ISE - Cisco Live 2014

Report
Managing Policies for BYOD Network
BRKEWN-2020
Damodar Banodkar
Technical Marketing Engineer
For Your
Reference
For Your Reference
• There are slides in your PDF that will not be presented, or quickly presented.
• They are there usually valuable, but included only “For your Reference”.
For Your
Reference
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
3
The Need for managing devices and applications
4X
Smartphone connection speeds
will grow 4-fold from 2011 to 2016
90%
Mobile video traffic will have annual
growth rate of 90% 2011 to 2016 —Cisco VNI
56%
100%
BRKEWN-2020
—Cisco VNI
of US information workers spend time
working outside the office
—Forrester
of IT staff is struggling to keep
up with mobility trends
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
—Gartner
2
Agenda: Managing Policies for BYOD Network
Personal Devices on
Network
Securely Board the
Device
Application
Experience
Step 1
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Step 2
5
Simplified Services
Operations
3rd Party
Step 3
MDM
Wireless BYOD
• Drivers and Assumptions
Drivers
• Majority of new network devices have no wired port
• Users will change devices more frequently than in the past
• Mobile devices have become an extension of our Personality and Work
• Guest / Contractor access and accountability has become a mandatory business need
Assumptions
• Guest and Contractors must be isolated and accounted for.
• Users will have 1 wired and 2+ wireless devices moving forward
• The wireless network must be secure and as predictable as the wired network
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
6
Spectrum of BYOD Strategies
• Different Deployment Requirements for Different Environments
Cisco WLAN
Controller
ISE
(Identity Services Engine)
Cisco Catalyst Switch
ASA Firewall
Controller only BYOD
Controller + ISE-Wireless BYOD
Wireless Only
Wireless Only
Basic Profiling and Policy
on WLC
BRKEWN-2020
AAA+ Advanced Profiling + Device Posture +
Client On-board + Guest + Mobile Device
Management (MDM)
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
7
Controller + ISE-Advanced BYOD
Wired + Wireless + Remote Access
AAA + Advanced Profiling + Device Posture +
Client On-board + Guest + MDM
Cisco BYOD Device Policy Steps
EAP
Phase 1
Authentication
Phase 2
Device / User Identification
Phase 3
Posture assessment, MDM,
Lost device containment
Phase 4
Device Policy Enforcement
ISE
MAC, DHCP, DNS, HTTP
ISE
Client Supplicant
ISE
InternetOnly
Allowed
Device?
WLC
QoS
ACL
VLAN
AVC
Allowed
Access
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
8
• Silver
• Allow-All
• Employee
• Block Youtube
Contextual Policy for BYOD Deployments
• Control and Enforcement
IDENTITY
PROFILING
ISE
1
802.1x EAP
User
Authentication
NETFLOW
HQ
DNS
RADIUS
Policy
Decision
Profiling to
identify device
Corporate
Resources
4
Access Point
2:38pm
Personal
asset
SNMP
VLAN 10
VLAN 20
2
Company
asset
HTTP
Wireless LAN
Controller
3
Posture
of the device
Internet Only
5
Unified Access
Management
Enforcement
dACl, VLAN,
SGA, Application
With the ISE, Cisco wireless can support multiple users
and device types on a single SSID.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
DHCP
9
6
Full or partial
access granted
Integrating WLC and ISE for Authentication
and Profiling
Extensible Authentication Protocol (EAP) — Protocol
Flow
Layer 2 Point-to-Point
Supplicant
EAP over LAN
(EAPoL)
Layer 3 Link
Authenticator
RADIUS
Auth Server
EAPoL Start
Beginning
EAPoL Request Identity
EAP-Response Identity: Alice
The EAP Type is
negotiated between
Client and RADIUS
Server
RADIUS Access Request
[AVP: EAP-Response: Alice]
RADIUS Access-Challenge
EAP-Request: PEAP
Middle
[AVP: EAP-Request PEAP]
EAP-Response: PEAP
RADIUS Access Request
[AVP: EAP-Response: PEAP]
Secure Tunnel
Multiple
ChallengeRequest
Exchanges
Possible
Authentication conversation between Client and Auth Server
RADIUS Access-Accept
EAP Success
End
[AVP: EAP Success]
[AVP: VLAN 10, dACL-n]
• 802.1X (EAPoL) is a delivery mechanism and it doesn't provide the actual authentication mechanisms.
• When utilizing 802.1X, you need to choose an EAP type, such as Transport Layer Security (EAP-TLS) or PEAP, which defines
how the authentication takes place.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
11
EAP Authentication Types
• Different Authentication Options Leveraging Different Credentials
CertificateBased
Tunneling-Based
EAPPEAP
EAPTTLS
Inner Methods
EAP-GTC
EAP-MSCHAPv2
EAP-TLS
EAP-FAST
 Tunnel-based - Common deployments use a tunneling protocol (EAP-PEAP) combined
with an inner EAP type such as EAP-MSCHAPv2. PEAP Requires only a server-side
certificate.
This provides security for the inner EAP type which may be vulnerable by itself.
 Certificate-based – For more security EAP-TLS provides mutual authentication of both
the server and client.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
12
Factors in Choosing an EAP Method
• The Most Common EAP Types are PEAP and EAP-TLS
Security vs.
Complexity
Client
Support
Authentication
Server
Support
EAP Type(s)
Deployed

Most clients such as Windows, Mac OS X, Apple iOS devices support EAP-TLS, PEAP (MS-CHAPv2).
