Fully updated: The complete guide to Cisco Identity Services Engine solutions

Using Cisco Secure Access Architecture and Cisco Identity Services Engine, you can secure and gain control of access to your networks in a Bring Your Own Device (BYOD) world.

This second edition of Cisco ISE for BYOD and Secure Unified Accesscontains more than eight brand-new chapters as well as extensively updated coverage of all the previous topics in the first edition book to reflect the latest technologies, features, and best practices of the ISE solution. It begins by reviewing today's business case for identity solutions. Next, you walk through ISE foundational topics and ISE design. Then you explore how to build an access security policy using the building blocks of ISE. Next are the in-depth and advanced ISE configuration sections, followed by the troubleshooting and monitoring chapters. Finally, we go in depth on the new TACACS+ device administration solution that is new to ISE and to this second edition.

With this book, you will gain an understanding of ISE configuration, such as identifying users, devices, and security posture; learn about Cisco Secure Access solutions; and master advanced techniques for securing access to networks, from dynamic segmentation to guest access and everything in between.

Drawing on their cutting-edge experience supporting Cisco enterprise customers, the authors offer in-depth coverage of the complete lifecycle for all relevant ISE solutions, making this book a cornerstone resource whether you're an architect, engineer, operator, or IT manager.

· Review evolving security challenges associated with borderless networks, ubiquitous mobility, and consumerized IT

· Understand Cisco Secure Access, the Identity Services Engine (ISE), and the building blocks of complete solutions

· Design an ISE-enabled network, plan/distribute ISE functions, and prepare for rollout

· Build context-aware security policies for network access, devices, accounting, and audit

· Configure device profiles, visibility, endpoint posture assessments, and guest services

· Implement secure guest lifecycle management, from WebAuth to sponsored guest access

· Configure ISE, network access devices, and supplicants, step by step

· Apply best practices to avoid the pitfalls of BYOD secure access

· Set up efficient distributed ISE deployments

· Provide remote access VPNs with ASA and Cisco ISE

· Simplify administration with self-service onboarding and registration

· Deploy security group access with Cisco TrustSec

· Prepare for high availability and disaster scenarios

· Implement passive identities via ISE-PIC and EZ Connect

· Implement TACACS+ using ISE

· Monitor, maintain, and troubleshoot ISE and your entire Secure Access system

· Administer device AAA with Cisco IOS, WLC, and Nexus

Aaron Woland, CCIE No. 20113, is a Principal Engineer in Cisco's Security Group and works with Cisco's largest customers all over the world. His primary job responsibilities include Secure Access and Identity deployments with ISE, solution enhancements, standards development, Advanced Threat Security and solution futures. Aaron joined Cisco in 2005 and is currently a member of numerous security advisory boards and standards body working groups. Prior to joining Cisco, Aaron spent 12 years as a consultant and technical trainer. His areas of expertise include network and host security architecture and implementation, regulatory compliance, and route-switch and wireless.

Aaron is the author of many Cisco white papers and design guides and is co-author of CCNP Security SISAS 300-208 Official Cert Guide; Cisco Next-Generation Security Solutions: All-in-one Cisco ASA Firepower Services, NGIPS, and AMP; and CCNA Security 210-260 Complete Video Course.

Aaron is one of only five inaugural members of the Hall of Fame Elite for Distinguished Speakers at Cisco Live, and is a security columnist for Network World, where he blogs on all things related to secure network access. His other certifications include GHIC, GSEC, Certified Ethical Hacker, MCSE, VCP, CCSP, CCNP, CCDP, and many other industry certifications. You can follow Aaron on Twitter: @aaronwoland.

Jamey Heary, CCIE No. 7680, is a Distinguished Systems Engineer at Cisco Systems, where he leads the Global Security Architecture Team, GSAT. Jamey and his GSAT team work as trusted security advisors and architects to Cisco's largest customers worldwide. Jamey sits on the PCI Security Standards Council's Board of Advisors, where he provides strategic and technical guidance for future PCI standards. Jamey is the author of Cisco NAC Appliance: Enforcing Host Security with Clean Access. He also has a patent on a new DDoS mitigation and firewall IP reputation technique. Jamey blogged for many years on Network Worldon security topics and is a Cisco Live Distinguished Speaker. Jamey sits on numerous security advisory boards for Cisco Systems and was a founding member of several Cisco security customer user groups across the United States. His other certifications include CISSP, and he is a Certified HIPAA Security Professional. He has been working in the IT field for 24 years and in IT security for 20 years. You can contact Jamey at jheary@appledreams.com.

Introduction xxix

Part I Identity-Enabled Network: Unite!

Chapter 1 Regain Control of Your IT Security 1

Security: Still a Weakest-Link Problem 2

Cisco Identity Services Engine 3

Sources for Providing Identity and Context Awareness 5

Unleash the Power of Centralized Policy 6

Summary 8

Chapter 2 Fundamentals of AAA 9

Triple-A 10

Compare and Select AAA Options 10

Device Administration 11

Network Access 12

TACACS+ 13

TACACS+ Authentication Messages 14

TACACS+ Authorization and Accounting Messages 15

RADIUS 17

AV Pairs 20

Change of Authorization 20

Comparing RADIUS and TACACS+ 21

Summary 21

Chapter 3 Introducing Cisco Identity Services Engine 23

Architecture Approach to Centralized and Dynamic Network Security Policy Enforcement 23

Cisco Identity Services Engine Features and Benefits 26

ISE Platform Support and Compatibility 30

Cisco Identity Services Engine Policy Construct 30

ISE Authorization Rules 33

Summary 34

Part II The Blueprint, Designing an ISE-Enabled Network

Chapter 4 The Building Blocks in an Identity Services Engine Design 35

ISE Solution Components Explained 35

Infrastructure Components 36

Policy Components 42

Endpoint Components 42

ISE Personas 43

ISE Licensing, Requirements, and Performance 45

ISE Licensing 45

ISE Requirements 46

ISE Performance 47

ISE Policy-Based Structure Explained 48

Summary 49

Chapter 5 Making Sense of the ISE Deployment Design Options 51

Centralized Versus Distributed Deployment 52

Centralized Deployment 52

Distributed Deployment 55

Summary 58

Chapter 6 Quick Setup of an ISE Proof of Concept 59

Deploy ISE for Wireless in 15 Minutes 59

Wireless Setup Wizard Configuration 60

Guest Self-Registration Wizard 61

Secure Access Wizard 65

Bring Your Own Device (BYOD) Wizard 67

Deploy ISE to Gain Visibility in 15 Minutes 69

Visibility Setup Wizard 69