BYOD

What this chapter covers

This chapter shows how ISE lets people bring their own devices onto the network with proper identity and control.

It starts with the idea and the flow. It then covers the build on ISE and the network devices, the certificates that make the design work, and the lifecycle operations for lost, replaced and expired devices.

BYOD brings together many earlier pieces: redirection, CoA, policy sets, identity stores and the portals. Reading the policy and web authentication chapters first makes this chapter easier.

How the topics fit together

A device onboards once, then connects with a certificate until it is removed.

The topics build in that order:

• BYOD functionality explains the use cases, the components and the single and dual SSID flows.
• Onboarding with the internal CA is the configuration on ISE, switches and wireless controllers.
• Certificates explains the trust and the CA that make EAP-TLS work.
• Lifecycle operations cover the My Devices portal, blocking, revocation and housekeeping.

The chapter also introduces ideas that return in the posture chapter, such as client provisioning policy and the supplicant tools that ISE pushes to a device. A good grasp of the redirect and CoA cycle here pays off there.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

If you have a lab, build the single SSID design with one Windows device first. Watch the live logs to see the first authentication, the CoA and the second authentication. Then add a second device type.