Cisco Identity Services Engine User guide

Cisco Identity Services Engine Administrator Guide, Release 1.3

First Published: 2014-10-31

Last Modified: 2014-10-31

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CONTENTS

Preface xliii

PREFACE

Purpose xliii

Audience xliii

Document Organization xliii

Document Conventions xliv

Documentation Updates xlv

Obtaining Documentation and Submitting a Service Request xlv

Introduction 47

PART I

Cisco ISE Features 1

CHAPTER 1

Cisco ISE Overview 1

Key Functions 1

Identity-Based Network Access 2

Support for Multiple Deployment Scenarios 2

Support for UCS Hardware 3

Basic User Authentication and Authorization 3

Policy Sets 4

Support for Common Access Card Functions 4

Client Posture Assessment 5

Mobile Device Manager Interoperability with Cisco ISE 5

Wireless and VPN Traffic with Inline Posture Nodes 5

Profiled Endpoints on the Network 6

pxGrid Persona 6

Cisco ISE Certificate Authority 6

Cisco Identity Services Engine Administrator Guide, Release 1.3

ii

Contents

Support for Active Directory Multidomain Forests 6

Support for Installation on Multiple Hardware and VMware Platforms 6

Navigate the Admin portal 7

CHAPTER 2

Admin Portal 7

Cisco ISE Dashboard 9

Setup Assistant 10

Cisco ISE Licensing Impact on Setup Assistant 10

Run the Setup Assistant 11

Setup Assistant Overwrites Previous Configurations 11

Identify Policy Requirements Page in Setup Assistant 11

Configure Network Access Service Page in Setup Assistant 12

Select Network Device Types Page in Setup Assistant 14

Review and Confirm Your Choices Page in Setup Assistant 14

Filter Data on Listing Pages 15

Data Filters in Listing Pages 15

Customize the Displayed Field Attributes 15

Filter Data by Field Attributes Using the Quick Filter 15

Filter Data by Conditions Using the Advanced Filter 16

Create Custom Filters 16

Cisco ISE Internationalization and Localization 17

Supported Languages 17

Support for UTF-8 Character Data Entry 17

UTF-8 Credential Authentication 18

UTF-8 Policies and Posture Assessment 18

Cisco NAC and MAC Agent UTF-8 Support 18

UTF-8 Support for Messages Sent to Supplicant 18

Reports and Alerts UTF-8 Support 19

UTF-8 Character Support in the Portals 19

UTF-8 Support Outside the User Interface 22

Support for Importing and Exporting UTF-8 Values 22

UTF-8 Support on REST 22

UTF-8 Support for Identity Stores Authorization Data 23

MAC Address Normalization 23

Cisco Identity Services Engine Administrator Guide, Release 1.3

iii

Contents

Deploy Cisco ISE Nodes 25

PART II

Set Up Cisco ISE in a Distributed Environment 27

CHAPTER 3

Cisco ISE Deployment Terminology 27

Personas in Distributed Cisco ISE Deployments 28

Cisco ISE Distributed Deployment 28

Cisco ISE Deployment Setup 28

Data Replication from Primary to Secondary ISE Nodes 29

Cisco ISE Node Deregistration 29

Guidelines for Setting Up a Distributed Deployment 29

Menu Options Available on Primary and Secondary Nodes 30

Configure a Cisco ISE Node 31

Configure a Primary PAN 32

Install Trusted Certificates for Cisco ISE Inter-node Communication 32

Register a Secondary Cisco ISE Node 33

Administration Node 35

High Availability for the Administrative Node 35

Manually Promote Secondary PAN To Primary 35

Monitoring Node 36

Manually Modify MnT Role 36

Automatic Failover in Monitoring Nodes 36

pxGrid Node 38

pxGrid Client and Capability Management 39

Enable pxGrid Service 39

Deploy pxGrid Node 39

Cisco pxGrid Live Logs 40

ISE pxGrid Identity Mapping 40

Configure Identity Mapping 41

Filter Identity Mapping 42

Inline Posture Node 42

Inline Posture Node Installation 43

Register an Inline Posture Node 43

View Nodes in a Deployment 44

