Cisco Ise 13 User Guide

Import Cisco ISE Internal Users
YoucanimportnewuserdataintoISEwithacsvfiletocreatenewinternalaccounts.Atemplatecsvfileis
availablefordownloadonthepageswhereyoucanimportuseraccounts.Youcanimportuserson
Administration>IdentityManagement>Identities>Users.
Procedure
Step 1ChooseAdministration>IdentityManagement>Identities>Users.
Step 2ClickImporttoimportusersfromacomma-delimitedtextfile.
Ifyoudonothaveacomma-delimitedtextfile,clickGenerateaTemplatetocreateacsvfilewiththe
headingrowsfilledin.
Step...

Export User Identity Groups
CiscoISEallowsyoutoexportlocallyconfigureduseridentitygroupsintheformofacsvfile.
Procedure
Step 1ChooseAdministration>IdentityManagement>Groups>IdentityGroups>UserIdentityGroups.
Step 2Checkthecheckboxthatcorrespondstotheuseridentitygroupthatyouwanttoexport,andclickExport.
Step 3ClickOK.
Import User Identity Groups
CiscoISEallowsyoutoimportuseridentitygroupsintheformofacsvfile.
Procedure
Step 1ChooseAdministration>IdentityManagement>Groups>IdentityGroups>UserIdentityGroups....

External Identity Sources
CiscoISEallowsyoutoconfiguretheexternalidentitysourcethatcontainsuserinformation.CiscoISE
connectstoanexternalidentitysourcetoobtainuserinformationforauthentication.Externalidentitysources
alsoincludecertificateinformationfortheCiscoISEserverandcertificateauthenticationprofiles.CiscoISE
usesauthenticationprotocolstocommunicatewithexternalidentitysources.Thefollowingtablelists
authenticationprotocolsandtheexternalidentitysourcesthattheysupport.
Table 15: Authentication Protocols...

•LDAPtoaddanLDAPidentitysource(seeLDAP,onpage271formoredetails).
•RADIUSTokentoaddaRADIUSTokenserver(seeRADIUSTokenIdentitySources,onpage279
formoredetails).
•RSASecurIDtoaddanRSASecurIDserver(seeRSAIdentitySources,onpage283formoredetails).
Certificate Authentication Profiles
Foreachprofile,youmustspecifythecertificatefieldthatshouldbeusedastheprincipalusernameand
whetheryouwantabinarycomparisonofthecertificates.
Add a Certificate Authentication Profile...

•Alwaysperformbinarycomparison—Thisoptionalwaysperformsthebinarycomparisonofclient
certificatetocertificateonaccountinidentitystore(ActiveDirectoryorLDAP).
Step 6ClickSubmittoaddthecertificateauthenticationprofileorsavethechanges.
Active Directory as an External Identity Source
CiscoISEusesMicrosoftActiveDirectoryasanexternalidentitysourcetoaccessresourcessuchasusers,
machines,groups,andattributes.UserandmachineauthenticationinActiveDirectoryallowsnetworkaccess...

FeaturesAuthentication Protocols
•Userandmachineauthentication
•Groupsandattributesretrieval
•Binarycertificatecomparison
ProtectedExtensibleAuthentication
Protocol-TransportLayerSecurity(PEAP-TLS)
UserauthenticationLightweightExtensibleAuthenticationProtocol
(LEAP)
Active Directory Attribute and Group Retrieval for Use in Authorization Policies
CiscoISEretrievesuserormachineattributesandgroupsfromActiveDirectoryforuseinauthorization...

Thecertificateauthenticationprofiledeterminesthefieldwheretheusernameistakenfrominordertolookup
theuserinActiveDirectorytobeusedforretrievingcertificates,forexample,SubjectAlternativeName
(SAN)orCommonName.AfterCiscoISEretrievesthecertificate,itperformsabinarycomparisonofthis
certificatewiththeclientcertificate.Whenmultiplecertificatesarereceived,CiscoISEcomparesthecertificates
tocheckforonethatmatches.Whenamatchisfound,theuserormachineauthenticationispassed.
Active Directory User Authentication Process...

Active Directory Account Permissions Required for Performing Various Operations
Cisco Machine AccountsLeave OperationsJoin Operations
ForthenewlycreatedCisco
machineaccountthatisusedto
communicatetotheActive
Directoryconnection,thefollowing
permissionsarerequired:
•Abilitytochangeown
password
•Readtheuser/machine
objectscorrespondingto
users/machines
•Querysomepartsofthe
ActiveDirectorytolearn
aboutrequiredinformation
(forexample,trusted
domains,alternativeUPN
suffixesandsoon.)
•AbilitytoreadtokenGroups...

Network Ports That Must Be Open for Communication
NotesAuthenticatedTargetPort (remote-local)Protocol
—NoDNSServers/AD
DomainControllers
Randomnumber
greaterthanorequal
to49152
DNS(TCP/UDP)
—YesDomainControllers445MSRPC
MSAD/KDCYes(Kerberos)DomainControllers88Kerberos
(TCP/UDP)
—YesDomainControllers389LDAP(TCP/UDP)
—YesGlobalCatalog
Servers
3268LDAP(GC)
—NoNTP
Servers/Domain
Controllers
123NTP
—Yes(UsingRBAC
credentials)
OtherISENodesin
theDeployment
80IPC
DNS Server...

•TheMicrosoftActiveDirectoryserverdoesnotresidebehindanetworkaddresstranslatoranddoesnot
haveaNetworkAddressTranslation(NAT)address.
•TheMicrosoftActiveDirectoryaccountintendedforthejoinoperationisvalidandisnotconfigured
withtheChangePasswordonNextLogin.
•YouhavetheprivilegesofaSuperAdminorSystemAdmininISE.
IfyouseeoperationalissueswhenCiscoISEisconnectedtoActiveDirectory,seetheADConnector
OperationsReportunderOperations>Reports.
Note...