Sem cis ise
Download as PPTX, PDF2 likes747 views
Cisco Identity Services Engine (ISE) is a centralized access control and policy management solution that can automate secure access to network resources. It profiles users and devices, authenticates network access, enforces security policy, and shares contextual data across the IT infrastructure. ISE provides capabilities for guest access management, secure BYOD onboarding, network access control, software-defined segmentation with Cisco TrustSec, and visibility/context sharing through its pxGrid technology. It supports a wide range of use cases including guest access, BYOD, network access, device administration, and compliance.
Sem cis ise
- 1. Building an Enterprise Access Control Architecture Using ISE and TrustSec
- 2. Agenda • What is ISE? • Visibility • Guest Access • Secure Access • BYOD • Compliance • TrustSec • Device Administration • Additional Features • 3rd Party NAD Support • Location BasedAuthorisation
- 3. What is ISE?
- 4. Identity Profiling Access Policy Network Resources and Posture Traditional Cisco TrustSec® BYOD Access Threat Containment Guest Access Role-Based Access Who Compliant What When Where How A centralised security solution that automates context-aware access to network resources and shares contextual data Network Door Physical or VM Controller Context ISE pxGrid 7
- 5. The Different Ways Customers Use ISE Guest Access Management Easily provide visitors secure guest Internet access BYOD and Enterprise Mobility Seamlessly classify & securely onboard devices with the right levels ofaccess Secure Access across the Entire Network Streamline enterprise network access policy over wired, wireless, & VPN Software-Defined Segmentation with Cisco TrustSec® Simplify Network Segmentation and Enforcement to Contain Network Threats Visibility & Context Sharing with pxGrid Share endpoint and user context to Cisco and 3rd party system Network Device Administration Device administration and Network Access on a single platform
- 6. With Cisco Identity Services Engine You Can 6 See and share rich user Stop and contain threats and device details Control all access throughout the network from one place
- 7. IT Requirements ISE Capabilities Access Control Authentication on wired & wireless networks as well as VPN BYOD Support Trusted Device Standard and enable BYOD Profiling Ability to identify users and devices on our network Endpoint Protection Protect the network from infected devices GuestAccess Restrict unauthorized devices & users to Internet access only Device Control Secure network while allowing mobile device access* * Cisco IT uses a 3 different Device ManagementProducts 11 Contextual Data Cross-platform contextual data sharing across the entire IT infrastructure
- 8. • Identity of a device on the network • Quantify the risk 1. Profiling • User and end device attribution • Identification of endpoints on Wireless/Wired connections 2.Authentication • Device security posture identification • Allows for better policy & security decisions 3. Posture • Ability to enforce policy decisions based on context • Untrusted devices have restricted access 4. Enforcement The Four Stages of a Secure Network ISE 1.2 Profiling ISE 1.2 802.1XAuth WLAN,CVO ISE 1.3/1.4 802.1XAuth CVO, Wired, VPN, MDM ISE 2.1 802.1X Wired AuthMode MDM √ √ √ 12
- 9. ISE Guest ION: GuestAccess ISE 802.1xAuth: Wireless,CVO ISE 802.1x + MAB Monitor Mode: Wired (Limited) ISE 802.1xAuth: VPN + AnyConnect: • Mobile Devices with Certificate • Laptops with OTP ISE/MDM Integration: Afaria, Casper ISE SGT: TrustSec Limited Deployment ISE/MDM: Posture Enforcement ISE 802.1xAuth: Xtranet/Partners ISE SGT: Network Segmentation& Optimization ISE TACACS+: Device Administration ACS + NACs: Guest Access ACS Auth: Wireless,CVO AD Auth + One- Time-Password: VPN Open Access: Wired Assured Network Access Roadmap Start ACS 5.x NAC Active Directory ISE 1.2 ISE 1.3 ISE 1.4 ISE 2.1 Continue ISE 802.1xAuth: Wired(Global) ISE/MDM Integration: Afaria, Casper, SCCM Posture Assessment Endpoint Protection: Quarantine/Remediate √ √ √ √ 13
- 10. Visibility
