Building CWA Authorization Policies
Configuring the authorization policy for centralized Web Authentication is ultimately a two-rule process. This section shows how to create two different authorization rules that will exist toward the end of your authorization policy. They appear at the end of the policy because of the top-down nature of ISE policies and to ensure that CWA is leveraged only when a more specific authorization rule does not apply. If an explicit authorization does not occur, ISE uses the CWA rule to redirect the user to the CWA portal.
The second rule must exist above the redirection rule because this rule is used to assign the right level of access to a user who successfully authenticates to the CWA portal. The second rule must exist above the first rule, or the user will end up in a CWA loop.
Cisco has included preconfigured authorization rules with ISE for wireless guest access Web Authentication. These rules, which are shown in Figure 12-14, are disabled by default.
)
You can leverage these prebuilt rules, but how would that help you learn and prepare for the SISE 300-715 exam? Instead of leveraging those prebuilt rules, which could shorten your configuration time dramatically, in the following sections you will see how to build your own rules.
Create the Rule to Redirect Users to the CWA Portal
The first rule to create is one that redirects unauthenticated users to the CWA portal, where they are required to authenticate interactively.
In the ISE GUI, follow these steps:
Step 1. Navigate to Work Centers > Network Access > Policy Sets.
Step 2. Drill down into your default policy set (or the policy set that is in use for your deployment at this time).
Step 3. Insert a new rule above the Basic_Authenticated_Access rule and name the new rule WebAuth, as shown in Figure 12-15.
Step 4. For the conditions, select two existing compound conditions from the library: Wired_MAB and Wireless_MAB. Ensure that the OR operator is used with the conditions, as shown in Figure 12-15.
Step 5. Use the CWA authorization profile you created previously for the result, as shown in Figure 12-15.
Step 6. Click Save.
)
Figure 12-15 shows the completed WebAuth authorization rule.
Create the Rules to Authorize Users Who Authenticate via CWA
The second rule needs to allow a user who authenticates via WebAuth to have specific access to the network. The number of rules created depends on the needs of your organization. For the purposes of this chapter, you will create only one rule, for employees. (Guest users are covered in Chapter 13.)
In this case, you need to construct a new authorization rule that will allow employees (users who are members of the Employees group in Active Directory) who have successfully authenticated through the web portal to have network access.
To accomplish this task, you can use a dictionary item named Guest Flow in your rule. ISE uses this dictionary item to identify when an authentication has occurred via an ISE web portal.
Technically, you are not required to use the Guest Flow attribute in your conditions, and an employee logging in through CWA will still land on any rule that matches your employee condition. However, for good security practice, you should be specific and construct an authorization rule that allows employees (users who belong to the Active Directory group named Employees) who have successfully authenticated through the web portal to have Internet-only network access.
In the ISE GUI, follow these steps:
Step 1. Navigate to Work Centers > Network Access > Policy Sets.
Step 2. Drill down into your default policy set (or the policy set that is in use for your deployment at this time).
Step 3. Insert a new rule above the WebAuth rule and name it Employee CWA.
Step 4. Use GuestFlow as the first condition for the rule.
Step 5. Add another condition with the AND operator.
Step 6. Select the Active Directory group named Employees as the second condition.
Step 7. Use the previously created authorization profile named Internet-Only.
Step 8. Select the Employees security group tag.
Step 9. Click Save.
Figure 12-16 shows the completed Employee_CWA rule.
)