Cisco Identity Services Engine User guide

Cisco Identity Services Engine Administrator Guide, Release 2.6

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

CONTENTS

Overview 1

CHAPTER 1

Cisco ISE Overview 1

Cisco ISE Features 2

Cisco ISE Administrators 3

Force CLI Administrator to Use External Identity Store 3

Create a New Administrator 4

Cisco ISE Administrator Groups 5

Create an Admin Group 15

Administrative Access to Cisco ISE 16

Role-Based Admin Access Control in Cisco ISE 17

Role-Based Permissions 17

RBAC Policies 17

Default Menu Access Permissions 18

Conﬁgure Menu Access Permissions 18

Prerequisites for Granting Data Access Permissions 19

Default Data Access Permissions 19

Conﬁgure Data Access Permissions 21

Read-Only Admin Policy 21

Customize Menu Access for the Read-Only Administrator 21

Licensing 23

CHAPTER 2

Cisco ISE Licenses 23

Cisco ISE Smart Licensing 24

Activate and Register Smart Licensing in Cisco ISE 25

Smart Licensing for Air-Gapped Networks 27

Conﬁgure Smart Software Manager On-Prem for Smart Licensing 27

Cisco Identity Services Engine Administrator Guide, Release 2.6

iii

Manage Smart Licensing in Cisco ISE 28

Manage Traditional License Files 29

Cisco ISE Licensing Model 29

Traditional License Consumption 34

View License Consumption 35

Unregistered License Consumption 35

Manage License Files 36

Register Licenses 36

Re-Host Licenses 37

Renew Licenses 37

Migrate and Upgrade Licenses 37

Remove Licenses 38

Deployment 39

CHAPTER 3

Cisco ISE Deployment Terminology 39

Personas in Distributed Cisco ISE Deployments 40

Conﬁgure a Cisco ISE Node 40

Conﬁgure a Primary Policy Administration Node (PAN) 41

Register a Secondary Cisco ISE Node 41

Support for Multiple Deployment Scenarios 43

Cisco ISE Distributed Deployment 43

Cisco ISE Deployment Setup 43

Data Replication from Primary to Secondary ISE Nodes 43

Cisco ISE Node Deregistration 44

Guidelines for Setting Up a Distributed Deployment 44

Menu Options Available on Primary and Secondary Nodes 45

Deployment and Node Settings 46

Deployment Nodes List Window 47

General Node Settings 48

Proﬁling Node Settings 54

Logging Settings 56

Remote Logging Target Settings 56

Conﬁgure Logging Categories 58

Admin Access Settings 59

Cisco Identity Services Engine Administrator Guide, Release 2.6

iv

Contents

Administrator Password Policy Settings 60

Session Timeout and Session Information Settings 63

Administration Node 63

High Availability for the Administrative Node 63

High-Availability Health Check Nodes 65

Health Check Nodes 65

Automatic Failover to the Secondary PAN 66

Sample Scenarios when Automatic Failover is Avoided 67

Functionalities Affected by the PAN Automatic Failover Feature 67

Conﬁgure Primary PAN for Automatic Failover 69

Manually Promote Secondary PAN to Primary 70

Reusing a Node of an Existing Cisco ISE Deployment as a Primary PAN for a New Cisco ISE

