Welcome to Global Knowledge Housekeeping Adjust the volume

Welcome to Global Knowledge

Housekeeping Adjust the volume on your computer speakers or headset Submit questions via the Chat Panel through Web. Ex Slides and recording distributed via email in a few days © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 2

Our presenters Graham Tuthill Cisco Lead Security Instructor Global Knowledge I joined Global Knowledge as a Cisco trainer in February 1999. I have since progressed on to become a Lead technologist for a small team of Cisco trainers. I have been in the networking industry for over 15 years mainly involved with training, course development and consultancy. I am a certified Cisco, Juniper and Nortel certified instructor. My relevant networking qualifications are: Certified Cisco Instructor (CCSI) Certified Juniper Instructor Cisco CDA Cisco CCNP Cisco CCVP Cisco CCSP Nortel Certified Instructor ATM Centillion Switching Nortel Certified Instructor Accelerated Routing © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 3

Cisco ISE and BYOD Graham Tuthill

Agenda Reasons for adopting BYOD Cisco ISE An overview of BYOD operation, configuration and user experience The challenges BYOD presents © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 5

Agenda 45 minute presentation and a 15 minute Q&A session © 2013 Global Knowledge

Reasons for adopting BYOD (1 -2) l Many Needs and Many Devices l Voice, Video and Apps l PCs, Tablets and Smartphones l Work and Personal boundaries overlap l Felibility, one device without switching l Anywhere, Anytime Mobility l 3 G/4 G Public WIFI access l Bandwidth demand © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 7

Reasons for adopting BYOD (2 -3 ) l Video, Collaboration & Rich Media Apps l Who is watching this Webinar on Bus, Train, Plane with Iphone, Smartphone, Tablet, or PC owned by company or not. © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 8

Reasons for adopting BYOD (3 -3) l % of devices chart etc OVUM Bookmarked

Cisco ISE Overview (1 -4) Mn. T Policy Administration Node (PAN) Multi Function Node Monitoring Node (Mn. T) IPN Inline Posture Node (IPN) PSN Policy Service Node (PSN) Can scale to 100, 000 Endpoints with 40 x. PSN 2 x. Admin 2 x. Monitoring l ISE Identity Service Engine l Comprising different personas l Admin/Monitoring/Policy © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 10

Cisco ISE Overview (2 -4) PSN Policy Service Node (PSN) l Policy Service Node (Radius Server) l Policies created on the Administration node, centrally l Policies synced from Admin node to all participating PSNs © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 11

Cisco ISE Overview (3 -4) l Communication flow endpoint to PSN NAD Network Access Device PSN Endpoint Wired Wireless VPN EAPOL (802. 1 x) EAP Over Radius EAP-TLS © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 12

Cisco ISE Overview (4 -4) l l l Authentication Authorization Profiling Posturing BYOD EPS

Cisco ISE an overview of BYOD operation, configuration and user experience. l BYOD Components l Cisco ISE n Database support, including Active Directory l Wireless Controllers and access points l Switches, Wired l VPN ISE l Endpoint devices: n Apple i. OS n Anroid n Windows n Mac OS X © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 14

Cisco ISE Device Onboarding Authentication Provision Native Provision Supplicants Certificates Self Registration Blacklisting © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 15

Cisco ISE DUAL SSID Design l Seperate network for Access and Provisioning l Open SSID for Provisioning l Can be applied to Guests and Employees © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 16

Cisco ISE BYOD Flow for DUAL SSID l Connect to open SSID l Redirected to a Web. Auth Portal l Enter either Guest/Employee credentials © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 17

Cisco ISE Guest Access l Guest agrees to Acceptable Use Policy (AUP) and gets

Cisco ISE Employee Access and Device Registration l Employee registers Device l Requests and Downloads all appropriate certificates l Downloads supplicant provisiong details l Employee reconnects using EAP-TLS © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 19

Cisco ISE Authorisation Policy Rules Rule Name Conditions Permissions All Rule IF Wireless_MAB Then WEB_Auth Guest Rule IF GUEST Then GUEST Employee Rule IF Employee Then Supp_Provis Rule IF Then Employee Deny Rule IF Employee/EAP-TLS Station ID = Certificate SAN No_Matches Then Deny © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 20

Cisco ISE Connecting to the Network PSN Radius Access-Request Guest connect to network via Open SSID Employees connect to network via Open SSID until their Endpoints provisioned © 2013 Global Knowledge Training LLC. All rights reserved. Radius Access-Accept Radius AV Pair=url Redirect URL: https: //ise-1. com: 8443/guestportal/gateway/sessionid. . /cwa 2/22/2021 Page 21

