geek-300x3001-300x200

Cisco Champion nominations

Cisco started the Cisco Champion program for people who are passionate about (Cisco) Datacenter technologies and love to share their knowledge with the rest of the world by blogging, twittering and other social media.

The nominations are open until oct 31th and it’s possible to nominate me and all other great bloggers we all check out regularly.

How to nominate?

Send your nomination to cisco_champions@external.cisco.com and make sure the text “Data Center” is in the message body.

All nominations are appreciated!

More information about the Cisco Champion program can be found here:

http://www.cisco.com/web/about/facts_info/champions.html
http://blogs.cisco.com/datacenter/all-new-cisco-champions-for-data-center-nominations-now-open/

 

Cisco ISE Part 10: Profiling and posture

This is a Cisco ISE blog post series with some how-to’s for configuring the ISE deployment, This blog post series exists of 10 parts.

The blogpost Agenda:

Part 1: introduction
Part 2: installation
Part 3: Active Directory
Part 4: High Availability
Part 5: Configuring wired network devices
Part 6: Policy enforcement and MAB
Part 7: Configuring wireless network devices
Part 8: Inline posture and VPN
Part 9: Guest and web authentication
Part 10: Profiling and posture

This week, the last post in the Cisco ISE blog post series: Profiling and posture. For both features is the Cisco ISE advanced license required.

Profiler is a functionality for discovering, locating and determing the capabilities of the attached endpoints. It will detect the network type and will authorize it.

A sensor in the network captures network packets by quering the NADs, it forwards the attributes to the analyzer. The analyzer checks the attributes using policies and identity groups. The results is stored in the ISE database with the corresponding device profile. The MAC address of the device will be linked to a existing endpoint identity group.

There are 9 availabled probes:

  • Netflow
  • DHCP
  • DHCP SPAN
  • HTTP
  • RADIUS
  • NMAP
  • DNS
  • SNMPQUERY
  • SNMPTRAP

Profiling uses CoA (change of authorization). There are 3 options:

  • No CoA: CoA is disabled
  • Port bounce: use this only of there is a single session on a switchport
  • Reauth: enforce reauthentication of a currently authenticated endpoint when it’s profiled

ISE creates three identity groups by default and two identity groups that are specific for Cisco IP phones. Creation of extra groups is optional.

An endpoint profiling policy contains a simple condition or a set of conditions (compound).

Configuring

Probe configuration

First, make sure the ISE appliance can SNMP to the switches (SNMPv2 or 3) with a read only community string. Also, configure a snmp trap destination to Cisco ISE policy node.

Switch(config)# snmp-server host 172.20.12.5 version 3 priv ISE
Switch(config)# snmp-server enable traps snmp linkdown linkup
Switch(config)# snmp-server enable traps mac-notification change move

On all interfaces:
Switch(config-if)# snmp trap mac-notification change added

For DHCP probing, configure an additional IP helper on the SVI to the policy node:

Switch(config-if)# ip helper-address 172.20.12.5

Cisco ISE configuration

Click Administration – System – Settings, click Profiling and configure the CoA.

profile5

Continue reading

How to: Cisco WLC Tacacs/radius for management

It took some time this morning for configuring a RADIUS or TACACS server for management access to a Cisco WLC. So, let’s write a short how-to:

  1. Login into the WLC and click Security – AAA – TACACS+ (or Radius) – Authentication
  2. Click New and enter:
    • Server IP Address – IP address of the TACACS server
    • Shared secret – The configured shared secret on the TACACS server
  3. If you’re using TACACS, click Authorization and enter the same Server IP address and Shared Secret. Configuring accounting is optional
  4. Click Security – Priority order – Management user and make sure TACACS (or radius) is in top of the list

tacacsorder

ISEfingerprint

Cisco ISE Part 1: introduction

Cisco ISE is a identity management product of Cisco. In the upcoming weeks more blogposts about the configuration and implementation of Cisco ISE. See the Cisco website for more information about the use of this awesome product. Also, watch this youtube movie for a great introduction about the functionality.

The blogpost Agenda:

  • Part 1: introduction
  • Part 2: installation
  • Part 3: Active Directory
  • Part 4: High Availability
  • Part 5: Configuring wired network devices
  • Part 6: Policy enforcement and MAB
  • Part 7: Configuring wireless network devices
  • Part 8: Inline posture and VPN
  • Part 9: Guest and web authentication
  • Part 10: Profiling and posture

This week, part 1: a basic product introduction to ISE.

Introduction 

This information could be outdated, Cisco released new appliances!

There are 3 appliances available and a virtual machine based on VMware 4.x or 5.x.

  • Cisco ISE 3315
  • Cisco ISE 3355
  • Cisco ISE 3395
  • VM (specs based on physical hardware)

The ISE deployment is based on node roles. There are 4 node roles available:

  • Admin
  • Monitoring
  • Policy
  • Inline posture

The admin node is for central management of the ISE deployment. Most of the configuration will be done on this node.

The monitoring node collects all monitoring events about all authentication and authorization attempts.

The policy node is the node which communicates with the endpoints and makes decisions about authentication and authorization. This is your radius server.