Deployment 71

Restoring Service to the Primary PAN 71

Support for Automatic Failover for the Administration Node 71

Policy Service Node 71

High Availability in Policy Service Nodes 72

Load Balancer to Distribute Requests Evenly Among PSNs 72

Session Failover in Policy Service Nodes 72

Number of Nodes in a Policy Service Node Group 73

Light Session Directory 73

Monitoring Node 74

Manually Modify the MnT Role 74

Syslog over Cisco ISE Messaging Service 75

Automatic Failover in MnT Nodes 76

Monitoring Database 77

Back Up and Restore the Monitoring Database 78

Monitoring Database Purge 78

Guidelines for Purging the Monitoring Database 78

Operational Data Purging 78

Purge Older Operational Data 79

Conﬁgure MnT Nodes for Automatic Failover 80

Cisco pxGrid Node 81

Cisco pxGrid Client and Capability Management 82

Cisco Identity Services Engine Administrator Guide, Release 2.6

v

Contents

Enable pxGrid Service 83

Enable pxGrid Capabilities 83

Deploy Cisco pxGrid Node 83

Cisco pxGrid Live Logs 84

Conﬁgure Cisco pxGrid Settings 84

Generate Cisco pxGrid Certiﬁcate 85

Control Permissions for Cisco pxGrid Clients 86

View Nodes in a Deployment 87

Download Endpoint Statistical Data from MnT Nodes 88

Database Crash or File Corruption Issues 88

Device Conﬁguration for Monitoring 89

Synchronize Primary and Secondary Cisco ISE Nodes 89

Change Node Personas and Services 89

Effects of Modifying Nodes in Cisco ISE 90

Create a Policy Service Node Group 90

Remove a Node from Deployment 91

Shut Down a Cisco ISE Node 92

Sample Scenarios Where You Need to Reregister a Node 92

Change the Hostname or IP Address of a Standalone Cisco ISE Node 94

Basic Setup 95

CHAPTER 4

Administration Portal 95

Cisco ISE Home Dashboards 99

Conﬁguring Home Dashboards 100

Context Visibility Views 100

Attributes in Context Visibility 102

The Application Dashboard 103

The Hardware Dashboard 105

Dashlets 107

Filtering Displayed Data in a View 108

Create Custom Filters 110

Filter Data by Conditions Using the Advanced Filter 110

Filter Data by Field Attributes Using the Quick Filter 111

Endpoint Actions in Dashlet Views 111

Cisco Identity Services Engine Administrator Guide, Release 2.6

vi

Contents

Cisco ISE Dashboard 112

Cisco ISE Internationalization and Localization 114

Supported Languages 114

End-User Web Portal Localization 115

Support for UTF-8 Character Data Entry 115

UTF-8 Credential Authentication 116

UTF-8 Policies and Posture Assessment 116

UTF-8 Support for Messages Sent to Supplicant 116

Reports and Alerts UTF-8 Support 116

UTF-8 Character Support in the Portals 117

UTF-8 Support Outside the Cisco ISE User Interface 120

Support for Importing and Exporting UTF-8 Values 120

UTF-8 Support on REST 120

UTF-8 Support for Identity Stores Authorization Data 121

MAC Address Normalization 121

Cisco ISE Deployment Upgrade 121

Administrator Access Console 122

Administrator Login Browser Support 122

Administrator Lockout Due to Failed Login Attempts 122

Conﬁgure Proxy Settings in Cisco ISE 123

Ports Used by the Administration Portal 123

Enable External RESTful Services Application Programming Interface 124

Enable External AD Access for External RESTful Services Application Programming Interface 125

External RESTful Services Software Development Kit 126

Specify System Time and Network Time Protocol Server Settings 126

Change the System Time Zone 127

Conﬁgure SMTP Server to Support Notiﬁcations 128

Federal Information Processing Standards Mode Support 129

Enable Federal Information Processing Standards Mode in Cisco ISE 130

Conﬁgure Cisco ISE for Administrator Common Access Card Authentication 130

Secure SSH Key Exchange Using Difﬁe-Hellman Algorithm 133

Conﬁgure Cisco ISE to Send Secure Syslog 133

Conﬁgure Secure Syslog Remote Logging Target 134

Remote Logging Target Settings 134

Cisco Identity Services Engine Administrator Guide, Release 2.6

vii

Contents

Enable Logging Categories to Send Auditable Events to the Secure Syslog Target 136

Conﬁgure Logging Categories 136

Disable TCP Syslog and UDP Syslog Collectors 137

Default Secure Syslog Collector 138

Ofﬂine Maintenance 139

Certiﬁcate Management in Cisco ISE 139

Conﬁgure Certiﬁcates in Cisco ISE to Enable Secure Access 139

Certiﬁcate Usage 140

Certiﬁcate Matching in Cisco ISE 142

Validity of X.509 Certiﬁcates 142

Enable Public Key Infrastructure in Cisco ISE 142

Wildcard Certiﬁcates 144

Wildcard Certiﬁcate Support in Cisco ISE 144

Wildcard Certiﬁcates for HTTPS and Extensible Authentication Protocol Communication 145

