Cisco Ise 13 User Guide
Have a look at the manual Cisco Ise 13 User Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 53 Cisco manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
Cisco Identity Services Engine Administrator Guide, Release 1.3
First Published: 2014-10-31
Last Modified: 2014-10-31
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
THESPECIFICATIONSANDINFORMATIONREGARDINGTHEPRODUCTSINTHISMANUALARESUBJECTTOCHANGEWITHOUTNOTICE.ALLSTATEMENTS,INFORMATION,ANDRECOMMENDATIONSINTHISMANUALAREBELIEVEDTOBEACCURATEBUTAREPRESENTEDWITHOUTWARRANTYOFANYKIND,EXPRESSORIMPLIED.USERSMUSTTAKEFULLRESPONSIBILITYFORTHEIRAPPLICATIONOFANYPRODUCTS. THESOFTWARELICENSEANDLIMITEDWARRANTYFORTHEACCOMPANYINGPRODUCTARESETFORTHINTHEINFORMATIONPACKETTHATSHIPPEDWITHTHEPRODUCTANDAREINCORPORATEDHEREINBYTHISREFERENCE.IFYOUAREUNABLETOLOCATETHESOFTWARELICENSEORLIMITEDWARRANTY,CONTACTYOURCISCOREPRESENTATIVEFORACOPY. TheCiscoimplementationofTCPheadercompressionisanadaptationofaprogramdevelopedbytheUniversityofCalifornia,Berkeley(UCB)aspartofUCB'spublicdomainversionoftheUNIXoperatingsystem.Allrightsreserved.Copyright©1981,RegentsoftheUniversityofCalifornia. NOTWITHSTANDINGANYOTHERWARRANTYHEREIN,ALLDOCUMENTFILESANDSOFTWAREOFTHESESUPPLIERSAREPROVIDED“ASIS"WITHALLFAULTS.CISCOANDTHEABOVE-NAMEDSUPPLIERSDISCLAIMALLWARRANTIES,EXPRESSEDORIMPLIED,INCLUDING,WITHOUTLIMITATION,THOSEOFMERCHANTABILITY,FITNESSFORAPARTICULARPURPOSEANDNONINFRINGEMENTORARISINGFROMACOURSEOFDEALING,USAGE,ORTRADEPRACTICE. INNOEVENTSHALLCISCOORITSSUPPLIERSBELIABLEFORANYINDIRECT,SPECIAL,CONSEQUENTIAL,ORINCIDENTALDAMAGES,INCLUDING,WITHOUTLIMITATION,LOSTPROFITSORLOSSORDAMAGETODATAARISINGOUTOFTHEUSEORINABILITYTOUSETHISMANUAL,EVENIFCISCOORITSSUPPLIERSHAVEBEENADVISEDOFTHEPOSSIBILITYOFSUCHDAMAGES. AnyInternetProtocol(IP)addressesandphonenumbersusedinthisdocumentarenotintendedtobeactualaddressesandphonenumbers.Anyexamples,commanddisplayoutput,networktopologydiagrams,andotherfiguresincludedinthedocumentareshownforillustrativepurposesonly.AnyuseofactualIPaddressesorphonenumbersinillustrativecontentisunintentionalandcoincidental. CiscoandtheCiscologoaretrademarksorregisteredtrademarksofCiscoand/oritsaffiliatesintheU.S.andothercountries.ToviewalistofCiscotrademarks,gotothisURL:http:// www.cisco.com/go/trademarks.Third-partytrademarksmentionedarethepropertyoftheirrespectiveowners.TheuseofthewordpartnerdoesnotimplyapartnershiprelationshipbetweenCiscoandanyothercompany.(1110R) ©2014CiscoSystems,Inc.Allrightsreserved.