‒
Additional supplicants can add more EAP types (Cisco AnyConnect).

Certain EAP types (TLS) can be more difficult to deploy than others depending on device type.

Cisco ISE Supplicant Provisioning can aid in the deployment.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
13
The RADIUS Protocol
• It’s initiated by the client to the server, but not CoA…
• RADIUS protocol is initiated by the network devices
• No way to change authorization from the ISE
Now I can control
ports when I want to!
RADIUS
CoA
Authenticator
• Now network devices listens to CoA request from ISE
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
14
Auth Server
• Re-authenticate session
• Terminate session
• Terminate session with port bounce
• Disable host port
IEEE 802.1X with Change of Authorization (CoA)
Layer 3 Link
Layer 2 Point-to-Point
Supplicant
EAP over LAN
(EAPoL)
Authenticator
RADIUS
Auth Server
RADIUS CoA-Request
[VSA: subscriber: reauthenticate]
Change of
Authorization
RADIUS CoA-Ack
EAPoL Request Identity
EAP-Response Identity: Alice
RADIUS Access Request
[AVP: EAP-Response: Alice]
Re-Authentication
RADIUS Access-Challenge
EAP-Request: PEAP
[AVP: EAP-Request PEAP]
EAP-Response: PEAP
RADIUS Access Request
[AVP: EAP-Response: PEAP]
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
15
Multiple
ChallengeRequest
Exchanges
Possible
Change of Authorization (CoA)
Changing Connection Policy Attributes Dynamically
Before –
After –
Posture Assessment and Profiling
Employee Policy Applied
Client Status • Profiled, Workstation
Client Status • Unknown
VLAN
• Limited Access
VLAN
ACL
• Posture-Assessment
ACL
• None
QoS
• Silver
QoS
• Gold
Application
• Block Youtube
Application
• Allow Youtube
User and Device
Specific Attributes
User and Device
Specific Attributes
ISE
BRKEWN-2020
• Employee
© 2014 Cisco and/or its affiliates. All rights reserved.
ISE
Cisco Public
16
For Your
Reference
Enable CoA – AAA Override
1
Allow AAA
Override to
Permit ISE to
Modify User
Access
Permissions
(CoA)
2
Allow AAA
Override to
Permit ISE to
redirect client
to a specific
URL
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
17
Cisco Wireless Controller User-Based Policy AAA
Override Attributes
VLAN
Access Control List (ACL)
Quality of Service (QoS)
CoA
Application Control (AVC)
Bonjour Service Policy
URL Redirect
Available in AireOS Version 8.0
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
18
FlexConnect and AAA Override
Setting the VLAN for Locally Switched Clients
IETF 81
IETF 65
IETF 64
WAN
WLC
AP
ISE
Create Sub-Interface on
FlexConnect AP and Set the
ACL on the VLAN
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
19
URL Redirection
Central Web Auth, Client Provisioning, Posture, MDM, Guest Services
External URL Redirect (ISE):
Redirect URL:.
cisco:cisco-av-pair=url-redirect= https://url
Example: TCP Traffic Flow for Login Page
Redirect ACL:.
cisco:cisco-av-pair=url-redirect-acl= ACL-POSTURE
TCP port 80 SYN
User opens browser
SYN-ACK
ACK
HTTP GET
http://www.google.com
Redirect: HTTP Login Page
Username, Password
HTTP GET
http://www.google.com
Host
WLC
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
20
ISE
Cisco Wireless LAN Controller ACLs
Layer 3-4 Filtering at Line-rate.
Inbound
WLC
Wired
LAN
Outbound
AP
• ACLs provide L3-L4 policy and can be applied per interface or per user.
• Cisco 2500, 5508 and WiSM2 implement hardware, line-rate ACLs.
• Up to 64 rules can be configured per ACL.
Implicit Deny All at the End
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
21
Unified Access BYOD - Downloadable ACL Support
Download - http://www.miercom.com/2013/05/cisco-wlc-5760/
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
22
Cisco Wireless User-Based QoS Capabilities
Allowing Per-User and Per-Devices Limiting of the Maximum QoS Level
For the contractor user, the
AAA server returned QoSSilver so even packets
marked with DSCP EF are
confined to the Best Effort
Queue.
WMM Queue
For the Employee user, the
AAA server returned
QoS-Platinum so packets
marked with DSCP EF are
allowed to enter the WMM
Voice Queue.
Voice
Video
Best Effort
Background
Employee –
Platinum QoS
Call Manager
WLC
Access
Point
QoS Tagged Packets
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
23
Contractor –
Silver QoS
Cisco Wireless Application Control
AVC provides Layer 7 policies per User (by Device Type and User Role)
Applications
Priority
User Role
Real Time Applications
(Business )
Non Real Time Applications
(Business)
Applications
Device
Priority
Exec
High
High
Normal
Employee
Normal
Casual Applications
Low
Contractor
Low
Malicious Applications
Drop
Available in AireOS Version 8.0
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
18
Cisco Wireless Bonjour Services Control
Bonjour Gateway provides Services policies per User
User Role
Bonjour Service Access
For the Employee and Exec
user, Airplay and AirPrint
access is permitted
Exec
Employee
Contractor
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
For the contractor user,
Airplay access is denied
Cisco Public
25
Cisco BYOD Policy Elements
VLAN
Access Control List (ACL)
Quality of Service (QoS)
CoA
Application Control (AVC)
Bonjour Service Policy
URL Redirect
Available in AireOS Version 8.0
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
26
Cisco BYOD Device Policy Steps
EAP
Phase 1
Authentication
Phase 2
Device / User Identification
Phase 3
Posture assessment, MDM,
Lost device containment
Phase 4
Device Policy Enforcement
ISE
MAC, DHCP, DNS, HTTP
ISE
Client Supplicant
ISE
InternetOnly
Allowed
Device?