Fully Qualiﬁed Domain Name in URL Redirection 145

Advantages of Using Wildcard Certiﬁcates 146

Disadvantages of Using Wildcard Certiﬁcates 146

Wildcard Certiﬁcate Compatibility 147

Certiﬁcate Hierarchy 147

System Certiﬁcates 148

View System Certiﬁcates 149

Import a System Certiﬁcate 150

System Certiﬁcate Import Settings 151

Generate a Self-Signed Certiﬁcate 152

Self-Signed Certiﬁcate Settings 153

Edit a System Certiﬁcate 154

Delete System Certiﬁcate 155

Export a System Certiﬁcate 156

Trusted Certiﬁcates Store 156

Certiﬁcates in Trusted Certiﬁcates Store 158

List of Trusted Certiﬁcates 158

Trusted Certiﬁcate Naming Constraint 159

View Trusted Certiﬁcates 160

Change the Status of a Certiﬁcate in Trusted Certiﬁcates Store 160

Cisco Identity Services Engine Administrator Guide, Release 2.6

viii

Contents

Add a Certiﬁcate to Trusted Certiﬁcates Store 160

Edit a Trusted Certiﬁcate 161

Trusted Certiﬁcate Settings 161

Delete Trusted Certiﬁcates 163

Export a Certiﬁcate from the Trusted Certiﬁcates Store 164

Import the Root Certiﬁcates to the Trusted Certiﬁcate Store 164

Trusted Certiﬁcate Import Settings 165

Certiﬁcate Chain Import 166

Install Trusted Certiﬁcates for Cisco ISE Inter-node Communication 166

Default Trusted Certiﬁcates in Cisco ISE 167

Certiﬁcate Signing Requests 170

Create a Certiﬁcate Signing Request and Submit it to a Certiﬁcate Authority 170

Bind the CA-Signed Certiﬁcate to the Certiﬁcate Signing Request 171

Export a Certiﬁcate Signing Request 172

Certiﬁcate Signing Request Settings 172

Set Up Certiﬁcates for Portal Use 177

Reassign Default Portal Certiﬁcate Group Tag to CA-Signed Certiﬁcate 178

Associate the Portal Certiﬁcate Tag Before You Register a Node 178

User and Endpoint Certiﬁcate Renewal 179

Dictionary Attributes Used in Policy Conditions for Certiﬁcate Renewal 180

Authorization Policy Condition for Certiﬁcate Renewal 180

CWA Redirect to Renew Certiﬁcates 180

Conﬁgure Cisco ISE to Allow Users to Renew Certiﬁcates 180

Update the Allowed Protocol Conﬁguration 180

Create an Authorization Policy Proﬁle for CWA Redirection 181

Create an Authorization Policy Rule to Renew Certiﬁcates 182

Enable BYOD Settings in the Guest Portal 182

Certiﬁcate Renewal Fails for Apple iOS Devices 183

Certiﬁcate Periodic Check Settings 183

Cisco ISE CA Service 183

ISE CA Certiﬁcates Provisioned on Administration and Policy Service Nodes 184

ISE CA Chain Regeneration 185

Elliptical Curve Cryptography Certiﬁcates Support 185

Cisco ISE Certiﬁcate Authority Certiﬁcates 187

Cisco Identity Services Engine Administrator Guide, Release 2.6

ix

Contents

Edit a Cisco ISE CA Certiﬁcate 187

Export a Cisco ISE CA Certiﬁcate 188

Import a Cisco ISE CA Certiﬁcate 188

Certiﬁcate Templates 189

Certiﬁcate Template Name Extension 189

Use Certiﬁcate Template Name in Authorization Policy Conditions 189

Deploy Cisco ISE CA Certiﬁcates for pxGrid Controller 189

Simple Certiﬁcate Enrollment Protocol Proﬁles 190

Issued Certiﬁcates 191

Issued and Revoked Certiﬁcates 191

Backup and Restore of Cisco ISE CA Certiﬁcates and Keys 192

Export Cisco ISE CA Certiﬁcates and Keys 192

Import Cisco ISE CA Certiﬁcates and Keys 193

Generate Root CA and Subordinate CAs on the Primary PAN and PSN 194

Conﬁgure Cisco ISE Root CA as Subordinate CA of an External PKI 194

Conﬁgure Cisco ISE to Use Certiﬁcates for Authenticating Personal Devices 195

Add Users to the Employee User Group 196

Create a Certiﬁcate Authentication Proﬁle for TLS-Based Authentication 196

Create an Identity Source Sequence for TLS-Based Authentication 196

Conﬁgure Certiﬁcate Authority Settings 197

Create a CA Template 198

Internal CA Settings 200

Create a Native Supplicant Proﬁle to be Used in Client Provisioning Policy 200

Download Agent Resources from Cisco Site for Windows and MAC OS X Operating Systems 201