- 11. Make Fully Informed Decisions with Rich Contextual Awareness Poor Context Awareness Extensive ContextAwareness BobIP address 192.168.1.51 Context: Who TabletUnknownWhat Building 200, first floorUnknownWhere 11:00 a.m. EST on April 10UnknownWhen WirelessUnknownHow The right user, on the right device, fromthe right place is granted the rightaccess Any user, any device, anywhere gets on the network Result
- 12. Many Different Visibility Variables Trust Gradient •Authentication •Certificate •Managed/Unmanaged •Compliance/Posture Threat/Risk •Threat score •Fidelity Reach •What services can be accessed •What other entities can be impacted Behaviour •Historical versus active. Now or before •Was I doingthe expected or unexpected Users •Role •Permissions/rights •Importance Devices •Ownership – managed or unmanaged •Type of device •Function •Applications Connectivity • Medium (Wired/Wireless/VPN) •NAD/NAD Details •State (active session) Location •Physical •Logical Time •Time of Day •Day of week •Connection duration
- 13. Visibility Technologies ISE Description Technology and Use Cases Profiling Technology Device Identification by Cisco ISE SIEM -- Threat Detection with a NetflowAnalyser SIEM and threat detection analyses network traffic and tells ISE to take action NaaS/ NaaE Network as a Sensor Network as an Enforcer Rapid Threat Containment Firepower and Identity Services Engine ISE can take action on Threats detected by Source Fire TheArchitecture PxGrid - SACM (Security Automation and ContinuousMonitoring) Cisco pxGrid provides a unified framework that enables ecosystem partners to integrate.
- 14. Better with Cisco Router and Switches Device Sensor • The Network IS the Collector! • Automatic discovery for most common devices (printers, phones, Cisco devices) • Collects the data at point closest to endpoint • Topology independent • Profiling based on: • CDP/LLDP • DHCP • HTTP (WLC only) • mDNS, H323, MSI-Proxy (4k only) Device Sensor Distributed Probes ISE Device Sensor Support 3k/4k/WLC DHCP HTTPCDP/LLDP/DHCP/CDP/LLDP/DHCP CDP/LLDP/DHCP
- 15. IPv6 Device Sensor RADIUS HTTP SENSOR DHCP SENSOR IPv6 Device Sensor is supported • RADIUS i.e. Framed-IPv6-Address accounting • HTTP sensor – e.g. REMOTE_HOST, REMOTE_ADDR • DHCP sensor - DHCPv6 options
- 16. See How Endpoints Act On The Network With Better Visibility Network as a Sensor • Cisco ISE • Cisco Networking Portfolio • Cisco NetFlow • Lancope StealthWatch Data
- 17. ADMIN ZONE ENTERPRISE ZONE POS ZONE VENDOR ZONE And Make Visibility Actionable Through Segmentation And Automation Network as an Enforcer • Cisco ISE • Cisco Networking Portfolio • Cisco NetFlow • Lancope StealthWatch • Cisco TrustSec Software-Defined Segmentation EMPLOYEE ZONE DEV ZONE
- 18. Enable Unified Threat Response By Sharing Contextual Data Cisco Platform Exchange Grid (pxGrid) Cisco and Partner Ecosystem When Where Who How What 32 1 ISE 45 Cisco Network pxGrid controller 1 ISE collects contextual data fromnetwork Contextual data is 2 shared via pxGrid technology Partners use ISEdata 3 to quickly identify and classify threats Partners take 4 remediation actions throughISE ISE fine tunesaccess 5 policies with security event data Context
- 19. Guest Access
- 20. Improve Guest Experiences Without Compromising Security Guest Guest GuestSponsor Internet Internet Internet and Network Immediate, Uncredentialed InternetAccess with Hotspot SimpleSelf-Registration Role-Based Accesswith Employee Sponsorship
- 21. ISE Built-in Portal Customisation? CreateAccounts Print Email SMS Mobile and DesktopPortals Notifications Approved! credentials username: trex42 password: littlearms
- 22. Which Portals Are Customisable All Except The Admin Portal 1. Guest 2. Sponsor 3. BYOD (Device Registration) 4. My Devices 5. Client Provisioning (Desktop Posture) 6. MDM (Mobile Device Management) 7. Blacklist 8. Certificate Provisioning Portal
- 23. Access your portals to manage and share Choose from Pre-Built Portal Layouts
- 24. ISE Express offers the same dynamic Guest features of the market-leading Cisco ISE in an entry-level bundle at an aggressive 70-80% discount over the competition.
