Ise Guest Portal Certificate

 admin



Cisco Identity Services Engine (ISE) may be used for guest management when paired with Meraki Access Points. Cisco ISE is another option for authorizing users, enabling many additional business use cases.

Meraki APs will pass necessary information over to Cisco ISE using MAC-based authentication and honor a Uniform Resource Locator (URL) redirect that is received from the Cisco ISE Server. Using change of authorization (CoA), the Cisco ISE server can ensure that the correct authorization is applied to the end user devices based on the authentication status.

Expected Packet Flow


If required complete a Certificate Signing Request for a Portal certificate (ensure the assign Portal tag is referenced in the Guest Portal). Figure 1 – ISE Portal Certificate. Navigate to Work Center Guest Access Portal & Components Guest Portals; Click Self-Registered Guest Portal (default). 1.-Provide an screenshot of the trusted certificate list. 2.-Provide an screenshot of the system certificates (I need to validate something) 3.-Go to WORK CENTER - GUEST ACCESS - PORTALS AND COMPONENTS - GUEST PORTALS - Select your portal - PORTAL TEST URL (Send me the result). The video shows the third guest access deployment model on Cisco ISE 2.2 called Self-Registration guest. We will continue with our configuration from the previous lab and add guest ability to create an account. We will explore both automatic and manual account approval. At the end, we will allow guest to register additional non-user devices via device registration.

This video walks a user through the creation of a WildCard Certificate in ISE 2.1 If you would like to see other topics presented, please send us an email wi.

  1. Client machine associates to the web authentication SSID

  2. Client MAC address is sent to RADIUS server as a username and password (Access-Request) by MR, and the MR responds to the client machine acknowledging the association request

  3. ISE server responds with an RADIUS Access-Accept and a redirect URL

  4. Client machine gets an IP address and DNS server address through DHCP

  5. Client machine tries to reach a webpage which results in an HTTP GET packet

  6. MR intercepts the GET packet and sends redirect URL instead (with webpage hosted on ISE)

  7. Client machine authenticates on the ISE web portal

  8. RADIUS server then sends a CoA request (CoA requests work on UDP Port 1700) with a request to re-authenticate, also indicating that user is valid
  9. MR sends CoA-ACK
  10. MR Authenticator sends an Access-Request with existing client machine's session-ID and MAC address

  11. ISE server then responds back with Access-Acccept and any extra ISE functions after client's successful authentication to web portal

  12. Client is allowed access to the network

Configuration

The following sections of this guide will outline a configuration example with using Cisco ISE as the guest management system which is also hosting the captive portal.

Meraki Access Point Dashboard Configuration

The Meraki Access Point configuration is outlined below all on the Access Control Page for a particular SSID (Wireless > Configure > Access Control).

Configure MAC-Based Authentication

Select MAC-based access control from the association requirements section of the access control page.

Enter the details for the RADIUS server including the IP address, port, and secret. If using Group Policies select Airspace-ACL-Name for the RADIUS attribute specifying the group policy name. The Airspace-ACL-Name must match the name of one of your group policies configured under Network-wide > Group Policies. Enable CoA support if there is a requirement to change the attributes of an authentication, authorization, and accounting (AAA) session.

Configure CWA for Splash page

SelectCisco Identity Services Engine (ISE) Authentication in the Splash Page section of the access control page. This setting will honor the Cisco custom url-redirect attribute sent from Cisco ISE.

Configure the Walled Garden

The IP address of the Cisco ISE server needs to be added to the walled garden to ensure that a client will be permitted through the walled garden before being authenticated by the Cisco ISE server.

DNS traffic is permitted by default through the walled garden

Disable CNA

As of Cisco ISE 2.2, Apple CNA is supported for Guest and BYOD. Beginning July 26th, 2017, Apple CNA and Android captive portal detection are enabled by default on Cisco Meraki MR access points. On iOS 7+ and OS X, the client will automatically launch a mini-browser (CNA) that takes the user to the splash page to complete authentication and gain access to the network. Android devices will display a notification on the device prompting the user to sign into the Wi-Fi network. Tapping the notification will launch the device browser and direct the user to the splash page. To disable CNA and captive portal detection, append the following 17.0.0.0/8 IP rangeand domain names to the walled garden as shown below:

Disabling CNA will require that users manually open their web browser before being presented with the splash page. Applications on the user's device that require Internet connectivity will not function as expected until the user has opened their web browser and completed authentication via the splash page.

