Cisco ISE Authorization with Device OS

Hi,
We want to permit access only to devices with Windows OS. I tried to make a authorization rule with the condition "Session:Device-OS EQUALS Windows" but it doesn't work. If I try to connect with a Windows 7 client, the access is denied and the log shows "15039 Rejected per authorization profile". What could be the problem?
We are using ISE with Version 1.1.3
thank you,
Marc

There is no issue with the ISE version 1.1.3, you are is the latest. May be the probes are not properly configured.
Please review the below link for assistance
http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_30_ise_profiling.pdf

Similar Messages

Cisco ISE FlexAuth with 802.1X PCs and IP Phones as MAB multi-domain Q?

Cisco ISE FlexAuth with 802.1X PCs and IP Phones as MAB multi-domain Q?
Im trying to follow the trustsec 2.1 guide on IP Phones into LowImpact mode.
I can get a PC on its own to authenticate via dot1x/tls
I can get a Cisco IP Phone on its own to authenticate via MAB.
When the two are on the same switchport, the phone will authenticate but not the PC. ISE logs EAP timeouts.
The switchport has the LowImpact port ACL of
ip access-group ACL-DEFAULT in
The IP Phone gets a dACL that allows it ok.
I assume MAB phone and dot1x PC is supported? Any ideas?
Thanks in advance.

The ISE log detailed steps are as follows:
Steps
11001 Received RADIUS Access-Request
11017 RADIUS created a new session
Evaluating Service Selection Policy
15048 Queried PIP
15048 Queried PIP
15004 Matched rule
11507 Extracted EAP-Response/Identity
12300 Prepared EAP-Request proposing PEAP with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12501 Extracted EAP-Response/NAK requesting to use EAP-TLS instead
12500 Prepared EAP-Request proposing EAP-TLS with challenge
12625 Valid EAP-Key-Name attribute received
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12502 Extracted EAP-Response containing EAP-TLS challenge-response and accepting EAP-TLS as negotiated
12800 Extracted first TLS record; TLS handshake started
12805 Extracted TLS ClientHello message
12806 Prepared TLS ServerHello message
12807 Prepared TLS Certificate message
12809 Prepared TLS CertificateRequest message
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
11001 Received RADIUS Access-Request
11018 RADIUS is re-using an existing session
12504 Extracted EAP-Response containing EAP-TLS challenge-response
12505 Prepared EAP-Request with another EAP-TLS challenge
11006 Returned RADIUS Access-Challenge
5411 No response received during 120 seconds on last EAP message sent to the client

Cisco ISE integration with third-party firewalls

Can Cisco ISE be integrated with a third-party firewall (such as Checkpoint), to provide authentication/authorization services to remote VPN user devices (based on device MAC address)?
The remote user would establish a VPN connection to a third-party firewall, based on a username/password authentication, but the user would only be allowed to send/receive traffic to the internal network if the MAC address of the device being used was authorized by Cisco ISE.
Thank you in advance.

Rui,
I do not think the vpn client sends the ip address in a called-station-id, that might be the public ip address that the client is initiating the request from. If you have an existing radius server or can run a packet capture you should be able to verify that.
If the client does send the mac address in the radius packet then you can create a custom condition that can be used to check the mac address along with the username to allow it access to the session. However in VPN deployments there is no concept of profiling since 802.1x deployments usually include the client's mac address.
Thanks,
Tarik Admani
*Please rate helpful posts*

Cisco ISE authorization

Hi
I want to find out if its possible on ISE dot1x implementation to authenticate domain machines using EAP-TLS (certificate) and after successful authentication, authorize the user using AD domain users. I cant seem to get this to work, the ISE just skips the authorization policy which I created to reference AD.
It seems you can only authenticate and authorize with the same parameter which i was able to achieve using MSCHAP-V2.
My aim is to authenticate the connecting PC using internal CA and further authorize the users using AD membership.
Thanks