Cisco Identity Services Engine Administrator Guide, Release 1.3

iv

Contents

Synchronize Primary and Secondary Cisco ISE Nodes 44

Change Node Personas and Services 44

Effects of Modifying Nodes in Cisco ISE 45

Create a Policy Service Node Group 45

Configure Monitoring Nodes for Automatic Failover 46

Remove a Node from Deployment 47

Shut Down an ISE Node 48

Change the Hostname or IP Address of a Standalone Cisco ISE Node 48

Replace the Cisco ISE Appliance Hardware 49

Set Up Inline Posture 51

CHAPTER 4

Role of Inline Posture Node in a Cisco ISE Deployment 51

Inline Posture Policy Enforcement 51

Inline Posture Policy Enforcement Flow 52

Trusted and Untrusted Interfaces 54

Dedicated Nodes Required for Inline Posture 54

Standalone Inline Posture Node in a Cisco ISE Deployment 54

Inline Posture High Availability 54

Automatic Failover in Inline Posture Nodes 55

Inline Posture Operating Modes 55

Inline Posture Routed Mode 56

Inline Posture Bridged Mode 57

Inline Posture Maintenance Mode 57

Inline Posture High Availability in Routed and Bridged Modes 58

Best Practices for Inline Posture Deployment 58

Inline Posture Node Guidelines 60

Inline Posture Node Authorization 61

Deploy an Inline Posture Node 63

Configure an Inline Posture Node 63

Create Inline Posture Downloadable Access Control Lists 66

Create Inline Posture Node Profiles 67

Create an Inline Posture Authorization Policy 68

Configure a High-Availability Pair 69

Synchronize an Inline Posture Node 70

Cisco Identity Services Engine Administrator Guide, Release 1.3

v

Contents

Configure Inline Posture Node as RADIUS Client in Administration Node 71

Remove an Inline Posture Node from Deployment 71

Health of an Inline Posture Node 72

Remote Access VPN Use Case 72

Configure an Inline Posture Node with a VPN Device 73

Collection of Inline Posture Node Logs 74

Kclick process in Inline Posture Node 74

Setup Cisco ISE Management Access 75

PART III

Administer Cisco ISE 77

CHAPTER 5

Administrator Access Console 77

Administrator Login Browser Support 78

Administrator Lockout Following Failed Login Attempts 78

Specify Proxy Settings in Cisco ISE 78

Ports Used by the Admin Portal 79

Enable External RESTful Services APIs 79

External RESTful Services SDK 80

Specify System Time and NTP Server Settings 80

Changing the System Time Zone 81

Configure SMTP Server to Support Notifications 82

Cisco Software Patches 82

Software Patch Installation Guidelines 83

Install a Software Patch 84

Roll Back Software Patches 84

Software Patch Rollback Guidelines 85

View Patch Install and Rollback Changes 85

FIPS Mode Support 86

Securing SSH Key Exchange Using Diffie-Hellman Algorithm 86

Configure Cisco ISE to Send Secure Syslog 86

Configure Secure Syslog Remote Logging Target 87

Enable Logging Categories to Send Auditable Events to the Secure Syslog Target 87

Disable the TCP Syslog and UDP Syslog Collectors 88

Offline Maintenance 88

Cisco Identity Services Engine Administrator Guide, Release 1.3

vi

Contents

Manage Administrators and Admin Access Policies 91

CHAPTER 6

Cisco ISE Administrators 91

Privileges of a CLI Administrator Versus a Web-Based Administrator 92

Create a New Administrator 92

Cisco ISE Administrator Groups 92

Create an Admin Group 99

Administrative Access to Cisco ISE 100

Role-Based Admin Access Control in Cisco ISE 100

Role-Based Permissions 101

RBAC Policies 101

Default Menu Access Permissions 101

Configure Menu Access Permissions 102

Default Data Access Permissions 103

Configure Data Access Permissions 104

Configure Admin Access Policies 104

Administrator Access Settings 105

Configure the Maximum Number of Concurrent Administrative Sessions and Login Banners 105

