Cisco Ise 13 User Guide

Werecommendthatyouuseonlythree,oratmostfourdatabasesinanidentitysourcesequence.
Figure 29: Rule-Based Authentication Policy Flow
Supported Dictionaries for Rule-Based Authentication Policies
CiscoISEsupportsthefollowingdictionaries:
•System-defineddictionaries
◦CERTIFICATE
◦DEVICE
◦RADIUS
•RADIUSvendordictionaries
Cisco Identity Services Engine Administrator Guide, Release 1.3    
415
Rule-Based Authentication Policies 

◦Airespace
◦Cisco
◦Cisco-BBSM
◦Cisco-VPN3000
◦Microsoft
◦Networkaccess
Attributes Supported by Dictionaries
Thetableliststhefixedattributesthataresupportedbydictionaries,whichcanbeusedinpolicyconditions.
Notalloftheseattributesareavailableforcreatingalltypesofconditions.
Forexample,whilecreatingaconditiontochoosetheaccessserviceinauthenticationpolicies,youwillonly
seethefollowingnetworkaccessattributes:DeviceIPAddress,ISEHostName,NetworkDeviceName,
Protocol,andUseCase....

Identity RulesAllowed Protocol Rules
and Proxy
AttributesDictionary
YesYesISEHostNameNetworkAccess
YesNoAuthenticationMethod
NoNoAuthenticationStatus
NoNoCTSDeviceID
YesYesDeviceIPAddress
YesNoEapAuthentication(theEAPmethodthatisused
duringauthenticationofauserofamachine)
YesNoEapTunnel(theEAPmethodthatisusedfortunnel
establishment)
YesYesProtocol
YesYesUseCase
YesNoUserName
NoNoWasMachineAuthenticated
Cisco Identity Services Engine Administrator Guide, Release 1.3    
417
Rule-Based Authentication...

Identity RulesAllowed Protocol Rules
and Proxy
AttributesDictionary
YesNoCommonNameCertificate
Country
E-mail
LocationSubject
Organization
OrganizationUnit
SerialNumber
StateorProvince
Subject
SubjectAlternativeName
SubjectAlternativeName-DNS
SubjectAlternativeName-E-mail
SubjectAlternativeName-OtherName
SubjectSerialNumber
Issuer
Issuer-CommonName
Issuer-Organization
Issuer-OrganizationUnit
Issuer-Location
Issuer-Country
Issuer-Email
Issuer-SerialNumber
Issuer-StateorProvince
Issuer-StreetAddress...

Identity RulesAllowed Protocol Rules
and Proxy
AttributesDictionary
Issuer-DomainComponent
Issuer-UserID
Protocol Settings for Authentication
YoumustdefineglobalprotocolsettingsinCiscoISEbeforeyoucanusetheseprotocolstocreate,saveand
implementapolicysettoprocessanauthenticationrequest.YoucanusetheProtocolSettingspagetodefine
globaloptionsfortheExtensibleAuthenticationProtocol-FlexibleAuthenticationviaSecureTunneling
(EAP-FAST),ExtensibleAuthenticationProtocol-TransportLayerSecurity(EAP-TLS),andProtected...

“EAP-FASTcryptobindingverificationfailed”messagemightbeseenifEAP-FASTauthenticationprotocol
isusedforHighSierraMACOSXdevices.WerecommendthatyouconfigurethePreferredEAPProtocol
fieldintheAllowedProtocolspagetousePEAPorEAP-TLSinsteadofEAP-FASTforHighSierraMAC
OSXdevices.
Note
Configure EAP-FAST Settings
Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step 1ChooseAdministration>System>Settings>Protocols>EAP-FAST>EAPFastSettings.
Step...

Procedure
Step 1ChooseAdministration>System>Settings>Protocols>EAP-TLS.
Step 2EnterthedetailsasrequiredtodefinetheEAP-TLSprotocol.
Step 3ClickSavetosavetheEAP-TLSsettings.
Configure PEAP Settings
Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step 1ChooseAdministration>System>Settings.
Step 2FromtheSettingsnavigationpaneontheleft,clickProtocols.
Step 3ChoosePEAP.
Step 4EnterthedetailsasrequiredtodefinethePEAPprotocol.
Step 5ClickSavetosavethePEAPsettings....

Network Access Service
Anetworkaccessservicecontainstheauthenticationpolicyconditionsforrequests.Youcancreateseparate
networkaccessservicesfordifferentusecases,forexample,Wired802.1X,WiredMAB,andsoon.Tocreate
anetworkaccessservice,configureallowedprotocolsorserversequences.
Define Allowed Protocols for Network Access
AllowedprotocolsdefinethesetofprotocolsthatCiscoISEcanusetocommunicatewiththedevicethat
requestsaccesstothenetworkresources.Anallowedprotocolsaccessserviceisanindependententitythat...

methodisrejectedbytheclientandEAP-TLSisnegotiated,identitystorepolicyisnotexecutedagain.In
caseidentitystorepolicyisbasedonEAPauthenticationattribute,itmighthaveunexpectedresultssincethe
realEAPauthenticationisEAP-TLSbutwassetafteridentitypolicyevaluation.
Enable MAB from Non-Cisco Devices
ConfigurethefollowingsettingssequentiallytoconfigureMABfromnon-Ciscodevices.
Procedure
Step 1EnsurethattheMACaddressoftheendpointsthataretobeauthenticatedareavailableintheEndpoints...

Procedure
Step 1EnsurethattheMACaddressoftheendpointsthataretobeauthenticatedareavailableintheEndpoints
database.YoucanaddtheseendpointsorhavethemprofiledautomaticallybytheProfilerservice.
Step 2CreateanAllowedProtocolservicebasedonthetypeofMACauthenticationusedbytheCiscodevice(PAP,
CHAP,orEAP-MD5).
a)ChoosePolicy>PolicyElements>Results>Authentication>AllowedProtocols
b)EnteranamefortheAllowedProtocolservice.Forexample,MABforCiscoDevices.
c)ChecktheProcessHostLookupcheckbox....