Cisco Ise 13 User Guide

Usage GuidelinesFields
Chooseoneofthefollowingformats:
•ASCII—TheKeyEncryptionKeymustbe16characters(bytes)long,and
theMessageAuthenticatorCodeKeymustbe20characters(bytes)long.
•Hexadecimal—TheKeyEncryptionKeymustbe32byteslong,andthe
MessageAuthenticatorCodeKeymustbe40byteslong.
KeyInputFormat
Related Topics
DefaultNetworkDeviceDefinitioninCiscoISE,onpage174
Third-PartyNetworkDeviceSupportinCiscoISE
NetworkDeviceGroups,onpage176
CreateaNetworkDeviceDefinitioninCiscoISE,onpage174...

Usage GuidelinesFields
ClickBrowsetothelocationofthecomma-separatedvaluefilethatyoumight
havecreatedorpreviouslyexportedfromanyCiscoISEdeployment.
YoucanimportnetworkdevicesinanotherCiscoISEdeploymentwithnewand
updatednetworkdevicesinformationusingimport.
File
CheckthischeckboxifyouwantCiscoISEtoreplaceexistingnetworkdevices
withthedevicesinyourimportfile.
Ifyoudonotcheckthischeckbox,newnetworkdevicedefinitionsthatare
availableintheimportfileareaddedtothenetworkdevicerepository.Duplicate...

Usage GuidelinesFields
EnterthedescriptionfortherootorthechildNetworkDeviceGroup.Description
EnterthetypefortherootNetworkDeviceGroup.
ForallsubsequentchildnetworkdevicegroupsundertherootNDG,thetypeis
inheritedfromtheparentNDGandthereforeallthechildNDGsunderarootNDG
willbeofthesametype.
IfthisNDGisarootNDG,thenthetypewillbeavailableasanattributeinthe
devicedictionary.Youcandefineconditionsbasedonthisattribute.Thenameof
theNDGisoneofthevaluesthatthisattributecantake.
Type
Related Topics...

Usage GuidelinesFields
CheckthischeckboxifyouwantCiscoISEtodiscontinueimportwhenit
encountersanerrorduringimport,butCiscoISEimportsnetworkdevice
groupsuntilthattimeofanerror.
Ifthischeckboxisnotcheckedandanerrorisencountered,theerroris
reported,andCiscoISEcontinuestoimportdevicegroups.
StopImportonFirstError
Related Topics
NetworkDeviceGroups,onpage176
NetworkDeviceAttributesUsedByCiscoISEinPolicyEvaluation,onpage177
ImportNetworkDeviceGroupsintoCiscoISE,onpage177
External RADIUS Server Settings...

Usage GuidelinesFields
SpecifytheformatyouwanttousetoentertheCiscoISEencryptionkey,sothat
itmatchestheconfigurationthatisavailableontheWLANcontroller.(Thevalue
youspecifymustbethecorrect[full]lengthforthekeyasdefinedbelow—shorter
valuesarenotpermitted.)
•ASCII—TheKeyEncryptionKeymustbe16characters(bytes)long,and
theMessageAuthenticatorCodeKeymustbe20characters(bytes)long.
•Hexadecimal—TheKeyEncryptionKeymustbe32byteslong,andthe
MessageAuthenticatorCodeKeymustbe40byteslong.
KeyInputFormat...

Usage GuidelinesFields
Checkthischeckboxtoenableaccountingintheremotepolicyserver.RemoteAccounting
CheckthischeckboxtoenableaccountinginCiscoISE.LocalAccounting
AdvancedAttributeSettings
Checkthischeckboxtostriptheusernamefromtheprefix.Forexample,ifthe
subjectnameisacme\userAandtheseparatoris\,theusernamebecomesuserA.
StripStartofSubject
NameuptotheFirst
Occurrenceofthe
Separator
Checkthischeckboxtostriptheusernamefromthesuffix.Forexample,ifthe...

Related Topics
CiscoISEActingasaRADIUSProxyServer,onpage424
DefineRADIUSServerSequences,onpage425
NAC Manager Settings
ThefollowingtabledescribesthefieldsontheNewNACManagerspage,whichyoucanusetoaddaNAC
Manager.Thenavigationpathforthispageis:Administration>NetworkResources>NACManagers.
Table 103: NAC Manager Settings
Usage GuidelinesFields
EnterthenameoftheCiscoAccessManager(CAM).Name
ClicktheStatuscheckboxtoenableRESTAPIcommunicationfromtheCiscoISE
profilerthatauthenticatesconnectivitytotheCAM.
Status...

Device Portal Management
Configure Device Portal Settings
Global Settings for Device Portals
ChooseWorkCenters>BYOD>Settings>EmployeeRegisteredDevicesorAdministration>Device
PortalManagement>Settings.
YoucanconfigurethefollowinggeneralsettingsfortheBYODandMyDevicesportals:
•EmployeeRegisteredDevices—Enterthemaximumnumberofdevicesthatanemployeecanregister
inRestrictemployeesto.Bydefault,thisvalueissetto5devices.
•RetryURL—EnteraURLthatcanbeusedtoredirectthedevicebacktoCiscoISEinRetryURLfor
onboarding....

ThetestportaldoesnotsupportRADIUSsessions,soyouwon'tseetheentireportal
flowforallportals.BYODandClientProvisioningareexamplesofportalsthatdepend
onRADIUSsessions.Forexample,aredirecttoanexternalURLwillnotwork.
Note
•LanguageFile—Eachportaltypesupports15languagesbydefault,whichareavailableasindividual
propertiesfilesbundledtogetherinasinglezippedlanguagefile.Exportorimportthezippedlanguage
filetousewiththeportal.Thezippedlanguagefilecontainsalltheindividuallanguagefilesthatyou...

◦Validcombinationsinclude,usingtheSponsorportalasanexample:
◦Sponsorportal:Port8443,Interface0,CertificatetagAandMyDevicesportal:Port8443,
Interface0,CertificategroupA.
◦Sponsorportal:Port8443,Interface0,CertificategroupAandMyDevicesportal:Port8445,
Interface0,CertificategroupB.
◦Sponsorportal:Port8444,Interface1,CertificategroupAandBlacklistportal:Port8444,
Interface0,CertificategroupB.
◦Invalidcombinationsinclude:
◦Sponsorportal:Port8443,Interface0,CertificategroupAandMyDevicesportal:8443,...