Cisco ISE Guest Access l Guest endpoints are not provisioned l controlled through configuration l Guest access is restricted Multi-Portal Config Enable Self Provisioning Flow l controlled through configuration PSN Radius Access-Request Radius AV Pair=mac 00. 0 c. 00. a 3. 34. 69 Radius Access-Accept © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 22

Cisco ISE Employee Access before provisioning Multi-Portal Config Enable Self Provisioning Flow PSN Radius Access-Request Radius Access-Accept Radius AV Pair=url Redirect URL: https: //ise-1. com: 8443/guestportal/gateway/sessionid. . /nsp • Employee redirected to Native Supplicant Provisioning • Certificate obtained via SCEP • Native supplicant provisioned with certificate • WIFI Profile NSP =Native Supplicant Provisioning © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 23

Cisco ISE Device Registration CA PSN https to PSN sends CA Cert to endpoint User registers CA ISE Endpoint ID group 00. 0 c. 00. a 3. 34. 69 © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 24

Cisco ISE Device Enrollment CA PSN sends Profile Service to endpoint CSR is generated On endpoint CSR sent to PSN SCEP to CA Certificate sent to PSN Device PSN sends Device Certificate to endpoint © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 25

Device Provisioning CA PSN CSR sent to PSN SCEP to CA Certificate sent to PSN User PSN sends User Certificate to endpoint SSID = Corp Eap-TLS © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 26

Client Provisiong Rules • Rules based on 1. Identity group 2. Operating sytem 3. Other consitions Rule Name ID Groups OS Conditions Results IOS IF Any & IOS All & AD: Ext. Groups Equals Emplyees Then WIFI_Profile Android IF Any & Android & AD: Ext. Groups Equals Emplyees Then WIFI_Profile Windows IF Any & Windows & AD: Ext. Groups Equals Emplyees Then Win_Wizard Mac OS X IF Any & MAC OS X & AD: Ext. Groups Equals Emplyees Then MAC_Wizard © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 28

Employee Access after Endpoint Provisioning Rule Name Conditions Permissions Employee Rule IF Employee Then Supp_Provis Rule IF Employee/EAP-TLS Station ID = Certificate SAN Then Employee PSN SSID = Corp Eap-TLS Device CA User © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 29

Cisco ISE User Experience, Guest Portal Redirect URL: https: //ise-1. com: 8443/guestportal/gateway/sessionid. . /cwa CWA =Central Web Auth © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 30

Cisco ISE User Experience, Device Registration l CA Certificate is installed, user enters a description for the registered device. l MAC Address can be Profiled and WIFI Profile Installed © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 31

Cisco ISE Summary Flow Chart Start Athuc Guest Employee BYOD Provisioning Web Portal Result Unknown/Guest/Employee/BYOD Web Portal Athuz Guest Limited Access Stop BYOD Employee DENY BYOD Full Access Stop © 2013 Global Knowledge Training LLC. All rights reserved. Guest 2/22/2021 Page 34

The Challenges BYOD presents (1 -3) l Wide range of Devices and a Challenge to support l Selective device support l Approved list l Maintaining Secure Access to the Corporate Network. l Device identification (mac address) l Bringing a new device into the Network, On-Boarding l Self-Service access l Guest access © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 35

The Challenges BYOD presents (2 -3) l Company Usage policies and Enforcement l Work and Personal data on the same device l BYOD Network Visibility l Device location l Wired, Wireless and VPN l 3 G/4 G and WIFI l Protecting Corporate Data l Biggest Challenge l Regulaturity requirements. © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 36

The Challenges BYOD presents (3 -3 ) l Remote Wipe and or Blacklist l Device lost or stolen l Employee changing role l Wide range of Devices and apps, Wide range of threat vectors l ad-hoc hotspots l Malware l SMS threats © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 37

Summary l Reasons for adopting BYOD l Cisco ISE, an overview of BYOD operation, configuration and user experience. l The challenges BYOD presents © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 38

Questions Graham Tuthill Cisco Lead Security Instructor Global Knowledge © 2013 Global Knowledge Training

Find out more. . . l Default Gateway Site http: //defaultgateway. co. uk/sise Visit Our Community l Courses l Certifications l BYOD Webinar Site http: //byod. weebly. com l Solutions l News l Events l Webinars l Blog l Sign up to our Newsletters l Twitter l Linked. In l Google+ l Videos © 2013 Global Knowledge Training LLC. All rights reserved. 2/22/2021 Page 40

Thank you for attending For more information visit www. globalknowledge. co. uk Call us on 0118 912 3456