BYOD Device Lifecycle

What it is

The BYOD lifecycle covers what happens to a device after onboarding, up to the day it leaves.

A device is registered, used, perhaps lost or replaced, and eventually removed. ISE gives users and administrators tools for each step, so that stale or stolen devices cannot keep access.

How it works

Registered devices are tracked as endpoints, and each lifecycle action changes the endpoint record or the certificate.

Registration

When a user onboards a device, ISE records its MAC address, and marks the endpoint as registered. The endpoint goes into a registered devices identity group, and a BYOD registration attribute is set.

Policy uses these markers to tell a registered device from a new one. The same attribute stops a device from being redirected again after it onboards.

The My Devices portal

The My Devices portal is a self service page for employees. After signing in, the user sees the devices registered to them. The user can add a device, edit its name, and report it lost.

The portal is a web page on the PSNs, on TCP 8443 by default, with the same certificate considerations as other portals. You can tell users to open it by a friendly name, by setting a custom FQDN.

Lost devices

If a user marks a device as lost, ISE puts the endpoint in the blocked list group. An authorization rule that matches the group denies access, or sends the device to a page that explains the block.

This gives a fast way to protect the network. The user does not have to call the help desk, and the block applies on the next authentication. You can send a CoA to end the session at once.

If the user finds the device, they can reinstate it. The device is taken off the blocked list and can connect again with its existing certificate.

Deleting a device

When a user deletes a device, it is no longer in their list. It must onboard again to get network access.

With the ISE internal CA, deleting a device can also revoke the certificate that was issued to it. An administrator can revoke certificates too, from the issued certificates list in the certificate authority area of the portal.

Revocation

A revoked certificate must be refused during EAP-TLS. The internal CA can publish a CRL and run an OCSP responder, so that ISE can check the state of a certificate.

For a fast and reliable result, make sure the authentication policy checks revocation. A device with a revoked certificate then fails authentication, even if the certificate has not expired.

Limiting the number of devices

You can limit how many devices each user can register. The setting is part of the registered devices settings in the ISE admin portal, and its exact menu location differs by release. When the limit is reached, a user has to delete a device before adding a new one.

A limit stops one account from registering a large number of devices, which also limits the number of certificates ISE issues.

Expiry and renewal

Each endpoint certificate has a lifetime, set by the template. When it expires, the device cannot authenticate with EAP-TLS.

A device that is about to expire can onboard again to get a fresh certificate. Plan the lifetime so that it is long enough to avoid support calls, and short enough to limit the damage if a device is lost.

Housekeeping

Registered endpoints that never connect are removed by the purge rules on the endpoint database. Keep the purge period for registered devices longer than for unknown ones. If a device is purged, it onboards again.

Reports and monitoring

ISE has reports for BYOD, such as the list of registered devices and the activity on the portal. Use them to find devices that never reconnect, and to check how many devices each user holds.

Check the result

In the live logs, a blocked device shows a deny result that names the rule. In the issued certificates list, a revoked certificate shows its status. If a reinstated device still cannot connect, check whether it is still in the blocked list group.