Create Client Provisioning Policy Rules for Apple iOS, Android, and MACOSX Devices 201

Conﬁgure the Dot1X Authentication Policy Rule for TLS-Based Authentication 202

Create Authorization Proﬁles for Central Web Authentication and Supplicant Provisioning

Flows 202

Create Authorization Policy Rules 203

CA Service Policy Reference 203

Client Provisioning Policy Rules for Certiﬁcate Services 204

Authorization Proﬁles for Certiﬁcate Services 205

Authorization Policy Rules for Certiﬁcate Services 206

ISE CA Issues Certiﬁcates to ASA VPN Users 207

Cisco Identity Services Engine Administrator Guide, Release 2.6

x

Contents

VPN Connection Certiﬁcate Provisioning Flow 207

Conﬁgure Cisco ISE CA to Issue Certiﬁcates to ASA VPN Users 208

Revoke an Endpoint Certiﬁcate 211

OCSP Services 211

Cisco ISE CA Service Online Certiﬁcate Status Protocol Responder 212

OCSP Certiﬁcate Status Values 212

OCSP High Availability 213

OCSP Failures 213

Add OCSP Client Proﬁles 213

OCSP Client Proﬁle Settings 214

OCSP Statistics Counters 216

Conﬁgure Admin Access Policies 217

Administrator Access Settings 218

Conﬁgure the Maximum Number of Concurrent Administrative Sessions and Login Banners 218

Allow Administrative Access to Cisco ISE from Select IP Addresses 219

Allow Access to the MnT Section in Cisco ISE 219

Conﬁgure a Password Policy for Administrator Accounts 220

Conﬁgure Account Disable Policy for Administrator Accounts 221

Conﬁgure Lock or Suspend Settings for Administrator Accounts 221

Conﬁgure Session Timeout for Administrators 222

Terminate an Active Administrative Session 222

Change Administrator Name 222

Admin Access Settings 223

Administrator Password Policy Settings 223

Session Timeout and Session Information Settings 226

Maintain and Monitor 227

CHAPTER 5

Adaptive Network Control 228

Enable Adaptive Network Control in Cisco ISE 229

Conﬁgure Network Access Settings 229

Create Authorization Proﬁles for Network Access through ANC 230

ANC Quarantine and Unquarantine Flow 230

ANC NAS Port Shutdown Flow 231

Endpoints Purge Settings 232

Cisco Identity Services Engine Administrator Guide, Release 2.6

xi

Contents

Quarantined Endpoints Do Not Renew Authentication Following Policy Change 233

ANC Operations Fail when IP Address or MAC Address is not Found 233

Externally Authenticated Administrators Cannot Perform ANC Operations 234

Cisco ISE Software Patches 234

Software Patch Installation Guidelines 235

Install a Software Patch 235

Roll Back Software Patches 236

Software Patch Rollback Guidelines 237

View Patch Install and Rollback Changes 237

Backup Data Type 237

Backup and Restore Repositories 238

Create Repositories 239

Repository Settings 241

Enable RSA Public Key Authentication in SFTP Repository 242

On-Demand and Scheduled Backups 242

Perform an On-Demand Backup 243

On-Demand Backup Settings 244

Schedule a Backup 245

Scheduled Backup Settings 246

Backup Using the CLI 247

Backup History 247

Backup Failures 248

Cisco ISE Restore Operation 248

Guidelines for Data Restoration 248

Restoration of Conﬁguration or Monitoring (Operational) Backup from the CLI 249

Restore Conﬁguration Backups from the GUI 251

Restoration of Monitoring Database 252

Restore a Monitoring (Operational) Backup in a Standalone Environment 252

Restore a Monitoring Backup with Administration and Monitor Personas 253

Restore a Monitoring Backup with a Monitoring Persona 253

Restore History 254

Export Authentication and Authorization Policy Conﬁguration 254

Schedule Policy Export Settings 255

Synchronize Primary and Secondary Nodes in a Distributed Environment 255

Cisco Identity Services Engine Administrator Guide, Release 2.6

xii

Contents

Recovery of Lost Nodes in Standalone and Distributed Deployments 255

Recovery of Lost Nodes Using Existing IP Addresses and Hostnames in a Distributed Deployment 255

