Cisco ISE Architecture
July 2022
Div. Service Delivery Activation
Dept. ICT Infrastructure –
Del & Ops-Div. ICT Delivery & Ops
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
About me
Achmad Faesal
Computer Degree – Budi Luhur University (2008 – 2014)
[email protected] / [email protected]
+62 858 1136 9575
www.linkedin.com/in/acfaesal/
Experience
▪ 4 Years in Telco Network
▪ 3+ Years in Enterprises Network (Network & Security)
▪ 2 Years in Oil and Gas Company Network (Onshore & Offshore)
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Agenda
• Overview
• ISE Personas & Appliances
• ISE Deployment
• Network Devices Administration
• Identity Sources
• Study Case
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Agenda
• Overview
• ISE Personas & Appliances
• ISE Deployment
• Network Devices Administration
• Identity Sources
• Study Case
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Overview of Cisco ISE
Cisco ISE
• Network Access Control
• Policy Enforcement Platform
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Agenda
• Overview
• ISE Personas & Appliances
• ISE Deployment
• Network Devices Administration
• Identity Sources
• Study Case
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
ISE Personas & Appliances
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
ISE Personas & Appliances (cont.)
ISE Appliances Option
Appliance Virtual Machines
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Agenda
• Overview
• ISE Personas & Appliances
• ISE Deployment
• Network Devices Administration
• Identity Sources
• Study Case
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
ISE Multi-Node Deployment
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
ISE Multi-Node Deployment (cont.)
• Applies to both physical and virtual deployment
• Compatible with load balancers
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
ISE Multi-Node Deployment (cont.)
Standalone / Small Deployment
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
ISE Multi-Node Deployment (cont.)
Medium Deployment
DC DRC
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
ISE Multi-Node Deployment (cont.)
Large Deployment
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Agenda
• Overview
• ISE Personas & Appliances
• ISE Deployment
• Network Devices Administration
• Identity Sources
• Study Case
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Network Devices Administration
Different Access Based on Role
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Network Devices Administration (cont.)
Authorization Options (Privileges and Permissions)
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Network Devices Administration (cont.)
Device Administration policy best practice
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Agenda
• Overview
• ISE Personas & Appliances
• ISE Deployment
• Network Devices Administration
• Identity Sources
• Study Case
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Identity Sources
Internal Identity Source
▪ ISE Internal Identity
External Identity Source
▪ Active Directory
▪ LDAP Servers
▪ SQL Server
▪ Postgre SQL
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Agenda
• Overview
• ISE Personas & Appliances
• ISE Deployment
• Network Devices Administration
• Identity Sources
• Study Case
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Study Case - Wired
Wired Access
Wired Connection Using 802.1X
▪ Finance are connected to
Switch A using VLAN 30
▪ HR are connected to Switch B
using VLAN 40
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Study Case - Wireless
Wireless on Enterprise Network
Wireless Connection
▪ Employee Using 802.1X
▪ Internal & Internet
▪ Guest Using Mac
Authentication Bypass (MAB)
Authentication
Internet Traffic ▪ Internet Only
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Study Case – Wireless (cont.)
Guest Point of View
*Actual user experience may vary depending on ISE Portal setting
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Study Case - VPN
VPN Access
VPN Access Policy
▪ Employee users have unlimited
access to all internal servers
▪ External users have limited access
to particular servers
User Groups Authentication Server A Server B
Employee VPN – Passed Permit Permit
External VPN – Passed Deny Permit
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
Thank you
© Indosat Ooredoo Hutchison 2022 - www.ioh.co.id