WLC
QoS
ACL
VLAN
AVC
Allowed
Access
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
27
• Silver
• Allow-All
• Employee
• Block Youtube
BYOD Policy
Elements
BYOD with ISE (Identity Services)
ISE Device Profiling Example - iPad
• Once the device is profiled, it is stored within the
ISE for future associations:
Is the MAC Address
from Apple?
Does the Hostname
Contain “iPad”?
Is the Web Browser
Safari on an iPad?
Apple iPad
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
29
Client Attributes Used for ISE Profiling
How RADIUS, HTTP, DNS and DHCP (and Others) Are Used to Identify Clients.
2
The Client’s DHCP/HTTP
1 This provides the
Attributes are captured
MAC Address
which is checked
against the
known vendor
OUI database.
• The ISE uses multiple attributes to
build a complete picture of the end
client’s device profile.
by the AP and provided
in RADIUS Accounting
messages.
DHCP
HTTP
DHCP/
HTTP
Sensor
DNS Server
RADIUS
– The ISE can even kick off an NMAP
scan of the host IP to determine more
details.
4
HTTP UserAgent
3
The device is redirected using a
captive portal to the ISE for web
browser identification.
BRKEWN-2020
• Information is collected from
sensors which capture different
attributes
© 2014 Cisco and/or its affiliates. All rights reserved.
ISE
Cisco Public
A look up of the DNS
entry for the client’s
IP address reveals
the Hostname.
30
ISE Device Profiling Capabilities
• Over 200 Built-in Device Policies, Defined Hierarchically by Vendor
Smart Phones
Minimum
Confidence for a
Match
Gaming
Consoles
Multiple
Rules to Establish
Confidence Level
Workstations
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
31
1
2
Defining a BYOD Policy Within ISE
32
ISE Authentication Sources
User and/or Machine
Authentication
Active Directory,
Generic LDAP or PKI
EAPoL
RADIUS
Local DB
user1
C#2!ç@_E(
User/
Passwo
rd
BRKEWN-2020
RSA SecureID
Certificate
Token
Backend Database(s)
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
33
• Cisco ISE can reference
variety of backend
identity stores including
Active Directory, PKI,
LDAP and RSA
SecureID.
• The local database can
also be used on the ISE
itself for small
deployments.
Steps for Configuring ISE Policies
1. Authentication Rules
• Define what identity stores to reference.
• Example – Active Directory, CA Server or Internal DB.
BYOD Policy
Elements
2. Authorization Rules
• Define what users and devices get access to resources.
• Example – All Employees, with Windows Laptops have full
access.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
34
Authentication Rules
Example for PEAP and EAP-TLS
1
1
Reference Active Directory for PEAP
Authentication
2
Create Another Profile to Reference the
Certificate Store
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
35
Authorization Rules Configuration
Flexible Conditions Connecting Both User and Device
1Policy  Authorization - Simple
Specific Device Type
2
Active Directory
Groups Can Be
Referenced
Groups (such as
Workstations or iPods) Can
Be Utilized
3
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
The Authorization Rule Results in Attributes to
Enforce Policy on End Devices
36
Authorization Rule “Results”
The Actual Permissions Referenced by the Authorization Rules
1
Simple VLAN Override by
Specifying the Tag
• The authorization rules provide a
set of conditions to select an
authorization profile.
• The profile contains all of the
connection attributes including
VLAN, ACL and QoS.
2
BRKEWN-2020
• These attributes are sent to the
controller for enforcement, and
they can be changed at a later
time using CoA (Change of
Authorization).
All WLC Attributes are
Exposed to Override
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
37
Authorization Rule “Results”
The Application and Bonjour profile referenced in Authorization profile
VLAN
Access Control List (ACL)
Quality of Service (QoS)
Application Control (AVC)
Bonjour Service Policy
URL Redirect
WLC Attributes for AVC and
Bonjour policy override
Available in AireOS Version 8.0
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
BYOD Device Provisioning
39
Simplified On-Boarding for BYOD
Putting the End User in Control
Cert
Provisioning
MyDevices
Portal
Supplicant
Provisioning
Device
Onboarding
iOS
Android
Windows
MAC OS
BRKEWN-2020
Self-Service
Model
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
40
Apple iOS Device Provisioning
1
WLC
Initial Connection
Using PEAP
ISE
CA-Server
Device Provisioning
Wizard
2
Change of
Authorization
Future Connections
Using EAP-TLS
3
BRKEWN-2020
WLC
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
41
ISE
CA-Server
Defining the Supplicant Provisioning Authorization
Profile
1
Configure Redirect ACL On WLC
2
Choose “Supplicant Provisioning” for the Redirect Portal
URL Redirect
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
42
“My Devices” Portal
• Self-Registration and Self-Blacklisting of BYOD Devices
Devices can be marked
lost by the User.