Allow Administrative Access to Cisco ISE from Select IP Addresses 106

Configure a Password Policy for Administrator Accounts 106

Configure Session Timeout for Administrators 107

Terminate an Active Administrative Session 108

Change Administrator Name 108

Administrative Access to Cisco ISE Using an External Identity Store 108

External Authentication and Authorization 109

Configure Admin Access Using an External Identity Store for Authentication with Internal

Authorization 111

Cisco ISE Licenses 113

CHAPTER 7

Cisco ISE Licenses 113

License Consumption 115

View License Consumption 115

Unregistered License Consumption 116

Manage License Files 117

Cisco Identity Services Engine Administrator Guide, Release 1.3

vii

Contents

Register Licenses 117

Re-Host Licenses 118

Renew Licenses 118

Migrate and Upgrade Licenses 118

Remove Licenses 119

Manage Certificates 121

CHAPTER 8

Certificate Management in Cisco ISE 121

Certificates Enable Cisco ISE to Provide Secure Access 121

Certificate Usage 122

Certificate Matching in Cisco ISE 123

Validity of X.509 Certificates 124

Enable PKI in Cisco ISE 124

Wildcard Certificates 125

Wildcard Certificate Support in Cisco ISE 126

Wildcard Certificates for HTTPS and EAP Communication 126

Fully Qualified Domain Name in URL Redirection 127

Advantages of Using Wildcard Certificates 128

Disadvantages of Using Wildcard Certificates 128

Wildcard Certificate Compatibility 129

System Certificates 129

View System Certificates 130

Import a System Certificate 131

Generate a Self-Signed Certificate 131

Edit a System Certificate 132

Export a System Certificate 133

Trusted Certificates Store 134

Certificates in Trusted Certificates Store 135

Trusted Certificate Naming Constraint 135

View Trusted Store Certificates 136

Change the Status of a Certificate in Trusted Certificates Store 136

Add a Certificate to Trusted Certificates Store 136

Edit a Trusted Certificate 137

Export a Certificate from the Trusted Certificates Store 137

Cisco Identity Services Engine Administrator Guide, Release 1.3

viii

Contents

Import the Root Certificates to the Trusted Certificate Store 138

Certificate Chain Import 139

Certificate Signing Requests 139

Create a Certificate Signing Request and Submit the CSR to a Certificate Authority 139

Bind the CA-Signed Certificate to the CSR 140

Export a Certificate Signing Request 141

Set Up Certificates for Portal Use 141

User and Endpoint Certificate Renewal 142

Dictionary Attributes Used in Policy Conditions for Certificate Renewal 142

Authorization Policy Condition for Certificate Renewal 142

CWA Redirect to Renew Certificates 142

Configure Cisco ISE to Allow Users to Renew Certificates 142

Update the Allowed Protocol Configuration 143

Create an Authorization Policy Profile for CWA Redirection 143

Create an Authorization Policy Rule to Renew Certificates 144

Enable BYOD Settings in the Guest Portal 145

Certificate Renewal Fails for Apple iOS Devices 145

Cisco ISE CA Service 145

Simple Certificate Enrollment Protocol Profiles 146

Endpoint Certificates 146

Backup and Restore of Cisco ISE CA Certificates and Keys 146

Export Cisco ISE CA Certificates and Keys 147

Import Cisco ISE CA Certificates and Keys 148

Generate Root CA and Subordinate CAs on the Primary PAN and PSN 148

Configure Cisco ISE Root CA as Subordinate CA of an External PKI 149

Configure Cisco ISE to Use Certificates for Authenticating Personal Devices 150

Add Users to the Employee User Group 150

Create a Certificate Authentication Profile for TLS-Based Authentication 151

Create an Identity Source Sequence for TLS-Based Authentication 151

Configure Certificate Authority Settings 152

Create a CA Template 153

Create a Native Supplicant Profile to be Used in Client Provisioning Policy 154

Download Agent Resources from Cisco Site for Windows and MAC OS X Operating Systems

154

Cisco Identity Services Engine Administrator Guide, Release 1.3

ix

Contents

Create Client Provisioning Policy Rules for Apple iOS, Android, and MACOSX Devices 155

Configure the Dot1X Authentication Policy Rule for TLS-Based Authentication 155

Create Authorization Profiles for Central Web Authentication and Supplicant Provisioning Flows

