- Cisco Ise 2.4 Ad Integration Tutorial
- Cisco Ise 2.4 Ad Integration Definition
- Cisco Ise 2.4 Admin Guide
- If you're using Cisco Identity Services Engine (ISE) 2.4 for your TACACS+ Authentication and you use Cisco Prime then you'll be happy to know integrating the two is dead simple. If you followed my Cisco ISE TACACS+ guides then it'll be even easier because my screenshots will be pretty close to what you're running.
- A vulnerability in the Active Directory integration component of Cisco Identity Service Engine (ISE) could allow an unauthenticated, remote attacker to perform a denial of service attack. The vulnerability is due to improper handling of password authentication protocol (PAP) authentication requests when ISE is configured with an authorization policy based on Active Directory group membership.
Introduction
To see the integration with version 6.x, check out Cisco ISE for BYOD and Secure Unified Access, Second Edition (Cisco Press, 2017). Click the settings cog in the upper-right corner and select Central Management, as shown in Figure 6-56.
This document describes the configuration process for integration of the Identity Services Engine (ISE) pxGrid version 2.4 and Firepower Management Center (FMC) version 6.2.3.
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
- ISE 2.4
- FMC 6.2.3
- Active Directory/Lightweight Directory Access Protocol (LDAP)
Components Used
The information in this document is based on these software and hardware versions:
- Standalone ISE 2.4
- FMCv 6.2.3
- Active Directory 2012R2
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Configure ISE
Step 1. Enable pxGrid Services
- Log into the ISE Admin GUI, navigate to Administration > Deployment.
2. Select the ISE node to be used for pxGrid persona as shown in the image.
3. Enable pxGrid service and click Save as shown in the image.
4. Verify that the pxGrid services are running from the CLI.
Note: It might take up to 5 minutes for the pxGrid services to fully start and determine High Availability (HA) state if more than one pxGrid node is in use.
5. SSH into the ISE pxGrid node CLI and check the application status.
6. Access the ISE Admin GUI and verify that the services are online and working. Navigate to Administration > pxGrid Services.
7. At the bottom of the page, ISE should display Connected to pxGrid as shown in the image.
Step 2. Configure ISE to Approve all pxGrid Certificate-Based Accounts
1. Navigate to Administration > pxGrid Services > Settings.
2. Check the box: 'Automatically approve new certificate-based accounts' and click Save as shown in the image.
Note: The administrator should manually approve the FMC connection to ISE if this option is not enabled.
Step 3. Export ISE MNT Admin Certificate and pxGrid CA Certificates
1. Navigate to Administration > Certificates > System Certificates.
2. Expand the Primary Monitoring (MNT) node if not enabled on the Primary Administration node.
3. Select the certificate with the Used-By 'Admin' field.
Note: This guide uses the default ISE Self-Signed Certificate for Admin usage. If you use a Certificate Authority (CA) signed Admin Certificate you need to export the Root CA that signed the Admin certificate on the ISE MNT node.
4. Click Export.
5. Choose the option to Export Certificate and Private Key.
6. Set an encryption key.
7. Export and Save the file as shown in the image.
9. Return to the ISE System Certificates screen.
10. Determine the Issued By field on the certificate with the 'pxGrid' usage in the Used By column.
Note: In older versions of ISE, this was a self-signed certificate, but from 2.2 onwards this certificate is issued by the Internal ISE CA Chain by default.
11. Select the Certificate and click View as shown in the image.
12. Determine the top level (Root) certificate. In this case it is 'Certificate Services Root CA - tim24adm'.
13. Close the certificate view window as shown in the image.
14. Expand the ISE Certificate Authority Menu.
15. Select Certificate Authority Certificates.
16. Select the Root Certificate that was identified and click Export. Then save the pxGrid Root CA certificate as shown in the image.
Configure FMC
Step 4. Add a new realm to FMC
- Access the FMC GUI and navigate to System > Integration > Realms.
- Click on New Realm as shown in the image.
3. Fill out the form and click the Test Active Directory (AD) Join button.
Note: The AD Join Username should be in User Principal Name (UPN) format or the test fails (user@domain.com).
4. If the Test AD Join is successful, click OK.
5. Click on the Directory tab and then click Add directory as shown in the image.
6. Configure IP/Hostname and Test Connection.
Note: If the Test fails, verify the credentials on the Realm Configuration tab.