2
3
1
New Devices Can be Added with
a Description
Demo Video:
www.youtube.com/watch?v=lgJCJNgFjEM
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
45
Lost devices can be blackholed using
url-redirect
Ensuring Endpoint Compliance
• Endpoint Health assessment
Wired, Wireless,
VPN User
Temporary Limited Network
Access Until Remediation Is
Complete
NonCompliant
Sample Employee Policy:
Challenge:
Value:
• Microsoft patches updated
• Understanding health of device
• Temporal (web-based) or
• McAfee AV installed, running,
• Varying level of control over devices
and current
• Corp asset checks
• Enterprise application running
BRKEWN-2020
• Cost of Remediation
© 2014 Cisco and/or its affiliates. All rights reserved.
Persistence Agent
• Automatic Remediation
• Differentiated policy enforcement-
based on role
Cisco Public
48
MDM Integration
ISE Registered
MDM Registered
Encryption
PIN Locked
Jail Broken
PIN Locked
Jail Broken
© 2014 Cisco and/or its affiliates. All rights reserved. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view
a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does
49
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
not imply a partnership relationship between Cisco and any other company. (1110R)
Visibility with Prime Infrastructure and ISE Integration
1
Both Wired +
Wireless Clients in a
Single List
2
Device Identity from
ISE Integration
AAA Override
Parameters Applied
to Client
3
Policy Information
Including Windows
AD Domain
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
50
Local Profiling on WLC
Build BYOD Policy: Flexible Options
• Different Deployment Requirements for Different Environments
• Centralized Policy
ISE
ACS
(Identity Services Engine)
NAC
Profiler
Guest
Server
NAC
Manager
NAC
Server
Controller + ISE-Wireless BYOD
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
52
• RADIUS Server
• Posture Assessment
• Guest Access Services
• Device Profiling
• Client Provisioning
• MDM
• Monitoring
Troubleshooting
Reporting
Build BYOD Policy: Flexible Options
• Local Profiling & Policy on WLC
Network Components
POLICY
WLC
Radius Server
(e.g.. ISE Base, ACS)
Only Wireless
Elements
Device Type
User Role
Policy Enforced
BRKEWN-2020
VLAN
© 2014 Cisco and/or its affiliates. All rights reserved.
Access List
Cisco Public
Authentication
QoS
Application
Time of Day
Services (Bonjour)
WLC Native Profiling for BYOD Deployments
IDENTITY
Radius Server
User-Role
2
POLICY
VLAN 10
1
Corporate
3
Policy
Decision
Profiling to
identify device
6
Corporate
Resources
Auth-Type
Access Point
Wireless LAN
Controller
5
Personal
4
Time
BRKEWN-2020
Internet Only
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Enforcement
Unified Access ACl, VLAN, QoS,
Management
Application,
Bonjour
54
VLAN 20
Configuring User-Role
User Role
Radius
role=Employee
Employee
Controller
role=Contractor
Contractor
Privilege
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
55
Native Device Profiling on WLC
Step 2
Device Type
Create Device Profiling Policy
Step 1
Cisco WLC configuration
Step 3
156 Pre-Defined Device Signature
Enable DHCP and HTTP Profiling
on the WLC
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
56
Native Profiling Authentication and Time Policy
Wireless Client Authentication EAP Type
Authentication
LEAP
EAP-FAST
EAP-TLS
PEAP
Time of Day
Active hours for Policy
Time based policy
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
57
Enforce Policy on the WLC
Enforced Policy
ACL*
VLAN
QoS*
Session Timeout
Application Control
mDNS Policy
* Supported in FlexConnect mode
58
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Applying Native profiling policy per WLAN / AP Group
Native Profiling per AP Group
Native Profiling per WLAN
Restriction: First Matched Rule Applies
Maximum 16 polices can be created per WLAN / AP Groups and 64 globally
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
59
Required Network Components and Versions
For Your
Reference
Cisco Wireless LAN
Feature/Platform
OS Version
5508 / WiSM2
7500
2500
AireOS 7.2.x onwards
CoA Support
8500
Unified Access (5760/3850)
AireOS 7.3.x
onwards
IOS XE 3.2.2 onwards
440x/WiSM1
AireOS 7.0.116 onwards
802.1x and L3 Web-auth WLAN
802.1x WLAN only
Access Point Mode for
Profiling and Posture
Local and FlexConnect mode
Local Mode only
Limited Profiling and
Policy on WLC
AireOS 7.5 onwards*
N/A
Extra License
None
*FlexConnect mode: No WLC BYOD support for Local Auth on AP
Identity Services Engine
BRKEWN-2020
210x
Identity Services Engine Version
Licenses for Onboarding, Profiling, Posture and
MDM
Version 1.1.1 onwards
Advanced / Wireless License
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
60
Beyond BYOD
The Optimized Experience for Every Workspace
Device Onboarding and
Network Access
Unified BYOD
Policy
Beyond BYOD
BYOD
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Application
Experience
Cisco Public
Simplified
Operations
Application Visibility and Control (AVC)
What is the Need for AVC?
Who are the top 10 users?
Devices
Apps
Is someone running
Bit-torrent and bringing
down my business
applications?
Should I add
more APs to
enhance the
capacity?
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
63
What are the top 10
applications?
How much traffic is
BYOD generating on my
network?
What is Application Visibility & Control ?
