Skip to content

Cisco_ISE_setup.md

Latest commit

 

History

History
373 lines (221 loc) · 6.57 KB

Cisco_ISE_setup.md

File metadata and controls

373 lines (221 loc) · 6.57 KB

🔐 Cisco ISE TACACS+ & Device Administration Lab Guide

⚠️ Prerequisites (Before Installing Cisco ISE)

📌 Ensure the following services are properly configured before deploying Cisco ISE

🌐 1. DNS Server

  • ✅ Forward Lookup Zone configured
  • ✅ Reverse Lookup Zone configured
  • ✅ ISE must resolve its own FQDN
  • 💡 AD-integrated DNS is recommended

🔍 Example

  • Hostname: ise.local.lab
  • IP Address: 10.100.10.2

Test:

nslookup ise.local.lab

⏱️ 2. NTP Server

  • ⏱️ Time synchronization is critical
  • All systems must match:
    • Cisco ISE
    • Active Directory
    • Network Devices

⚠️ Time mismatch will cause:

  • ❌ Authentication failures
  • ❌ Domain join issues
  • ❌ Certificate problems

🪟 3. Active Directory (Recommended)

⚠️ Optional, but strongly recommended for this lab

Required for:

  • 🔐 802.1X authentication
  • 📡 MAB (MAC Authentication Bypass)
  • 🌐 VPN authentication

🔗 ISE must be able to:

  • Join the domain
  • Query users/groups

🖥️ 4. Proxmox Deployment Guide

Follow this video to install Cisco ISE on Proxmox: 👉 https://www.youtube.com/watch?v=ZtiXCOCgFgs⁠�

💻 5. Minimum System Requirements

⚠️ If these are not met, installation may fail or be unstable

  • 🧠 CPU: 4 vCPU
  • 🧠 RAM: 16 GB
  • 💾 Disk: 300 GB

1. ⚙️ Enable Device Admin Service

Log in to Cisco ISE and navigate to:

Administration > System > Deployment

1

Select the ISE node (typically only one in a lab setup).

Under General Settings, enable Device Admin Service, then click Save.

2

💡 This service allows administrative access to network devices (switches, routers, etc.) using TACACS+.

2. 👤 Create Local User

Go to:

Administration > Identity Management > Identities → Click Add

3

Under Network Access User:

  • 🧾 Enter username
  • 🔑 Set Password Type to Internal Users
  • 🔒 Define password
  • 👥 Under User Groups, select ALL_ACCOUNTS (default)

Click Submit

4.0

4.1

💡 For this lab, an IT group will be created and used instead.

3. 🏢 Join Active Directory

Navigate to:

Administration > Identity Management > External Identity Sources

5.0

Select Active Directory → Click Add

5.1

Enter:

  • 🏷️ Join Point Name (any name)
  • 🌐 Active Directory Domain

Click Submit → Confirm Yes

6

4. 🔑 Provide AD Credentials

Enter credentials with sufficient privileges on the Domain Controller.

Click OK

7

Verify the status shows ✅ Operational

8

🔐 TACACS+ Configuration

5. 📁 Create TACACS Profiles

Navigate to:

Work Centers > Device Administration > Policy Elements > Results > TACACS Profiles

9.0

Click Add

9.1

Create the following profiles:

  • 📡 WLC_ADMIN_PROFILE
  • 🛡️ ROUTER_ADMIN_PROFILE
  • 🔌 SWITCH_ADMIN_PROFILE

For each profile:

  • ⚙️ Select Shell Profile
  • 🔓 Enable Default Privilege = 15

10.0

For WLC profile only, add custom attributes:

  • Type: OPTIONAL
  • Name: role1
  • Value: ALL

Click Save

10.1

6. 🗂️ Create Device Type Groups

Go to:

Administration > Network Resources > Network Device Groups

11.0

Click Add

  • 🏷️ Name: (e.g., WLC, ROUTER, SWITCH)
  • 📂 Parent Group: All Device Types

Click Save

11.1

7. 📜 Configure Device Admin Policy Set

Navigate to:

Work Centers > Device Administration > Device Admin Policy Sets

12.0

Click +

  • 🏷️ Policy Name: Network_Admin_Access

12.1

⚙️ Conditions

  • Open Condition Studio
  • Select OR
  • Click NEW three times
  • Configure:
    DEVICE:Device Type EQUALS All Device Types#<Group>

Click Use

12.2

🔐 Policy Settings

  • 🔑 Allowed Protocols: Default Device Admin

Click Save

12.3

8. 🔄 Configure Authentication & Authorization

Expand the created policy:

🔐 Authentication Policy

  • Set Use = Internal Users

12.4

🛡️ Authorization Policy

Create 3 rules:

  • 📡 WLC → WLC_ADMIN_PROFILE
  • 🛡️ Router → ROUTER_ADMIN_PROFILE
  • 🔌 Switch → SWITCH_ADMIN_PROFILE

Click Save

12.5

🌐 Network Device Configuration

9. 🖥️ Add Network Devices

Go to:

Administration > Network Resources > Network Devices

Click Add

13.0

Enter:

  • 🏷️ Hostname
  • 🌐 IP Address
  • 📍 Location (optional)
  • 🗂️ Device Type

13.1

Scroll down:

  • ✅ Enable TACACS Authentication Settings
  • 🔐 Enter Shared Secret

Click Save

13.2

Repeat for all:

  • 🛡️ Routers
  • 🔌 Switches
  • 📡 WLC

⚠️ For WLC: Configure both RADIUS (client auth) and TACACS (admin access)

13.3

🔑 Identity Source Sequence

10. 🔗 Create Identity Source Sequence

Go to:

Administration > Identity Management > Identity Source Sequences

14.0

Click Add

  • 🏷️ Name the sequence
  • ➕ Add to Authentication Search List:
    • 👤 Internal Users
    • 🏢 AD-Lab

Click Save

14.1

11. 📜 Apply Identity Source Sequence

Go to:

Policy > Policy Sets

Open Default Policy

14.2

⚙️ Authentication Policy

  • Apply the created sequence to:
    • 📱 MAB
    • 🔐 Dot1X

Click Save

14.3

💡 This allows users to authenticate via both local and Active Directory accounts.

✅ Summary

This lab covers:

  • 🔐 Enabling TACACS+ on Cisco ISE
  • 🏢 Integrating Active Directory
  • 📁 Creating admin profiles
  • 📜 Defining policy sets
  • 🖥️ Adding network devices
  • 🔄 Configuring authentication flows