Although EAP Fast and the EAP chaining are not proprietary to Cisco, AnyConnect is the only supplicant that I am aware of that currently supports the feature.
The only other option that I tell you is using machine access restrictions MAR, but I would highly recommend against this unless the customer is aware of the caveats associated with MAR. With MAR the supplicant is configured to use "user or computer" When the user is logged off the device authenticates using the computer's account. When the user logs in the supplicant starts the authentication process over using the user credentials. With MAR ISE first verifies that the machine authenticated before the user. If not then the user is not authorized to connect. The issue is that if the device goes into hibernation instead of logging off the user may fail to authenticate because ISE doesnt see the computer auth.
EAP chaining is the answer to MAR's shortfalls. This is because the computer and the user authenticate together everytime.
If their goal is to ensure that the device is a corporate owned device then you can always consider posture as a means to ensure that. You can have a registry entry, or file on the computer that signifies that the device is a corporate owned device. You would still need to install the posture agent and this would change the licensing requirements where as eap chaining is included in the base licensing and doesn't require plus or apex.
The other outside of the box idea that i have seen is to use GPO to change the LAN NIC's name
to something like "Corporate LAN" and then using profiling you can create a custom profile that matches. See pages 91-114 there are several options listed including the ones I've already mentioned.
http://d2zmdbbm9feqrf.cloudfront.net/2015/anz/pdf/BRKSEC-3697.pdf

Cisco ISE deployment with HP Swithes

Is there any compatibility matrix of cisco ISE with HP access swithes or there is any features restriction on HP access layer. The HP switches do support 802.1x.
Thanks
Qasim

Qasim,
The only compatibility with network access devices is all related to Cisco gear. It would be best to stick with a full supported solution for the sake of support. In my opinion this will be a nightmare to manage if an issue was to occur.
Thanks,
Tarik Admani
*Please rate helpful posts*

Cisco ISE integration with AD fails

Cisco ISE Ver: 1.1.2.145
Windows : Win 2003 Server
I am attempting to integrate ISE with AD, but ISE won't join AD and joining attempts fails, though I am able to add same domain as external LDAP identity store ?
1.user used to join the domain has admin permission on AD
2. ISE resolved the domain correctly
3.There is a firewall inbetween ISE (192.168.100.10) & AD (172.16.100.1), but all the traffic are permited.
4. No NATing taking place, Firewall is forwarding all trafic between ISE & AD
Can't really understand why AD connection fails
From ISE Interface - Detailed Test Connection
Adinfo (CentrifyDC 4.5.0-357)
Host Diagnostics
Uname: Linux Iseadn 2.6.18-274.17.1.el5PAE #1 SMP Wed Jan 4 22:49:48 EST 2012 I686
OS: Linux
Version: 2.6.18-274.17.1.el5PAE
Number Of CPUs: 1
IP Diagnostics
Local Host Name: Iseadn
Local IP Address: 192.168.100.10
FQDN Host Name:iseadn.gnet.cp
Domain Diagnostics
Domain: Gnet.cp
Subnet Site: Default-first-site-name
    DNS Query For: _ldap._tcp.gnet.cp
    Found SRV Records:
      Gnet.cp:389
Testing Active Directory Connectivity:
    Domain Controller: Gnet.cp
      Ldap:      389/tcp - Good
      Ldap:      389/udp - Good
      Smb:       445/tcp - Good
      Kdc:        88/tcp - Good
      Kpasswd:   464/tcp - Good
      Ntp:       123/udp - Good
Domain Controller: Gnet.cp:389
    Domain Controller Type: Windows 2003
    Domain Name:            GNET.CP
    IsGlobalCatalogReady:   TRUE
    DomainFunctionality:           2 = (DS_BEHAVIOR_WIN2003)
    ForestFunctionality:           0 = (DS_BEHAVIOR_WIN2000)
    DomainControllerFunctionality: 2 = (DS_BEHAVIOR_WIN2003)
Forest Name: GNET.CP
    DNS Query For: _gc._tcp.GNET.CP
Testing Active Directory Connectivity:
Forest Name: GNET.CP
Kerberos Error: Rc=-1765328377 SASL Bind To Ldap/[email protected] - GSSAPI Mechanism With Kerberos Error : Server Not Found In Kerberos Database
Computer Account Diagnostics
Not Joined To Any Domain
System Diagnostic
Not Joined To Any Domain
Centrify DirectControl Status
Not Joined To Any Domain
Licensed Features: Enabled
SELinux Status:                 Disabled
Amavis1.1.0
Ccs1.0.0
Clamav1.1.0
Dcc1.1.0
Dnsmasq1.1.1
Evolution1.1.0
Ipsec1.4.0
Iscsid1.0.0
Milter1.0.0
Mozilla1.1.0
Mplayer1.1.0
Nagios1.1.0
Oddjob1.0.1
Pcscd1.0.0
Postgrey1.1.0
Prelude1.0.0
Pyzor1.1.0
Qemu1.1.2
Razor1.1.0
Ricci1.0.0
Smartmon1.1.0
Spamassassin1.9.0
Virt1.0.0
Zosremote1.0.0
From Ad-agent log