156

Create Authorization Policy Rules 157

CA Service Policy Reference 157

Client Provisioning Policy Rules for Certificate Services 157

Authorization Profiles for Certificate Services 158

Authorization Policy Rules for Certificate Services 159

Revoke an Endpoint Certificate 160

OCSP Services 160

Cisco ISE CA Service Online Certificate Status Protocol Responder 161

OCSP Certificate Status Values 161

OCSP High Availability 161

OCSP Failures 162

Add OCSP Client Profiles 162

OCSP Statistics Counters 163

Manage Network Devices 165

CHAPTER 9

Define Network Devices in Cisco ISE 165

Support for Session Aware Networking (SAnet) 166

Define a Default Network Device in Cisco ISE 166

Add a Network Device in Cisco ISE 167

Import Network Devices into Cisco ISE 167

Export Network Devices from Cisco ISE 168

Network Device Groups 168

Network Device Attributes Used By Cisco ISE in Policy Evaluation 169

Import Network Device Groups in to Cisco ISE 169

Export Network Device Groups from Cisco ISE 170

Import Templates in Cisco ISE 170

Network Devices Import Template Format 170

Network Device Groups Import Template Format 174

Mobile Device Manager Interoperability with Cisco ISE 175

Supported MDM Use Cases 175

Cisco Identity Services Engine Administrator Guide, Release 1.3

x

Contents

Supported MDM Servers 176

Ports Used by the MDM Server 176

MDM Integration Process Flow 177

Set Up MDM Servers with Cisco ISE 178

Import MDM Server Certificate into Cisco ISE 178

Create Mobile Device Manager Definitions 179

Open Firewall Ports for WMI Access 180

Configure an Authorization Profile for Redirecting Nonregistered Devices 180

Configure Authorization Policy Rules for the MDM Use Cases 181

Wipe or Lock a Device 181

View Mobile Device Manager Reports 182

View Mobile Device Manager Logs 182

Manage Resources 183

CHAPTER 10

Dictionaries and Dictionary Attributes 183

System Defined Dictionaries and Dictionary Attributes 183

Display System Dictionaries and Dictionary Attributes 184

User-Defined Dictionaries and Dictionary Attributes 184

Create User-Defined Dictionaries 184

Create User-Defined Dictionary Attributes 185

RADIUS-Vendor Dictionaries 185

Create RADIUS-Vendor Dictionaries 186

Create RADIUS-Vendor Dictionary Attributes 186

Logging Mechanism 187

CHAPTER 11

Cisco Logging Mechanism 187

Configure Syslog Purge Settings 188

Cisco ISE System Logs 188

Configure Remote Syslog Collection Locations 188

Cisco ISE Message Codes 190

Set Severity Levels for Message Codes 190

Cisco ISE Message Catalogs 190

Debug Logs 191

View Logging Components for a Node 191

Cisco Identity Services Engine Administrator Guide, Release 1.3

xi

Contents

Configure Debug Log Severity Level 191

Endpoint Debug Log Collector 192

Download Debug Logs for a Specific Endpoint 192

Collection Filters 193

Configure Collection Filters 193

Event Suppression Bypass Filter 193

Backup and Restore Operations 195

CHAPTER 12

Backup Data Type 195

Backup and Restore Repositories 195

Create Repositories 196

On-Demand and Scheduled Backups 197

Perform an On-Demand Backup 197

Schedule a Backup 199

Backup Using the CLI 201

Backup History 201

Backup Failures 201

Cisco ISE Restore Operation 202

Guidelines for Data Restoration 202

Restoration of Configuration or Monitoring (Operational) Backup from the CLI 203

Restore Configuration Backups from the GUI 205

Restoration of Monitoring Database 206

Restore a Monitoring (Operational) Backup in a Standalone Environment 207

Restore a Monitoring Backup with Administration and Monitor Personas 207

Restore a Monitoring Backup with a Monitoring Persona 208

Restore History 208

Export Authentication and Authorization Policy Configuration 209

Synchronize Primary and Secondary Nodes in a Distributed Environment 209

Recovery of Lost Nodes in Standalone and Distributed Deployments 210

Recovery of Lost Nodes Using Existing IP Addresses and Hostnames in a Distributed Deployment

