Network Wizkid's Technical Knowledge Base

When deploying Cisco Identity Services Engine (ISE) in today’s world, many companies want to take advantage of the guest services on offer. Cisco ISE has the ability to authenticate guest users and apply relevant controls while guests are visiting. As Cisco ISE has evolved over time, the network requirements from companies have also evolved. Companies are more conscious about network security and are constantly looking for ways to further secure their networks. With that, this often means restricting access to the corporate network if certain requirements aren’t met. By combining multiple Cisco technologies, we have the ability to segregate guests from the corporate network while still being able to allow them internet access. In summary, we can do this by deploying Cisco ISE in a DMZ and tunnelling all guest traffic to an anchor controller sat in the same DMZ. As you can imagine, designs for this sort of deployment can vary and no doubt if you’re reading this, you more than likely al...

In this quick tip Cisco ISE article I would like to point out how ISE administrators can displays usernames for failed authentications. The following has been tested on ISE 2.4 but is relevant for older ISE versions. When a user/machine fails authentication ISE will mask the identity automatically. This can be seen in the RADIUS Live Logs and looks like the screenshot (1) shown below. Although you can click on the details of each live log, sometimes it’s good to know what the identity is to troubleshoot further. The good news is that with ISE, we can unmask the identity, however, the bad news for some is that you can only keep identities unmasked for a limited time, depending on ISE version. As of up to ISE 2.4 patch 3 you cannot keep identities unmasked permanently, in fact, the maximum time in which you can keep identities unmasked for is 30 minutes before ISE masks them again. As mentioned, this is not convenient and was in fact raised as a bug (CSCvh91118). I believe ISE releases ...

In this article I will walk through the steps that are required to configure the ASA for external authentication using Cisco ISE for remote access VPN users. This demonstration will use the following devices: Cisco ISE 2.4 Cisco ASA 9.8 Cisco AnyConnect 4.6 Test Laptop Server 2012 R2 Overview Cisco ISE can be used to authenticate remote access users terminating on a Cisco ASA. Before users gain access to the network, they are required to authenticate using a set of credentials, often certificate-based or by using a username and password. Based on the user authentication, Cisco ISE can be used to determine which tunnel-group the user should be placed within. Change of Authorization (CoA) is supported from ASA version 9.2.1, this allows for ISE to perform things such as posturing. Although not the main focus of this article, Cisco ISE can also be used to apply things such as Dynamic Access Control Lists (dACL’s) based on matched authorization policies. Demonstration Topology In this demo...