Step 1

Add the third-party network device to Cisco ISE (See Import Network Devices into Cisco ISE. If you are configuring Guest, BYOD, or Posture workflows, ensure that CoA is defined and the NAD’s URL redirect mechanism is configured to point to the relevant Cisco ISE portal. To configure the URL redirect, copy the Cisco ISE portal URL from the portal’s landing page. For more information about configuring CoA types and URL redirects for the NAD in Cisco ISE, see Network Device Definition Settings. In addition, see the third-party device’s administration guide for instructions.

Step 2

Ensure that an appropriate NAD profile for your device is available in Cisco ISE. To view the existing profiles, choose Administration > Network Resources > Network Device Profiles. If an appropriate profile does not exist in Cisco ISE, create a custom profile. See Create a Network Device Profile for information on how to create custom profiles.

Step 3

Assign a NAD profile to the NAD that you want to configure. Choose Administration > Network Resources > Network Devices. Open the device to which you want to assign a profile, and from the Device Profile drop-down list, choose the profile that you want to assign.

Step 4

When you configure your policy rules, set the authorization profile to the NAD profile in step 1, or Any if you are just using VLAN or ACL, or if you have different devices from different vendors in your network. To set the NAD profile for the authorization profile, choose Policy > Policy Elements > Results > Authorization > Authorization Profiles. Open the relevant authorization profile and from the Network Device Profile drop-down list, choose the relevant NAD profile. When using Auth VLAN for Guest flows, you should also define a guest portal and select that portal in an Authorization profile that is bound to MAB authorization—similar to regular Guest flows. For more information about guest portals, see the "Cisco ISE Guest Services" section in Cisco ISE Admin Guide: Guest and BYOD .

Step 1

Choose Administration > Network Resources > Network Device Profiles.

Step 2

Click Add.

Step 3

In the New Network Device Profile window that is displayed, enter the corresponding values in the Name and Description fields for the network device.

Step 4

From the Vendor drop-down list, choose the vendor of the network device.

Step 5

In the Icon area, click Change Icon... to upload an icon for the network device from your system.

Step 6

In the Supported Protocols area, check the check boxes for the protocols that the device supports. Check the check boxes only for the protocols that you want to actually use. If the network device supports the RADIUS protocol, choose the RADIUS dictionary to be used in the device from RADIUS Dictionaries drop-down list.

Step 7

In the Templates area, enter relevant details:

1. Click Authentication/Authorization to configure the network device's default settings for flow types, attribute aliasing, and host lookup. In the new Flow Type Conditions area that is displayed, enter the attributes and values that your device uses for various authentication and authorization flows such as Wired MAB or 802.1X. This enables Cisco ISE to detect the correct flow type for your device according to the attributes it uses. There is no IETF standard for MAB, and different vendors use different values for Service Type. See the device's user guide or use a sniffer trace of a MAB authentication to determine the correct settings. In the Attribute Aliasing area, map device-specific attribute names to common names to simplify policy rules. Currently, only the Service Set Identifier (SSID) is defined. If the network device has the concept of wireless SSID, then set this to the attribute it uses. Cisco ISE maps this to an attribute called SSID in the Normalized RADIUS dictionary. This simplifies policy rule configuration because you can refer to SSID in one rule, and it works for multiple devices even if the underlying attributes are different. In the Host Lookup area, check the Process Host Lookup check box and select the relevant MAB protocols and attributes for your device, based on the instructions provided by the third-party device vendor.

2. Click Permissions to configure the network device's default settings for VLAN and ACL. These are automatically mapped based on the authorization profiles that you create in Cisco ISE.

3. Click Change of Authorization (CoA) to configure the network device's CoA capabilities.

   If you choose RADIUS from the CoA By drop-down list, in the configurations area that is displayed, you must choose only static attributes. Dynamic attributes are not supported.

4. Click Redirect to configure the network device's URL-redirect capabilities. URL redirection is necessary for guest, BYOD, and posture services.

Step 8

Click Submit.

Step 1

Choose Administration > Network Resources > Network Device Profiles.

Step 2

Check the check boxes next to the devices that you want to export, and click Export Selected.

Step 3

A file that is named DeviceProfiles.xml downloads to your local hard disk.

Step 1

Choose Administration > Network Resources > Network Device Profiles.

Step 2

Click Import.

Step 3

Click Choose File to choose the XML file from the system that is running the client browser.

Step 4

Click Import.

Step 1

Configure IP address on the interface from the Cisco ISE CLI.

Step 2

Add a directly connected network device to the IPSec network device group.

1. Choose Administration > Network Resources > Network Devices.

2. In the Network Devices window, click Add.

3. Enter the name and IP address and subnet of the network device that you want to add in the corresponding fields.

4. From the IPSEC drop-down list, choose Yes.

5. Check the RADIUS Authentication Settings check box.

6. In the Shared Secret field, enter the shared secret key that you have configured on the network device.

7. Click Submit.

Step 3

(Optional; required only for Smart Licensing) Add a separate management interface to interact with the Cisco Smart Software Manager (CSSM). See Smart Software Manager satellite for information on Embedded Services Router (ESR). To do this, from the Cisco ISE CLI, run the following command to select the corresponding management interface (Gigabit Ethernet 1 to 5 (or Bond 1 or 2)):

Step 4

Add a network device to a directly connected gateway from the Cisco ISE CLI.

Step 5

Activate IPSec on Cisco ISE nodes.

