b ise admin guide

Cisco Identity Services Engine Administrator Guide, Release 2.2
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

Contents
Cisco Identity Services Engine Administrator Guide, Release 2.2
ii
C O N T E N T S
Full Cisco Trademarks with Software License ?
P ART I
Introduction 51
C H A P T E R 1
Cisco ISE Features 1
Cisco ISE Overview 2
Key Functions 2
Identity-Based Network Access 3
Support for Multiple Deployment Scenarios
3
Support for UCS Hardware 3
Basic User Authentication and Authorization
3
Policy Sets 5
Support for Common Access Card Functions
5
Client Posture Assessment 5
Mobile Device Manager Interoperability with Cisco ISE 6
Profiled Endpoints on the Network 6
pxGrid Persona 6
TACACS+ Device Administration 7
Support for SXP 7
Third Party Device Support 7
Telemetry 8
IPv6 Support 8
Location Based Authorization 8
Cisco ISE Certificate Authority 9
Certificate Provisioning Portal 9

Contents
Cisco Identity Services Engine Administrator Guide, Release 2.2
iii
Certificate Template Extension 9
Cisco ISE Internal CA Issues Certificates to ASA VPN Users 9
Support for Active Directory Multidomain Forests 9
Support for Automatic Failover for the Administration Node 10
GUI-Based Upgrade 10
Technical Support Tunnel for Advanced Troubleshooting 10
C H A P T E R 2
C H A P T E R 3
Navigate the Admin portal 11
Administration Portal 11
Cisco ISE Home Dashboards 13
Configuring Home Dashboards 14
Context Visibility Views 15
Dashlets 17
Filtering Displayed Data in a View 18
Endpoint Actions in Dashlet Views 21
Attributes in Context Visibility 21
Cisco ISE Internationalization and Localization 22
Supported Languages 22
End-User Web Portal Localization 23
Support for UTF-8 Character Data Entry 23
UTF-8 Credential Authentication 23
UTF-8 Policies and Posture Assessment 24
Cisco NAC and MAC Agent UTF-8 Support 24
UTF-8 Support for Messages Sent to Supplicant 24
Reports and Alerts UTF-8 Support 24
UTF-8 Character Support in the Portals 25
UTF-8 Support Outside the Cisco ISE User Interface 28
Support for Importing and Exporting UTF-8 Values 28
UTF-8 Support on REST 28
UTF-8 Support for Identity Stores Authorization Data 29
MAC Address Normalization 29
What Is Wireless Setup 31
Configure Wireless Controllers in the Wireless Network 34

Contents
Cisco Identity Services Engine Administrator Guide, Release 2.2
iv
Active Directory with Wireless Setup 35
Guest Portals in Wireless Setup 36
Wireless Network Self-Registration Portal 37
Wireless Network Sponsored Guest Flow 37
Wireless Setup BYOD Flow - For Native Supplicant and Certificate Provisioning 37
802.1X Wireless Flow 39
Changes on Cisco ISE and Wireless Controller by the Wireless Setup flow 40
P ART II Deploy Cisco ISE Nodes 43
C H A P T E R 4 Set Up Cisco ISE in a Distributed Environment 45
Cisco ISE Deployment Terminology 45
Personas in Distributed Cisco ISE Deployments 46
Cisco ISE Distributed Deployment 46
Cisco ISE Deployment Setup 46
Data Replication from Primary to Secondary ISE Nodes 47
Cisco ISE Node Deregistration 47
Guidelines for Setting Up a Distributed Deployment 47
Menu Options Available on Primary and Secondary Nodes 48
Configure a Cisco ISE Node 49
Configure a Primary Policy Administration Node (PAN) 50
Install Trusted Certificates for Cisco ISE Inter Node Communication 50
Register a Secondary Cisco ISE Node 51
Administration Node 53
High Availability for the Administrative Node 53
High-Availability Health Check Nodes 54
Health Check Nodes 55
Automatic Failover to the Secondary PAN 55
Sample Scenarios when Automatic Failover is Avoided 56
Functionalities Affected by the PAN Automatic Failover Feature 57
Configure Primary PAN for Automatic Failover 58
Manually Promote Secondary PAN to Primary 59
Restoring Service to the Primary PAN 60
Policy Service Node 60

Contents
Cisco Identity Services Engine Administrator Guide, Release 2.2
v
High Availability in Policy Service Nodes 60
Load Balancer to Distribute Requests Evenly Among PSNs 61
Session Failover in Policy Service Nodes 61
Number of Nodes in a Policy Service Node Group 61
Monitoring Node 61
Manually Modify the MnT Role 62
Automatic Failover in MnT Nodes 62
Cisco pxGrid Node 63
Cisco pxGrid Client and Capability Management 65
Enable pxGrid Service 65
Enable pxGrid Capabilities 66
Deploy Cisco pxGrid Node 66
Cisco pxGrid Live Logs 66
Configure Cisco pxGrid Settings 67
Generate Cisco pxGrid Certificate 67
View Nodes in a Deployment 69
Synchronize Primary and Secondary Cisco ISE Nodes 69
Change Node Personas and Services 69
Effects of Modifying Nodes in Cisco ISE 70
Create a Policy Service Node Group 70
Configure MnT Nodes for Automatic Failover 71
Remove a Node from Deployment 72
Shut Down a Cisco ISE Node 73
Change the Hostname or IP Address of a Standalone Cisco ISE Node 73
Replace the Cisco ISE Appliance Hardware 74
P A R T III Setup Cisco ISE Management Access 75
C H A P T E R 5 Administer Cisco ISE 77
Administrator Access Console 77
Administrator Login Browser Support 78
Administrator Lockout Because of Login Attempts 78
Configure Proxy Settings in Cisco ISE 78
Ports Used by the Administration Portal 79