CONTENTS Preface Prefacexliii Purposexliii Audiencexliii DocumentOrganizationxliii DocumentConventionsxliv DocumentationUpdatesxlv ObtainingDocumentationandSubmittingaServiceRequestxlv PART I Introduction1 CHAPTER 1 CiscoISEFeatures3 CiscoISEOverview3 KeyFunctions4 Identity-BasedNetworkAccess4 SupportforMultipleDeploymentScenarios4 SupportforUCSHardware5 BasicUserAuthenticationandAuthorization5 PolicySets6 SupportforCommonAccessCardFunctions6 ClientPostureAssessment7 NetworkAccessforGuests7 SupportforPersonalDevices7 MobileDeviceManagerInteroperabilitywithCiscoISE8 WirelessandVPNTrafficwithInlinePostureNodes8 ProfiledEndpointsontheNetwork8 pxGridPersona8 CiscoISECertificateAuthority9 Cisco Identity Services Engine Administrator Guide, Release 1.3 iii
SupportforActiveDirectoryMultidomainForests9 SupportforSAnetDevices9 SupportforInstallationonMultipleHardwareandVMwarePlatforms9 CHAPTER 2 NavigatetheAdminportal11 AdminPortal12 CiscoISEDashboard13 SetupAssistant14 CiscoISELicensingImpactonSetupAssistant14 RuntheSetupAssistant14 SetupAssistantOverwritesPreviousConfigurations15 IdentifyPolicyRequirementsPageinSetupAssistant15 ConfigureNetworkAccessServicePageinSetupAssistant16 SelectNetworkDeviceTypesPageinSetupAssistant18 ReviewandConfirmYourChoicesPageinSetupAssistant18 FilterDataonListingPages18 DataFiltersinListingPages19 CustomizetheDisplayedFieldAttributes19 FilterDatabyFieldAttributesUsingtheQuickFilter19 FilterDatabyConditionsUsingtheAdvancedFilter19 CreateCustomFilters20 CiscoISEInternationalizationandLocalization20 SupportedLanguages20 SupportforUTF-8CharacterDataEntry21 UTF-8CredentialAuthentication21 UTF-8PoliciesandPostureAssessment22 CiscoNACandMACAgentUTF-8Support22 UTF-8SupportforMessagesSenttoSupplicant22 ReportsandAlertsUTF-8Support22 UTF-8CharacterSupportinthePortals23 UTF-8SupportOutsidetheUserInterface25 SupportforImportingandExportingUTF-8Values26 UTF-8SupportonREST26 UTF-8SupportforIdentityStoresAuthorizationData26 MACAddressNormalization26 Cisco Identity Services Engine Administrator Guide, Release 1.3 iv Contents
AdminFeaturesLimitedbyRole-BasedAccessControlPolicies27 PART II DeployCiscoISENodes29 CHAPTER 3 SetUpCiscoISEinaDistributedEnvironment31 CiscoISEDeploymentTerminology31 PersonasinDistributedCiscoISEDeployments32 CiscoISEDistributedDeployment32 CiscoISEDeploymentSetup32 DataReplicationfromPrimarytoSecondaryISENodes33 CiscoISENodeDeregistration33 GuidelinesforSettingUpaDistributedDeployment33 MenuOptionsAvailableonPrimaryandSecondaryNodes34 ConfigureaCiscoISENode35 ConfigureaPrimaryPAN36 RegisteraSecondaryCiscoISENode36 AdministrationNode38 HighAvailabilityfortheAdministrativeNode38 ManuallyPromoteSecondaryPANToPrimary39 PolicyServiceNode40 HighAvailabilityinPolicyServiceNodes40 LoadBalancerToDistributeRequestsEvenlyAmongPSNs40 SessionFailoverinPolicyServiceNodes41 NumberofNodesinaPolicyServiceNodeGroup41 MonitoringNode41 AutomaticFailoverinMonitoringNodes42 pxGridNode43 pxGridClientandCapabilityManagement44 EnablepxGridClients44 CiscopxGridLiveLogs44 ISEpxGridIdentityMapping45 ConfigureIdentityMapping46 FilterIdentityMapping47 InlinePostureNode47 InlinePostureNodeInstallation47 Cisco Identity Services Engine Administrator Guide, Release 1.3 v Contents