7. Click OK.
8. Click the User Download tab as shown in the image.
9. If not already selected, enable user and group download
10. Click Download Now
11. Once the list populates, add desired groups and select Add to Include.
12. Save the Realm Configuration.
13. Enable the Realm State as shown in the image.
Step 5. Generate FMC CA Certificate
1. Navigate to Objects > Object Management > Internal CAs as shown in the image.
2. Click Generate CA.
3. Fill out the form and click Generate self-signed CA as shown in the image.
4. Once generation completes, click on the pencil to the right of the generated CA Certificate as shown in the image.
5. Click Download.
6. Configure and confirm the encryption password and click OK.
7. Save the Public-Key Cryptography Standards (PKCS) p12 file to your local file system.
Step 6. Extract the Certificate and Private Key from the Generated Certificate with the Use of OpenSSL
This might be done either on root of the FMC, or on any client capable of running OpenSSL commands. This example uses a standard Linux shell.
1. Use openssl in order to extract the certficate (CER) and private key (PVK) from the p12 file.
2. Extract the CER file then configure the certificate export key from the cert generation on FMC.
3. Extract the PVK file, configure the certificate export key, then set a new PEM pass phrase and confirm.
4. You will need this PEM phrase in the next step.
Step 7. Install certificate into FMC
1. Navigate to Objects > Object Management > PKI > Internal Certs.
2. Click Add Internal Cert as shown in the image.
3. Configure a name for the Internal Certificate.
4. Browse to the location of the CER file and select it. Once the Certificate Data populates, select the second.
5. Browse Option and select the PVK file.
6. Delete any leading 'Bag attributes' and any trailing values in the PVK section. The PVK should begin with -----BEGIN ENCRYPTED PRIVATE KEY----- and end with -----END ENCRYPTED PRIVATE KEY-----.
Note: You will not be able to click OK if the PVK text has any characters outside of the leading and trailing hyphens.
7. Check the Encrypted box and configure the password created when the PVK was exported in Step 6.
8. Click OK.
Step 8. Import the FMC Certificate into ISE
1. Access the ISE GUI and navigate to Administration > System > Certificates > Trusted Certificates.
2. Click Import.
3. Click Choose File and select the FMC CER file from your local system.
Optional: Configure a Friendly Name.
4. Check Trust for authentication within ISE.
Optional: Configure a Description.
5. Click Submit as shown in the image.
Step 9. Configure pxGrid Connection on FMC
1. Navigate to System > Integration > Identity Sources as shown in the image.
2. Click ISE.
3. Configure the IP address or hostname of the ISE pxGrid node.
4. Select the + to the right of pxGrid Server CA.
5. Name the Server CA file and then browse to the pxGrid Root Signing CA collected in Step 3. and click Save.
6. Select the + to the right of MNT Server CA.
7. Name the Server CA file and then browse to the Admin certificate collected in Step 3. and click Save.
8. Select the FMC CER file from the dropdown list.
9. Click Test.
10. If the test is successful, click on OK, then Save at the top right of the screen.
Note: When you run 2 ISE pxGrid nodes, it is normal for one host to show Success and one to show Failure since pxGrid only runs actively on one ISE node at a time. It depends on the configuration whether which Primary host might display Failure and Secondary host might display Success. This is all dependent on which node in ISE is the active pxGrid node.
Verify
Verification in ISE
1. Open the ISE GUI and navigate to Administration > pxGrid Services.
If all was successful, there should be two firepower connections listed in the client list. One for the actual FMC (iseagent-hostname-33bytes), and one for the test device that was used when you clicked the Test button in FMC (firesightisetest-hostname-33bytes).
The iseagent-firepower connection should display 6 subs and appear online.
The firesightisetest-firepower connection should display 0 subs and appear offline.
Expanded view of the iseagent-firepower client should display the six subscriptions as shown in the image.
Note: Due to CSCvo75376there is a hostname limitation and Bulk Download fails. The test button on the FMC displays a connectivity failure. This affects 2.3p6, 2.4p6, and 2.6. The current recommendation is to run 2.3 patch 5 or 2.4 patch 5 until an official patch is released.
Verification in FMC
1. Open the FMC GUI and navigate to Analysis > Users > Active Sessions.
Any Active Sessions published via the Session Directory capability in ISE should be displayed in the Active Sessions table on FMC.
From the FMC CLI sudo mode, the 'adi_cli session' should display the user session information sent from ISE to FMC.
Troubleshoot
There is currently no specific troubleshooting information available for this configuration.
The purpose of this blog post is to document the configuration steps required to configure Wireless 802.1x authentication on a Cisco vWLC v8.3 using Cisco ISE 2.4 as the RADIUS server.
