To configure an SGT in the response as well as other attributes such as VLAN 300, we can use a configured Result Profile of VLAN 300, and select and SGT value in the Security Groups list.Once the use button is clicked we will be returned to the rule list with our new rule in the list, however there is no "Results Profile" or "Security Groups" selection made. Next we will click "Use" at the bottom.Now we will create a rule that matches a domain authenticated wired 802.1X request using the following conditions:.To create a new rule, click the sprocket to the right of a rule and choose "Insert new rule above" or "Insert new rule below" being cognizant that the choice can affect other authentication requests depending on the specificity of the rule: The most specific rules should be up top (where the match is extremely specific to the authentication request) and the least specific match should be towards the bottom. However before creating a new rule, take note that the rules are processed in a top down fashion. Click the Authorization section of the policy set here:.To create a rule in the default rule-set click the right arrow here:.In this example the bare minimum of Name, IP info, and The RADIUS Shared Secret that will be used is filled out.Īt this point the endpoint/s is/are configured and will be able to be successfully processed by Cisco ISE.Ĭreating a rule-set to send back an SGT and optionally other data This once again can be filled out to be very granular down to a specific/set of device IP address/es, Specifying Location (which can be used as a conditional match in ISE), and Device Type (which can also be used as a conditional match in ISE). Next step is to fill out the device details.Navigate to Administration > Network Devices and Groups > Network Devices.This can be done in a couple of ways including setting a Default Network Device, or configured specific devices and groups for use within ISE. There are a number of ways to group devices in ISE including device type, location, etc, that will not be covered in this documentation. To configure a Meraki device in ISE perform the following configurations: Meraki devices need to be configured as RADIUS clients within Cisco ISE before ISE will allow authentication requests to be processed.
0 kommentar(er)
