Cisco Ise 13 User Guide
Here you can view all the pages of manual Cisco Ise 13 User Guide. The Cisco manuals for Interface are available online for free. You can easily download all the documents as PDF.
Page 171
Mobility/MobilityUpgradelicenseisalwaysdisplayedasBase/Plus/Apexintheuserinterfacewithits correspondingnumberofendpoints. Note IfyourCiscoISEnodeneedstosupport: •Alargernumberofconcurrentusersthanthenumberforwhichyouhavelicenses •Wired(LAN)access,andyoursystemhasonlytheMobilitylicense Youwillneedtoupgradeyourlicense(s)forthatnode.ThisprocessiscarriedoutbyyourCiscopartneror accountteamonly. Remove Licenses Before You Begin Keepthefollowinginmindbeforeattemptingtoremovealicense:...
Page 172
Cisco Identity Services Engine Administrator Guide, Release 1.3 126 Manage License Files
Page 173
CHAPTER 8 Manage Certificates •CertificateManagementinCiscoISE,page127 •CiscoISECAService,page152 •OCSPServices,page169 Certificate Management in Cisco ISE Acertificateisanelectronicdocumentthatidentifiesanindividual,aserver,acompany,orotherentityand associatesthatentitywithapublickey.Aself-signedcertificateissignedbyitsowncreator.Certificatescan beself-signedordigitallysignedbyanexternalCertificateAuthority(CA).ACA-signeddigitalcertificate isconsideredindustrystandardandmoresecure....
Page 174
PrimaryAdministrationNode(PAN),andareautomaticallyreplicatedtoallothernodesinanCisco ISEdeployment. Inadistributeddeployment,youmustimportthecertificateonlyintothecertificatetrustlist(CTL)ofthe PAN.Thecertificategetsreplicatedtothesecondarynodes. Ingeneral,toensurecertificateauthenticationinCiscoISEisnotimpactedbyminordifferencesin certificate-drivenverificationfunctions,uselowercasehostnamesforallCiscoISEnodesdeployedina network. Certificate Usage...
Page 175
EAP-TLSclientcertificateshouldhaveKeyUsage=KeyAgreementandExtendedKeyUsage=Client Authenticationforthefollowingciphers: Note •ECDHE-ECDSA-AES128-GCM-SHA256 •ECDHE-ECDSA-AES256-GCM-SHA384 •ECDHE-ECDSA-AES128-SHA256 •ECDHE-ECDSA-AES256-SHA384 EAP-TLSclientcertificateshouldhaveKeyUsage=KeyEnciphermentandExtendedKeyUsage=Client Authenticationforthefollowingciphers: •AES256-SHA256 •AES128-SHA256 •AES256-SHA •AES128-SHA •DHE-RSA-AES128-SHA •DHE-RSA-AES256-SHA •DHE-RSA-AES128-SHA256 •DHE-RSA-AES256-SHA256...
Page 176
For,matchingisperformedbetweenthenodes(iftherearetwo)andbetweentheandpxGrid. CiscoISEchecksforamatchingsubjectnameasfollows: 1CiscoISElooksatthesubjectalternativename(SAN)extensionofthecertificate.IftheSANcontains oneormoreDNSnames,thenoneoftheDNSnamesmustmatchtheFQDNoftheCiscoISEnode.Ifa wildcardcertificateisused,thenthewildcarddomainnamemustmatchthedomainintheCiscoISEnode’s FQDN. 2IftherearenoDNSnamesintheSAN,oriftheSANismissingentirely,thentheCommonName(CN)...
Page 177
IfacertificatechainconsistsofarootCAcertificateplusoneormoreintermediateCAcertificates,tovalidate theauthenticityofauserordevicecertificate,youmustimporttheentirechainintotheTrustedCertificates Store. Forinter-nodecommunication,youmustpopulatetheTrustedCertificatesStorewiththetrustcertificate(s) neededtovalidatetheAdminsystemcertificatebelongingtoeachnodeintheCiscoISEdeployment.Ifyou wanttousethedefaultself-signedcertificateforinternodecommunication,thenyoumustexportthiscertificate...
Page 178
Thefollowingfigureshowsanexampleofawildcardcertificatethatisusedtosecureawebsite. Figure 13: Wildcard Certificate Example Wildcard Certificate Support in Cisco ISE CiscoISEsupportswildcardcertificates.Inearlierreleases,CiscoISEverifiedanycertificateenabledfor HTTPStoensuretheCNfieldmatchestheFullyQualifiedDomainName(FQDN)ofthehostexactly.Ifthe fieldsdidnotmatch,thecertificatecouldnotbeusedforHTTPScommunication. Inearlierreleases,CiscoISEusedthatCNvaluetoreplacethevariableintheurl-redirectA-Vpairstring....
Page 179
Ifyouusewildcardcertificates,westronglyrecommendthatyoupartitionyourdomainspaceforgreater security.Forexample,insteadof*.example.com,youcanpartitionitas*.amer.example.com.Ifyoudo notpartitionyourdomain,itcanleadtoserioussecurityissues. Note Wildcardcertificateusesanasterisk(*)andaperiodbeforethedomainname.Forexample,theCNvaluefor acertificate’sSubjectNamewouldbeagenerichostnamesuchasaaa.ise.localandtheSANfieldwouldhave...
Page 180
Advantages of Using Wildcard Certificates •Costsavings.CertificatessignedbyathirdpartyCertificateAuthorityisexpensive,especiallyasthe numberofserversincrease.WildcardcertificatesmaybeusedonmultiplenodesintheCiscoISE deployment. •Operationalefficiency.WildcardcertificatesallowallPolicyServiceNode(PSN)EAPandwebservices tosharethesamecertificate.Inadditiontosignificantcostsavings,certificateadministrationisalso simplifiedbycreatingthecertificateonceandapplyingitonallthePSNs....