1. Choose Administration > System > Settings > Protocols > IPSec..

   All the Cisco ISE nodes in the deployment are listed in this window.

2. Check the check box next to the Cisco ISE node on which you want to activate IPSec, and then click the Enable radio button.

3. Choose the interface that you want to use for IPSec communication from the IPSec Interface for selected nodes: drop-down list.

4. Click the radio button for one the following authentication type for the selected Cisco ISE node:

   • Pre-shared Key: If you choose this option, you must enter the pre-shared key and configure the same key on the network device. Use alphanumeric characters for the pre-shared key. Special characters are not supported. For instructions on how to configure the pre-shared key on the network device, see the network device documentation. For an example of the pre-shared key configuration output, see Example: Output of Pre-shared Key Configuration on Cisco Catalyst 3850 Series Switches.

   • X.509 Certificates: If you choose this option, from the Cisco ISE CLI, go to the ESR shell and configure and install X.509 Certificates for ESR 5921. Then, configure the network device for IPSec. For instructions, see Configure and Install X.509 Certificates on ESR-5921.

5. Click Save.

Step 6

Type esr to enter into the ESR shell.

ise/admin# esr
% Entering ESR 5921 shell
% Cisco IOS Software, C5921 Software (C5921_I86-UNIVERSALK9-M), Version 15.5(2)T2, RELEASE SOFTWARE (fc3)
% Technical Support: http://www.cisco.com/techsupport
% Copyright (c) 1986-2015 Cisco Systems, Inc.

Press RETURN to get started, CTRL-C to exit

ise-esr5921>
ise-esr5921>

ise-esr5921(config)#enable secret level 1 ?
0 Specifies an UNENCRYPTED password will follow
5 Specifies a MD5 HASHED secret will follow
8 Specifies a PBKDF2 HASHED secret will follow
9 Specifies a SCRYPT HASHED secret will follow
LINE The UNENCRYPTED (cleartext) 'enable' secret

ip nat inside source static udp 10.1.1.2 [port_number] interface Ethernet0/0 [port_number]

Step 7

(Optional; required only if you have not enabled Smart Licensing in Step 3) Add a Cisco ISE Classic license or an Evaluation license (that is valid for 90 days) to the Cisco ISE appliances.

Step 8

Verify IPSec tunnel and RADIUS authentication over IPSec tunnel.

1. Add a user in Cisco ISE and assign the user to a user group (Administration > Identity Management > Identities > Users).

2. Carry out the following steps to verify if the IPSec tunnel is established between Cisco ISE and the NAD:

   1. Use the ping command to test if Cisco ISE is connected to the NAD.

   2. Run the following command from the ESR shell or the NAD CLI to verify if the connection is in the active state:

      show crypto isakmp sa

      ise-esr5921#show crypto isakmp sa
      IPv4 Crypto ISAKMP SA
      dst             src             state          conn-id status
      192.168.30.1    192.168.30.3    QM_IDLE           1001 ACTIVE
      
      

   3. Run the following command from the ESR shell or the NAD CLI to verify if the tunnel is established:

      show crypto ipsec sa

      ise-esr5921#show crypto ipsec sa
      
      interface: Ethernet0/0
          Crypto map tag: radius, local addr 192.168.30.1 
      
         protected vrf: (none)
         local  ident (addr/mask/prot/port): (192.168.30.1/255.255.255.255/0/0)
         remote ident (addr/mask/prot/port): (192.168.30.2/255.255.255.255/0/0)
         current_peer 192.168.30.2 port 500
           PERMIT, flags={}
          #pkts encaps: 52, #pkts encrypt: 52, #pkts digest: 52
          #pkts decaps: 57, #pkts decrypt: 57, #pkts verify: 57
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts compr. failed: 0
          #pkts not decompressed: 0, #pkts decompress failed: 0
          #send errors 0, #recv errors 0
      
           local crypto endpt.: 192.168.30.1, remote crypto endpt.: 192.168.30.2
           plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
           current outbound spi: 0x393783B6(959939510)
           PFS (Y/N): N, DH group: none
      
           inbound esp sas:
            spi: 0x8EA0F6EE(2392913646)
              transform: esp-aes esp-sha256-hmac ,
              in use settings ={Tunnel, }
              conn id: 99, flow_id: SW:99, sibling_flags 80000040, crypto map: radius
              sa timing: remaining key lifetime (k/sec): (4237963/2229)
              IV size: 16 bytes
              replay detection support: Y
              Status: ACTIVE(ACTIVE)
      
           inbound ah sas:
      
           inbound pcp sas:
      
           outbound esp sas:
            spi: 0x393783B6(959939510)
              transform: esp-aes esp-sha256-hmac ,
              in use settings ={Tunnel, }
              conn id: 100, flow_id: SW:100, sibling_flags 80000040, crypto map: radius
              sa timing: remaining key lifetime (k/sec): (4237970/2229)
              IV size: 16 bytes
              replay detection support: Y
              Status: ACTIVE(ACTIVE)
      
           outbound ah sas:
      
           outbound pcp sas:
      

3. Verify the RADIUS authentication using one of the following methods:

   • Log in to the network device using the credentials of the user that you created in Step 8 (a). The RADIUS authentication request is sent to the Cisco ISE node. View the details in the Live Authentications window.

   • Connect the end host with the network device and configure 802.1X authentication. Log in to the end host using the credentials of the user that you created in Step 8 (a). The RADIUS authentication request is sent to the Cisco ISE node. View the details in the Live Authentications window.