210

Recovery of Lost Nodes Using New IP Addresses and Hostnames in a Distributed Deployment 211

Recovery of a Node Using Existing IP Address and Hostname in a Standalone Deployment 211

Recovery of a Node Using New IP Address and Hostname in a Standalone Deployment 212

Cisco Identity Services Engine Administrator Guide, Release 1.3

xii

Contents

Configuration Rollback 212

Recovery of Primary Node in Case of Failure in a Distributed Deployment 213

Recovery of Secondary Node in Case of Failure in a Distributed Deployment 213

Setup 215

CHAPTER 13

Enable in Cisco ISE 215

Configure Network Access Settings 215

Quarantined Endpoints Do Not Renew Authentication Following Policy Change 216

217

Create Authorization Profiles for Network Access through 218

Create Exception Policies for Network Access through 218

Operations Fail when IP Address or MAC Address is not Found 219

Externally Authenticated Administrators Cannot Perform Operations 219

Quarantine and Unquarantine Flow 219

NAS Port Shutdown Flow 220

Endpoints Purge Settings 221

Manage Users and End-User Portals 223

PART IV

Manage Users and External Identity Sources 225

CHAPTER 14

Cisco ISE Users 225

User Identity 225

User Groups 225

User Identity Groups 226

User Role 226

User Account Custom Attributes 226

User Authentication Settings 226

Add Users 227

Export Cisco ISE User Data 228

Import Cisco ISE Internal Users 228

Create a User Identity Group 229

Export User Identity Groups 229

Import User Identity Groups 230

Internal and External Identity Sources 230

Cisco Identity Services Engine Administrator Guide, Release 1.3

xiii

Contents

Create an External Identity Source 231

Certificate Authentication Profiles 232

Add a Certificate Authentication Profile 232

Active Directory as an External Identity Source 233

Active Directory Supported Authentication Protocols and Features 233

Active Directory Attribute and Group Retrieval for Use in Authorization Policies 234

Active Directory Certificate Retrieval for Certificate-Based Authentication 235

Active Directory User Authentication Process Flow 235

Support for Active Directory Multidomain Forests 236

Prerequisites for Integrating Active Directory and Cisco 236

Active Directory Account Permissions Required to Perform Various Operations 237

Network Ports That Must Be Open for Communication 237

DNS Server 238

Configure Active Directory as an External Identity Source 238

Add an Active Directory Join Point and Join Cisco ISE Node to the Join Point 239

Leave the Active Directory Domain 241

Configure Authentication Domains 241

Configure Active Directory User Groups 242

Configure Active Directory User and Machine Attributes 243

Modify Password Changes, Machine Authentications, and Machine Access Restriction Settings

244

Support for Active Directory Multi-Join Configuration 244

Create a New Scope to Add Active Directory Join Points 245

Identity Rewrite 245

Enable Identity Rewrite 246

Identity Resolution Settings 247

Avoid Identity Resolution Issues 247

Configure Identity Resolution Settings 247

Test Users for Active Directory Authentication 248

Delete Active Directory Configurations 249

View Active Directory Joins for a Node 249

Diagnose Active Directory Problems 250

Enable Active Directory Debug Logs 250

Obtain the Active Directory Log File for Troubleshooting 251

Cisco Identity Services Engine Administrator Guide, Release 1.3

xiv

Contents

Active Directory Alarms and Reports 251

Active Directory Advanced Tuning 252

Supplemental Information for Setting Up Cisco ISE with Active Directory 252

Configure Group Policies in Active Directory 252

Configure Odyssey 5.X Supplicant for EAP-TLS Machine Authentications Against Active

