificates and preconfigured wifi-profiles.
The problem is that Windows 7 supplicant does not send TLS alert in pop up window, when connecting to 802.1x SSID.
If this alert is seen, than you can accept it and proceed the connection. After that you will be asked to install ROOT-cert, get your own cert and etc.
So, the question is: how to make the windows supplicant to show the pop-up window with TLS alert?
p.s. the attached file shows the example of pop up TLS-alert window

Are there any recommendations from Cisco about the issue with Windows?
I believe there's a new version of smart solution design guide coming up.
The current one does not mention anything to do with certs in "User Experience" chapter.
You can check one of the possible approaches in Nico's document:
http://www.cisco.com/en/US/products/ps11640/products_configuration_example09186a0080bead09.shtml
(It can be easily expended).
I think irt. PEAP we will always say that the cert or the root/sub CA cert should be already trusted on the device when perfoming enrollment.
Will try to dig in, can't say I promise to get something concrete though.

Ask the Expert: Cisco BYOD Wireless Solution: ISE and WLC Integration

With Jacob Ideji, Richard Hamby and Raphael Ohaemenyi
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the new Identity Solutions Engine (ISE) and Wireless LAN Controller (WLC) hardware/software, integration, features, specifications, client details, or just questions about Cisco's Bring-your-own device (BYOD) solution with cisco Experts Richard Hamby, Jacob Ideji, and Raphael Ohaemenyi. The interest in BYOD (Bring You Own Device) solutions in the enterprise has grown exponentially as guests and company users increasingly desire to use personal devices to access . Cisco BYOD enhances user experience and productivity while providing security, ease-of-administration, and performance. The heart of the Cisco wireless BYOD solution is Identity Solutions Engine (ISE) utilizing the Cisco Unified Wireless portfolio. Starting with ISE v1.1.1MR and WLC (Wireless LAN Controller) code v7.2.110.0 and higher, end-to-end wireless BYOD integration is reality.
Jacob Ideji is the technical team lead in the Cisco authentication, authorization and accounting (AAA) security team in Richardson, Texas. During his four years of experience at Cisco he has worked with Cisco VPN products, Cisco Network Admission Control (NAC) Appliance, Cisco Secure Access Control Server, and Dot1x technology as well as the current Cisco Identity Services Engine. He has a total of more than 12 years experience in the networking industry. Ideji holds CCNA, CCNP, CCSP, CCDA, CCDP, and CISM certifications from Cisco plus other industry certifications.
Richard Hamby works on the Cisco BYOD Plan, Design, Implement (PDI) Help Desk for Borderless Networks, where he is the subject matter expert on wireless, supporting partners in the deployment of Cisco Unified Wireless and Identity Services Engine solutions. Prior to his current position, Hamby was a customer support engineer with the Cisco Technical Assistance Center for 3 years on the authentication, authorization, accounting (AAA) and wireless technology teams.
Raphael Ohaemenyi Raphael Ohaemenyi is a customer support engineer with the authentication, authorization and accounting (AAA) team in the Technical Assistance Center in Richardson, Texas, where he supports Cisco customers in identity management technologies. His areas of expertise include Cisco Access Control Server, Cisco Network Admission Control (NAC) Appliance, Cisco Identity Services Engine, and IEEE 802.1X technologies. He has been at Cisco for more than 2 years and has worked in the networking industry for 8 years. He holds CCNP, CCDP, and CCSP certification.
Remember to use the rating system to let Jacob, Richard and Raphael know if you have received an adequate response.
Jacob, Richard and Raphael might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the wireless mobility sub community forum shortly after the event. This event lasts through Oct 5th, 2012. Visit this forum often to view responses to your questions and the questions of other community members.

OOPS !!
I will repost the whole messaqge with the correct external URL's:
In general, the Trustsec design and deployment guides address the specific support for the various features of the 'whole' Cisco TS (and other security) solution frameworks. And then a drill-down (usually the proper links are embedded) to the specifc feature, and then that feature on a given device. TS 2.1 defines the use of ISE or ACS5 as the policy server, and confiugration examples for the platforms will include and refer to them.
TrustSec Home Page
http://www.cisco.com/en/US/netsol/ns1051/index.html
http://www.cisco.com/en/US/solutions/collateral/ns170/ns896/ns1051/product_bulletin_c25-712066.html
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/at_a_glance_c45-654884.pdf
I find this page very helpful as a top-level start to what features and capabilities exist per device:
http://www.cisco.com/en/US/solutions/ns170/ns896/ns1051/trustsec_matrix.html
The TS 2.1 Design Guides
http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html
DesignZone has some updated docs as well
http://www.cisco.com/en/US/netsol/ns982/networking_solutions_program_home.html#~bng
As the SGT functionality (at this point) is really more of a router/LAN/client solution, the most detailed information will be in the IOS TS guides like :
http://www.cisco.com/en/US/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6.x.html
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_cts/configuration/xe-3s/asr1000/sec-usr-cts-xe-3s-asr1000-book.html
http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/trustsec.html

BYOD without ISE?

Similar Messages

Maybe you are looking for