Cisco Ise 13 User Guide

•MatchedValue
•StaticAssignment
•StaticGroupAssignment
•MatchedPolicyID
•NmapSubnetScanID
•PortalUser
•DeviceRegistrationStatus
•BYODRegistration
WhenanendpointiseditedandsavedintheAdministrationnode,theattributesareretrievedfromthecurrent
owneroftheendpoint.
Create Endpoint Identity Groups
CiscoISEgroupsendpointsthatitdiscoversintothecorrespondingendpointidentitygroups.CiscoISE
comeswithseveralsystem-definedendpointidentitygroups.Youcanalsocreateadditionalendpointidentity...

Default Endpoint Identity Groups Created for Endpoints
CiscoISEcreatesthefollowingfiveendpointidentitygroupsbydefault:Blacklist,GuestEndpoints,Profiled,
RegisteredDevices,andUnknown.Inaddition,itcreatestwomoreidentitygroups,suchasCisco-IP-Phone
andWorkstation,whichareassociatedtotheProfiled(parent)identitygroup.Aparentgroupisthedefault
identitygroupthatexistsinthesystem.
CiscoISEcreatesthefollowingendpointidentitygroups:...

Procedure
Step 1ChooseAdministration>IdentityManagement>Groups>EndpointIdentityGroups.
Step 2Chooseanendpointidentitygroup,andclickEdit.
Step 3ClickAdd.
Step 4ChooseanendpointintheEndpointswidgettoaddtheselectedendpointintheendpointidentitygroup.
Step 5ClicktheEndpointGroupListlinktoreturntotheEndpointIdentityGroupspage.
Dynamic Endpoints Reprofiled After Adding or Removing in Identity Groups
Ifanendpointidentitygroupassignmentisnotstatic,thenendpointsarereprofiledafteryouaddorremove...

policiesthatarenewlyaddedareremovedandendpointprofilingpoliciesthatareupdatedarerevertedtothe
previousstate.Inaddition,theprofilerfeedserviceisautomaticallydisabled.
Whentheupdatesoccur,onlytheCiscoprovidedprofilingpoliciesandtheendpointprofilingpolicieswhich
weremodifiedbythepreviousupdate,areupdated.Ciscoprovideddisabledprofilingpoliciesarealsoupdated
buttheyremaindisabled.AdministratorCreatedorAdministratorModifiedprofilingpoliciesarenot...

Procedure
Step 1ChooseAdministration>Certificates>TrustedCertificates,andcheckifVerisignClass3PublicPrimary
CertificationAuthorityandVerisignClass3ServerCA-G3areenabled.
Step 2ChooseAdministration>FeedService>Profiler.
Step 3ChecktheEnableProfilerFeedServicecheckbox.
Step 4EntertimeinHH:MMformat(localtimezoneoftheCiscoISEserver)intheFeedServiceSchedulersection.
Bydefault,CiscoISEfeedserviceisscheduledat1.00AMeveryday.
Step...

Procedure
Step 1ChooseAdministration>FeedService>Profiler.
Step 2ChecktheEnableProfilerFeedServicecheckbox.
Step 3ClickGotoUpdateReportPageifyouwanttoviewtheconfigurationchangesmadeintheChange
ConfigurationAuditreport.
Step 4ClickUndoLatest.
Profiler Reports
CiscoISEprovidesyouwithvariousreportsonendpointprofiling,andtroubleshootingtoolsthatyoucanuse
tomanageyournetwork.Youcangeneratereportsforhistoricalaswellascurrentdata.Youmaybeableto...

CHAPTER 22
Configure Client Provisioning
•ConfigureClientProvisioninginCiscoISE,page522
•ClientProvisioningResources,page523
•AddClientProvisioningResourcesfromCisco,page523
•AddCiscoProvidedClientProvisioningResourcesfromaLocalMachine,page524
•AddCustomerCreatedResourcesforAnyConnectfromaLocalMachine,page525
•CreateNativeSupplicantProfiles,page525
•CreateAnyConnectConfiguration,page527
•CreateAnyConnectandCiscoNACAgentProfiles,page528
•AgentProfileConfigurationGuidelines,page529...

Configure Client Provisioning in Cisco ISE
Enableclientprovisioningtoallowuserstodownloadclientprovisioningresourcesandconfigureagent
profiles.YoucanconfigureagentprofilesforWindowsclients,MacOSXclients,andnativesupplicant
profilesforpersonaldevices.Ifyoudisableclientprovisioning,usersattemptingtoaccessthenetworkwill
receiveawarningmessageindicatingthattheyarenotabletodownloadclientprovisioningresources.
Before You Begin...

Client Provisioning Resources
Clientprovisioningresourcesaredownloadedtoendpointsaftertheendpointconnectstothenetwork.Client
provisioningresourcesconsistofcomplianceandpostureagentsfordesktops,andnativesupplicantprofiles
forphonesandtablets.Clientprovisioningpoliciesassigntheseprovisioningresourcestoendpointstostart
anetworksession.
ClientprovisioningresourcesarelistedonPolicyElements>Results>ClientProvisioning>Resources.
ThefollowingresourcetypescanbeaddedtothelistbyclickingtheAddbutton:...

Procedure
Step 1ChoosePolicy>PolicyElements>Results>ClientProvisioning>Resources.
Step 2ChooseAdd>AgentresourcesfromCiscosite.
Step 3SelectoneormorerequiredclientprovisioningresourcesfromthelistavailableintheDownloadRemote
Resourcesdialogbox.
Step 4ClickSave.
What to Do Next
AfteryouhavesuccessfullyaddedclientprovisioningresourcestoCiscoISE,youcanbegintoconfigure
clientprovisioningresourcepolicies.
Add Cisco Provided Client Provisioning Resources from a Local Machine...