Page is loading ...
Cisco Identity Services Engine Administrator Guide, Release 1.3
First Published: 2014-10-31
Last Modified: 2014-10-31
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
CONTENTS
Preface xliii
PREFACE
Purpose xliii
Audience xliii
Document Organization xliii
Document Conventions xliv
Documentation Updates xlv
Obtaining Documentation and Submitting a Service Request xlv
Introduction 47
PART I
Cisco ISE Features 1
CHAPTER 1
Cisco ISE Overview 1
Key Functions 1
Identity-Based Network Access 2
Support for Multiple Deployment Scenarios 2
Support for UCS Hardware 3
Basic User Authentication and Authorization 3
Policy Sets 4
Support for Common Access Card Functions 4
Client Posture Assessment 5
Mobile Device Manager Interoperability with Cisco ISE 5
Wireless and VPN Traffic with Inline Posture Nodes 5
Profiled Endpoints on the Network 6
pxGrid Persona 6
Cisco ISE Certificate Authority 6
Cisco Identity Services Engine Administrator Guide, Release 1.3
ii
Contents
Support for Active Directory Multidomain Forests 6
Support for Installation on Multiple Hardware and VMware Platforms 6
Navigate the Admin portal 7
CHAPTER 2
Admin Portal 7
Cisco ISE Dashboard 9
Setup Assistant 10
Cisco ISE Licensing Impact on Setup Assistant 10
Run the Setup Assistant 11
Setup Assistant Overwrites Previous Configurations 11
Identify Policy Requirements Page in Setup Assistant 11
Configure Network Access Service Page in Setup Assistant 12
Select Network Device Types Page in Setup Assistant 14
Review and Confirm Your Choices Page in Setup Assistant 14
Filter Data on Listing Pages 15
Data Filters in Listing Pages 15
Customize the Displayed Field Attributes 15
Filter Data by Field Attributes Using the Quick Filter 15
Filter Data by Conditions Using the Advanced Filter 16
Create Custom Filters 16
Cisco ISE Internationalization and Localization 17
Supported Languages 17
Support for UTF-8 Character Data Entry 17
UTF-8 Credential Authentication 18
UTF-8 Policies and Posture Assessment 18
Cisco NAC and MAC Agent UTF-8 Support 18
UTF-8 Support for Messages Sent to Supplicant 18
Reports and Alerts UTF-8 Support 19
UTF-8 Character Support in the Portals 19
UTF-8 Support Outside the User Interface 22
Support for Importing and Exporting UTF-8 Values 22
UTF-8 Support on REST 22
UTF-8 Support for Identity Stores Authorization Data 23
MAC Address Normalization 23
Cisco Identity Services Engine Administrator Guide, Release 1.3
iii
Contents
Deploy Cisco ISE Nodes 25
PART II
Set Up Cisco ISE in a Distributed Environment 27
CHAPTER 3
Cisco ISE Deployment Terminology 27
Personas in Distributed Cisco ISE Deployments 28
Cisco ISE Distributed Deployment 28
Cisco ISE Deployment Setup 28
Data Replication from Primary to Secondary ISE Nodes 29
Cisco ISE Node Deregistration 29
Guidelines for Setting Up a Distributed Deployment 29
Menu Options Available on Primary and Secondary Nodes 30
Configure a Cisco ISE Node 31
Configure a Primary PAN 32
Install Trusted Certificates for Cisco ISE Inter-node Communication 32
Register a Secondary Cisco ISE Node 33
Administration Node 35
High Availability for the Administrative Node 35
Manually Promote Secondary PAN To Primary 35
Monitoring Node 36
Manually Modify MnT Role 36
Automatic Failover in Monitoring Nodes 36
pxGrid Node 38
pxGrid Client and Capability Management 39
Enable pxGrid Service 39
Deploy pxGrid Node 39
Cisco pxGrid Live Logs 40
ISE pxGrid Identity Mapping 40
Configure Identity Mapping 41
Filter Identity Mapping 42
Inline Posture Node 42
Inline Posture Node Installation 43
Register an Inline Posture Node 43
View Nodes in a Deployment 44
Cisco Identity Services Engine Administrator Guide, Release 1.3
iv
Contents
Synchronize Primary and Secondary Cisco ISE Nodes 44
Change Node Personas and Services 44
Effects of Modifying Nodes in Cisco ISE 45
Create a Policy Service Node Group 45
Configure Monitoring Nodes for Automatic Failover 46