Cisco ISE Configuration

Guest

The following sections focuses on Cisco ISE 2.4 and it will present a basic configuration with default web portal from Cisco ISE. For more information about web portal customization please look into ISE documentation.

Adding Managed Network Devices

MR access points acting as authenticators (devices through which AAA requests are sent to Cisco ISE) need to be added to ISE before Access-Request will be answered, it will by default not answer any requests.

To add a new device:

  1. In Cisco ISE, choose Administration > Network Resources > Network Devices.

  2. From the Network Devices navigation pane on the left, click Network Devices.

  1. Click Add, from the action icon on the Network Devices navigation pane or click an already added device name from the list to edit it.

  2. In the right pane, enter the Name and IP Address. As for the mask, you can add devices inside a network using /24, or as needed to avoid manually importing several APs.

  3. Check the Authentication Settings check box and define a Shared Secret for RADIUS authentication. This must match the Secret entered for the RADIUS server when configuring the SSID in Dashboard.

  1. Click Submit

Once a device is added, it will show up on the device list in ISE.

Creating Results for Rules

A new results needs to be created where the redirection will be specified.

To do this, go to “Policy > Results”. Click on Authorization and Authorization Profiles.

Click on “Add”

  1. Name this authorization profile.

  2. On Common Tasks, select “Web Redirection (CWA, MDM, NSP, CPP)”, choose Centralized Web Auth, on ACL “NULL” and Value “Self-Registered” (These values can change depending on your needs.

Optionally, Static IP can be used to not used a DNS server, however, this is not recommended because the IP of the ISE server will be clear text and visible for the end client.

Enabling Policy Sets

Cisco ISE supports policy sets, which allow grouping sets of authentication and authorization policies, as opposed to the basic authentication and authorization policy model, which is a flat list of authentication and authorization rules. Policy sets allow for logically defining an organization's IT business use cases into policy groups or services, such as VPN and 802.1X. This makes configuration, deployment, and troubleshooting much easier.

Ise Portal Builder

In Cisco ISE, choose Administration > System > Settings > Policy Sets.

Creating a Policy Set

  1. Click on Policy > Policy Set

  1. Click the plus (+) sign or click on the settings icon and Create above to create a new policy set.

  2. Enter the Name, Description and a Condition for this group policy.

  3. Click on Condition, a new menu will show, match the condition necessary, per SSID policy sets are recommended, therefore, attribute “Radius·Called-Station-ID” ENDS WITH “<SSID name>” is the preferred option. Click “Use” after configuring this step.

  1. Define allow protocols, by default “Default Network Access” can be used.

  2. Click on “Save”

Create Authentication Policy

  1. Click on “View” policy by clicking on the right arrow.

  2. Click on ”Options”

  3. Change “If user not found” to CONTINUE

Create Authorization Policy.

Two rules are required in Authorization Policies for Central Web-Auth, one rule will prompt the redirection and the second rule will grant access once the client machine has passed web page authentication.

  1. Click on Authorization Policy

  1. Click on the (+) sign or on the settings Icon to create a new rule.

  2. Click on “Condition”. a new window will pop up. In this window, the method of the client requesting access can be selected.

    • Look for Called-Station-ID, and match it to the name of the SSID.

  1. Click “Use”

  2. Select on “Results”, the name of the profile created for redirection, in this case it is “CWA”.

For second rule click on the Action Icon and select “Insert new row above”

Cisco Ise Guest Portal Certificate

  1. Click on “Condition” a new window will pop up, in this window the method of the client requesting access can be selected.

  2. Look for “IdentityGroup:Name”

  1. Select “In” and “Endpoint Identity Groups: GuestEndpoints”.

Cisco Ise Guest Portal Certificate

  1. Click on “Use”.

  2. Select on “Results” the profile called “PermitAccess”

  3. Click Save.

My Guest Portal

Both rules should be created and should look like the image below, order is very important.