Directory 253

AnyConnect Agent for Machine Authentication 254

ISE pxGrid Identity Mapping 254

Configure Identity Mapping 255

Filter Identity Mapping 256

LDAP 256

LDAP Directory Service 256

Multiple LDAP Instances 257

LDAP Failover 257

LDAP Connection Management 257

LDAP User Authentication 258

LDAP Group and Attribute Retrieval for Use in Authorization Policies 258

Errors Returned by the LDAP Server 260

LDAP User Lookup 261

LDAP MAC Address Lookup 261

Add LDAP Identity Sources 261

Configure Primary and Secondary LDAP Servers 262

Enable Cisco ISE to Obtain Attributes from the LDAP Server 262

Retrieve Group Membership Details from the LDAP Server 263

Retrieve User Attributes From the LDAP Server 263

Enable Secure Authentication with LDAP Identity Source 264

RADIUS Token Identity Sources 264

RADIUS Token Server Supported Authentication Protocols 265

Ports Used By the RADIUS Token Servers for Communication 265

RADIUS Shared Secret 265

Failover in RADIUS Token Servers 265

Configurable Password Prompt in RADIUS Token Servers 265

RADIUS Token Server User Authentication 266

User Attribute Cache in RADIUS Token Servers 266

Cisco Identity Services Engine Administrator Guide, Release 1.3

xv

Contents

RADIUS Identity Source in Identity Sequence 266

RADIUS Server Returns the Same Message for All Errors 266

Safeword Server Supports Special Username Format 267

Authentication Request and Response in RADIUS Token Servers 267

Add a RADIUS Token Server 268

Delete a RADIUS Token Server 269

RSA Identity Sources 269

Cisco ISE and RSA SecurID Server Integration 270

RSA Configuration in Cisco ISE 270

RSA Agent Authentication Against the RSA SecurID Server 270

RSA Identity Sources in a Distributed Cisco ISE Environment 270

RSA Server Updates in a Cisco ISE Deployment 271

Override Automatic RSA Routing 271

RSA Node Secret Reset 271

RSA Automatic Availability Reset 271

Add RSA Identity Sources 271

Import the RSA Configuration File 272

Configure the Options File for a Cisco ISE Server and Resetting SecurID and sdstatus.12 Files