Remove a Node from Deployment 47
Shut Down an ISE Node 48
Change the Hostname or IP Address of a Standalone Cisco ISE Node 48
Replace the Cisco ISE Appliance Hardware 49
Set Up Inline Posture 51
CHAPTER 4
Role of Inline Posture Node in a Cisco ISE Deployment 51
Inline Posture Policy Enforcement 51
Inline Posture Policy Enforcement Flow 52
Trusted and Untrusted Interfaces 54
Dedicated Nodes Required for Inline Posture 54
Standalone Inline Posture Node in a Cisco ISE Deployment 54
Inline Posture High Availability 54
Automatic Failover in Inline Posture Nodes 55
Inline Posture Operating Modes 55
Inline Posture Routed Mode 56
Inline Posture Bridged Mode 57
Inline Posture Maintenance Mode 57
Inline Posture High Availability in Routed and Bridged Modes 58
Best Practices for Inline Posture Deployment 58
Inline Posture Node Guidelines 60
Inline Posture Node Authorization 61
Deploy an Inline Posture Node 63
Configure an Inline Posture Node 63
Create Inline Posture Downloadable Access Control Lists 66
Create Inline Posture Node Profiles 67
Create an Inline Posture Authorization Policy 68
Configure a High-Availability Pair 69
Synchronize an Inline Posture Node 70
Cisco Identity Services Engine Administrator Guide, Release 1.3
v
Contents
Configure Inline Posture Node as RADIUS Client in Administration Node 71
Remove an Inline Posture Node from Deployment 71
Health of an Inline Posture Node 72
Remote Access VPN Use Case 72
Configure an Inline Posture Node with a VPN Device 73
Collection of Inline Posture Node Logs 74
Kclick process in Inline Posture Node 74
Setup Cisco ISE Management Access 75
PART III
Administer Cisco ISE 77
CHAPTER 5
Administrator Access Console 77
Administrator Login Browser Support 78
Administrator Lockout Following Failed Login Attempts 78
Specify Proxy Settings in Cisco ISE 78
Ports Used by the Admin Portal 79
Enable External RESTful Services APIs 79
External RESTful Services SDK 80
Specify System Time and NTP Server Settings 80
Changing the System Time Zone 81
Configure SMTP Server to Support Notifications 82
Cisco Software Patches 82
Software Patch Installation Guidelines 83
Install a Software Patch 84
Roll Back Software Patches 84
Software Patch Rollback Guidelines 85
View Patch Install and Rollback Changes 85
FIPS Mode Support 86
Securing SSH Key Exchange Using Diffie-Hellman Algorithm 86
Configure Cisco ISE to Send Secure Syslog 86
Configure Secure Syslog Remote Logging Target 87
Enable Logging Categories to Send Auditable Events to the Secure Syslog Target 87
Disable the TCP Syslog and UDP Syslog Collectors 88
Offline Maintenance 88
Cisco Identity Services Engine Administrator Guide, Release 1.3
vi
Contents
Manage Administrators and Admin Access Policies 91
CHAPTER 6
Cisco ISE Administrators 91
Privileges of a CLI Administrator Versus a Web-Based Administrator 92
Create a New Administrator 92
Cisco ISE Administrator Groups 92
Create an Admin Group 99
Administrative Access to Cisco ISE 100
Role-Based Admin Access Control in Cisco ISE 100
Role-Based Permissions 101
RBAC Policies 101
Default Menu Access Permissions 101
Configure Menu Access Permissions 102
Default Data Access Permissions 103
Configure Data Access Permissions 104
Configure Admin Access Policies 104
Administrator Access Settings 105
Configure the Maximum Number of Concurrent Administrative Sessions and Login Banners 105
Allow Administrative Access to Cisco ISE from Select IP Addresses 106
Configure a Password Policy for Administrator Accounts 106
Configure Session Timeout for Administrators 107
Terminate an Active Administrative Session 108
Change Administrator Name 108
Administrative Access to Cisco ISE Using an External Identity Store 108
External Authentication and Authorization 109
Configure Admin Access Using an External Identity Store for Authentication with Internal
Authorization 111
Cisco ISE Licenses 113
CHAPTER 7
Cisco ISE Licenses 113