Hi Jallaluddin
I work for Centrify Support and saw your posting. Here our analysis on checking the adlogs.txt.zip:
Server not found in Kerberos database" (reference base/adbind.cpp:495 rc: -1765328377)
That error is likely coming from the KDC - meaning there is some problem with server side SPNs
We need the following:
1) A network trace.
2) adcheck output.
3) adinfo --support output
4) Run dcdiag or netdiag on the server side.
Also we partner with Cisco and so would it possible to work with your partners and I am pretty sure they have seen this before with DC issues etc. Can you please work with them and see?. TIA
Best Regards
Raghu Srinivasan

Cisco ISE Integrate with Airwatch

Dears,
I need a configuration guide or video how to integrate Cisco ISE with Airwatch. Please provide me this informations
Thanks

If you have a CCO ID, you may be able to see it here:
ISE integration with AirWatch MDM
If you cannot, you should be able to osk your Cisco AM for this.
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

Cisco ISE integration with SMS passcode Device

HI Experts,
i have a scenario where the requirement is to integrate the ISE device with SMSpasscode device which will trigger the OTP to the mobile devices
Currently i have my authentication configured to work with the AD
When my VPN users connects its authenticates against AD and the users get the access .
Now as per the new requirement once the user is authenticate against AD , the user should be prompted for the OTP password send to the users using SMS passcode device
Anyone had worked on similar requirement please help me to resolve the issue .
Thanks in advance
Angus

Hi all
I am working exactly for a month on this topic with no success.
I need to integrate VASCO OTP solution. But VASCO do not support any external authentication backend for virtual/SMS token. Only passcode or local authentication.
I need to implement an external authentication against LDAP somewhere...
Gunnar, do CISCO clearly says it is not able to participate to such setup?
So, my need would be to be able to insert in the flow an authentication in ISE against the LDAP.
The flow is:
WebApplication send login+password (LDAP) to ISE
ISE checks the credentials and if it is OK forward the request to VASCO
VASCO does not check for password but generate the OTP and send it via SMS
VASCO replies with a access-challenge
ISE forward the challenge to Web Application
WebApplication send login+OTP response to ISE
ISE forward to VASCO
VASCO checks for OTP and replies to ISE with accept
ISE forward to Web Application
User is logged in...
All the flow is working if the user enters a passcode
I would like to implement a Identity source sequences where the user is checked again all the entries not the first match
First LDAP then VASCO...

Cisco ISE - User with expired password is forced to logoff before they can change password.

I came across a situation today where a user was logged into a laptop with an expired password and could not change it by simply locking the computer and logging in with the correct credentials. (They had previously changed it on their main computer) The port restricted any communication since the user was failing authentication.
So, the I had the user logout and immediately the computer authenticated, and the user was able to login with the correct credentials. I dont want my users to have to logout completely in this situation. Below is the port config and the ISE error messages.
switchport access vlan 423
switchport mode access
switchport block unicast
switchport voice vlan 425
ip arp inspection limit rate 10
ip access-group ACL-LOW-IMPACT-MODE in
authentication event fail action next-method
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity server
authentication violation restrict
mab
snmp trap mac-notification change added
dot1x pae authenticator
dot1x timeout tx-period 3600
spanning-tree portfast
spanning-tree bpduguard enable
ip dhcp snooping limit rate 100

Completely forgot about odac version. I have ODT with ODAC 102.02 installed.
I want to download new drivers from here:
Oracle10g Release 2 ODAC and Oracle Developer Tools for Visual Studio .NET
http://download.oracle.com/otn/other/ole-oo4o/ODTwithODAC1020221.exe
And old drivers from here (just for testing)
Oracle Developer Tools for Visual Studio .NET 10.1.0.4.0
http://download.oracle.com/otn/other/ODT10104.exe
Does anybody know something about these releases? Do they have the same behavior?
Thanks.

