CWA - Central Web Authentication with Cisco ISE

Meraki Access Point Dashboard Configuration

The Meraki Access Point configuration is outlined below all on the Access Control Page for a particular SSID (Wireless > Configure > Access Control). 

17.0.0.0/8
captive.apple.com
*.apple.com
*.appleiphonecell.com
*.ibook.info
*.itools.info
*.airport.us
*.thinkdifferent.us
clients3.google.com
*.gstatic.com

Adding Managed Network Devices

MR access points acting as authenticators (devices through which AAA requests are sent to Cisco ISE) need to be added to ISE before Access-Request will be answered, it will by default not answer any requests.

To add a new device:

1. In Cisco ISE, choose Administration > Network Resources > Network Devices.

2. From the Network Devices navigation pane on the left, click Network Devices.

3. Click Add, from the action icon on the Network Devices navigation pane or click an already added device name from the list to edit it.

4. In the right pane, enter the Name and IP Address. As for the mask, you can add devices inside a network using /24, or as needed to avoid manually importing several APs.

5. Check the Authentication Settings check box and define a Shared Secret for RADIUS authentication. This must match the Secret entered for the RADIUS server when configuring the SSID in Dashboard.

6. Click Submit

Once a device is added, it will show up on the device list in ISE.

Creating Results for Rules

A new results needs to be created where the redirection will be specified.

To do this, go to “Policy > Results”. Click on Authorization and Authorization Profiles.

Click on “Add”

1. Name this authorization profile.

2. On Common Tasks, select “Web Redirection  (CWA, MDM, NSP, CPP)”, choose Centralized Web Auth, on ACL “NULL” and Value “Self-Registered” (These values can change depending on your needs.

Optionally, Static IP can be used to not used a DNS server, however, this is not recommended because the IP of the ISE server will be clear text and visible for the end client.

Enabling Policy Sets

Cisco ISE supports policy sets, which allow grouping sets of authentication and authorization policies, as opposed to the basic authentication and authorization policy model, which is a flat list of authentication and authorization rules. Policy sets allow for logically defining an organization's IT business use cases into policy groups or services, such as VPN and 802.1X. This makes configuration, deployment, and troubleshooting much easier.

In Cisco ISE, choose Administration > System > Settings > Policy Sets.

Creating a Policy Set

1. Click on Policy > Policy Set

2. Click the plus (+) sign or click on the settings icon and Create above to create a new policy set.

3. Enter the Name, Description and a Condition for this group policy.

4. Click on Condition, a new menu will show, match the condition necessary, per SSID policy sets are recommended, therefore, attribute “Radius·Called-Station-ID” ENDS WITH “<SSID name>”  is the preferred option. Click “Use” after configuring this step.

5. Define allow protocols, by default “Default Network Access” can be used.

6. Click on “Save”

Create Authentication Policy

1. Click on “View” policy by clicking on the right arrow.

2. Click on ”Options”

3. Change “If user not found” to CONTINUE

Create Authorization Policy

Two rules are required in Authorization Policies for Central Web-Auth, one rule will prompt the redirection and the second rule will grant access once the client machine has passed web page authentication.

1. Click on Authorization Policy

2. Click on the (+) sign or on the settings Icon to create a new rule.

3. Click on “Condition”. a new window will pop up. In this window, the method of the client requesting access can be selected. 

   • Look for Called-Station-ID, and match it to the name of the SSID.

4. Click “Use”

5. Select on “Results”, the name of the profile created for redirection, in this case it is “CWA”.

For second rule click on the Action Icon and select “Insert new row above”

1. Click on “Condition” a new window will pop up, in this window the method of the client requesting access can be selected. 

2. Look for “IdentityGroup:Name”

3. Select “In” and “Endpoint Identity Groups: GuestEndpoints”.

4. Click on “Use”.

5. Select on “Results” the profile called “PermitAccess”

6. Click Save.

Both rules should be created and should look like the image below, order is very important.