Practical Deployment of Cisco Identity Services Engine (ISE)
Real-World Examples of AAA Deployments
Table of Contents
Copyright
Acquiring Editor: Chris Katsaropoulos
Editorial Project Manager: Anna Valutkevich
Project Manager: Punithavathy Govindaradjane
Designer: Mark Rogers
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
Copyright 2016 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publishers permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.
ISBN: 978-0-12-804457-5
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library
Library of Congress Cataloging-in-Publication Data
A catalog record for this book is available from the Library of Congress
For information on all Syngress publications visit our website at http://store.elsevier.com/Syngress
Acknowledgments
I have to first thank my wife Jenn for being incredibly supportive through this. To my daughter Grace for keeping everything important in perspective.
My colleagues at Presidio have been so helpful to me over the years through many projects. Thanks to especially Jonathan, Ron, Colum, Gareth, and Tom.
The AAA TAC team out of RTP incredibly still takes my calls and they have always been polite while fixing any of my mistakes. Thanks guys.
http://bit.ly/1JYMtma
Andy Richter
The support of family and friends while writing this book is what made it possible for me; thank you to all of you. The IT group at Norwich University as well deserves a special mention because without them I wouldnt have most of the experience needed for this. Finally my coauthor Andy, it was his drive to do this book that really got it off the ground.
Jeremy Wood
Chapter 1
Introduction
Abstract
This chapter introduces some history of the product field Identity Services Engine (ISE) fits into and has a very high-level overview of topics that will be covered. We talk about some of the more common scenarios that companies face that will drive them to implement ISE as well as some problems that can be solved with it. Core concepts such as what AAA is and how it is used in ISE will be discussed before talking about going into general ISE features and how they could be utilized.
Keywords
introduction
history
AAA
Thank you for opening to the first page, as this is a step many people dont take in a technical manual. I have a few technical books on my shelf that I use exclusively to flip through to specific chapters and have never read the introduction. In that spirit, lets keep the intro short so we can get into the meat of what youre here for.
In this book we hope to bring a practical perspective to deploying the Cisco Identity Services Engine (ISE) system that may otherwise be elusive to the uninitiated in the arts of edge authentication or those who dont have lots of time to spend in the lab playing.
A little history: Before ISE was a product, if you were a Cisco customer and you wanted to deploy edge authentication that used 802.1x, enforce policy based on the posture of a personal computer (PC), deploy robust guest provisioning/web authentication, and profile what connected devices physically, youd need to buy four separate products. These included:
Cisco Access Control Server (ACS)
Cisco Clean Access
Network Admission Control (NAC) Guest
NAC Profiler
Someone at Cisco (whose hand wed really like to shake) decided that having so many products in a design was a really poor idea and Cisco went about creating a product that brought each of those together.
ISE provides edge authentication services for networks in a variety of ways:
IEEE 802.1x authentication
Media access control (MAC) Authentication Bypass (MAB)
Web authentication
Posture assessment
Device profiling
External mobile device management (MDM) integration
Authentication via application program interface (API)
To accomplish these functions, ISE integrates into network access devices (switches, wireless controllers, virtual private network (VPN) concentrators) with Remote Authentication Dial-In User Service (RADIUS). Not only is it simply RADIUS integration, but also the great majority of what ISE provides is standards-compliant RADIUS. Being that Cisco is a large manufacturer (lets point out the obvious), there are some proprietary features ISE provides; well address some of those individually later.
Because ISE is a RADIUS server at its core, when you configure it, you have to remember the three As (aka AAA or triple A):
Authentication
Authorization
Accounting
Each of these not only need to be configured on your network access devices but are also the process that ISE goes through in processing devices that are connecting to the network.
When a RADIUS authentication request first comes in, it goes to authentication policy. This is where ISE determines if the identity of the user or device is who they say they are. This process could involve 802.1x authentication, MAB, or a web authentication.
For the authentication to be successful, a few possible things could be validated, which depends on what is happening for the specific device. If a password is used in the authentication, the password is validated against the Active Directory (AD) and/or Lightweight Directory Access Protocol (LDAP) database. If a certificate is used, it is validated against the certification authority (CA) certificate chain; perhaps its validity is also checked for revocation status. If the MAC address is presented for an authentication bypass, MAB authentication is processed, meaning the MAC address is checked against the MAC addresses in a database of known MAC addresses.