Recovery of Lost Nodes Using New IP Addresses and Hostnames in a Distributed Deployment 256

Recovery of a Node Using Existing IP Address and Hostname in a Standalone Deployment 257

Recovery of a Node Using New IP Address and Hostname in a Standalone Deployment 257

Conﬁguration Rollback 258

Recovery of Primary Node in Case of Failure in a Distributed Deployment 258

Recovery of Secondary Node in Case of Failure in a Distributed Deployment 258

Cisco ISE Logging Mechanism 259

Conﬁgure Syslog Purge Settings 259

Cisco ISE System Logs 260

Conﬁgure Remote Syslog Collection Locations 260

Cisco ISE Message Codes 261

Set Severity Levels for Message Codes 262

Cisco ISE Message Catalogs 262

Debug Logs 262

View Logging Components for a Node 263

Conﬁgure Debug Log Severity Level 263

Endpoint Debug Log Collector 264

Download Debug Logs for a Speciﬁc Endpoint 264

Collection Filters 264

Conﬁgure Collection Filters 265

Event Suppression Bypass Filter 265

Cisco ISE Reports 266

Report Filters 266

Create the Quick Filter Criteria 267

Create the Advanced Filter Criteria 267

Run and View Reports 268

Reports Navigation 268

Export Reports 268

Schedule and Save Cisco ISE Reports 269

Cisco ISE Active RADIUS Sessions 270

Change Authorization for RADIUS Sessions 271

Available Reports 272

Cisco Identity Services Engine Administrator Guide, Release 2.6

xiii

Contents

RADIUS Live Logs 291

RADIUS Live Sessions 294

TACACS Live Logs 298

Export Summary 300

Device Administration 303

CHAPTER 6

TACACS+ Device Administration 303

Device Administration Work Center 305

Device Administration Deployment Settings 305

Device Admin Policy Sets 306

Create Device Administration Policy Sets 306

TACACS+ Authentication Settings and Shared Secret 307

Device Administration - Authorization Policy Results 309

Allowed Protocols in FIPS and Non-FIPS Modes for TACACS+ Device Administration 309

