Step 1

In Cisco EPN Manager:

1. Choose Administration > Users > Users and Roles > Roles.

2. From the Roles list, select the user group, and copy the role for each user group by clicking the Task List icon (in front of Role Permissions).

   • If you are using RADIUS, right-click the role0 line in the RADIUS Custom Attributes field and choose Copy.

   • If you are using TACACS+, right-click the role0 line in the TACACS+ Custom Attributes field, and choose Copy.

Step 2

Paste the information into your Cisco ISE server. These steps show how to add the information to an existing user group in Cisco ACS. If you have not yet added this information to Cisco ISE, see:

1. Navigate to User or Group Setup.

2. For the applicable user or group, click Edit Settings.

3. Paste the attributes list into the appropriate text box.

4. Select the check boxes to enable these attributes, then click Submit + Restart.

Step 1

Choose Administration > Users > Virtual Domains.

Step 2

In the Virtual Domains sidebar menu, click the i (info) icon and click Create Sub Domain.

Step 3

Enter the name and description for the domain.

Step 4

Click Submit to view a summary of the newly created virtual domain.

Step 1

Choose Administration > Users > Virtual Domains.

Step 2

In the Virtual Domains sidebar menu:

1. Locate the domain under which you want to create a new child domain. (This is called the parent domain.)

2. Click the information (i) icon next to the domain name. This opens a data popup window.

3. In the popup window, click Add a Sub Domain. The navigation pane switches to the list view, with the parent domain displayed above the child domain named Untitled.

Step 3

Enter a name in the Name text box. The name in the navigation pane will change from Untitled to the child domain name after you save the new child domain.

Step 4

(Optional) Add a description.

Step 5

Click Create and confirm the creation of the new child domain.

Step 1

In Cisco EPN Manager:

1. Choose Administration > Users > Virtual Domains.

2. Click Export Custom Attributes at the top right of the window. This opens the Virtual Domain Custom Attributes dialog.

3. Copy the attributes list.

   • If you are using RADIUS, right-click all of the text in the RADIUS Custom Attributes field and choose Copy.

   • If you are using TACACS+, right-click all of the text in the TACACS+ Custom Attributes field and choose Copy.

Step 2

Paste the information into your Cisco ISE server. These steps show how to add the information to an existing user group in Cisco ISE. If you have not yet added this information to Cisco ISE, see:

1. Navigate to User or Group Setup.

   If you want to specify virtual domains on a per-user basis, then you must make sure you add all of the custom attributes (for example, tasks, roles, virtual domains) information to the User custom attribute page.

1. For the applicable user or group, click Edit Settings.

2. Paste the attributes list into the appropriate text box.

3. Select the check boxes to enable these attributes, then click Submit + Restart.

Step 1

Choose Administration > Users > AAA, then choose Servers. From this window, you can add, edit settings, and delete a new RADIUS/TACACS+ server.

Step 2

Select the type of server that you want to add.

• For RADIUS, click the RADIUS tab. Click the icon.
• For TACACS+, click the TACACS+ tab. Click the icon.

Step 3

Enter the required information—IP address, DNS Name, and so forth. For Cisco EPN Manager to communicate with the external authentication server, the shared secret entered on this page must match the shared secret configured on the RADIUS or TACACS+ server. You can use alphabets, numbers, and special characters except ‘ (single quote) and “ (double quote) while entering the shared secret key for a third-party TACACS+ or RADIUS server. Enter the Retransmit Timeout and the Retries.

Step 4

Select the authentication type.

• PAP—Password-based authentication protocol requires two entities to share a password in advance and use the password for authentication.
• CHAP—Challenge-Handshake Authentication Protocol requires the client and server to know the plain text of the secret, although it is never sent over the network. CHAP provides greater security than Password Authentication Protocol (PAP).

Step 5

Click Test to check the connectivity of the AAA server. The connectivity test passes only if the port, authentication type, and shared key that you have entered match the TACACS or RADIUS server.

Step 6

Click Save.

Step 7

To edit a RADIUS/TACACS+ server:

1. Click the checkbox next to the RADIUS/TACACS+ server and click . After making changes, click Save.

Step 8

To delete a RADIUS/TACACS+ server:

1. Click the checkbox next to the RADIUS/TACACS+ server and click . The Delete dialog box opens. Click Delete to confirm.

Step 1

Choose Administration > Users > AAA, then choose Settings.

Step 2

Select TACACS+ or RADIUS.