RegisteranInlinePostureNode48 ViewNodesinaDeployment48 SynchronizePrimaryandSecondaryCiscoISENodes49 ChangeNodePersonasandServices49 EffectsofModifyingNodesinCiscoISE50 CreateaPolicyServiceNodeGroup50 DeploypxGridNode51 ConfigureMonitoringNodesforAutomaticFailover51 RemoveaNodefromDeployment52 ChangetheHostnameorIPAddressofaStandaloneCiscoISENode53 ReplacetheCiscoISEApplianceHardware53 CHAPTER 4 SetUpInlinePosture55 RoleofInlinePostureNodeinaCiscoISEDeployment55 InlinePosturePolicyEnforcement56 InlinePosturePolicyEnforcementFlow56 TrustedandUntrustedInterfaces58 DedicatedNodesRequiredforInlinePosture58 StandaloneInlinePostureNodeinaCiscoISEDeployment58 InlinePostureHighAvailability58 AutomaticFailoverinInlinePostureNodes59 InlinePostureOperatingModes59 InlinePostureRoutedMode60 InlinePostureBridgedMode60 InlinePostureMaintenanceMode61 InlinePostureHighAvailabilityinRoutedandBridgedModes61 BestPracticesforInlinePostureDeployment62 InlinePostureNodeGuidelines63 InlinePostureNodeAuthorization66 DeployanInlinePostureNode68 ConfigureanInlinePostureNode68 CreateInlinePostureDownloadableAccessControlLists71 CreateInlinePostureNodeProfiles72 CreateanInlinePostureAuthorizationPolicy72 ConfigureaHigh-AvailabilityPair73 Cisco Identity Services Engine Administrator Guide, Release 1.3 vi Contents
SynchronizeanInlinePostureNode75 ConfigureInlinePostureNodeasRADIUSClientinAdministrationNode75 RemoveanInlinePostureNodefromDeployment76 HealthofanInlinePostureNode76 RemoteAccessVPNUseCase77 ConfigureanInlinePostureNodewithaVPNDevice78 CollectionofInlinePostureNodeLogs78 KclickprocessinInlinePostureNode79 PART III SetupCiscoISEManagementAccess81 CHAPTER 5 AdministerCiscoISE83 LogintoCiscoISE83 AdministratorLoginBrowserSupport84 AdministratorLockoutFollowingFailedLoginAttempts84 SpecifyProxySettingsinCiscoISE84 PortsUsedbytheAdminPortal85 EnableExternalRESTfulServicesAPIs85 ExternalRESTfulServicesSDK86 SpecifySystemTimeandNTPServerSettings86 ChangetheSystemTimeZone87 ConfigureSMTPServertoSupportNotifications88 InstallaSoftwarePatch88 CiscoSoftwarePatches89 SoftwarePatchInstallationGuidelines89 RollBackSoftwarePatches90 SoftwarePatchRollbackGuidelines90 ViewPatchInstallandRollbackChanges91 FIPSModeSupport91 ConfigureCiscoISEforAdministratorCACAuthentication91 SupportedCommonAccessCardStandards93 CommonAccessCardOperationinCiscoISE93 SecuringSSHKeyExchangeUsingDiffie-HellmanAlgorithm94 ConfigureCiscoISEtoSendSecureSyslog94 ConfigureSecureSyslogRemoteLoggingTarget94 Cisco Identity Services Engine Administrator Guide, Release 1.3 vii Contents
EnableLoggingCategoriestoSendAuditableEventstotheSecureSyslogTarget95 DisabletheTCPSyslogandUDPSyslogCollectors96 OfflineMaintenance96 CHAPTER 6 ManageAdministratorsandAdminAccessPolicies97 Role-BasedAccessControl97 CiscoISEAdministrators97 PrivilegesofaCLIAdministratorVersusaWeb-BasedAdministrator98 CreateaNewCiscoISEAdministrator98 CiscoISEAdministratorGroups99 CreateAdminGroups105 AdministrativeAccesstoCiscoISE106 Role-BasedAccessControlinCiscoISE106 Role-BasedPermissions106 RBACPolicies106 DefaultMenuAccessPermissions107 ConfigureMenuAccessPermissions108 DefaultDataAccessPermissions108 ConfigureDataAccessPermissions109 ConfigureAdminAccessPolicies109 AdministratorAccessSettings110 ConfiguretheMaximumNumberofConcurrentAdministrativeSessionsandLogin Banners110 