TACACS+ Command Sets 309

Wildcards and Regex in Command Sets 309

Command Line and Command Set List Match 310

Process Rules with Multiple Command Sets 311

Create TACACS+ Command Sets 311

TACACS+ Proﬁle 312

Create TACACS+ Proﬁles 312

Common Tasks Settings 313

Access the Command-Line Interface to Change the Enable Password 315

Conﬁgure Global TACACS+ Settings 316

Data Migration from Cisco Secure ACS to Cisco ISE 316

Monitor Device Administration Activity 317

TACACS Live Logs 317

Guest and Secure WiFi 321

CHAPTER 7

Cisco ISE Guest Services 321

End-User Guest and Sponsor Portals in Distributed Environment 322

Guest and Sponsor Accounts 322

Guest Types and User Identity Groups 323

Create or Edit Guest Types 323

Cisco Identity Services Engine Administrator Guide, Release 2.6

xiv

Contents

Disable a Guest Type 326

Conﬁgure Maximum Simultaneous Logins for Endpoint Users 327

Schedule When to Purge Expired Guest Accounts 328

Add Custom Fields for Guest Account Creation 328

Specify Email Addresses and SMTP Servers for Email Notiﬁcations 329

Assign Guest Locations and SSIDs 329

Rules for Guest Password Policies 330

Set the Guest Password Policy and Expiration 331

Rules for Guest Username Policies 331

Set the Guest Username Policy 331

SMS Providers and Services 332

Conﬁgure SMS Gateways to Send SMS Notiﬁcations to Guests 332

Social Login for Self-Registered Guests 333

Conﬁguring Social Login 335

Guest Portals 337

Credentials for Guest Portals 337

Guest Access with Hotspot Guest Portals 338

Guest Access with Credentialed Guest Portals 338

Employee Access with Credentialed Guest Portals 339

Guest Device Compliance 339

Guest Portals Conﬁguration Tasks 339

Enable Policy Services 340

Add Certiﬁcates for Guest Portals 340

Create External Identity Sources 340

Create Identity Source Sequences 342

Create Endpoint Identity Groups 342

Create a Hotspot Guest Portal 343

Create a Sponsored-Guest Portal 344

Create a Self-Registered Guest Portal 344

Authorize Portals 346

Customize Guest Portals 347

Conﬁgure Periodic AUP Acceptance 348

Forcing Periodic AUP 348

Guest Remember Me 348

Cisco Identity Services Engine Administrator Guide, Release 2.6

xv

Contents

Sponsor Portals 349

Managing Guest Accounts on the Sponsor Portal 349

Managing Sponsor Accounts 350

Conﬁgure Account Content for Sponsor Account Creation 354

Conﬁgure a Sponsor Portal Flow 355

Enable Policy Services 356

Add Certiﬁcates for Guest Services 356

Create External Identity Sources 356

Create Identity Source Sequences 357

Create a Sponsor Portal 357

Customize Sponsor Portals 358

Conﬁguring Account Content for Sponsor Account Creation 358

Conﬁguring the Time Settings Available to Sponsors 359

Kerberos Authentication for the Sponsor Portal 360

Sponsors Cannot Log In to the Sponsor Portal 362

Monitor Guest and Sponsor Activity 362

Metrics Dashboard 363

AUP Acceptance Status Report 363

Guest Accounting Report 363

Master Guest Report 363

Sponsor Login and Audit Report 364

Audit Logging for Guest and Sponsor Portals 364

Guest Access Web Authentication Options 364

NAD with Central WebAuth Process 365

Wireless LAN Controller with Local WebAuth Process 366

Wired NAD with Local WebAuth Process 367

IP Address and Port Values Required for the Login.html Page 367

HTTPS Server Enabled on the NAD 368

Support for Customized Authentication Proxy Web Pages on the NAD 368

Conﬁgure Web Authentication on the NAD 368

Device Registration WebAuth Process 369

Guest Portal Settings 371

Portal Identiﬁcation Settings 371

Portal Settings for Hotspot Guest Portals 372

Cisco Identity Services Engine Administrator Guide, Release 2.6

xvi

Contents

Acceptable Use Policy (AUP) Page Settings for Hotspot Guest Portals 374

Post-Access Banner Page Settings for Hotspot Portals 374

Portal Settings for Credentialed Guest Portals 374

Login Page Settings for Credentialed Guest Portals 376

Self-Registration Page Settings 377

Self Registration Success Page Settings 380

Acceptable Use Policy (AUP) Page Settings for Credentialed Guest Portals 381

Guest Change Password Settings for Credentialed Guest Portals 381

Guest Device Registration Settings for Credentialed Guest Portals 382

BYOD Settings for Credentialed Guest Portals 382

Post-Login Banner Page Settings for Credentialed Guest Portals 383

Guest Device Compliance Settings for Credentialed Guest Portals 383

VLAN DHCP Release Page Settings for Guest Portals 384

Authentication Success Settings for Guest Portals 384

Support Information Page Settings for Guest Portals 385

Sponsor Portal Application Settings 386

Portal Identiﬁcation Settings 386

Portal Settings for Sponsor Portals 387

Login Settings for Sponsor Portals 390

Acceptable Use Policy (AUP) Settings for Sponsor Portals 390

Sponsor Change Password Settings for Sponsor Portals 391

Post-Login Banner Settings for Sponsor Portals 391

Support Information Page Settings for Sponsor Portals 391

Notify Guests Customization for Sponsor Portals 392

Manage and Approve Customization for Sponsor Portals 392

Global Settings for Guest and Sponsor Portals 393

Guest Type Settings 393

Sponsor Group Settings 396