Cisco ISE with cisco-av-pair

Hi All
I am deploying a Cisco ISE together with a WLC to provide guest services. After the authentication the users will be redirected to the device registration page, this is done via the radius attribute "cisco-av-pair = url-redirect=https://FQDN:8443/guestportal/gateway?sessionId=SesionIdValue&portal=..." returned by the ISE. My problem is that there is no internal DNS server in the guest network (point to public DNS servers), so the clients cannot resolve the FQDN. We can manually add the redirect URL, however the SessionIdValue in the URL is a dynamic value, is there a way to put a dynamic value in the attributes manually?
Thanks a lot!
Leo

Thanks Tarik, I saw u helped a lot of ppl on ISE configuration, really appreciate for your help.
In ISE there is a place to set the default URL for Sponsor and My device, not sure why not for Guest portal. As the DNS server is not available at this moment, we are using the WLC to do the redirect (so not CWA), the downside is we cannot have a whitelist since all request will be redirected to the guest portal.

Cisco ISE 1.2.x with Posture Configuration - Windows Patches

Hi, Anybody has any experience in integrating Cisco ISE Posture with Microsoft SCCM?
With WSUS this works fine, but with SCCM I don't have any idea how to proceed. Anybody knows what it's included in the predefined rules
pr_WSUSRule and pr_WSUSCheck? I can't find any information in ISE Console or Cisco documentation.
Thanks.

Once agent performs the posture checks containing the windows hotfix checks, if the administrator configured the Launch Program Posture Remediation , agent will launch the script file which will initiate the windows hotfix updates via SCCM client configuration manager pre-installed/pre-configured on the box.

Cisco ISE with EAP-FAST and PAC provisioning

Hi,
I have search with no result on this topic. So, Does anyone have implemented Cisco ISE authentication with EAP-FAST and PAC provisioning ?
Since I have an issue with internal proxy, user required to authenticate with an internal proxy before granting access to the internet.
If you have any documents, it would be appreciated for me.
Thanks,
Pongsatorn

From what I understand a Internet proxy PAC and a eap-fast PAC are two different purposes.
Is that what you are trying to get clarification on.
Basically eap fast PAC provisioning is a PAC that s provisioned when a client authenticates successfully. The client provides this PAC for network authentication and not proxy authentication.
Sent from Cisco Technical Support iPad App

Cisco ISE in Apple Mac Environment

Hi,
One of our clients need to implement BYOD in their network. They are using Mac servers and clients. The requirement is to authenticate (wireless) users against the Mac directory server, in order to provide access to resources. I am trying to figure out whether Cisco ISE can perform LDAP authentication with Mac server. As per this document, Mac server is not a supported external identity source/LDAP server. Currently they are providing access to users by adding MAC addresses to WLC manually, which is not practical now due to increase in number of end devices, and limitation in MAC addresses supported by WLC (2048).
Is it possible to implement this? Has anyone came across similar scenario?
Thanks,
John

The Cisco Identity Services Engine (Cisco ISE) integrates with external identity sources to validate credentials in user authentication functions, and to retrieve group information and other attributes that are associated with the user for use in authorization policies. You must configure the external identity source that contains your user information in Cisco ISE. External identity sources also include certificate information for the Cisco ISE server and certificate authentication profiles.
Both internal and external identity sources can be used as the authentication source for sponsor authentication and also for authentication of remote guest users.
Table 5-1 lists the identity sources and the protocols that they support.
Table 5-1 Protocol Versus Database Support
Protocol (Authentication Type)
Internal Database
Active Directory
LDAP1
RADIUS Token Server or RSA
EAP-GTC2 , PAP3 (plain text password)
Yes
Yes
Yes
Yes
MS-CHAP4 password hash: MSCHAPv1/v25 EAP-MSCHAPv26 LEAP7
Yes
Yes
No
No
EAP-MD58 CHAP9
Yes
No
No
No
EAP-TLS10 PEAP-TLS11 (certificate retrieval) Note For TLS authentications (EAP-TLS and PEAP-TLS), identity sources are not required, but are optional and can be added for authorization policy conditions.
No
Yes
Yes
No
1 LDAP = Lightweight Directory Access Protocol. 2 EAP-GTC = Extensible Authentication Protocol-Generic Token Card 3 PAP = Password Authentication Protocol 4 MS-CHAP = Microsoft Challenge Handshake Authentication Protocol 5 MS-CHAPv1/v2 = Microsoft Challenge Handshake Authentication Protocol Version 1/Version 2 6 EAP-MSCHAPv2 = Extensible Authentication Protocol-Microsoft Challenge Handshake Authentication Protocol Version 2 7 LEAP = Lightweight Extensible Authentication Protocol 8 EAP-MD5 = Extensible Authentication Protocol-Message Digest 5 9 CHAP = Challenge-Handshake Authentication Protocol 10 EAP-TLS = Extensible Authentication Protocol-Transport Layer Security 11 PEAP-TLS = Protected Extensible Authentication Protocol-Transport Layer Security
and for the WLC Check the Link : www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/91901-mac-filters-wlcs-config.html#backinfo

