Cisco Ise 13 User Guide

Create External Identity Sources
CiscoISEcanconnectwithexternalidentitysourcessuchasActiveDirectory,LDAP,RADIUSToken,and
RSASecurIDserverstoobtainuserinformationforauthenticationandauthorization.Externalidentitysources
alsoincludescertificateauthenticationprofilesthatyouneedforcertificate-basedauthentications.
Procedure
Step 1ChooseAdministration>IdentityManagement>ExternalIdentitySources.
Step 2Chooseoneoftheseoptions:
•CertificateAuthenticationProfileforcertificate-basedauthentications....

•DonotaccessotherstoresinthesequenceandsettheAuthenticationStatusattributetoProcessError
—IfyouwantCiscoISEtodiscontinuethesearch,iftheuserisnotfoundinthefirstselectedidentity
source.
•Treatasiftheuserwasnotfoundandproceedtothenextstoreinthesequence—IfyouwantCisco
ISEtocontinuesearchingtheotherselectedidentitysourcesinsequence,iftheuserisnotfoundinthe
firstselectedidentitysource.
Whileprocessingarequest,CiscoISEsearchestheseidentitysourcesinsequence.Ensurethatyouhave...

Procedure
Step 1ChooseAdministration>DevicePortalManagement>BlacklistPortal>Edit.
Step 2ProvideauniquePortalNameandaDescriptionfortheportal.
Ensurethattheportalnamethatyouusehereisnotusedforanyotherend-userportals.
Step 3UsetheLanguagesmenutoexportandimportlanguagefilestousewiththeportal.
Step 4Updatethedefaultvaluesforcertificategrouptags,languagesandsooninPortalSettings,anddefinebehavior
thatappliestotheoverallportal.
•HTTPSport—Enteraportvaluebetween8000to8999;thedefaultvalueis8443forallthedefault...

◦TheinterfacesyouenableheremustbeavailableonallyourPSNs,includingVM-basedoneswhen
PolicyServicesturnedon.ThisisrequiredbecauseanyofthesePSNscanbeusedforaredirect
atthestartoftheguestsession.
◦TheportalcertificateSubjectName/AlternateSubjectNamemustresolvetotheinterfaceIP.
◦Configureiphostx.x.x.xyyy.domain.cominISECLItomapsecondaryinterfaceIPtoFQDN,
whichisusedtomatchCertificateSubjectName/AlternateSubjectName.
•Certificategrouptag—Pickacertificategrouptagthatspecifiesthecertificatetousefortheportal’s...

Procedure
Step 1ChooseAdministration>DevicePortalManagement>BYODPortals>Create,EditorDuplicate.
Step 2ProvideauniquePortalNameandaDescriptionfortheportal.
Ensurethattheportalnamethatyouusehereisnotusedforanyotherend-userportals.
Step 3UsetheLanguageFiledrop-downmenutoexportandimportlanguagefilestousewiththeportal.
Step 4Updatethedefaultvaluesforports,certificategrouptags,endpointidentitygroupsandsooninPortalSettings,
anddefinebehaviorthatappliestotheoverallportal.
Step...

Create a Client Provisioning Portal
YoucanprovideaClientProvisioningportaltoenableemployeestodownloadeithertheCiscoAnyConnect
posturecomponentortheCiscoNACagent,whichverifiestheposturecomplianceofthedevicebefore
allowingaccesstothenetwork.
YoucancreateanewClientProvisioningportal,oryoucaneditorduplicateanexistingone.Youcandelete
anyClientProvisioningportal,includingthedefaultportalprovidedbyCiscoISE.
AnychangesthatyoumaketothePageSettingsonthePortalBehaviorandFlowSettingstabarereflected...

Step 7ClickSaveandthenClose.
What to Do Next
Youmustauthorizetheportalinordertouseit.Youcanalsocustomizeyourportaleitherbeforeorafteryou
authorizeitforuse.
Related Topics
AuthorizePortals,onpage314
CustomizeDevicePortals,onpage355
Create an MDM Portal
YoucanprovideaMobileDeviceManagement(MDM)portaltoenableemployeestomanagetheirmobile
devicesthatareregisteredforuseonyourcorporatenetwork.
YoucancreateanewMDMportal,oryoucaneditorduplicateanexistingone.YoucandeleteanyMDM...

•Non-compliant—WhenthedevicebeingenrolledisnotcompliantwiththerequirementsoftheMDM
system.
•Continue—Whenthedeviceshouldtryconnectingtothenetworkincaseofconnectivityissues.
•Enroll—WhenthedevicerequirestheMDMagentandneedstobeenrolledintheMDMsystem.
Step 7ClickSaveandthenClose.
What to Do Next
Youmustauthorizetheportalinordertouseit.Youcanalsocustomizeyourportaleitherbeforeorafteryou
authorizeitforuse.Alsoseethefollowingtopics:
•AddCertificates,onpage344
•CreateEndpointIdentityGroups,onpage346...

•AcceptableUsePolicy(AUP)PageSettings—AddaseparateAUPpageanddefinetheacceptableuse
policybehaviorforemployees.
•Post-LoginBannerPageSettings—Notifyemployeesofadditionalinformationaftertheylogintothe
portal.
•EmployeeChangePasswordSettings—Allowemployeestochangetheirownpasswords.Thisoption
isenabledonlyiftheemployeeispartoftheInternalUsersdatabase.
Step 6InthePortalPageCustomizationtab,customizethefollowinginformationthatappearsintheMyDevices
portalduringregistrationandmanagement:...

Before You Begin
Ifyoudonotplantouseadefaultportal,youmustfirstcreatetheportalsoyoucanassociatetheportalname
withtheauthorizationprofile.
Procedure
Step 1ChoosePolicy>PolicyElements>Results>Authorization>AuthorizationProfiles.
Step 2Createanauthorizationprofileusingthenameoftheportalthatyouwanttoauthorizeforuse.
What to Do Next
Youshouldcreateaportalauthorizationpolicyrulethatusesthenewlycreatedauthorizationprofile.
Create Authorization Policy Rules...