The inline role is used with devices which don’t have support for CoA (change of authority). Most of the recent Cisco switches do have support for CoA. The inline appliance can only be a physical appliance and can be in routed or bridged mode. The table below shows the device compatibility:

Access switch Minimum OS MAB 802.1X Web auth CoA VLAN dACL
Catalyst 2940 IOS v12.1(22)EA1 Y Y - - Y -
Catalyst 2950 IOS v12.1(22)EA1 - Y - - Y -
Catalyst 2955 IOS v12.2(22)EA1 - Y - - Y -
Catalyst 2960 IOS v12.2(52)EA1 Y Y Y Y Y Y
Catalyst 2970 IOS v12.2(25)EA1 Y Y - - Y -
Catalyst 2975 IOS v12.2(52)SE Y Y Y Y Y Y
Catalyst 3550 IOS v12.2(44)SE Y Y - - Y Y
Catalyst 3560-E IOS v12.2(52)SE Y Y Y Y Y Y
Catalyst 3560-X IOS v12.2(52)SE Y Y Y Y Y Y
Catalyst 3750 IOS v12.2(52)SE Y Y Y Y Y Y
Catalyst 3750-E IOS v12.2(52)SE Y Y Y Y Y Y
Catalyst 3750-Metro IOS v12.2(52)SE Y Y Y Y Y Y
Catalyst 3750-X IOS v12.2(52)SE Y Y Y Y Y Y
Catalyst 4500 IOS v12.2(54)SG Y Y Y Y Y Y
Catalyst 6500 IOS v12.2(33)SXJ Y Y Y Y Y Y
Catalust 4900 IOS v12.1(54)SG Y Y Y Y Y Y
Nexus 7000 NX-OS 5.0(2) - - - - Y -
WLAN Controller  WLC 2100, 4400, 5500 7.0.116.0 - Y Y Y Y Y
WISM 7.0.116.0 - Y Y Y Y Y
WLC for ISR 7.0.116.0 - Y Y Y Y Y
WLC for 3759 7.0.116.0 - Y Y Y Y Y

Most features of Cisco ISE require CoA!

Cisco ISE appliance roles can be combined or used on a single appliance. This depends on the ISE design. More policy nodes in your network means bigger an more administrations and montoring nodes. See this chart. In de left colomn the amount of endpoints, in the top colomn the amount of policy nodes.

distribution

There is a maximum of 2 admin nodes (active/standby, not hot-standby)
There is a maximum of 2 monitoring nodes (active/standby or HA)

Licensing is based on concurrent endpoints and on features.
The wireless license contains base + advanced features but for wireless only!

ise license

Design

Some considerations for a ISE design:

  • Only 1 Microsoft Active Directory membership per ISE deployment (at this point, version 1.1.x)
  • Licensing is based on concurrent amount of endpoints
  • Endpoint is a authenticated device, like a PC, Phone, Printer, iPad, etc
  • Authentication of Microsoft AD, LDAP, EAP-TLS, Webbased authentication can be mixed.
  • Profiling (detecting device type) and posture (health of an endpoint) is advanced license only
  • Maximum of 2000 endpoints if you’re using 1 ISE appliance with all roles
  • Maximum of 4000 endpoints (non-redundant) if you’re using 2 ISE appliances with all roles

If you’re using seperate nodes for the policy role, this are the maximum supported endpoints:

  • 3315: 3000 endpoints
  • 3355: 6000 endpoints
  • 3395: 10.000 endpoints

When colocating admin and monitoring roles together, only 5 policy nodes in your deployment are supported!

When you’re using seperate admin and monitoring roles, both redundant, maximum 40 policy nodes are supported with a maximum of 100.000 endpoints.

These are some more limitations:

  • 100.000 endpoints per ISE domain (deployment)
  • Max 5 or 40 policy nodes
  • Unlimited inline posture nodes

Performance

Performance of the deployment according Cisco, in authentications per second:

  • PAP: 1431
  • EAP-MD5: 600
  • EAP-TLS: 335 internal, 124 LDAP
  • LEAP: 455
  • MSCHAPv1: 1064 internal, 361 AD
  • MSCHAPv2: 1316 internal, 277 AD
  • PEAP-MSCHAPv2: 181
  • PEAP-GTC: 196 AD, 188 LDAP
  • FAST-MSCHAPv2: 192
  • GAST-GTC: 222
  • Guest (Web auth): 17

Bandwidth requirements:

  • Policy services and monitoring: 1Mb/s
  • Admin and monitoring: 256Kb/s
  • Endpoints and policy: 125 Kb/s per endpoint
  • Redundant monitoring pair: 256 Kb/s
  • Admin and policy: 256Kb/s

I’ll start with the basic installation of the ISE software in part 2 of this Cisco ISE blog series.

Workaround: BUG in ASA IOS 8.4(4) and 8.4(5) adding network-object-nat

When upgrading from prior IOS 8.4 to 8.4(4) and 8.4(5), the configuration will be converted for the new IOS without any problems. But when you’re creating a new Network Object NAT rule, you’ll get a nasty error:

ERROR: NAT Policy is not downloaded

There’s no solution for this error at this point (january 2013), Cisco TAC mentioned me that the development team is still working on this issue but it’s hard for them to reproduce this error in their lab.

But.. there is a workaround available!

Continue reading