On Wireless Controllers
Real Time
Interactive
Traffic
Non-Real Time
Background
NBAR2 LIBRARY
Deep Packet
inspection
NETFLOW (STATIC
TEMPLATE)
provides Flow Export
POLICY
Packet Mark and Drop
CISCO PRIME
COMPLIANCE
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
CAPACITY
PLANNING
Cisco Public
TROUBLESHOOTING
THIRD PARTY
NETFLOW
COLLECTOR
How Does AVC Classify Applications: Cisco Jabber
Three classifications flows for Cisco Jabber
Cisco Jabber Audio
Cisco Jabber Video
Different Policies for different
components of a Jabber
Session
Demo Video:
www.youtube.com/watch?v=1kt2hvo4UL4
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Cisco Jabber Control
Enabling Application Visibility and Control
• AVC is enabled per WLAN to Allow Deep Packet Inspection
1
Change the QoS level to
reflect the highest
application level for that
SSID
2
Enable Application Visibility
3
Ensure WMM is set to
“Allowed” or “Required”
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
67
Basic Application Visibility Added on the Controller
Home Screen
Top Applications
Show Sorted by
Bytes
Use “Monitor” ->
“Applications” to View
More Statistics
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
68
Viewing Real-Time Statistics
• Use for Assessing Current Usage or Troubleshooting
Real Time Stats (Last 90 Seconds)
Application Usage Displayed
by % of Total Bytes for Last 90 Seconds
Average Packet Size to See Small
vs. Large Packet Flows
DSCP marking per client (Last 90 Seconds)
Real-Time QoS Markings
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
69
Viewing Historical Statistics
• Use for Assessing Overall Usage
Cumulative Statistics
Application Usage Displayed
by % of Total Bytes
Total Bytes Transferred – Useful for Tracking Down
Bandwidth Hogs
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
70
Application Control
1
Med
2
AVC Profile – Drop Bit torrent
AVC Profile – Mark Citrix
Low
High
Medium
Low
3
Control
Control application
usage and
performance
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
71
AVC Profile – Rate Limit Facebook
AVC configuration for AAA override
Example – Teacher, Student
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
For Your
Reference
Applying AVC Profiles
1
Create AVC Profile for Applications at Wireless > AVC
2
Maximum 32 Rules can be created per AVC
Profile
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
74
Apply AVC Profile to WLAN
Apply AVC Profile per client
using Local profiling on
WLC
3
Apply AVC Profile per
client using AAA Override
(Radius Server)
NBAR2 – Regular Updates
In-service Application Definition Update
PP X (Major)
PP Y (Major)
PP X.1 (Minor)
•protocols~ 10
• updates and
fixes
PPY.1 (Minor)
•Bug fixes
•small updates
•Bug fixes
•small updates
• Protocols~10
• updates and
fixes
PP 6.3
Available
• Standard Protocol Pack
Includes only subset of protocols
No Support for Traffic categorization and Attributes
Available (as Default Protocol pack) in IP Base image
No periodic releases and SLA
Includes all supported Protocols / Applications
Support Traffic categorization and Attributes
Available (as Default protocol pack) in DATA image
Periodic releases and Offers SLA
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Protocol Pack
Protocoln
–
–
–
–
Protocol2
• Advanced Protocol Pack
NBAR2
Protocol1
–
–
–
–
NBAR2 Protocol Pack
Example
• Add new applications recognized by NBAR2 without WLC reload
• New protocol pack is published every two months on CCO
• Single CLI to enable the protocol pack
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Application Visibility at Cisco Prime
Application Filter / Visibility per:
•
SSID
•
Client
•
Building
•
Floor
•
Device (AP/Controller)
Application Based Reporting
Wired/Wired with Third party
Netflow
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Application Visibility with 3rd Party Vendors
• Using Netflow exports,
third party tools like
Plixer Scrutinizer can
visualize the data and
track it historically.
• Custom reports in this
3rd party tool allow
viewing of upstream,
downstream flows as
well as client DSCP
markings.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
78
Cisco Wireless Netflow Record
NetFlow v9
Client MAC
Client IP
 Monitors data from layer 2 thru 7
 Determines applications by combination of port
and payload
SSID
Access Point MAC
Packet Count
NetFlow
 Flow information contains Client, wireless
infrastructure, Application, QoS marking and
bandwidth detail
Octet Count
Before AVC DSCP
After AVC DSCP
Application Tag
What applications, how much bandwidth, flow direction?
(NetFlow and NBAR2)
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
79
Netflow Collection and Export Configuration
Create Netflow Monitor and Exporter at Wireless > Netflow
WLC
NFv9
Reporting Tools
Apply Netflow monitor per WLAN
Netflow Collection &
Exporting
WLC collects
application bandwidth,
export to management
tool for reporting
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
80
For Your
Reference
Application Visibility and Control Verification
Application Control Tested
•
•
•
Citrix video streaming
quality improves by 55%
Microsoft Lync Voice
MOS Score Rises to 4.20.
