EndPoint Whitelist

Question

In ISE v1.1.1, is it possible to create a whitelist of endpoints just for a specific WLAN SSID - i.e. a whitelist that can be associated wih only one SSID?
Many thanks.
Sankung

Answer 1

WIRELESS:
Simply means brining a new device onto the network for the first time. On-boarding can be designed many ways however for this post we will use two SSIDs called Provisioning_Wireless for new devices and Employee_Wireless for existing approved devices.  An accesslist limiting access to ISE, DHCP and DNS will be enabled to prevent devices from staying on the provisioning SSID. 
Go to WLANs > Create New > Go and fill out the profile details. Use NONE for the layer 2 settings so it’s OPEN. For AAA, set the Radius server for ISE. Under advanced, enabled Allow AAA Override and change the NAC state to Radius NAC. Go to Controller > General > Fast SSID change and enabled Fast SSID to help speed up the SSID changing.
i- Join the ISE to an AD system. ii- Define the certificate authentication profile
iii- Define an Identity Source Sequence iv- Configure ISE to act as a Simple Certificate Enrollment proxy server
For this scenario, Configure ISE authentication to use MAB for on-boarding new devices. 
In many cases, ISE will not know the MAC addresses in advance so it must be configured to continue the authentication process via redirection regardless.
This is done in ISE:
Policy > Authentication, choose your MAB wireless policy, click the carrot after allow protocols to show the user options and click the + sign for use.
Select IF USERS NOT FOUND, CONTINUE. As a reminder, ISE Authentication policies are verified top down so make sure your MAB policy used for BYOD is at the top and open for all identity stores. You should lock down the 802.1x wireless to only wireless certificates.
Note: Client provisioning is based on how ISE classifies the client machine. There are customized packages in ISE available that include a software-provisioning wizard, which configures 802.1x settings and ability to obtain digital certificates on the endpoint.
To download wizard packages in ISE
Policy Elements > Results > Client Provisioning > Resources > Add. Common mobile devices such as iOS typically have these settings enabled natively so a wizard is not needed.
To configure client provisioning in ISE:
Policy Elements > Results > Client Provisioning > Resources > Add.
Create a native suppliant profile by giving it a name, selecting the Wireless Checkbox, your on-boarding SSID, WPA2 for security, TLS for allow protocols and key size 2048.
Policy > Client > Provisioning to build your provisioning resources. Create one for native devices and select the mobile profile you just created for the results (example RULE = IOS, Identiy Group = Any, Operating systems MAC IOS ALL and your new mobile profile for results).
Create another that is similar however use Android for the operating systems. Create a third for generic MacOsX devices and use the downloaded wizard. You may also want to create a separate one for Wired and Wireless. The same goes for two more to cover wireless and wired Windows devices. Here is an example of my Client Polices
The final steps are verifying profiling for wireless is working as well as your authorization profiles are setup for redirection, employee and guest access (see previous postings for these configs). These can vary depending on how you want to restrict devices that pass and fail your polices.
For Complete Guide Please visit
http://www.thesecurityblogger.com/?tag=ise-advance-license
Video Link for Configuration of BYOD
http://www.labminutes.com/sec0054_ise_1_1_byod_wireless_onboarding_dual_ssid_testing