Cisco Ise 13 User Guide

onCiscoISEmaintainsacost-basedroutingtabletomakethebestuseoftheRSAserversintherealm.You
can,however,choosetooverridethisroutingwithamanualconfigurationforeachCiscoISEserverforthe
realmusingatextfilecalledsdopts.recthroughtheAdminportal.RefertotheRSAdocumentationfor
informationonhowtocreatethisfile.
RSA Node Secret Reset
Thesecuridfileisasecretnodekeyfile.WhenRSAisinitiallysetup,itusesasecrettovalidatetheagents.
WhentheRSAagentthatresidesinCiscoISEsuccessfullyauthenticatesagainsttheRSAserverforthefirst...

WhenyoucreatetheRSAidentitysourceforthefirsttime,theImportnewsdconf.recfilefieldwillbea
mandatoryfield.Fromthenon,youcanreplacetheexistingsdconf.recfilewithanupdatedone,butreplacing
theexistingfileisoptional.
Step 3Entertheservertimeoutvalueinseconds.CiscoISEwillwaitforaresponsefromtheRSAserverforthe
amountoftimespecifiedbeforeittimesout.Thisvaluecanbeanyintegerfrom1to199.Thedefaultvalue
is30seconds.
Step 4ChecktheReauthenticateonChangePINcheckboxtoforceareauthenticationwhenthePINischanged.
Step...

b)ClickSaveinthisrowtosavethechanges.
Step 8ClickSave.
Configure Authentication Control Options for RSA Identity Source
YoucanspecifyhowCiscoISEdefinesauthenticationfailuresandenableidentitycaching.TheRSAidentity
sourcedoesnotdifferentiatebetween“Authenticationfailed”and“Usernotfound”errorsandsendsan
Access-Rejectresponse.
YoucandefinehowCiscoISEshouldhandlesuchfailureswhileprocessingrequestsandreportingfailures....

Configure RSA Messages
CiscoISEallowsyoutoconfiguremessagesthatarepresentedtotheuserwhileprocessingrequestssentto
theRSASecurIDserver.
Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step 1ChooseAdministration>IdentityManagement>ExternalIdentitySources>RSASecurID.
Step 2ClickPrompts.
Step 3ClicktheMessagestab.
Step 4EnterthevaluesasdescribedinRSASecurIDIdentitySourceSettings.
Step 5ClickSubmit.
Identity Source Sequences...

ForallowingguestuserstoauthenticatethroughLocalWebAuth,youmustconfigureboththeGuestPortal
authenticationsourceandtheidentitysourcesequencetocontainthesameidentitystores.
Procedure
Step 1ChooseAdministration>IdentityManagement>IdentitySourceSequences>Add.
Step 2Enteranamefortheidentitysourcesequence.Youcanalsoenteranoptionaldescription.
Step 3ChecktheSelectCertificateAuthenticationProfilecheckboxandchooseacertificateauthenticationprofile
forcertificate-basedauthentication.
Step...

Identity Source Details in Reports
CiscoISEprovidesinformationabouttheidentitysourcesthroughtheAuthenticationsdashletandIdentity
Sourcereports.
Authentications Dashlet
FromtheAuthenticationsdashlet,youcandrilldowntofindmoreinformationincludingfailurereasons.
ChooseOperations>Authenticationstoviewreal-timeauthenticationsummary.Formoreinformation,see
RecentRADIUSAuthentications,onpage857.
Identity Source Reports...

CHAPTER 15
Configure Guest Access
•CiscoISEGuestServices,page291
•GuestandSponsorAccounts,page292
•GuestPortals,page303
•SponsorPortals,page316
•MonitorGuestandSponsorActivity,page325
•GuestAccessWebAuthenticationOptions,page327
Cisco ISE Guest Services
CiscoIdentityServicesEngine(ISE)guestservicesenableyoutoprovidesecurenetworkaccesstoguests
suchasvisitors,contractors,consultants,andcustomers.YoucansupportguestswithbaseCiscoISElicenses,...

•AdministrationNode—Configurationchangesthatyoumaketousers,devices,andend-userportals
arewrittentotheAdministrationnode.
•PolicyServicesNode—Theend-userportalsrunonaPolicyServicesNode,whichhandlesallsession
traffic,including:networkaccess,clientprovisioning,guestservices,posture,andprofiling.IfaPolicy
ServiceNodeispartofanodegroup,andonenodefails,theothernodesdetectthefailureandresetany
pendingsessions.
•MonitoringNode—TheMonitoringnodecollects,aggregates,andreportsdataabouttheend-userand...

Whencreatingguestaccounts,certainsponsorgroupscanberestrictedtousingspecificguesttypes.Members
ofsuchagroupcancreateguestswithonlythefeaturesspecifiedfortheirguesttype.Forinstance,thesponsor
group,ALL_ACCOUNTS,canbesetuptouseonlytheContractorguesttype,andthesponsorgroups,
OWN_ACCOUNTSandGROUP_ACCOUNTS,canbesetuptouseDailyandWeeklyguesttypes.Also,
sinceself-registeringguestsusingtheSelf-RegisteredGuestportaltypicallyneedaccessforjustaday,you
canassignthemtheDailyguesttype....

Theaccountpurgepolicychecksforexpiredguestaccounts,andsendsexpiration
notification.Thispolicyrunsevery20minutes,soifyousettheaccountdurationtoless
than20mins,itispossiblethatexpirationnoticesmaynotbesentoutbeforetheaccount
ispurged.
Note
Youcanspecifythedurationtimeandthedaysoftheweekwhenaccessisprovidedtotheguests
ofthisGuestTypebyusingtheAllowaccessonlyonthesedaysandtimesoption.
◦Thedaysoftheweekthatyouselectlimitsaccesstothedatesthatareselectableinthe
Sponsor'scalendar....