Cisco Ise 13 User Guide

tosearchforspecificRADIUSserversbasedonthenameordescription,orboth.Inbothsimpleandrule-based
authenticationpolicies,youcanusetheRADIUSserversequencestoproxytherequeststoaRADIUSserver.
TheRADIUSserversequencestripsthedomainnamefromtheRADIUS-UsernameattributeforRADIUS
authentications.ThisdomainstrippingisnotapplicableforEAPauthentications,whichusetheEAP-Identity
attribute.TheRADIUSproxyserverobtainstheusernamefromtheRADIUS-Usernameattributeandstrips...

Procedure
Step 1ChooseAdministration>NetworkResources>RADIUSServerSequences.
Step 2ClickAdd.
Step 3Enterthevaluesasrequired.
Step 4ClickSubmittosavetheRADIUSserversequencetobeusedinpolicies.
Policy Modes
CiscoISEprovidestwotypesofpolicymodes,theSimplemodeandthePolicySetmode.Youcanselect
eitheroneofthesetoconfigureauthenticationandauthorizationpolicies.Whenyouchangethepolicymode,
youarepromptedtologinagaintotheCiscoISEinterface.IfyouswitchfromthePolicySetmodetothe...

•AfteryoudoafreshinstallorupgradefromCiscoISE,Release1.1,theSimpleModepolicymodelis
selectedbydefault.
•IfyouchoosetoswitchtoPolicySetModefromSimpleMode,theauthenticationandauthorization
policiesaremigratedtothedefaultpolicyset.
•IfyouchoosetoswitchtoSimpleModefromPolicySetMode,theauthenticationandauthorizationof
thedefaultpolicysetaremigratedtobetheauthenticationandauthorizationpolicies.Allotherpolicy
setpoliciesaredeleted.
Procedure
Step 1ChooseAdministration>System>Settings>PolicySets.
Step...

Configure a Rule-Based Authentication Policy
Inarule-basedpolicy,youcandefineconditionsthatallowsCiscoISEtodynamicallychoosetheallowed
protocolsandidentitysources.Youcandefineoneormoreconditionsusinganyoftheattributesfromthe
CiscoISEdictionary.
Werecommendthatyoucreatetheallowedprotocolaccessservices,conditions,andidentitysource
sequencesbeforeyoucreatetherule-basedauthenticationpolicy.IfyouwanttousetheRADIUSserver
sequence,youcandefinetheRADIUSserversequencebeforeyoucreatethepolicy.
Tip
Before You...

ISEdoesnotrestrictauserormachineEAP-TLSauthenticationagainstActiveDirectorywhentheaccount
inActiveDirectoryissettodenytheuserormachineusinglogonhours,locked-out,orworkstationsattributes.
YoushouldnotusetheseattributestorestrictauserormachineforEAP-TLSauthentications.
Default Authentication Policy
Thelastrowintheauthenticationspolicypageisthedefaultpolicythatwillbeappliedifnoneoftherules
matchtherequest.Youcanedittheallowedprotocolsandidentitysourceselectionforthedefaultpolicy....

Policy Set Evaluation Flow
Figure 32: Policy Set Authentication and Authorization Evaluation Flow
Thesequenceofpolicysetandtheauthenticationandauthorizationevaluationflowisasfollows:
1Evaluatepolicyset(byevaluatingthepolicysetcondition).Asaresult,onepolicysetisselected.
2Evaluateallowedprotocolsrulesoftheselectedpolicyset.
3EvaluateIDstorerulesoftheselectedpolicyset.
4Evaluateauthorizationrulesoftheselectedpolicyset,basedonthefollowingparadigm:
Evaluatethelocalexceptionpolicyincaseitisdefined...

•Rulescannotbesharedbydifferentpolicysets;eachpolicysethasitsownrule,howeverconditionscan
besharedincaseyouusetheconditionlibrary.
Global Authorization Exception Policy
Theglobalauthorizationexceptionpolicyallowsyoutodefinerulesthatapplytoallpolicysets.Theglobal
authorizationexceptionpolicyisaddedtoeachauthorizationpolicyofallthepolicyset.Globalauthorization
exceptionpolicycanbeupdatedbyselectingtheGlobalExceptionsoptionfromthepolicysetlist....

Table 22: Authentication Policy Configuration Defaults
Additional InformationDescriptionPath in the User InterfaceName
Youcanusethisaccess
serviceforwiredand
wireless802.1X,andwired
MABauthentication
policies.
Thisdefaultisthebuilt-in
networkaccessallowed
protocolsservicetobeused
inauthenticationpolicies.
Policy>PolicyElements
>Configuration>Allowed
Protocols
DefaultNetwork
AccessAllowed
ProtocolsAccess
Service
Thiscompoundconditionis
usedinthewired802.1X
authenticationpolicy.Any
requestthatmatchesthe...

Additional InformationDescriptionPath in the User InterfaceName
Tousethiscompound
condition,youmustcreate
anauthenticationpolicythat
wouldcheckforthis
condition.Youcanalso
defineanaccessservice
basedonyourrequirements
orusethedefaultnetwork
accessallowedprotocols
serviceforthispolicy.
Thiscompoundcondition
checksforthefollowing
attributesandvalues:
•RADIUS:Service-Type
equalsOutbound
•RADIUS:NAS-Port-Type
equals
Wireless-IEEE802.11
Policy>PolicyElements
>Conditions>
Authentication>
CompoundConditions...

Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step 1ChooseOperations>Authenticationstoviewreal-timeauthenticationsummary.
Step 2Youcanviewtheauthenticationsummaryinthefollowingways:
•HoveryourmousecursorovertheStatusicontoviewtheresultsoftheauthenticationandabrief
summary.Apop-upwithstatusdetailsappears.
•Enteryoursearchcriteriainanyoneormoreofthetextboxesthatappearatthetopofthelist,andpress
Enter,tofilteryourresults....