1. Basic Setup with Review - (Configuring 802.
1x Authentication with ISE & AD)
2. Guest - HotSpot
3. Guest - Sponsor Portal
4. MAB for APs
5. Mobility Express
6. Device Administration with ISE
7. ATF
8. Clear Air Configurations
-----------------------------------------------
===============================================
Base Configuration
===============================================
-----
CAT1
-----
vlan 10-15,20,30
exit
!
Interface vlan 101
ip address [Link] [Link]
no shut
!
default interface range gig 1/0/10-11
!
Interface range gig 1/0/10-11
channel-group 21 mode on
no shut
!
Interface port-channel 21
switchport mode trunk
!
Interface vlan 10
ip address [Link] [Link]
no shut
!
Interface gig 1/0/1
switchport mode access
switchport access vlan 11
!
Interface vlan 11
ip address [Link] [Link]
no shut
!
Interface vlan 15
ip address [Link] [Link]
no shut
!
Interface vlan 20
ip address [Link] [Link]
no shut
!
Interface vlan 13
ip address [Link] [Link]
no shut
!
ip dhcp excluded-address [Link] [Link]
ip dhcp excluded-address [Link] [Link]
ip dhcp excluded-address [Link] [Link]
ip dhcp excluded-address [Link] [Link]
ip dhcp excluded-address [Link] [Link]
ip dhcp excluded-address [Link] [Link]
!
ip dhcp pool AP1
network [Link] /24
default-router [Link]
dns-server [Link]
option 43 hex f104.0A00.0A15
!
ip dhcp pool AP2
network [Link] /24
default-router [Link]
dns-server [Link]
!
ip dhcp pool AP3
network [Link] /24
default-router [Link]
dns-server [Link]
option 43 hex f104.0A00.0A15
!
ip dhcp pool EXECS
network [Link] /24
default-router [Link]
dns-server [Link]
!
ip dhcp pool EMPLOYEES
network [Link] /24
default-router [Link]
dns-server [Link]
!
ip dhcp pool GUESTS
network [Link] /24
default-router [Link]
dns-server [Link]
!
no router eigrp 1
router eigrp 111
network [Link]
passive-interface default
no passive-interface vlan 13
-----
CAT2
-----
vlan 10-15,20,30
exit
!
default interface range gig 1/0/10-11
!
Interface range gig 1/0/10-11
channel-group 21 mode on
no shut
!
Interface port-channel 21
switchport mode trunk
!
Interface vlan 14
ip address [Link] [Link]
no shut
!
Interface gig 1/0/3
switchport mode access
switchport access vlan 12
!
Interface vlan 12
ip address [Link] [Link]
ip helper-address [Link]
no shut
!
Interface vlan 13
ip address [Link] [Link]
no shut
!
Interface vlan 30
ip address [Link] [Link]
ip helper-address [Link]
no shut
!
Interface vlan 40
ip address [Link] [Link]
ip helper-address [Link]
no shut
!
Interface loopback0
ip address [Link] [Link]
!
no router eigrp 1
router eigrp 111
network [Link]
network [Link]
passive-interface default
no passive-interface vlan 13
==================================================
Basic Wireless Network with ISE and AD Integration
==================================================
***************************************
WLC
***************************************
----------------------------------
1. Configure the VLAN Interfaces
----------------------------------
Controller -> Interfaces
Name: execs - VLAN 20
Name: employees - VLAN 30
Name: guests - VLAN 40
-------------------------------------------
2. Configure the relationship towards ISE
-------------------------------------------
Security -> AAA -> RADIUS -> Authentication
Security -> AAA -> RADIUS -> Accounting
-------------------------------------------
3. Configure the WLAN using ISE
-------------------------------------------
WLAN -> Create New
General
Name: ABC Profile
SSID: ABC
Enabled: Checked
Interface: management
Security:
Layer2 : WPA+WPA2 (Default)
AAA Server Tab:
RADIUS Server Overwrite Interface : checked
Authentication Server: [Link]
Accounting Server : [Link]
Advanced Tab:
Allow AAA Override : Checked
***************************************
ISE
***************************************
---------------------------------------
1. Configure the relationship with WLC
---------------------------------------
Administration -> Network Resources -> Network Device Groups -> Add
Name: HQ-WLCs
Administration -> Network Resources -> Network Devices -> Add
Name: WLC1
IP Address: [Link]
Network Device Group: HQ-WLCs
Protocol : RADIUS
Key: cisco123
---------------------------------------
2. Configure integration with AD
---------------------------------------
A. Administration -> Identity Management -> Exernal Identity Sources -> Active
Directory -> Add
B. Administration -> Identity Management -> Exernal Identity Sources -> Active
