BYOD Onboarding with the Internal CA

What it is

This page puts the BYOD parts together using the ISE internal certificate authority, on a Cisco switch or a Cisco wireless controller.

You build the provisioning objects, the portal and the policy on ISE. You then prepare the network device to redirect, and to accept CoA. The result is a working onboarding flow.

How it works

You work in five parts: the profile, the provisioning policy, the portal, the authorization rules and the network device.

1. The native supplicant profile

The native supplicant profile holds the network settings that ISE installs on the device. You create it in the client provisioning resources.

The main fields are the profile name, the connection type (wired, wireless or both), the SSID for wireless, the allowed protocol, and the certificate template. For a secure SSID you pick the EAP-TLS protocol, and you choose the template that issues the certificate.

2. The client provisioning policy

The client provisioning policy chooses which profile a device receives. Each rule has a device type, such as Windows, macOS, iOS or Android, and a result that names the profile and the setup tool.

You need a rule for each type that you support. If a type has no rule, that device cannot complete onboarding. ISE has default resources for the setup tools, and you can add the ones you need from the Cisco site or from a file.

3. The BYOD portal

The portal is the web page for sign in and registration. You find it in the BYOD work center, and ISE provides a default portal that you can edit.

Settings include the identity source sequence, the acceptable use policy, the device name field, and the text. The portal certificate and FQDN matter here, as for other portals. The portal runs on TCP 8443 by default.

4. The authorization rules

You write two authorization rules, as the previous page showed. The redirect rule applies to a user who signed in with a password and whose device is not registered.

It returns an authorization profile with web redirection, set to native supplicant provisioning, and a redirect ACL. The portal is the BYOD portal.

The other rule matches a registered device that authenticated with a certificate, and returns normal access. A permit access profile is enough for a first test.

Place the rule for the certificate based, registered device above the redirect rule.

5. The network device

On a switch, the redirect needs the web server and a redirect ACL, as in central web authentication. On a wireless controller, the redirect ACL has to exist on the controller, with the same name that ISE returns.

Switch(config)# ip access-list extended REDIRECT-ACL
Switch(config-ext-nacl)# deny udp any any eq domain
Switch(config-ext-nacl)# deny ip any host 10.1.1.11
Switch(config-ext-nacl)# permit tcp any any eq www
Switch(config-ext-nacl)# permit tcp any any eq 443
Switch(config)# ip http server
Switch(config)# ip http secure-server

The device also has to reach ISE for provisioning, not only for the web page. Many designs allow this with a separate ACL on the port, and keep the redirect ACL for web traffic only.

On a Catalyst 9800 controller, the policy profile needs aaa-override and nac. The WLAN uses 802.1X. For the single SSID design, no extra WLAN is needed.

For dual SSID, the onboarding WLAN is open or uses a simple method, with MAC filtering and central web authentication, as for guests. The secure WLAN uses 802.1X.

The certificate step

When the device asks for a certificate, ISE issues it from the internal CA. The certificate template sets the subject and the lifetime. The device then uses it for EAP-TLS.

For this to work, the device has to trust the ISE EAP certificate, so the profile also installs the signer certificate. The next page covers certificates in detail.

Testing the flow

Test one device type at a time. Connect the device, follow the redirect, register it, and watch for the reconnect.

On ISE, the live logs show the first authentication with the redirect, then a CoA, then a second authentication with EAP-TLS. If the second step never comes, the CoA failed or the device did not reconnect.

Switch# show authentication sessions interface GigabitEthernet1/0/5 details

The details show the redirect URL while the device is onboarding, and the final result afterwards.