AllowAdministrativeAccesstoCiscoISEfromSelectIPAddresses111 ConfigureaPasswordPolicyforAdministratorAccounts111 ConfigureSessionTimeoutforAdministrators112 TerminateanActiveAdministrativeSession113 ChangeAdministratorName113 AdministrativeAccesstoCiscoISEUsinganExternalIdentityStore114 ExternalAuthenticationandAuthorization114 ExternalAuthenticationProcessFlow114 ConfigureaPassword-BasedAuthenticationUsinganExternalIdentityStore115 CreateanExternalAdministratorGroup115 ConfigureMenuAccessandDataAccessPermissionsfortheExternalAdministrator Group116 Cisco Identity Services Engine Administrator Guide, Release 1.3 viii Contents
CreateanRBACPolicyforExternalAdministratorAuthentication116 ConfigureAdminAccessUsinganExternalIdentityStoreforAuthenticationwith InternalAuthorization117 CHAPTER 7 CiscoISELicenses119 CiscoISELicenses119 LicenseConsumption121 ViewLicenseConsumption122 UnregisteredLicenseConsumption122 ManageLicenseFiles123 RegisterLicenses123 Re-HostLicenses124 RenewLicenses124 MigrateandUpgradeLicenses124 RemoveLicenses125 CHAPTER 8 ManageCertificates127 CertificateManagementinCiscoISE127 CertificatesEnableCiscoISEtoProvideSecureAccess127 CertificateUsage128 CertificateMatchinginCiscoISE129 ValidityofX.509Certificates130 EnablePKIinCiscoISE130 WildcardCertificates131 WildcardCertificateSupportinCiscoISE132 WildcardCertificatesforHTTPSandEAPCommunication132 FullyQualifiedDomainNameinURLRedirection133 AdvantagesofUsingWildcardCertificates134 DisadvantagesofUsingWildcardCertificates134 WildcardCertificateCompatibility135 SystemCertificates135 ViewSystemCertificates136 ImportaSystemCertificate136 GenerateaSelf-SignedCertificate137 EditaSystemCertificate138 Cisco Identity Services Engine Administrator Guide, Release 1.3 ix Contents
ExportaSystemCertificate138 TrustedCertificatesStore139 CertificatesinTrustedCertificatesStore140 TrustedCertificateNamingConstraint140 ViewTrustedStoreCertificates141 ChangetheStatusofaCertificateinTrustedCertificatesStore141 AddaCertificatetoTrustedCertificatesStore142 EditaTrustedCertificate142 ExportaCertificatefromtheTrustedCertificatesStore143 ImporttheRootCertificatestotheTrustedCertificateStore143 CertificateChainImport144 CertificateSigningRequests144 CreateaCertificateSigningRequestandSubmittheCSRtoaCertificate Authority144 BindtheCA-SignedCertificatetotheCSR145 ExportaCertificateSigningRequest146 InstallTrustedCertificatesforCiscoISEInter-nodeCommunication146 SetUpCertificatesforPortalUse147 AssociatethePortalCertificateTagBeforeYouRegisteraNode148 UserandEndpointCertificateRenewal149 DictionaryAttributesUsedinPolicyConditionsforCertificateRenewal149 AuthorizationPolicyConditionforCertificateRenewal149 CWARedirecttoRenewCertificates150 ConfigureCiscoISEtoAllowUserstoRenewCertificates150 UpdatetheAllowedProtocolConfiguration150 CreateanAuthorizationPolicyProfileforCWARedirection151 CreateanAuthorizationPolicyRuletoRenewCertificates151 EnableBYODSettingsintheGuestPortal152 CertificateRenewalFailsforAppleiOSDevices152 CiscoISECAService152 CertificatesProvisionedonPrimaryPolicyAdministrationNodeandPolicyService Nodes153 SimpleCertificateEnrollmentProtocolProfiles154 EndpointCertificates154 BackupandRestoreofCiscoISECACertificatesandKeys154 Cisco Identity Services Engine Administrator Guide, Release 1.3 x Contents