License Consumption 115
View License Consumption 115
Unregistered License Consumption 116
Manage License Files 117
Cisco Identity Services Engine Administrator Guide, Release 1.3
vii
Contents
Register Licenses 117
Re-Host Licenses 118
Renew Licenses 118
Migrate and Upgrade Licenses 118
Remove Licenses 119
Manage Certificates 121
CHAPTER 8
Certificate Management in Cisco ISE 121
Certificates Enable Cisco ISE to Provide Secure Access 121
Certificate Usage 122
Certificate Matching in Cisco ISE 123
Validity of X.509 Certificates 124
Enable PKI in Cisco ISE 124
Wildcard Certificates 125
Wildcard Certificate Support in Cisco ISE 126
Wildcard Certificates for HTTPS and EAP Communication 126
Fully Qualified Domain Name in URL Redirection 127
Advantages of Using Wildcard Certificates 128
Disadvantages of Using Wildcard Certificates 128
Wildcard Certificate Compatibility 129
System Certificates 129
View System Certificates 130
Import a System Certificate 131
Generate a Self-Signed Certificate 131
Edit a System Certificate 132
Export a System Certificate 133
Trusted Certificates Store 134
Certificates in Trusted Certificates Store 135
Trusted Certificate Naming Constraint 135
View Trusted Store Certificates 136
Change the Status of a Certificate in Trusted Certificates Store 136
Add a Certificate to Trusted Certificates Store 136
Edit a Trusted Certificate 137
Export a Certificate from the Trusted Certificates Store 137
Cisco Identity Services Engine Administrator Guide, Release 1.3
viii
Contents
Import the Root Certificates to the Trusted Certificate Store 138
Certificate Chain Import 139
Certificate Signing Requests 139
Create a Certificate Signing Request and Submit the CSR to a Certificate Authority 139
Bind the CA-Signed Certificate to the CSR 140
Export a Certificate Signing Request 141
Set Up Certificates for Portal Use 141
User and Endpoint Certificate Renewal 142
Dictionary Attributes Used in Policy Conditions for Certificate Renewal 142
Authorization Policy Condition for Certificate Renewal 142
CWA Redirect to Renew Certificates 142
Configure Cisco ISE to Allow Users to Renew Certificates 142
Update the Allowed Protocol Configuration 143
Create an Authorization Policy Profile for CWA Redirection 143
Create an Authorization Policy Rule to Renew Certificates 144
Enable BYOD Settings in the Guest Portal 145
Certificate Renewal Fails for Apple iOS Devices 145
Cisco ISE CA Service 145
Simple Certificate Enrollment Protocol Profiles 146
Endpoint Certificates 146
Backup and Restore of Cisco ISE CA Certificates and Keys 146
Export Cisco ISE CA Certificates and Keys 147
Import Cisco ISE CA Certificates and Keys 148
Generate Root CA and Subordinate CAs on the Primary PAN and PSN 148
Configure Cisco ISE Root CA as Subordinate CA of an External PKI 149
Configure Cisco ISE to Use Certificates for Authenticating Personal Devices 150
Add Users to the Employee User Group 150
Create a Certificate Authentication Profile for TLS-Based Authentication 151
Create an Identity Source Sequence for TLS-Based Authentication 151
Configure Certificate Authority Settings 152
Create a CA Template 153
Create a Native Supplicant Profile to be Used in Client Provisioning Policy 154
Download Agent Resources from Cisco Site for Windows and MAC OS X Operating Systems
154
Cisco Identity Services Engine Administrator Guide, Release 1.3
ix
Contents
Create Client Provisioning Policy Rules for Apple iOS, Android, and MACOSX Devices 155
Configure the Dot1X Authentication Policy Rule for TLS-Based Authentication 155
Create Authorization Profiles for Central Web Authentication and Supplicant Provisioning Flows
156
Create Authorization Policy Rules 157
CA Service Policy Reference 157
Client Provisioning Policy Rules for Certificate Services 157
Authorization Profiles for Certificate Services 158
Authorization Policy Rules for Certificate Services 159
