Single SSID - Multi VLAN - FlexConnect

An configuration example that I feel is under documented and not particularly clear is how to deploy a single SSID on a cisco WLC with ISE authentication on multiple VLANs based on authorization profiles.

It is actually very simple.

1st:

You build out you ISE policies just as you would for Wired.1x or Wireless.1x and make sure to add the VLAN assignment to the authorization result that you match.

2nd:

On your WLC, make sure that your SSID has the box for Flexconnect local switching checked and AAA override checked on the advanced tab.  

Make sure that you AP has VLAN support turned on and a local VLAN (Native) configured.

3rd:

Create a flexconnect group on your WLC from the wireless tab and add your APs to that group.

From the AAA VLAN-ACL mapping tab, create all of the VLANs that you will need to add users to from dynamic ISE assignments. 

This will cause sub-interfaces to be auto-generated on all of your APs in that flexconnect group.

Finally:

Test a user/device that ISE will assign to one of the VLANs and verify that they are authenticated and placed into the desired VLAN.  If everything connects you are good to go.

ISE

WLC

TIPS:

Make sure your VLANs are extended to the switch that the AP is connected to.

Make sure the WLC is running code level 7.4 or higher.

Network Engineers need Linux

Although I am my no means an expert in Linux (yet), I have done the swap.  I have dropped Windows for a Mint 17.3 Linux.  Since I work in the network consulting realm, it does make things (some things) a little simpler.  I am a fan of Windows 10, but the good about Linux far out weighs the good about Windows.

Benefits:

• Become more familiar with commands that are regularly used to install and troubleshoot Cisco and other vendor appliances
• terminal services are much more fluid and many variants are available
• VIRL and GNS3, in my opinion, run much more efficiently on Linux.
• Over all performance increase 
• Less bloat in my OS
• The new Linux distros' GUIs are as good as, if not better than Windows
• IT'S FREE!

Drawbacks:

• Visio and a few other office like products
• I like Outlook much better than Thunderbird or Evolution

*** I still have Windows 10 installed on my hard drive for now if I need to use certain applications

More info on current Linux distributions: Click Here

More info on Mint: Click Here

WPA(WPA2)-PSK not supported for ISE guest CWA?

I ran across this one very recently. 

If you are using ISE for CWA, then you are "limited" in what you can do from and SSID security standpoint.
Basic constraints:

• Set Layer2 security to None with MAC filtering. 
• Select the ISE IP address for both Authentication and Accounting Servers. 
• Advanced tab, enable AAA Override and set the Network Admission Control (NAC) State to RADIUS NAC (CoA support)

This means that you cannot use a PSK when you want to do central web auth with ISE.  Its sounds bad (unsecure) until you think about the security mechanisms behind it.  

• Your guest VLAN should not have access to anything besides the internet once authenticated.  
• All devices must get registered in ISE before they can authentication, so even if an unencrypted packet is sniffed, the device still gets redirected to the Guest portal page.  
• Absolute worst case, the "hacker" gets on your guest network: your guest VLAN ACLs peel them off to the internet only and you disallow peer to peer communication on the SSID.

I realize this might make some people uncomfortable with "no security" in the SSID, but keep in mind that this is for guest only and ISE is validating clients.

Links to ISE/WLC Guest Configuration:

ISE 1.3 CWA DOC

Cisco ISE Fail Open Ports

One thing that you have to to consider when installing ISE in an organization is complete ISE failure.  In this scenario ISE has failed because of complete power outage or network access to ISE has been removed and no access can be granted to end devices.  This could in effect shut down your entire company.  This is a very big problem when dealing with a multi-site business with a singular data center.

On your switch ports, add the following command to your standard 802.1x config:
authentication event server dead action authorize vlan X

This command will grant access and dump all traffic on the specified VLAN in the event of total ISE failure/unreachability.

ISE and iPads

I do a lot of customer site install these days.  There are varying levels of infrastructure at all of them so here is a solution I ran into recently.

Needs:
ISE authentication for Wired Domain Joined PC
ISE authentication for Wired Non-Domain Joined (printers)
ISE authentication for Wireless Domain Joined PC
ISE authentication for Wireless Non-Domain Joined (ipad, iphone, scan gun)

Most of this is straight forward.

For starters they wanted to use Certificate authentication.  This worked great for all of the domain joined PCs, wired and wireless alike.  I simply allowed EAP-TLS connections only for each and used computer based authentication with a machine cert validation.  I pushed out the machine certs with a GPO and did the roll out the following week.  Piece of cake.

MAB was an easy solution for all of the printers, scanners, and misc devices in the manufacturing/warehouse areas.

The issue came in when they wanted secure access via their iPads.  Had these devices been domain joined it would have been simple.  Issue them a machine cert.  Alternately I could have used NDES to join the iPads (but they're running windows server 2008 standard... Not NDES).  A third option would be to manually generate certs for each device (not an option, too many and spread out across the country).

My solution was to add all users that needed WiFi via iPads into an AD group.  I then profiled all apple devices joining the network and created an identity group mapping.

My policy was simple and just required that after a cert failure, check to see if the devices has been profile as an apple-device and that the user is a member of the ipadUser group.  Not as secure as certificates or checking for domain joined machines, but a lot better than just allow all devices coming and going onto the corp-WiFi.