End-User Portals 399

Customization of End-User Web Portals 399

Portal Content Types 401

Basic Customization of Portals 402

Modify the Portal Theme Colors 402

Change the Portal Display Language 403

Cisco Identity Services Engine Administrator Guide, Release 2.6

xvii

Contents

Change the Portal Icons, Images, and Logos 404

Update the Portal Banner and Footer Elements 404

Change the Titles, Instructions, Buttons, and Label Text 405

Format and Style Text Box Content 405

Variables for Portal Pages Customization 406

View Your Customization 409

Custom Portal Files 409

Advanced Customization of Portals 410

Enable Advanced Portal Customization 411

Portal Theme and Structure CSS Files 411

About Changing Theme Colors with jQuery Mobile 412

Change Theme Colors with jQuery Mobile 413

Location Based Customization 414

User Device Type Based Customization 415

Export a Portal’s Default Theme CSS File 415

Create a Custom Portal Theme CSS File 416

Embed Links in Portal Content 416

Insert Variables for Dynamic Text Updates 417

Use Source Code to Format Text and Include Links 418

Add an Image as an Advertisement 419

Set Up Carousel Advertising 420

Customize Greetings Based on Guest Location 422

Customize Greetings Based on User Device Type 423

Modify the Portal Page Layout 424

Import the Custom Portal Theme CSS File 426

Delete a Custom Portal Theme 426

View Your Customization 427

Portal Language Customization 427

Export the Language File 429

Add or Delete Languages from the Language File 429

Import the Updated Language File 430

Customization of Guest Notiﬁcations, Approvals, and Error Messages 431

Customize Email Notiﬁcations 431

Customize SMS Text Message Notiﬁcations 432

Cisco Identity Services Engine Administrator Guide, Release 2.6

xviii

Contents

Customize Print Notiﬁcations 432

Customize Approval Request Email Notiﬁcations 433

Edit Error Messages 434

Portal Pages Titles, Content and Labels Character Limits 434

Character Limits for Portal Pages Titles, Content and Labels 434

Portal Customization 436

CSS Classes and Descriptions for End-User Portals Page Layout 436

HTML Support for a Portal Language File 437

HTML Support for the Blacklist Portal Language File 437

HTML Support for Bring Your Own Device Portals Language Files 438

HTML Support for Certiﬁcate Provisioning Portal Language Files 439

HTML Support for Client Provisioning Portals Language Files 440

HTML Support for Credential Guest Portals Language Files 441

HTML Support for Hotspot Guest Portals Language Files 443

HTML Support for Mobile Device Management Portals Language Files 444

HTML Support for My Devices Portals Language Files 445

HTML Support for Sponsor Portals Language Files 446

Asset Visibility 449

CHAPTER 8

Administrative Access to Cisco ISE Using an External Identity Store 450

External Authentication and Authorization 451

Conﬁgure a Password-Based Authentication Using an External Identity Store 451

Create an External Administrator Group 452

Create an Internal Read-Only Admin 452

Map External Groups to the Read-Only Admin Group 452

Conﬁgure Menu Access and Data Access Permissions for External Administrator Group 453

Create an RBAC Policy for External Administrator Authentication 453

Conﬁgure Admin Access Using an External Identity Store for Authentication with Internal

Authorization 454

External Authentication Process Flow 454

External Identity Sources 454

LDAP Identity Source Settings 455

RADIUS Token Identity Sources Settings 462

RSA SecurID Identity Source Settings 462

Cisco Identity Services Engine Administrator Guide, Release 2.6

xix

Contents

Cisco ISE Users 463

User Identity 464

User Groups 464

User Identity Groups 464

User Role 464

User Account Custom Attributes 464

User Authentication Settings 465

Generate Automatic Password for Users and Administrators 467

Internal User Operations 467

Add Users 467

Export Cisco ISE User Data 468

Import Cisco ISE Internal Users 468

Endpoint Settings 469

Endpoint Import from LDAP Settings 470

Identity Group Operations 472

Create a User Identity Group 472

Export User Identity Groups 473

Import User Identity Groups 473

Endpoint Identity Group Settings 473

Conﬁgure Maximum Concurrent Sessions 474

Maximum Concurrent Sessions for a Group 474

Conﬁgure Counter Time Limit 475

Disable Account Policy 475

Disable Individual User Accounts 476

Disable User Accounts Globally 476

Internal and External Identity Sources 476

Create an External Identity Source 478

Authenticate Internal Users Against External Identity Store Password 479

Certiﬁcate Authentication Proﬁles 479

Add a Certiﬁcate Authentication Proﬁle 480

Active Directory as an External Identity Source 480

Active Directory-Supported Authentication Protocols and Features 481

Active Directory Attribute and Group Retrieval for Use in Authorization Policies 481

Support for Boolean Attributes 482

Cisco Identity Services Engine Administrator Guide, Release 2.6

xx

Contents

Page is loading ...

Cisco Identity Services Engine User guide

This manual is also suitable for

Cisco Identity Services Engine User guide

Related papers

Other documents