Cisco ISE guest portal redirect not working after successful authentiation and URL redirect.

Hi to all,
I am having difficulties with an ISE deployment which I am scratching my head over and can't fathom out why this isn't working.
I have an ISE 3315 doing a captive webportal for my guest users who are on an SSID. The users are successfully redirected by the WLC to the following URL:https://x.x.x.x:8443/guestportal/Login.action?portalname=XXX_Guest_Portal
Now when the user passes through the user authentication splash screen they get redirected to https://x.x.x.x:8443/guestportal/guest/redir.html and recieve the following error:
Error: Resource not found.
Resource: /guestportal/
Does anyone have any ideas why the portal is doing this?
Thanks
Paul

Hello,
As you are not able to get the guest portal, then you need to assure the following things:-
1) Ensure that the two Cisco av-pairs that are configured on the authorization profile should exactly match the example below. (Note: Do not replace the "IP" with the actual Cisco ISE IP address.)
–url-redirect=https://ip:8443/guestportal/gateway?...lue&action=cpp
–url-redirect-acl=ACL-WEBAUTH-REDIRECT (ensure that this ACL is also defined on the access switch)
2) Ensure that the URL redirection portion of the ACL have been applied to the session by entering the show epm session ip command on the switch. (Where the session IP is the IP address that is passed to the client machine by the DHCP server.)
Admission feature : DOT1X
AAA Policies : #ACSACL#-IP-Limitedaccess-4cb2976e
URL Redirect ACL : ACL-WEBAUTH-REDIRECT
URL Redirect :
https://node250.cisco.com:8443/guestportal/gateway?sessionId=0A000A72
0000A45A2444BFC2&action=cpp
3) Ensure that the preposture assessment DACL that is enforced from the Cisco ISE authorization profile contains the following command lines:
remark Allow DHCP
permit udp any eq bootpc any eq bootps
remark Allow DNS
permit udp any any eq domain
remark ping
permit icmp any any
permit tcp any host 80.0.80.2 eq 443 --> This is for URL redirect
permit tcp any host 80.0.80.2 eq www --> Provides access to internet
permit tcp any host 80.0.80.2 eq 8443 --> This is for guest portal
port
permit tcp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8905 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
permit udp any host 80.0.80.2 eq 8906 --> This is for posture
communication between NAC agent and ISE (Swiss ports)
deny ip any any
Note:- Ensure that the above URL Redirect has the proper Cisco ISE FQDN.
4) Ensure that the ACL with the name "ACL-WEBAUTH_REDIRECT" exists on the switch as follows:
ip access-list extended ACL-WEBAUTH-REDIRECT
deny ip any host 80.0.80.2
permit ip any any
5) Ensure that the http and https servers are running on the switch:
ip http server
ip http secure-server
6) Ensure that, if the client machine employs any kind of personal firewall, it is disabled.
7) Ensure that the client machine browser is not configured to use any proxies.
8) Verify connectivity between the client machine and the Cisco ISE IP address.
9) If Cisco ISE is deployed in a distributed environment, make sure that the client machines are aware of the Policy Service ISE node FQDN.
10) Ensure that the Cisco ISE FQDN is resolved and reachable from the client machine.
11) Or you need to do re-image again.

Cisco ISE to block jailbroken or android specific versions

We have Cisco ISE deployed with Advanced subscription license. Is it possible to block IOS jailbroken devices and android devices with older OS version (or rooted) from joining the wireless network.

You cannot do that with ISE alone. You will need to purchase a supported MDM solution (Airwatch, MobileIron, Maas360, etc) and integrate that with ISE. The MDM can then be queried by ISE and check for things like rooted device, PIN, encryption, etc
Thank you for rating helpful posts!

Cisco ISE Authorization with Device OS

Similar Messages

Maybe you are looking for