Revoke an Endpoint Certificate 160
OCSP Services 160
Cisco ISE CA Service Online Certificate Status Protocol Responder 161
OCSP Certificate Status Values 161
OCSP High Availability 161
OCSP Failures 162
Add OCSP Client Profiles 162
OCSP Statistics Counters 163
Manage Network Devices 165
CHAPTER 9
Define Network Devices in Cisco ISE 165
Support for Session Aware Networking (SAnet) 166
Define a Default Network Device in Cisco ISE 166
Add a Network Device in Cisco ISE 167
Import Network Devices into Cisco ISE 167
Export Network Devices from Cisco ISE 168
Network Device Groups 168
Network Device Attributes Used By Cisco ISE in Policy Evaluation 169
Import Network Device Groups in to Cisco ISE 169
Export Network Device Groups from Cisco ISE 170
Import Templates in Cisco ISE 170
Network Devices Import Template Format 170
Network Device Groups Import Template Format 174
Mobile Device Manager Interoperability with Cisco ISE 175
Supported MDM Use Cases 175
Cisco Identity Services Engine Administrator Guide, Release 1.3
x
Contents
Supported MDM Servers 176
Ports Used by the MDM Server 176
MDM Integration Process Flow 177
Set Up MDM Servers with Cisco ISE 178
Import MDM Server Certificate into Cisco ISE 178
Create Mobile Device Manager Definitions 179
Open Firewall Ports for WMI Access 180
Configure an Authorization Profile for Redirecting Nonregistered Devices 180
Configure Authorization Policy Rules for the MDM Use Cases 181
Wipe or Lock a Device 181
View Mobile Device Manager Reports 182
View Mobile Device Manager Logs 182
Manage Resources 183
CHAPTER 10
Dictionaries and Dictionary Attributes 183
System Defined Dictionaries and Dictionary Attributes 183
Display System Dictionaries and Dictionary Attributes 184
User-Defined Dictionaries and Dictionary Attributes 184
Create User-Defined Dictionaries 184
Create User-Defined Dictionary Attributes 185
RADIUS-Vendor Dictionaries 185
Create RADIUS-Vendor Dictionaries 186
Create RADIUS-Vendor Dictionary Attributes 186
Logging Mechanism 187
CHAPTER 11
Cisco Logging Mechanism 187
Configure Syslog Purge Settings 188
Cisco ISE System Logs 188
Configure Remote Syslog Collection Locations 188
Cisco ISE Message Codes 190
Set Severity Levels for Message Codes 190
Cisco ISE Message Catalogs 190
Debug Logs 191
View Logging Components for a Node 191
Cisco Identity Services Engine Administrator Guide, Release 1.3
xi
Contents
Configure Debug Log Severity Level 191
Endpoint Debug Log Collector 192
Download Debug Logs for a Specific Endpoint 192
Collection Filters 193
Configure Collection Filters 193
Event Suppression Bypass Filter 193
Backup and Restore Operations 195
CHAPTER 12
Backup Data Type 195
Backup and Restore Repositories 195
Create Repositories 196
On-Demand and Scheduled Backups 197
Perform an On-Demand Backup 197
Schedule a Backup 199
Backup Using the CLI 201
Backup History 201
Backup Failures 201
Cisco ISE Restore Operation 202
Guidelines for Data Restoration 202
Restoration of Configuration or Monitoring (Operational) Backup from the CLI 203
Restore Configuration Backups from the GUI 205
Restoration of Monitoring Database 206
Restore a Monitoring (Operational) Backup in a Standalone Environment 207
Restore a Monitoring Backup with Administration and Monitor Personas 207
Restore a Monitoring Backup with a Monitoring Persona 208
Restore History 208
Export Authentication and Authorization Policy Configuration 209
Synchronize Primary and Secondary Nodes in a Distributed Environment 209
Recovery of Lost Nodes in Standalone and Distributed Deployments 210
Recovery of Lost Nodes Using Existing IP Addresses and Hostnames in a Distributed Deployment
210
Recovery of Lost Nodes Using New IP Addresses and Hostnames in a Distributed Deployment 211
Recovery of a Node Using Existing IP Address and Hostname in a Standalone Deployment 211
Recovery of a Node Using New IP Address and Hostname in a Standalone Deployment 212