Step 3

Select the Fallback to Local checkbox to enable the use of the local database when the external AAA server is down.

Step 4

If you want to revert to local authentication when the external RADIUS or TACACS+ server goes down, perform the following steps:

1. Select Fallback to Local.

2. Specify the fallback conditions:

   • Only on no server response—only when the external server is unreachable or has network problems. If you select this option, you can login as an AAA user only.

   • On authentication failure or no server response—either when the external server is unreachable, or has network problems, or the external AAA server cannot authenticate the user. If you select this option, you can login as a local user and an AAA user.

Step 5

Click Save All Changes.

Step 1

Log in to Cisco ISE as the admin user.

Step 2

Choose Policy > Authorization.

Step 3

In the Standard area, click the down arrow on the far right and select either Insert New Rule Above or Insert New Rule Below.

Step 4

Enter the rule name and choose identity group, condition, attribute, and permission for the authorization policy.

Step 5

Click Done, and then click Save.

Step 1

Log in to Cisco ISE as the admin user.

Step 2

Choose Administration > Network Resources > Network Devices.

Step 3

In the Network Devices page, click Add.

Step 4

Enter the device name and IP address of the Cisco Evolved Programmable Network Manager server.

Step 5

Check the Authentication Settings check box, and then enter the shared secret.

Step 6

Click Submit.

Step 1

Log in to Cisco ISE as the admin user.

Step 2

Choose Administration > Identity Management > Groups.

Step 3

In the User Identity Groups page, click Add.

Step 4

In the Identity Group page, enter the name and description of the user group.

Step 5

Click Submit.

Step 1

Log in to Cisco ISE as the admin user.

Step 2

Choose Administration > Identity Management > Identities.

Step 3

In the Network Access Users page, click Add.

Step 4

From the Select an item drop-down list, choose a user group to assign the user to.

Step 5

Click Submit.

Step 1

Log in to Cisco ISE as the admin user.

Step 2

Choose Policy > Policy Elements > Results.

Step 3

From the left sidebar, choose Authorization > Authorization Profiles.

Step 4

In the Standard Authorization Profiles page, click Add.

Step 5

In the Authorization Profile page, enter the name and description of the authorization profile.

Step 6

From the Access Type drop-down list, choose ACCESS_ACCEPT.

Step 7

In the Advanced Attributes Settings area, paste in the complete list of RADIUS custom attributes for:

Step 8

Click Submit.

Step 1

Log in to Cisco ISE as the admin user.

Step 2

Choose Work Center > Device Administration > Policy Elements.

Step 3

From the left sidebar, choose Results > TACACS Profiles.

Step 4

In the TACACS Profiles page, click Add.

Step 5

From the Access Type drop-down list, choose ACCESS_ACCEPT.

Step 6

In the TACACS Profiles page, enter the name and description of the authorization profile.

Step 7

In the Raw View Profile Attributes area, paste in the complete list of TACACS+ custom attributes for:

Step 8

Click Submit.

Step 1

Log in to Cisco ISE as the admin user.

Step 2

Choose Policy > Authorization.

Step 3

In the Standard area, click the down arrow on the far right and select either Insert New Rule Above or Insert New Rule Below.

Step 4

Enter the rule name and choose identity group, condition, attribute, and permission for the authorization policy.

Step 5

Click Done, and then click Save.

Step 1

Log in to Cisco ISE as the Super Admin or System Admin user.

Step 2

Choose Policy > Authentication.

Step 3

Choose the Policy Type as Simple or Rule-Based to create the required authentication policy.

Step 4

Enter the required details based on the policy type selected.

Step 5

Click Save.

Step 1

Choose Administration > Users > AAA, then choose Servers. Select the SSO tab. From this window, you can add, edit settings, and delete a new SSO server.

Step 2

Click the icon.

Step 3

Enter the SSO information. The maximum number of server retries for an SSO server authentication request is nine.

Step 4

Click Save.

Step 1

Choose Administration > Users > AAA, then choose Servers. Select the SSO tab.

Step 2

Select the servers that you want to delete.

Step 3

Click the checkbox next to the SSO server and click . The Delete dialog box opens. Click Delete to confirm.

Step 1

Choose Administration > Users > AAA, then choose SSO Settings.

Step 2

Choose which SSO Server AAA Mode you want to use. You can select only one at a time.

Step 3

Select/de-select Enable Single Sign-Out checkbox.

Step 4

Choose a time span from the Ticket Granting Ticket Timeout drop-down.

Step 5

Click Save All Changes.