Identity and Secure Access Concepts, Device Compliance and Application Control

What it is

Secure network access means that the network decides who and what may connect, and what each one may reach.

Cisco Identity Services Engine (ISE) is the policy engine for this. It identifies the user and the device, checks the device health, and returns an access decision. The decision can place the endpoint in a VLAN, apply an access list or assign a security group tag.

How it works

Each concept answers a different question about the endpoint.

ISE roles

ISE is made of roles, which can run on one node or be spread across several.

Network devices send their RADIUS requests to a PSN, which evaluates the policy.

Guest services

Guest access gives visitors limited internet access without exposing the internal network. A guest portal is a web page where the guest signs in or registers. The common types are:

• Hotspot: the guest accepts a policy and gets access, with no credentials.
• Self-registered: the guest fills in a form, and receives credentials.
• Sponsored: an employee, the sponsor, creates or approves the account.

Guests are placed in a separate VLAN or given a restricted access list. Accounts expire after a set time.

Profiling

Profiling identifies the type of an endpoint, such as a printer, an IP phone or a laptop, without an agent. ISE collects attributes using probes, then compares them with profiling policies.

Each profiling policy has a minimum certainty factor. When the combined evidence reaches it, the endpoint is assigned that profile. The profile can then be used in an authorisation rule, for example to place all IP phones in the voice VLAN.

Posture assessment

Posture checks whether a device meets health rules, such as antimalware status, firewall state and patch level. A device can be compliant, noncompliant or unknown, and noncompliant devices are limited until fixed.

BYOD

Bring your own device lets staff use personal devices on the network. In ISE onboarding, the user signs in to a portal, registers the device, and receives a certificate and a network profile. Later connections use that certificate, so the user need not type credentials again.

BYOD policies often give personal devices access to fewer resources than corporate devices. ISE can tell the two apart using the certificate, the endpoint identity group or MDM information.

Device compliance

Compliance is the state of meeting your security policy. It has several sources.

• Posture agent checks: run on the device when it connects.
• MDM data: reports encryption, passcode, jailbreak status and registration.
• Endpoint protection status: whether the security agent is running and clean.

The network access decision uses the compliance result. A compliant device gets normal access. A device that fails gets restricted access and remediation steps.

Application control

Application control limits which applications may run or be used. It can apply at several points.

Use more than one point, because each sees the problem differently.

Putting the concepts together

An example policy treats each case differently.

• Unknown devices are profiled.
• A corporate laptop with a certificate is allowed.
• A guest device goes to the guest portal.
• A personal phone is onboarded, checked against MDM, and given limited access if compliant.
• A noncompliant device is isolated until it is fixed.