Background traffic using
Windows File sharing
drops by 74%
Download - http://dcc.syr.edu/PDF/Cisco-AVC-Application-Improvement-Report-Feb-2013.pdf
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
81
Bonjour Services Gateway
Bonjour Protocol
 Bonjour Protocol helps Apple devices discover Services
 Uses mDNS protocol to advertise and discover services
 Link Local: Does not cross subnets
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
83
Bonjour Challenges across VLAN’s
Bonjour is Link-Local Multicast
and can’t be Routed
VLAN X
224.0.0.251
VLAN Y
CAPWAP Tunnel
WLC
AP
Router
224.0.0.251
VLAN X
•
Bonjour is link local multicast and thus forwarded on Local L2 domain
•
mDNS operates at UDP port 5353 and sent to the reserved group addresses:
IPv4 Group Address – 224.0.0.251
IPv6 Group Address – FF02::FB
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
84
Apple TV
(VLAN Y)
Apple TV Bluetooth Discovery process
Enable Wi-Fi
and make sure
its routable to
Apple TV subnet
iDevices
discovers
Apple TVs in
Bluetooth
range (40 feet)
iDevices can
start mirroring
Bluetooth is used only to discover Bonjour AirPlay services
Does not apply for AirPrint, Backup, AirDrop etc.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
85
Apple TV Bluetooth Discovery Implications on Wi-Fi
Bonjour Policy Control
Wi-Fi Interference
Student
Apple TVs add new set of Bluetooth
interfering devices on network
Congested 2.4 GHz spectrum makes
Bluetooth discovery slow and unreliable
Teacher
Student can discover Apple TV and
gain AirPlay Access
Password mechanism lacks Role based policy
control
No Bluetooth discovery for Mac OSX
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
86
Bonjour mDNS Gateway on Cisco WLC
Bonjour Advertisement
VLAN 20
CAPWAP Tunnel
WLC
AP
VLAN 99
Bonjour Advertisement
iPad
© 2014 Cisco and/or its affiliates. All rights reserved.
VLAN 23
AirPrinter
(wired)
 Step 1 – Listen for Bonjour Services
BRKEWN-2020
Switch
AirPrint Offered
Apple TV
Cisco Public
87
Bonjour mDNS Gateway on Cisco WLC
Bonjour Cache:
AirPlay – VLAN 20
AirPrint – VLAN 23
VLAN 20
Apple TV
AP
VLAN 99
iPad
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Switch
VLAN 23
AirPrinter
(wired)
 Step 2 –Bonjour Services cached on the controller
BRKEWN-2020
WLC
AirPrint Offered
CAPWAP Tunnel
88
Bonjour mDNS Gateway on Cisco WLC
Bonjour Cache:
AirPlay – VLAN 20
AirPrint – VLAN 23
VLAN 20
Apple TV
CAPWAP Tunnel
AP
WLC
Switch
VLAN 23
VLAN 99
iPad
Bonjour Query
AirPrinter
(wired)
 Step 3 –Listen for Client Service Queries for Services
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
89
Bonjour mDNS Gateway on Cisco WLC
Bonjour Cache:
AirPlay – VLAN 20
AirPrint – VLAN 23
Bonjour Response
From Controller
VLAN 20
Apple TV
CAPWAP Tunnel
AP
WLC
Switch
VLAN 23
VLAN 99
iPad
 Step 4 –Respond to Client Queries (unicast) for Bonjour Services
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
90
AirPrinter
(wired)
Bonjour traffic optimization
80% less Bonjour Traffic*
100% less Bonjour Multicast Traffic
Bonjour Cache:
AirPrint – VLAN 23
Airplay – VLAN 20
* For 4 Access Point Deployment
6400 Entries per
Controller
WLC
Reason for Traffic optimization
Bonjour Service query is cached on
Controller
 Not forwarded
Bonjour Client Query
 Unicast Response
 Not forwarded
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
91
Filter Services by WLAN and VLAN
Services Directory
Contractor
Service Policy
Employee
Service Policy
WLC
FileShare
Single - SSID
AP
FileShare
Contractor Network
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Employee Network
Cisco Public
92
Bonjour Policy Example for Education using v8.0
Teacher
Service Profile
Teacher Service
Instance List
Student Service
Instance List
Student
Service Profile
Apple TV1
AirPrint
AirPlay
File
Share
Apple TV1
AirPlay
iTunes
Sharing
AirPlay
File
Share
Apple TV2
Teacher Network
mDNS Service Instances Groups
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
95
Student
Network
AirPrint
Bonjour Policy enhancements in v8.0
• Location and Role filtering in release v8.0
• Bonjour Policies allow creation of the mDNS Service Groups and Service
Instances within the Group
• Service Instance mandates how the service instance is shared by configuring
o
o
o
o
MAC address of the Service Instance
Name of the Service Instance
Location Type Of the Services Instance by AP Group, AP Name or AP Location
Location configuration allows access the “service instance” i.e. client location
 Location configuration applied to wired and wireless instances of all services and
printers as in Any, Same or one AP Name.
 This allows selective sharing of service instances based on the location and
rule (=user-id and role ) on the Same WLAN
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
96
96
Bonjour Policy Configuration
Configure Service Instances in the mDNS group, and role
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
97
Bonjour Policy enhancements in v8.0
• Service Instance associated with mac address can be configured in multiple service
groups
 Currently we support a maximum of 5 service groups for a single mac address.
 Service group configurations can be done even when mDNS snooping is disabled
 Number of Service instances per Service group is limited by the platform supported
(ie
6400 on 5508)
• Location Filtering of Service instance can be limited by following attributes:
 “any” –clients from any location can access the service subject
to role and user-id credentials being allowed by the policy
associated with the service group for the said mac address.
 “same” - only clients from the SAME location as that of the
device can access that Service Instance publishing the service
can access the service.