Cisco Identity Services Engine Administrator Guide, Release 1.3
xii
Contents
Configuration Rollback 212
Recovery of Primary Node in Case of Failure in a Distributed Deployment 213
Recovery of Secondary Node in Case of Failure in a Distributed Deployment 213
Setup 215
CHAPTER 13
Enable in Cisco ISE 215
Configure Network Access Settings 215
Quarantined Endpoints Do Not Renew Authentication Following Policy Change 216
217
Create Authorization Profiles for Network Access through 218
Create Exception Policies for Network Access through 218
Operations Fail when IP Address or MAC Address is not Found 219
Externally Authenticated Administrators Cannot Perform Operations 219
Quarantine and Unquarantine Flow 219
NAS Port Shutdown Flow 220
Endpoints Purge Settings 221
Manage Users and End-User Portals 223
PART IV
Manage Users and External Identity Sources 225
CHAPTER 14
Cisco ISE Users 225
User Identity 225
User Groups 225
User Identity Groups 226
User Role 226
User Account Custom Attributes 226
User Authentication Settings 226
Add Users 227
Export Cisco ISE User Data 228
Import Cisco ISE Internal Users 228
Create a User Identity Group 229
Export User Identity Groups 229
Import User Identity Groups 230
Internal and External Identity Sources 230
Cisco Identity Services Engine Administrator Guide, Release 1.3
xiii
Contents
Create an External Identity Source 231
Certificate Authentication Profiles 232
Add a Certificate Authentication Profile 232
Active Directory as an External Identity Source 233
Active Directory Supported Authentication Protocols and Features 233
Active Directory Attribute and Group Retrieval for Use in Authorization Policies 234
Active Directory Certificate Retrieval for Certificate-Based Authentication 235
Active Directory User Authentication Process Flow 235
Support for Active Directory Multidomain Forests 236
Prerequisites for Integrating Active Directory and Cisco 236
Active Directory Account Permissions Required to Perform Various Operations 237
Network Ports That Must Be Open for Communication 237
DNS Server 238
Configure Active Directory as an External Identity Source 238
Add an Active Directory Join Point and Join Cisco ISE Node to the Join Point 239
Leave the Active Directory Domain 241
Configure Authentication Domains 241
Configure Active Directory User Groups 242
Configure Active Directory User and Machine Attributes 243
Modify Password Changes, Machine Authentications, and Machine Access Restriction Settings
244
Support for Active Directory Multi-Join Configuration 244
Create a New Scope to Add Active Directory Join Points 245
Identity Rewrite 245
Enable Identity Rewrite 246
Identity Resolution Settings 247
Avoid Identity Resolution Issues 247
Configure Identity Resolution Settings 247
Test Users for Active Directory Authentication 248
Delete Active Directory Configurations 249
View Active Directory Joins for a Node 249
Diagnose Active Directory Problems 250
Enable Active Directory Debug Logs 250
Obtain the Active Directory Log File for Troubleshooting 251
Cisco Identity Services Engine Administrator Guide, Release 1.3
xiv
Contents
Active Directory Alarms and Reports 251
Active Directory Advanced Tuning 252
Supplemental Information for Setting Up Cisco ISE with Active Directory 252
Configure Group Policies in Active Directory 252
Configure Odyssey 5.X Supplicant for EAP-TLS Machine Authentications Against Active
Directory 253
AnyConnect Agent for Machine Authentication 254
ISE pxGrid Identity Mapping 254
Configure Identity Mapping 255
Filter Identity Mapping 256
LDAP 256
LDAP Directory Service 256
Multiple LDAP Instances 257
LDAP Failover 257
LDAP Connection Management 257
LDAP User Authentication 258
LDAP Group and Attribute Retrieval for Use in Authorization Policies 258
Errors Returned by the LDAP Server 260
LDAP User Lookup 261
LDAP MAC Address Lookup 261
Add LDAP Identity Sources 261
Configure Primary and Secondary LDAP Servers 262
