{"id":5244,"date":"2020-04-23T16:40:36","date_gmt":"2020-04-23T16:40:36","guid":{"rendered":"http:\/\/wiki-see.info\/wp\/?p=5244"},"modified":"2020-04-23T16:40:36","modified_gmt":"2020-04-23T16:40:36","slug":"privilege-level-15-with-cisco-ise","status":"publish","type":"post","link":"https:\/\/wiki-see.info\/wp\/2020\/04\/23\/privilege-level-15-with-cisco-ise\/","title":{"rendered":"Privilege Level 15 with Cisco ISE"},"content":{"rendered":"\n

In this post, I\u2019m going to show you how to assign privilege level 15 with Cisco ISE through RADIUS.

In addition, there are some other configuration required to be applied on the network devices themselves mainly to enable AAA and RADIUS authentication and authorisation. We will go only through the most relevant configuration parts in this post.

Let\u2019s get started with ISE configuration. First we will create a new authorisation profile and we will call it\u00a0R1_PRIV_15<\/strong>. The option we are after is called\u00a0Web Authentication (Local Web Auth)<\/strong>. This option allows ISE to push Cisco AV Pair attribute\u00a0priv-lvl=15<\/strong>\u00a0inside the RADIUS packets to the network device:

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Let\u2019s enable this option, and verify what attributes will be associated with it:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

As we can see, by enabling the Web Authentication (Local Web Auth)<\/strong> option we can see the Cisco AV Pair attribute priv-lvl=15<\/strong> in the attributes details section.<\/p>\n\n\n\n

ADD the NETWORK DEVICE<\/h2>\n\n\n\n

Now let\u2019s create a network device and configure its Device Type as\u00a0IOS<\/strong>. The Device Type will be used in the top conditions on the policy set, we will see this later. We are going to call the network device\u00a0Router-01<\/strong>:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

JOIN ISE TO THE AD<\/h2>\n\n\n\n

Now let\u2019s make sure we have the AD group\u00a0LabAdmins<\/strong>\u00a0already added:<\/p>\n\n\n\n

  • \"\"<\/figure><\/li><\/ul><\/figure>\n\n\n\n

    As we can see the last group on the list is the LabAdmins<\/strong> group.<\/p>\n\n\n\n

    ISE POLICY SET<\/h2>\n\n\n\n

    Now let\u2019s create a new policy set and call it ADMIN_ACCESS_PRIV_15<\/strong>. As mentioned above this policy set will have some conditions on the top to match the traffic coming from the network device Router-01<\/strong>. The conditions are the Device Type which we configured as IOS<\/strong>, the RADIUS NAS Port Type which is Virtual in this case, and the RADIUS Service Type which is Login.<\/p>\n\n\n\n

    All these conditions should match for any SSH connection to Router-01<\/strong>. The point here is to make the policy set as much accurate as possible to match the exact traffic that should be served by itself. In the authentication section we will configure the authentication against the AD which is already joined to ISE.<\/p>\n\n\n\n

    And finally in the authorisation section we will configure a rule with a condition to check if the users are located in the AD group\u00a0LabAdmins<\/strong>, if so, then the authorisation profile we created earlier which is called\u00a0R1_PRIV_15<\/strong>\u00a0will be applied, instead if no match, the default authorisation rule will be applied which will deny accesses:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    ROUTER RADIUS CONFIGURATION<\/h2>\n\n\n\n

    Now that we have applied all the required configuration on ISE, let\u2019s move on and apply the required configuration on the\u00a0Router-01<\/strong>. Mainly what we need is to enable AAA, configure the RADIUS authentication and authorisation, associating AAA authentication and authorisation method lists to the VTY lines, and restricting the accesses to the VTY lines for SSH only:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    One thing worth mentioning here is that if we want to use the RADIUS Service Type in our conditions on ISE, then we need to enable radius-server attribute 6 on-for-login-auth<\/strong>, if not the RADIUS Service Type would be ignored in the RADIUS packets.<\/p>\n\n\n\n

    VERIFICATION<\/h2>\n\n\n\n

    All the required configurations are now in place. Let\u2019s do some tests by initiating SSH connection from the client, and trying to connect to the router with the\u00a0admin1<\/strong>\u00a0username which is located in the AD group\u00a0LabAdmins<\/strong>:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    As we can see, we have successfully logged into the router, and we have been straightaway placed into privilege level 15. We can verify that by looking at the\u00a0#<\/strong>\u00a0symbol or by using the command\u00a0show privilege<\/strong>. We can also verify the connected username by using the command\u00a0show users<\/strong>:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Finally, let\u2019s look at RADIUS debugs and see what are the most relevant attributes for our SSH connection that have been exchanged between\u00a0Router-01<\/strong>\u00a0and ISE:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    This wraps up this Privilege Level 15 with Cisco ISE post. I hope you enjoyed it, and as always, I would love to hear your feedback. Thanks for reading!<\/p>\n","protected":false},"excerpt":{"rendered":"

    In this post, I\u2019m going to show you how to assign privilege level 15 with Cisco ISE through RADIUS. In addition, there are some other configuration required to be applied on the network devices themselves mainly to enable AAA and RADIUS authentication and authorisation. We will go only through the most relevant configuration parts in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[808],"tags":[],"class_list":["post-5244","post","type-post","status-publish","format-standard","hentry","category-cisco-ise"],"_links":{"self":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/5244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/comments?post=5244"}],"version-history":[{"count":1,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/5244\/revisions"}],"predecessor-version":[{"id":5256,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/5244\/revisions\/5256"}],"wp:attachment":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/media?parent=5244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/categories?post=5244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/tags?post=5244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}