 “ap-name” – only clients associated to that AP can
access the Service Instance
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
98
98
Bonjour Policy enhancements in v8.0
• Allows articulation as “service instance” is shared with whom i.e. user-id,
“service instance is shared with which role/s” i.e. teacher or student
• With Bonjour access policy there will now be two levels of filtering client
queries
1. At the service type level by using the mDNS profile
 mDNS profile can be user specific and be overridden with ISE “av-pair
“returned to WLC that overrides default profile
2. At the Service Instance level using the access policy associated with
each Service Instance.
Note: Service instances which are not configured with any access policy will be mapped
to the default access policy that allows configured <roles/names> to receive the service
instances
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
Location Specific Service for Bonjour
With LSS Bonjour services
can be location specific
Bonjour Services
Directory
mDNS AP
CAPWAP Tunnel
CAPWAP Tunnel
Localization can be any
service specific
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
100
Apple Services
Enable Bonjour for Remote VLAN: mDNS AP
With mDNS-AP Bonjour services
can be seen from a remote VLAN
mDNS AP
(Trunk mode)
224.0.0.251
VLAN X
CAPWAP Tunnel
Remote-Switch
CAPWAP Tunnel
WLC
Switch
AP
VLAN Y
VLAN X
Bonjour Services Directory
Apple TV
(Remote VLAN)
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
101
Google ChromeCast With Cisco Wireless LAN
Controllers
How Does Google ChomeCast Work?
1. (Services Discovery Request)
239.255.255.250
Unicast Response
2. (Response with IP address of service)
• ChromeCast Deployment Guide:
– http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/76/chromecastDG76/ChromecastDG76.html
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
102
For Your
Reference
AVC and Bonjour Gateway Network Requirements
Network Management
Cisco Wireless LAN
Feature/Platform
5508 / WiSM2
7500
8500
2500
Feature/Platform
Cisco Prime
Flexible Netflow
AVC
AireOS 7.4 onwards
Performance Collection
Access Point Mode for
AVC
Local Mode Only
License
AVC Protocol Pack
Update
Bonjour Gateway
AireOS 7.5 onwards
AireOS 7.5 onwards
mDNS AP feature
AireOS 7.5 onwards
Access Point mode for
Bonjour Gateway
Local Mode Only
BRKEWN-2020
N/A
AireOS 7.4 onwards
Bonjour Location
Specific Service
Extra License
Prime Assurance
NBAR2 Limitations on WLC:
• When an AP is in flex connect mode,
NBAR is not supported
• IPv6 traffic cannot be classified
• Not supported by the vWLC or WLC on
SRE
None
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
103
Summary: Managing Policies for BYOD Network
Personal Devices on
Network
Network Components
Application
Experience
Securely Board the
Device
Wireless
Remote
Access
Wired
ISE
Simplified Bonjour
Operations
Prime
rd Party
3rd3Party
MDMMDM
Optional
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
104
Participate in the “My Favorite Speaker” Contest
Promote Your Favorite Speaker and You Could be a Winner
• Promote your favorite speaker through Twitter and you could win $200 of Cisco
Press products (@CiscoPress)
• Send a tweet and include
– Your favorite speaker’s Twitter handle <Speaker – enter your twitter handle here>
– Two hashtags: #CLUS #MyFavoriteSpeaker
• You can submit an entry for more than one of your “favorite” speakers
• Don’t forget to follow @CiscoLive and @CiscoPress
• View the official rules at http://bit.ly/CLUSwin
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
105
Complete Your Online Session Evaluation
• Give us your feedback and you
could win fabulous prizes. Winners
announced daily.
• Complete your session evaluation
through the Cisco Live mobile app
or visit one of the interactive kiosks
located throughout the convention
center.
Don’t forget: Cisco Live sessions will be available
for viewing on-demand after the event at
CiscoLive.com/Online
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
106
Continue Your Education
• Demos
• Labs
• Lunch
• Topics
• Final copy TBD
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
107
Configurations for Your Reference
108
Steps for Integrating the Controller and ISE
1. Configure WLAN for 802.1x Authentication
• Configure RADIUS Server on Controller
• Setup WLAN for AAA Override, Profiling and RADIUS NAC
2. Configure ISE Profiling
• Enable profiling sensors
3. Setup Access Restrictions
• Configure ACLs to filter and control network access.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
109
For Your
Reference
Configuring ISE as the Authentication Server
and Accounting Server
1
Enable “RFC 3576” for
Support Change of
Authorization
2
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
110
Add to Accounting Servers
to Receive Session
Statistics
For Your
Reference
Configuring the WLAN for Secure Connectivity
For Your
Reference
Enabling Secure Authentication and Encryption with WPA2-Enterprise
1
WPA2 Security with AES
Encryption
2
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
111
Assign Radius Server per
WLAN
Setting the WLAN QoS Level for Override
Using WMM, the QoS Level is Based on the Marking of the Packet.
This Acts As An
Upper Limit, or
Ceiling for the
WLAN’s QoS
Configuration
1
• If WMM is set to Allowed, the Quality of Service configuration serves as a limit for the
entire SSID.
• Ensure all controller uplinks, media servers and Access Points have proper Quality of
Service trust commands in IOS.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
112
For Your
Reference
Configuring the WLAN for ISE Identity-based
Networking Cont’d
1
For Your
Reference
2
Allow AAA
Override to
Permit ISE to
Modify User
Access
Permissions
BRKEWN-2020
Enable RADIUS
NAC to allow
ISE to use
Change of
Authorization.