Enable Cisco ISE to Obtain Attributes from the LDAP Server 262
Retrieve Group Membership Details from the LDAP Server 263
Retrieve User Attributes From the LDAP Server 263
Enable Secure Authentication with LDAP Identity Source 264
RADIUS Token Identity Sources 264
RADIUS Token Server Supported Authentication Protocols 265
Ports Used By the RADIUS Token Servers for Communication 265
RADIUS Shared Secret 265
Failover in RADIUS Token Servers 265
Configurable Password Prompt in RADIUS Token Servers 265
RADIUS Token Server User Authentication 266
User Attribute Cache in RADIUS Token Servers 266
Cisco Identity Services Engine Administrator Guide, Release 1.3
xv
Contents
RADIUS Identity Source in Identity Sequence 266
RADIUS Server Returns the Same Message for All Errors 266
Safeword Server Supports Special Username Format 267
Authentication Request and Response in RADIUS Token Servers 267
Add a RADIUS Token Server 268
Delete a RADIUS Token Server 269
RSA Identity Sources 269
Cisco ISE and RSA SecurID Server Integration 270
RSA Configuration in Cisco ISE 270
RSA Agent Authentication Against the RSA SecurID Server 270
RSA Identity Sources in a Distributed Cisco ISE Environment 270
RSA Server Updates in a Cisco ISE Deployment 271
Override Automatic RSA Routing 271
RSA Node Secret Reset 271
RSA Automatic Availability Reset 271
Add RSA Identity Sources 271
Import the RSA Configuration File 272
Configure the Options File for a Cisco ISE Server and Resetting SecurID and sdstatus.12 Files
273
Configure Authentication Control Options for RSA Identity Source 273
Configure RSA Prompts 274
Configure RSA Messages 274
Identity Source Sequences 274
Create Identity Source Sequences 275
Delete Identity Source Sequences 275
Identity Source Details in Reports 276
Authentications Dashlet 276
Identity Source Reports 276
Configure Guest Access 277
CHAPTER 15
Cisco ISE Guest Services 277
End-User Guest and Sponsor Portals in Distributed Environment 277
Guest and Sponsor Accounts 278
Guest Types and User Identity Groups 278
Cisco Identity Services Engine Administrator Guide, Release 1.3
xvi
Contents
Create or Edit a Guest Type 279
Disable a Guest Type 281
Schedule When to Purge Expired Guest Accounts 282
Add Custom Fields for Guest Account Creation 283
Specify Email Addresses and SMTP Servers for Email Notifications 283
Assign Guest Locations and SSIDs 283
Rules for Guest Password Policies 284
Set the Guest Password Policy and Expiration 285
Rules for Guest Username Policies 285
Set the Guest Username Policy 285
SMS Providers and Services 286
Configure SMS Gateways to Send SMS Notifications to Guests 286
Guest Portals 287
Credentials for Guest Portals 287
Guest Access with Hotspot Guest Portals 288
Guest Access with Credentialed Guest Portals 289
Employee Access with Credentialed Guest Portals 289
Guest Device Compliance 289
Guest Portals Configuration Tasks 290
Enable Policy Services 291
Add Certificates for Guest Portals 291
Create External Identity Sources 291
Create Identity Source Sequences 291
Create Endpoint Identity Groups 292
Create a Hotspot Guest Portal 293
Create a Sponsored-Guest Portal 294
Create a Self-Registered Guest Portal 294
Authorize Portals 295
Customize Guest Portals 297
Sponsor Portals 297
Managing Guest Accounts on the Sponsor Portal 297
Managing Sponsor Accounts 298
Configure Account Content for Sponsor Account Creation 302
Configure a Sponsor Portal Flow 302
Cisco Identity Services Engine Administrator Guide, Release 1.3
xvii
Contents
Enable Policy Services 303
Add Certificates for Guest Services 303
Create External Identity Sources 303
Create Identity Source Sequences 304
Create a Sponsor Portal 305
Customize Sponsor Portals 305
Configuring Account Content for Sponsor Account Creation 305
Sponsors Cannot Log In to the Sponsor Portal 306
Monitor Guest and Sponsor Activity 306
Metrics Dashboard 307