WLC Configuration
Define AAA Servers
- Login to the WLC WebGUI
- Click Advanced
- Navigate to Security > AAA > RADIUS > Authentication
- Click New
- Define the IP address of the RADIUS Server (ISE)
- Define the Shared Secret
- Ensure Support for CoA is Enabled
- Click Apply
- Navigate to Security > AAA > RADIUS > Accounting
- Click New
- Define the IP address of the RADIUS Server (ISE)
- Define the Shared Secret
- Click Apply
Create WLAN
- Navigate to WLANs > WLANSs > WLANs
- Select Create New and click Go
- Define a Profile Name e.g. LAB_WLAN
- Define a SSID e.g. LAB_SSID
- Define an ID e.g. 1
- Click Apply
- Under the General tab, ensure the Status is Enabled and Security Policies is [WPA2][Auth (802.1x)]
- Under the Security tab, select AAA Servers
- Ensure the Auth Called Station ID Type is AP MAC Address:SSID
- From the drop down list select the previously defined Authentication and Accounting Servers
- Ensure Interim Update is selected
- Scroll down and remove LOCAL and LDAP, ensure only RADIUS is used for authentication
- Under the Advanced tab, tick the box for DHCP Addr. Assignment
- Under the Radius Client Profiling section, tick the box for DHCP Profiling and HTTP Profiling
- Click Apply
AP Groups
- Navigate to WLANs > Advanced > AP Groups
- Click Add Group
- Define a name for the group, e.g. LAB_GROUP
- Click Add
- Click the newly created AP Group
- Define a NAS-ID e.g vWLC
- Click Apply
- Click WLANs tab
- Click Add New
- Select the WLAN SSID from the drop down list, click Add
- Click the APs tab
- Select the AP(s) to add to the Group, click Add APs
NOTE – the AP(s) will now be reconfigured and rebooted
- Click when complete
ISE Configuration
Authentication Policy
- Create or modify the Authentication Policy
- Create a rule to authenticate using PEAP/MSCHAPv2, named appropriately
- Log into the ISE Admin GUI, navigate to Administration > Deployment.
2. Select the ISE node to be used for pxGrid persona as shown in the image.
3. Enable pxGrid service and click Save as shown in the image.
4. Verify that the pxGrid services are running from the CLI.
Note: It might take up to 5 minutes for the pxGrid services to fully start and determine High Availability (HA) state if more than one pxGrid node is in use.
5. SSH into the ISE pxGrid node CLI and check the application status.
6. Access the ISE Admin GUI and verify that the services are online and working. Navigate to Administration > pxGrid Services.
7. At the bottom of the page, ISE should display Connected to pxGrid as shown in the image.
Step 2. Configure ISE to Approve all pxGrid Certificate-Based Accounts
1. Navigate to Administration > pxGrid Services > Settings.
2. Check the box: 'Automatically approve new certificate-based accounts' and click Save as shown in the image.
Note: The administrator should manually approve the FMC connection to ISE if this option is not enabled.
Step 3. Export ISE MNT Admin Certificate and pxGrid CA Certificates
1. Navigate to Administration > Certificates > System Certificates.
2. Expand the Primary Monitoring (MNT) node if not enabled on the Primary Administration node.
3. Select the certificate with the Used-By 'Admin' field.
Note: This guide uses the default ISE Self-Signed Certificate for Admin usage. If you use a Certificate Authority (CA) signed Admin Certificate you need to export the Root CA that signed the Admin certificate on the ISE MNT node.
4. Click Export.
5. Choose the option to Export Certificate and Private Key.
6. Set an encryption key.
7. Export and Save the file as shown in the image.
9. Return to the ISE System Certificates screen.
10. Determine the Issued By field on the certificate with the 'pxGrid' usage in the Used By column.
Note: In older versions of ISE, this was a self-signed certificate, but from 2.2 onwards this certificate is issued by the Internal ISE CA Chain by default.
11. Select the Certificate and click View as shown in the image.
12. Determine the top level (Root) certificate. In this case it is 'Certificate Services Root CA - tim24adm'.
13. Close the certificate view window as shown in the image.
14. Expand the ISE Certificate Authority Menu.
15. Select Certificate Authority Certificates.
16. Select the Root Certificate that was identified and click Export. Then save the pxGrid Root CA certificate as shown in the image.
Configure FMC
Step 4. Add a new realm to FMC
- Access the FMC GUI and navigate to System > Integration > Realms.
- Click on New Realm as shown in the image.
3. Fill out the form and click the Test Active Directory (AD) Join button.
Note: The AD Join Username should be in User Principal Name (UPN) format or the test fails (user@domain.com).