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
113
3
Enable Radius
Client Profiling
to Send DHCP
and HTTP
attributes to
ISE.
Configuring the Controller ACL
1
This ACL will be referenced by name by the
ISE to restrict the user.
2
Use the ISE server’s IP address to allow only
traffic to that site.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
114
For Your
Reference
Configuring ISE Profiling Sensors
For Your
Reference
• Profiling relies on a multitude of “sensors” to
assess the client’s device type.
• Profiling can always be achieved through a span
port, more efficient profiling is achieved through
sensors which selectively forward attributes.
• For DHCP Profiling:
– Option A: Use v7.2 MR1 code to send DHCP attributes
in RADIUS accounting messages.
– Option B: Use Cisco IOS “ip helper” addressed to ISE
on switches adjacent to the WLC.
• For HTTP Profiling:
– Use the Web-Authentication redirect to get the HTTP
user agent.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
115
Steps for Configuring Device Provisioning
For Your
Reference
1. Configure Integration with External CA Server
• Define SCEP URL and certificates.
• Example – Active Directory, CA Server or Internal DB.
2. Define Supplicant Provisioning Profile
• Define what security and EAP type is deployed to end
devices.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
116
Configuring SCEP Integration on the ISE
For Your
Reference
• The ISE Must Point to the SCEP Server and Have a Valid Certificate Signed by the CA
1
Configure the SCEP URL Pointing
to the Microsoft Windows 2008
Server or other CA
2
Request a Certificate for the ISE
from the CA Server
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
117
Configuring Certificates on the ISE
For Your
Reference
• Certificates are Used for HTTPS and EAP Connections
1
The Web Server Certificate Can Be The
Same, or Different than the EAP/RADIUS
Certificate
2
Use the Certificate from Your CA
Server for EAP Authentication
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
118
Configuring the Web-Authentication Redirect ACL
For Your
Reference
• The ACL is Used in HTTP Profiling as Well as Posture and Client Provisioning.
1
This ACL will be referenced by name by the
ISE to restrict the user.
2
Use the ISE server’s IP address to allow only
traffic to that site.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
119
Defining the Supplicant Provisioning
Authorization Profile
1
Configure Redirect ACL On WLC
2
Choose “Supplicant Provisioning” for the
Redirect Portal
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
120
For Your
Reference
BYOD configuration for Unified Access
121
For Your
Reference
Unified Access BYOD Config
Change Of Authorization (CoA)
Network Access Control
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
122
Steps for AVC configuration
Configure AVC policy and Netflow
• Define AVC profile and apply to WLAN.
• Define netflow export profile and apply to WLAN.
Update NBAR2 protocol pack
• Steps to update protocol pack on controller.
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
123
For Your
Reference
For Your
Reference
Applying AVC Profiles
Create AVC Profile for Applications at Wireless > AVC
Apply AVC Profile to WLAN
Maximum 32 Rules can be created per AVC Profile
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
124
Netflow Collection and Export Configuration
Create Netflow Monitor and Exporter at Wireless > Netflow
WLC
NFv9
Reporting Tools
Apply Netflow monitor per WLAN
Netflow Collection &
Exporting
WLC collects
application bandwidth,
export to management
tool for reporting
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
125
For Your
Reference
AVC: Steps updating AVC Protocol Pack
For Your
Reference
 Protocol Pack allows adding more applications without upgrading or reloading AireOS
 NBAR2 Protocol List:
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6558/ps6616/product_bulletin_c25-627831.html
 Protocol Pack are released for specific NBAR Engine
– AireOS 7.5 WLC has NBAR Engine 13 (protocol pack will be pp-adv-asr1k-152-4.S-13-3.0.0.pac)
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
126
Steps for Bonjour configuration
For Your
Reference
Bonjour Profile
• Steps to configure mDNS profile
• Steps to Apply the mDNS profile per interface.
Location specific Bonjour Service
• Steps to enable location specific services on
controller
Remote VLAN bonjour Service
• Steps to discover bonjour service on remote VLAN
by enabling mDNS AP
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
127
Bonjour Gateway Services filter
For Your
Reference
Enable mDNS Globally / Add Services
mDNS Profile for Employee
Max. of 64 services can be enabled
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
128
Applying the Bonjour Gateway Profile
WLAN
VLAN
Controlling Bonjour Gateway Profile per Interface
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
129
For Your
Reference
Bonjour:
Steps Configuring LSS service from CLI
1. Once the basic bonjour gateway setup is configured the LSS can be enabled by
accessing the WLC CLI, LSS is disabled by default on the WLC
2. Configure LSS services from CLI:
(WLC) >config mdns service lss <enable / disable> <service_name/all>
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
130
For Your
Reference
Bonjour:
Configure mDNS- AP from CLI
1. Configure switch port for mDNS-AP in trunk mode or Access Mode
2. Configure mDNS-AP Trunk Mode or Access Mode:
(WLC)> config mdns ap enable/disable <APName/all> vlan <vlan-id>
(WLC) >config mdns ap vlan add/delete <vlanid> <AP Name>
(WLC)> config mdns ap enable/disable <APName/all> - no VLAN Config in Access Mode
BRKEWN-2020
© 2014 Cisco and/or its affiliates. All rights reserved.
Cisco Public
131
For Your
Reference

similar documents