AUP Acceptance Status Report 307
Guest Accounting Report 307
Master Guest Report 307
Sponsor Login and Audit Report 307
Audit Logging for Guest and Sponsor Portals 308
Guest Access Web Authentication Options 308
NAD with Central WebAuth Process 308
Wireless LAN Controller with Local WebAuth Process 310
Wired NAD with Local WebAuth Process 311
IP Address and Port Values Required for the Login.html Page 311
HTTPS Server Enabled on the NAD 312
Support for Customized Authentication Proxy Web Pages on the NAD 312
Configure Web Authentication on the NAD 312
Device Registration WebAuth Process 313
Support Device Access 315
CHAPTER 16
Personal Devices on a Corporate Network (BYOD) 315
End-User Device Portals in a Distributed Environment 315
Global Settings for Device Portals 316
Personal Device Portals 316
Access Device Portals 317
Blacklist Portal 317
Bring Your Own Device Portal 317
Client Provisioning Portal 317
Cisco Identity Services Engine Administrator Guide, Release 1.3
xviii
Contents
Mobile Device Management Portal 318
My Devices Portal 318
BYOD Deployment Options and Status Flow 319
Limit the Number of Personal Devices Registered by Employees 321
Support Device Registration Using Native Supplicants 321
Operating Systems Supported by Native Supplicants 322
Allow Employees to Register Personal Devices Using Credentialed Guest Portals 322
Provide a URL to Reconnect with BYOD Registration 322
Device Portals Configuration Tasks 323
Enable Policy Services 324
Add Certificates to the Device Portal 324
Create External Identity Sources 325
Create Identity Source Sequences 325
Create Endpoint Identity Groups 326
Edit the Blacklist Portal 327
Create a BYOD Portal 328
Create a Client Provisioning Portal 330
Create an MDM Portal 331
Create a My Devices Portal 332
Create Authorization Profiles 333
Create Authorization Profiles 334
Create Authorization Policy Rules 334
Customize Device Portals 335
Manage Personal Devices Added by Employees 335
Display Devices Added by an Employee 335
Errors When Adding Devices to My Devices Portal 336
Devices Deleted from My Devices Portal Remain in Endpoints Database 336
Limit the Number of Personal Devices Registered by Employees 336
Monitor My Devices Portals and Endpoints Activity 336
My Devices Login and Audit Report 337
Registered Endpoints Report 337
Customize End-User Web Portals 339
CHAPTER 17
End-User Portals 339
Cisco Identity Services Engine Administrator Guide, Release 1.3
xix
Contents
Customization of End-User Web Portals 339
Portal Content Types 342
Basic Customization of Portals 343
Modify the Portal Theme Colors 343
Change the Portal Display Language 344
Change the Portal Icons, Images, and Logos 344
Update the Portal Banner and Footer Elements 345
Change the Titles, Instructions, Buttons, and Label Text 346
Format and Style Text Box Content 346
Variables for Portal Pages Customization 347
View Your Customization 350
Advanced Customization of Portals 350
Enable Advanced Portal Customization 351
Portal Theme and Structure CSS Files 351
About Changing Theme Colors with jQuery Mobile 352
Change Theme Colors with jQuery Mobile 353
Location Based Customization 354
User Device Type Based Customization 355
Export a Portal’s Default Theme CSS File 355
Create a Custom Portal Theme CSS File 356
Embed Links in Portal Content 356
Insert Variables for Dynamic Text Updates 357
Use Source Code to Format Text and Include Links 358
Add an Image as an Advertisement 359
Set Up Carousel Advertising 360
Customize Greetings Based on Guest Location 362
Customize Greetings Based on User Device Type 363
Modify the Portal Page Layout 364
Import the Custom Portal Theme CSS File 366
Delete a Custom Portal Theme 367
View Your Customization 367
Portal Language Customization 368
Export the Language File 369
Add or Delete Languages from the Language File 370
Cisco Identity Services Engine Administrator Guide, Release 1.3
xx
Contents
/