Directory -> Groups
C. Administration -> Identity Management -> Exernal Identity Sources ->
Certification Authentication Profile -> Preloaded Ceritficate Profile
D. Administration -> Identity Management -> Identity Source Sequence ->
All_User_ID_Stores
---------------------------------------
3. Configure the Authorization Profiles
---------------------------------------
Policy -> Policy Elements -> Results -> Authorization -> Authorization Profile ->
Add
Name: EXECS-PROFILE
VLAN: 20
Name: EMPLOYEES-PROFILE
VLAN: 30
-----------------------------------------------------------------------------
4. Configure the Authorization Policy to link the conditions to the Profile
-----------------------------------------------------------------------------
Policy -> Authorization -> Insert
Name: EXECS-POLICY
Conditions:
AD-ABC:ExternalGroup equals adgroup1 [AD Group]
RADIUS:Called-Station endswith ABC [SSID]
Wireless_802.1x [Specifying the Condition for Wireless Users]
Device:DeviceType equals HQ-WLCs [The WLC or WLC Group]
Permission : EXECS-PROFILE [Assigns a user that meets the above req. to
VLAN 20]
=========================================
2. Guest - HotSpot
=========================================
------
WLC
------
---------------------------------
1. Create the ACL for Pre-Auth
---------------------------------
Security -> Access Control Lists -> Access Control List
Name: ISE
Permit to communicate to DHCP, DNS and ISE only. This is the Pre-Auth ACL.
------------------------------------
2. Create a special SSID for GUESTS
------------------------------------
Name: GUESTS
SSID: GUEST
Interface: guests
Enabled: Checked
Security Tab:
Layer 2: None; MAC Filtering
AAA Server Tab:
Authentication and Accounting Server: [Link] (ISE)
Advanced Tab:
Check "Allow AAA Override"
NAC State: ISE_NAC
------
ISE
------
--------------------------------------------------------------------
1. Add the Guest VLAN Interface of WLC as a Client address to WLC1
--------------------------------------------------------------------
Administration -> Network Resources -> Network Devices -> WLC1 -> Edit
Add : [Link]
--------------------------------------------------------------------
2. Create the HOTSPOT Guest Portal
--------------------------------------------------------------------
Work Centers -> Guest Access -> Portals and Components -> Guest Portals -> Create -
> Hotspot
Name:ABC-HotSpot
AUP Page Settings:
Require Code: Cisco123
Save
--------------------------------------------------------------------
3. Create an Authorization Profile
--------------------------------------------------------------------
Policy -> Policy Elements -> Results -> Authorization -> Authorization Profile ->
Add
Name: ABC-GUEST-HOTSPOT
Web Redirection:
Type: HotSpot
ACL: ISE
Value:ABC-HotSpot
Save
--------------------------------------------------------------------
4. Create Authorization Policies
--------------------------------------------------------------------
Policy -> Authorization -> Insert
Name:GUEST-ACCESS
Condition: EndpointGroup = GuestEndpoint
Permission: PermitAccess
Name:GUEST-AUTHENTICATION
Condition:Wireless_MAB
RADIUS:called-station endswith GUEST
Permission: ABC-GUEST-HOTSPOT
=========================================
3. Guest - Sponsor Portal
=========================================
------------------------------------------------------------------------
1. Create the Group and User Accounts for Creating the Guest Accounts
------------------------------------------------------------------------
Administration -> Identity Management -> Groups -> EndUser Identity Groups -> Add
Name: ABC-SponsorGroup
Administration -> Identity Management -> Identities -> Add
Name: khawar
Password: Cisco123*
Group: ABC-SponsorGroup
------------------------------------------------------------------------
2. Create a location which helps in control time/date of login for Guest
------------------------------------------------------------------------
Work Centers -> Guest Access -> Settings -> Guest Location and SSIDs
Name: Chicago
Timezone: CST6
------------------------------------------------------------------------
3. Create the Guest Type
------------------------------------------------------------------------
Work Centers -> Guest Access -> Portals & Components -> Guest Types -> Create
Name: ChicagoGuests
Configure the limits for the Guest like the number of simultaneous Logins....