4. If the Test AD Join is successful, click OK.
5. Click on the Directory tab and then click Add directory as shown in the image.
6. Configure IP/Hostname and Test Connection.
Note: If the Test fails, verify the credentials on the Realm Configuration tab.
7. Click OK.
8. Click the User Download tab as shown in the image.
9. If not already selected, enable user and group download
10. Click Download Now
11. Once the list populates, add desired groups and select Add to Include.
12. Save the Realm Configuration.
13. Enable the Realm State as shown in the image.
Step 5. Generate FMC CA Certificate
1. Navigate to Objects > Object Management > Internal CAs as shown in the image.
2. Click Generate CA.
3. Fill out the form and click Generate self-signed CA as shown in the image.
4. Once generation completes, click on the pencil to the right of the generated CA Certificate as shown in the image.
5. Click Download.
6. Configure and confirm the encryption password and click OK.
7. Save the Public-Key Cryptography Standards (PKCS) p12 file to your local file system.
Step 6. Extract the Certificate and Private Key from the Generated Certificate with the Use of OpenSSL
This might be done either on root of the FMC, or on any client capable of running OpenSSL commands. This example uses a standard Linux shell.
1. Use openssl in order to extract the certficate (CER) and private key (PVK) from the p12 file.
2. Extract the CER file then configure the certificate export key from the cert generation on FMC.
3. Extract the PVK file, configure the certificate export key, then set a new PEM pass phrase and confirm.
4. You will need this PEM phrase in the next step.
Step 7. Install certificate into FMC
1. Navigate to Objects > Object Management > PKI > Internal Certs.
2. Click Add Internal Cert as shown in the image.
3. Configure a name for the Internal Certificate.
4. Browse to the location of the CER file and select it. Once the Certificate Data populates, select the second.
5. Browse Option and select the PVK file.
6. Delete any leading 'Bag attributes' and any trailing values in the PVK section. The PVK should begin with -----BEGIN ENCRYPTED PRIVATE KEY----- and end with -----END ENCRYPTED PRIVATE KEY-----.
Note: You will not be able to click OK if the PVK text has any characters outside of the leading and trailing hyphens.
7. Check the Encrypted box and configure the password created when the PVK was exported in Step 6.
8. Click OK.
Step 8. Import the FMC Certificate into ISE
1. Access the ISE GUI and navigate to Administration > System > Certificates > Trusted Certificates.
2. Click Import.
3. Click Choose File and select the FMC CER file from your local system.
Optional: Configure a Friendly Name.
4. Check Trust for authentication within ISE.
Optional: Configure a Description.
5. Click Submit as shown in the image.
Step 9. Configure pxGrid Connection on FMC
1. Navigate to System > Integration > Identity Sources as shown in the image.
2. Click ISE.
3. Configure the IP address or hostname of the ISE pxGrid node.
4. Select the + to the right of pxGrid Server CA.
5. Name the Server CA file and then browse to the pxGrid Root Signing CA collected in Step 3. and click Save.
6. Select the + to the right of MNT Server CA.
7. Name the Server CA file and then browse to the Admin certificate collected in Step 3. and click Save.
8. Select the FMC CER file from the dropdown list.
9. Click Test.
10. If the test is successful, click on OK, then Save at the top right of the screen.
Note: When you run 2 ISE pxGrid nodes, it is normal for one host to show Success and one to show Failure since pxGrid only runs actively on one ISE node at a time. It depends on the configuration whether which Primary host might display Failure and Secondary host might display Success. This is all dependent on which node in ISE is the active pxGrid node.
Verify
Verification in ISE
1. Open the ISE GUI and navigate to Administration > pxGrid Services.
If all was successful, there should be two firepower connections listed in the client list. One for the actual FMC (iseagent-hostname-33bytes), and one for the test device that was used when you clicked the Test button in FMC (firesightisetest-hostname-33bytes).
The iseagent-firepower connection should display 6 subs and appear online.
The firesightisetest-firepower connection should display 0 subs and appear offline.
Expanded view of the iseagent-firepower client should display the six subscriptions as shown in the image.
Note: Due to CSCvo75376there is a hostname limitation and Bulk Download fails. The test button on the FMC displays a connectivity failure. This affects 2.3p6, 2.4p6, and 2.6. The current recommendation is to run 2.3 patch 5 or 2.4 patch 5 until an official patch is released.
Verification in FMC
1. Open the FMC GUI and navigate to Analysis > Users > Active Sessions.
Any Active Sessions published via the Session Directory capability in ISE should be displayed in the Active Sessions table on FMC.
From the FMC CLI sudo mode, the 'adi_cli session' should display the user session information sent from ISE to FMC.