273

Configure Authentication Control Options for RSA Identity Source 273

Configure RSA Prompts 274

Configure RSA Messages 274

Identity Source Sequences 274

Create Identity Source Sequences 275

Delete Identity Source Sequences 275

Identity Source Details in Reports 276

Authentications Dashlet 276

Identity Source Reports 276

Configure Guest Access 277

CHAPTER 15

Cisco ISE Guest Services 277

End-User Guest and Sponsor Portals in Distributed Environment 277

Guest and Sponsor Accounts 278

Guest Types and User Identity Groups 278

Cisco Identity Services Engine Administrator Guide, Release 1.3

xvi

Contents

Create or Edit a Guest Type 279

Disable a Guest Type 281

Schedule When to Purge Expired Guest Accounts 282

Add Custom Fields for Guest Account Creation 283

Specify Email Addresses and SMTP Servers for Email Notifications 283

Assign Guest Locations and SSIDs 283

Rules for Guest Password Policies 284

Set the Guest Password Policy and Expiration 285

Rules for Guest Username Policies 285

Set the Guest Username Policy 285

SMS Providers and Services 286

Configure SMS Gateways to Send SMS Notifications to Guests 286

Guest Portals 287

Credentials for Guest Portals 287

Guest Access with Hotspot Guest Portals 288

Guest Access with Credentialed Guest Portals 289

Employee Access with Credentialed Guest Portals 289

Guest Device Compliance 289

Guest Portals Configuration Tasks 290

Enable Policy Services 291

Add Certificates for Guest Portals 291

Create External Identity Sources 291

Create Identity Source Sequences 291

Create Endpoint Identity Groups 292

Create a Hotspot Guest Portal 293

Create a Sponsored-Guest Portal 294

Create a Self-Registered Guest Portal 294

Authorize Portals 295

Customize Guest Portals 297

Sponsor Portals 297

Managing Guest Accounts on the Sponsor Portal 297

Managing Sponsor Accounts 298

Configure Account Content for Sponsor Account Creation 302

Configure a Sponsor Portal Flow 302

Cisco Identity Services Engine Administrator Guide, Release 1.3

xvii

Contents

Enable Policy Services 303

Add Certificates for Guest Services 303

Create External Identity Sources 303

Create Identity Source Sequences 304

Create a Sponsor Portal 305

Customize Sponsor Portals 305

Configuring Account Content for Sponsor Account Creation 305

Sponsors Cannot Log In to the Sponsor Portal 306

Monitor Guest and Sponsor Activity 306

Metrics Dashboard 307

AUP Acceptance Status Report 307

Guest Accounting Report 307

Master Guest Report 307

Sponsor Login and Audit Report 307

Audit Logging for Guest and Sponsor Portals 308

Guest Access Web Authentication Options 308

NAD with Central WebAuth Process 308

Wireless LAN Controller with Local WebAuth Process 310

Wired NAD with Local WebAuth Process 311

IP Address and Port Values Required for the Login.html Page 311

HTTPS Server Enabled on the NAD 312

Support for Customized Authentication Proxy Web Pages on the NAD 312

Configure Web Authentication on the NAD 312

Device Registration WebAuth Process 313

Support Device Access 315

CHAPTER 16

Personal Devices on a Corporate Network (BYOD) 315

End-User Device Portals in a Distributed Environment 315

Global Settings for Device Portals 316

Personal Device Portals 316

Access Device Portals 317

Blacklist Portal 317

Bring Your Own Device Portal 317

Client Provisioning Portal 317

Cisco Identity Services Engine Administrator Guide, Release 1.3

xviii

Contents

Mobile Device Management Portal 318

My Devices Portal 318

BYOD Deployment Options and Status Flow 319

Limit the Number of Personal Devices Registered by Employees 321

Support Device Registration Using Native Supplicants 321

Operating Systems Supported by Native Supplicants 322

Allow Employees to Register Personal Devices Using Credentialed Guest Portals 322

Provide a URL to Reconnect with BYOD Registration 322

Device Portals Configuration Tasks 323

Enable Policy Services 324

Add Certificates to the Device Portal 324

Create External Identity Sources 325

Create Identity Source Sequences 325

Create Endpoint Identity Groups 326

Edit the Blacklist Portal 327

Create a BYOD Portal 328

Create a Client Provisioning Portal 330

Create an MDM Portal 331

Create a My Devices Portal 332

Create Authorization Profiles 333

Create Authorization Profiles 334

Create Authorization Policy Rules 334

Customize Device Portals 335

Manage Personal Devices Added by Employees 335

Display Devices Added by an Employee 335

Errors When Adding Devices to My Devices Portal 336

Devices Deleted from My Devices Portal Remain in Endpoints Database 336

Limit the Number of Personal Devices Registered by Employees 336

Monitor My Devices Portals and Endpoints Activity 336

My Devices Login and Audit Report 337

Registered Endpoints Report 337

Customize End-User Web Portals 339

CHAPTER 17

End-User Portals 339

Cisco Identity Services Engine Administrator Guide, Release 1.3

xix

Contents

Customization of End-User Web Portals 339

Portal Content Types 342

Basic Customization of Portals 343

Modify the Portal Theme Colors 343

Change the Portal Display Language 344

Change the Portal Icons, Images, and Logos 344

Update the Portal Banner and Footer Elements 345

Change the Titles, Instructions, Buttons, and Label Text 346

Format and Style Text Box Content 346

Variables for Portal Pages Customization 347

View Your Customization 350

Advanced Customization of Portals 350

Enable Advanced Portal Customization 351

Portal Theme and Structure CSS Files 351

About Changing Theme Colors with jQuery Mobile 352

Change Theme Colors with jQuery Mobile 353

Location Based Customization 354

User Device Type Based Customization 355

Export a Portal’s Default Theme CSS File 355

Create a Custom Portal Theme CSS File 356

Embed Links in Portal Content 356

Insert Variables for Dynamic Text Updates 357

Use Source Code to Format Text and Include Links 358

Add an Image as an Advertisement 359

Set Up Carousel Advertising 360

Customize Greetings Based on Guest Location 362

Customize Greetings Based on User Device Type 363

Modify the Portal Page Layout 364

Import the Custom Portal Theme CSS File 366

Delete a Custom Portal Theme 367

View Your Customization 367

Portal Language Customization 368

Export the Language File 369

Add or Delete Languages from the Language File 370

Cisco Identity Services Engine Administrator Guide, Release 1.3

xx

Contents

Page is loading ...

Cisco Identity Services Engine User guide

Cisco Identity Services Engine User guide

Related papers

Other documents