------------------------------------------------------------------------
4. Create the Sponsor Groups
------------------------------------------------------------------------
Work Centers -> Guest Access -> Portals & Components -> Sponsor Groups -> Create
Name:ChicagoSponsors
Members: ABC-SPONSOR-GROUP
Guest Type that can be created: ChicagoGuests
Locations: Chicago
------------------------------------------------------------------------
5. Login as Sponsor to create the accounts
------------------------------------------------------------------------
Work Centers -> Guest Access -> Portals & Components -> Sponsor Portal -> default
FirstName: Ccie
LastName: Wireless1
Account: CWireless1/7902 (Automatically Created)
FirstName: Ccie
LastName: Wireless2
Account: CWireless2/8804 (Automatically Created)
------
WLC
------
---------------------------------
1. Create the ACL for Pre-Auth
---------------------------------
Security -> Access Control Lists -> Access Control List
Name: ISE
Permit to communicate to DHCP, DNS and ISE only. This is the Pre-Auth ACL.
------------------------------------
2. Create a special SSID for GUESTS
------------------------------------
Name: GUESTS
SSID: GUEST
Interface: guests
Enabled: Checked
Security Tab:
Layer 2: None; MAC Filtering
AAA Server Tab:
Authentication and Accounting Server: [Link] (ISE)
Advanced Tab:
Check "Allow AAA Override"
NAC State: ISE_NAC
--------
ISE
--------
-------------------------------------------------------------------
1. Create the Sponsor Guest Portal
--------------------------------------------------------------------
Work Centers -> Guest Access -> Portals and Components -> Guest Portals -> Create -
> SponsorPortal
Name:ABC-SponsorPortal
Portal Settings:
Employess using this portal as : ChicagoGuests
Login Page:
Include AUP
Save
--------------------------------------------------------------------
2. Create an Authorization Profile
--------------------------------------------------------------------
Policy -> Policy Elements -> Results -> Authorization -> Authorization Profile ->
Add
Name: ABC-GUEST-SponsorPortal
Web Redirection:
Type: Centralized Web Auth
ACL: ISE
Value:ABC-SponsorPortal
Save
--------------------------------------------------------------------
4. Create Authorization Policies
--------------------------------------------------------------------
Policy -> Authorization -> Insert
Name:GUEST-ACCESS
Condition: EndpointGroup = GuestEndpoint
Permission: PermitAccess
Name:GUEST-AUTHENTICATION
Condition:Wireless_MAB
RADIUS:called-station endswith GUEST
Permission: ABC-GUEST-Sponsor-Portal
===============================================
4. MAB for AP to authenticate based on ISE
===============================================
1. Copy the AP MAC address.
- You can copy it from WLC or Switch "Show mac address-table"
2. Create an identity group for Endpoints
Administration -> Identity Management -> Groups -> EndPoint Groups -> Add
Name: LEGIT-APs
3. Create the Endpoint and assign it to the Groups.
Context Visibility -> Endpoints -> Add
MAC: [Link]
Static Group Assignment : LEGIT-APs
4. Create the Policy
Policy -> Authorizations -> Insert
Name: LEGIT-AP-POLICY
Identity Group: LEGIT-APs
Condition: Wired-MAB
Permission: Permit Access
5. Create an Network Device for the Switch
Administration -> Network Resources -> Network Devices -> Add
Name: CAT1
IP Address: [Link]
Protocol: RADIUS
Key: cisco123
Submit
6. Configure the Switch for MAB
aaa new-model
!
radius server ISE
address ipv4 [Link] auth-port 1812 acct-port 1813
key cisco123
!
aaa group server radius RAD-AUTH
server name ISE
!
aaa authentication dot1x default group RAD-AUTH
aaa authorization network default group RAD-AUTH
!
dot1x system-auth-control
!
int gig 1/0/1
authentication order mab dot1x
authentication priority mab dot1x
mab
authentication port-control auto
no shut
==================================
5. Mobility Express
==================================
-----------------------------------------------------------------------
1. Configure the Switchport as a Trunk with a VLAN (FlexConnect type)
-----------------------------------------------------------------------
------
CAT1
------
Interface Gig 1/0/2
switchport mode trunk
switchport trunk native vlan 15
-----------------------------------------------------------------------
2. Configure the AP to load the ME Capable Image
-----------------------------------------------------------------------
------
CAT1
------
ap-type mobility-express
Note: It will reload as an AP. If there is not Controller on the segment, it will
also load the controller.