Troubleshoot
There is currently no specific troubleshooting information available for this configuration.
The purpose of this blog post is to document the configuration steps required to configure Wireless 802.1x authentication on a Cisco vWLC v8.3 using Cisco ISE 2.4 as the RADIUS server.
WLC Configuration
Define AAA Servers
- Login to the WLC WebGUI
- Click Advanced
- Navigate to Security > AAA > RADIUS > Authentication
- Click New
- Define the IP address of the RADIUS Server (ISE)
- Define the Shared Secret
- Ensure Support for CoA is Enabled
- Click Apply
- Navigate to Security > AAA > RADIUS > Accounting
- Click New
- Define the IP address of the RADIUS Server (ISE)
- Define the Shared Secret
- Click Apply
Create WLAN
- Navigate to WLANs > WLANSs > WLANs
- Select Create New and click Go
- Define a Profile Name e.g. LAB_WLAN
- Define a SSID e.g. LAB_SSID
- Define an ID e.g. 1
- Click Apply
- Under the General tab, ensure the Status is Enabled and Security Policies is [WPA2][Auth (802.1x)]
- Under the Security tab, select AAA Servers
- Ensure the Auth Called Station ID Type is AP MAC Address:SSID
- From the drop down list select the previously defined Authentication and Accounting Servers
- Ensure Interim Update is selected
- Scroll down and remove LOCAL and LDAP, ensure only RADIUS is used for authentication
- Under the Advanced tab, tick the box for DHCP Addr. Assignment
- Under the Radius Client Profiling section, tick the box for DHCP Profiling and HTTP Profiling
- Click Apply
AP Groups
- Navigate to WLANs > Advanced > AP Groups
- Click Add Group
- Define a name for the group, e.g. LAB_GROUP
- Click Add
- Click the newly created AP Group
- Define a NAS-ID e.g vWLC
- Click Apply
- Click WLANs tab
- Click Add New
- Select the WLAN SSID from the drop down list, click Add
- Click the APs tab
- Select the AP(s) to add to the Group, click Add APs
NOTE – the AP(s) will now be reconfigured and rebooted
- Click when complete
ISE Configuration
Authentication Policy
- Create or modify the Authentication Policy
- Create a rule to authenticate using PEAP/MSCHAPv2, named appropriately
Rule Name:-
MSCHAPv2 Wii usb loader channel.
Conditions:-
Network Access-EapAuthentication EQUALS EAP-MSCHAPv2
Wired_802.1x
Use:-
Authorization Policy
- Create new Authorization Rules as per the table below
| Rule Name | Conditions | Profiles |
| Domain Admins | Radius Called-Station-ID MATCHES .*(:)$ LAB_AD-ExternalGroups EQUALS lab.local/Users/Domain Admins Wireless_802.1X | PermitAccess |
| Domain Users | Airespace Airespace-Wlan-Id EQUALS 1 LAB_AD-ExternalGroups EQUALS lab.local/Users/Domain Users Wireless_802.1X | PermitAccess |
| Domain Computers | LAB_AD-ExternalGroups EQUALS lab.local/Users/Domain Computers Wireless_802.1X | PermitAccess |
| Default | PermitAccess |
Cisco Ise 2.4 Ad Integration Tutorial
When the user connects the AP MAC Address + SSID is sent in the radius packet, this can be used in the Authorization rule to distinguish users from the SSID they are connecting from. The first rule for Domain Admins uses the Called-Station-ID radius attribute with a regex to match the SSID the user is connected to.
In addition to using the Called-Station-ID radius attribute to determine the SSID the user is connected to, if the WLC/AP is Cisco we can use the attribute Airespace-Wlan-Id. For members of the Domain Users group we will use this value. It is important to note the value specified must equal the number of the SSID defined in the WLC SSID configuration.
For Domain Computers we will not require the computer can authenticate from a specific WLAN SSID, just that it is a member of the Domain Computers AD group.
Verification and Testing
With a wireless enabled device login as a user that is a member of the AD group Domain Users. From the ISE logs we can determine the user was matched against the correct Authorization rule and the conditions worked.
Logoff and login as a user that is a member of the AD group Domain Admins. From the ISE logs we can determine the user was matched against the correct Authorization rule and these conditions also worked.
Cisco Ise 2.4 Ad Integration Definition
From the detailed output we can determine the AD Group, the NAS-Identifier defined in the AP Group configuration and the Called-Station-ID.
Cisco Ise 2.4 Admin Guide
From the WLC we can navigate to Monitor > Clients and determine the client properties. We can determine user2 associated to the correct SSID and used 802.1x authentication, with PEAP as the protocol.
