Cisco ISE - part 2 - Integrating ISE with Microsoft AD

As I already mentioned Cisco ISE is product that is mainly used to control user's network access. Many organizations controls theirs users/computers through Microsoft Active Directory. That is why it can be very handy to integrate Cisco ISE with Microsoft AD. With the integration you will be able to still control users/computers on AD, but you can create network access policy on your Cisco ISE server, based on AD groups/users. 

Integration is actually pretty straightforward. There are some prerequisites, which can be found in Cisco docs. 

Before you start integration of Cisco ISE and MS AD you have to make sure, that time on both servers are synchronized. Of course the best way to do it is to use NTP. To join Cisco ISE to the domain, you have to create user on the AD. The best way is to create separate user with only needed privileges, which again could be found on Cisco docs.

When user with right privileges is created you can join AD to the domain. To do this you go to Administration -> Identity Management -> External Identity Sources -> Active Directory. 

First you need to go to Connection tab. You should enter your organization domain name and identity store name, which can be any chosen name. Now you click save configuration. Now you are ready to join Cisco ISE to the domain. You can click test connection, to test connection to your AD. This is of course optional steps, but could be very helpful for troubleshooting. To join Cisco ISE to the domain, simply click Join button, enter username/password and if everything is ok your Cisco ISE will join the domain. Now you can retrieve groups from AD. To do this simply click button groups and your can get the list of all groups in AD. Since output is limited to 100 groups you can filter this list to get groups you want.

That is it. As you can see it is pretty straightforward process.

Cisco ISE - part 1 - Installing

I will start my blogging with the series posts about installing and configuring Cisco Identity Service or Cisco ISE.

Cisco ISE is really cool platform for security management and control. It is primarily used to established secured network and guest access, but it could be also used for device access (routers, switches etc.). Cisco treats ISE as one of the main platform for establish BYOD.

Cisco ISE application runs on top of Cisco ADE-OS. You can do some basic system stuff on that OS, like IP addressing and routing, NTP settings, hostname etc. It can be used to reset admin password for Cisco ISE application as well. To access Cisco ADE-OS you can use SSH with your favorite terminal program.

Cisco ISE could be deployed as a hardware appliance (Cisco ISE 3000 series) or VM. Since I am a big fan of virtualization I prefer VM-based deployment, but it always depends on your requirements. ISE could be deployed in standalone mode or HA mode, in which you can also distribute different services among ISE servers. Since I am currently doing proof-of-concept I will use standalone mode. You can always extend your deployment to HA mode.

Of course to start using Cisco ISE you first need to install your server. The minimum requirements for installation by Cisco is Quad-Core, 4GB RAM and 60GB of disk storage. You must provide 4GB of RAM and 60GB of disk storage at installation. Otherwise the installation process will not let you through. If you just want to do proof-of-concept you can later decrease amount of RAM. You can use 1GB and you should be fine. But of course you need to increase resources to use it in production environment.

You should use iso file for installation. Insert Cisco ISE in your VM and start VM. You have to choose to install ISE and then wait for installation process to get to the login prompt, where you should enter setup mode with setup command. 

Now you will be guided through wizard for basic configuration parameters. As this is pretty straightforward I didn’t paste any screenshoot. After you enter basic parameters ISE application is going to install. You will have to enter database admin and user password. I believe those users are rarely used or are used by Cisco TAC. So you should use some good password and save this somewhere to safe place. By the way KeePass is good tool to store passwords. After some time ISE should be installed and you are able to access ADE-OS via ssh or Cisco ISE admin console via web browser.

You can check ise application status or reset application in ADE-OS. All processes should running to access ISE application through browser.

ciscoise/admin# sh application status ise

ISE Database listener is running, PID: 5237

ISE Database is running, number of processes: 27

ISE Application Server is running, PID: 11768

ISE M&T Session Database is running, PID: 4897

ISE M&T Log Collector is running, PID: 7022

ISE M&T Log Processor is running, PID: 7106

ISE M&T Alert Process is running, PID: 6928

% WARNING: ISE DISK SIZE NOT LARGE ENOUGH FOR PRODUCTION USE

% RECOMMENDED DISK SIZE: 200 GB, CURRENT DISK SIZE: 64 GB

You can start, stop, reset application, reset admin password or completely reset configuration to factory default. Commands are listed below. 

ciscoise/admin# application ?

 configure     Configure application

 install       Install An Application Bundle

 remove        Uninstall An Application

 reset-config  Reset application configuration to factory defaults

 reset-passwd  Reset application password for specified user

 start         Start an Application

 stop          Stop an Application

 upgrade       Upgrade An Application Bundle

To access Cisco ISE via web browser you should only enter http://x.x.x.x and you are automatically redirected to https page. You enter your credentials that were provided during installation and you are ready to use your fresh installation of the Cisco ISE. What is specially cool about ISE is that Cisco provide 90-days evaluation license with all features. So you can use this to build proof-of-concept or to test some functionalities.