Catalyst 9800 Uncategorized

CWA in AireOS vs IOS-XE using Cisco ISE

supertech

1.)ISE Setup
2.)AireOS Setup
3.)IOS-XE Setup

ISE Setup

  1. Login to ISE and add the NAD for the WLC under Administration > Network Resources > Network Devices
  2. Click the Add button and enter the info:
    1. Name the name used for ISE to identify.
    2. Description if applicable
    3. Set to IP address and put in the IP/subnet mask (/32) for single device usage.
    4. If network groups are used, then change the location and device type. I have a lab location and AireOS_WLC type defined.
    5. Check the box for RADIUS (TACACS as well if using for device login) and enter a shared secret for the device. 
  3. Create the Authorization Profiles.
    1. Name of the profile
    2. under common tasks, find Web Redirection set to Hotspot for passthrough with guests, Centralized web auth for web auth using accounts. The ACL is the name of the ACL on the WLC to be used.
    3. Click Save.
  4. Create a Policy set
    1. Policy > policy sets
    2. Press the + on the Left side and name the Policy set and assign a condition such as Wireless_Access, which will match all wireless conditions and save then click the > on the right
    3. Under Authentication, Create a new policy for MAB, set the condition to Wireless_MAB, and use internal Endpoints with options as reject, continue, drop.
    4. Under Authorization Policy, create 2 1 for a permit and 1 for CWA redirect. And click save.
      1. Guest_Access – conditions Guest_Flow and Wireless_MAB with the Result of PermitAccess
      2. Hotspot – Normalised Radius·RadiusFlowType equals WirelessMAB and Radius·Called-Station-ID Contains SSID with Result of the WLC_CWA (created earlier)

The only Difference with IOS-XE is when adding as a NAD I use and IOS-XE group for setup with TACACS.

AireOS WLC Setup

  1. Add the RADIUS server to the WLC under Security > AAA > RADIUS > Authentication > New
  2. Enter the IP and Shared secret of the ISE server and either check the “Apply Cisco ISE Default Settings” or Change the “Support for CoA” to Enabled.
  3. Create the WLAN under WLANs > Create New from the dropdown and then press go
  4. Enter the Profile Name, SSID, and WLAN ID.
  5. Edit the SSID by clicking the WLAN ID
  6. General Tab
    1. Set the needed radio policy
    2. Set the interface for the needed VLAN
  7. Security Tab
    1. Layer 2
      1. Set layer 2 security to none
      2. Enable Mac Filtering
      3. disable OWE Transition Mode
    2. AAA Servers
      1. set the servers to use the ISE nodes needed
  8. Advanced Tab
    1. Allow AAA Override set to enable
    2. NAC state set to ISE NAC
  9. Click apply
  10. Create a new ACL to match the name in ISE for redirect under Security > Access Control Lists > New  
  11. Edit the ACL by clicking its name and add the rules
    1. Permit ANY ANY to and from the DNS server
    2. Permit ANY ANY to UDP DHCP Server
    3. Permit ANY ANY from UDP DHCP Client
    4. Permit ANY ANY to and from ISE nodes
    5. Deny ANY ANY (implicit)
  12. If using Flexconnect, you will need to create the ACL as a Flexconnect ACL and then apply it to the group.
    1. Wireless > Flexconnect Groups > Click the name of the group > ACL Mapping >policies in the IPv4 Policy ACL, select the ACL needed and click add

IOS-XE Setup

  1. Add the RADIUS server under Configuration > Security > AAA > Servers/Groups > Radius Servers
    • Creating a server group here allows for multiple servers to be used via name rather than adding each one later.
    • Create the server making sure that Support for COA is enabled
    • apply to device
  2. Configuration > Security > AAA > AAA Method List > authorization
    • Add a new method list using just radius or use the server group crated for specific servers.
    • Apply to device
    • Go to accounting and add a method there as well using either the default radius or the server group.
    • Apply to device
  3. Create a new Wireless AAA Policy under Configuration > Security > Wireless AAA Policy (you can also just change the default policy as well). Set option 1 to SSID then apply to device.
  4. Create the WLAN under Configuration > Tags & Profiles > WLANS > add
    • on the General tab define the profile name, SSID, WLAN ID, and set the status to enable.
    • On the Security tab, layer 2 set the security mode to none, enable MAC Filtering, and set the Authorization list to the method created in step 2
    • Apply to Device, unless more settings are needed for customization.
  5. Create a Policy Profile under Configuration > Tags & Profiles > Policy > add
    • On the General Tab name the Policy and set the status to enabled.
    • On the Access Policies Tab set the VLAN to be used for the WLAN.
    • On the Advanced TAB check “Allow AAA Override and “NAC State”. Set the policy name to the policy created if not using the default and accounting list to the list made in step 2.
    • Apply to Device, unless more settings are needed for customization.
  6. Create the Policy Tag under Configuration > Tags & Profiles > Tags > Policy > add
    • Name the Policy Tag
    • +add to add a WLAN and select the WLAN profile and Policy profile previously created. Click the check and then apply to device.
  7. To TAG the ap see my section on AP tagging.
  8. Create the redirect ACL in Configuration > Security > ACL > add
    • This has to match the ACL name that was entered into ISE on the authorization results.
    • Add the following for basic setup using IPv4 Extended:
      • Deny ANY <ISE PSN> IP
      • Deny <ISE PSN> ANY IP
      • Deny ANY ANY UDP none DNS
      • Deny ANY ANY UDP DNS none
      • Permit ANY ANY TCP none WWW
  9. If using Flexconnect on the 9800 you will need to setup the Flex profile to distribute the ACL. Go to Configuration > Tags & Profiles > Flex > add
    • on the general tab name the flex profile and setup the native VLAN if not already created.
    • on the policy ACL tab click add and then from the drop down select the ACL created in step 8 and then check the “Central Web Auth” box and click save, then apply to device.