- 25. Features / Capabilities? Platform Included w/Licensing? List Price? Cisco ISE Base vs. Cisco ISE Express Same YES – Bundle includes 1 ISE VM + 150 Licenses $2,500 US Cisco ISE Express Guest Access; RADIUS/AAA NO – Purchase HW or VM and licensing $6,990 US (ISE VM:$5,990 + Base: $1,000, for 200 licenses) Cisco ISE Base
- 26. What’s New ISE Express Installation Wizard Free, downloadable application Simplifies ISE and wireless controller installation Provisions Hotspot, Self-Registered or Sponsor services Modifies guest portals with logo and colours Go to ISE Cisco Software Download on CCO
- 27. Secure Access
- 28. Secure Access Use Cases • MacAuthentication Bypass (MAB) • Whitelist • Central Web Authentication (CWA) • No supplicant Good Better • Roll out 802.1x in Phases (Monitor Mode) Best • 802.1x (Low Impact, Closed Mode) • Certificates • EAP etc.. • Supplicant on endpoint • Switch configuration
- 29. ISE is a Standards-Based AAAServer Access Control System Must Support All Connection Methods ISE PolicyServer VPN CiscoPrime Wireless VPN Supports Cisco and 3rd-Party solutions via standard RADIUS, 802.1X, EAP, and VPN Protocols .. more to come … RADIUS Wired 802.1X = EAPoLAN 802.1X = EAPoLAN SSL / IPsec
- 30. Building the Architecture in Phases 47 Access-Prevention Technology – A Monitor Mode is necessary – Must have ways to implement and see who will succeed and who will fail Determine why, and then remediate before taking 802.1X into astronger enforcementmode. Solution = Phased Approach to Deployment: Monitor Mode Low Impact Mode Closed Mode What part of the network does phased deployment apply?
- 31. BYOD
- 32. Internal Employee Intranet Enable Faster and Easier Device Onboarding Without Any IT Support Confidential HR Records ? Device Profiling www Employee Simplified Device Management from Self-Service Portal Automated Authentication and Access to BusinessAssets Rapid Device Identification with Out-of-the-Box Profiles ITStaff
- 33. Streamlining BYOD and Enterprise Mobility Reducing the Complexity of Managing BYOD and Device Onboarding Improved Device Recognition Desktop & Mobile Ready! Integrated Native Certificate Authority for Devices Customisable Branded Experiences Easy User Onboarding with Self-Service Device Portals Comprehensive Device Security with Posture and EMM Supports 1M Registered Endpoints and 250K ACTIVE, Concurrent Endpoints
- 34. Single Versus Dual SSID Provisioning • Single SSID • Start with 802.1X on one SSID using PEAP • End on same SSID with 802.1X using EAP-TLS • Dual SSID • Start with CWA on one SSID • End on different SSID with 802.1X using PEAP or EAP-TLS SSID = BYOD-Open (MAB / CWA) SSID = BYOD-Closed (802.1X) WLAN Profile SSID = BYOD-Closed PEAP or EAP-TLS (Certificate=MyCert) SSID = BYOD-Closed (802.1X) WLAN Profile SSID = BYOD-Closed EAP-TLS Certificate=MyCert Which flow provides better user experience?
- 35. Onboarding Personal Devices Registration, Certificate and Supplicant Provisioning Device Onboarding Certificate Provisioning Supplicant Provisioning Self- Service Model iOS Android Windows MAC OS MyDevices Portal Provisions device Certificates. ‒ Based on Employee-ID &Device-ID. Provisions Native Supplicants: ‒ Windows: XP, Vista, 7, 8, 8.1, 10 ‒ Mac: OS X 10.6, 10.7, 10.8, 10.9, 10.10. 10.11 ‒ iOS: 4, 5, 6, 7, 8, 9 ‒ Android – 2.2 and above ‒ 802.1X + EAP-TLS, PEAP & EAP-FAST Employee Self-Service Portal ‒ Lost Devices are Blacklisted ‒ Self-Service Model reduces ITburden
- 36. What Makes a BYOD Policy? Sample Complete BYOD Policy Internet Only Employee Guest Access-Reject i-Device Registered? Access-Accept MAC address lookup to AD/LDAP Profiling Posture Machine certificates Non-exportable user certificate Machine auth with PEAP- MSCHAPv2’ EAP chaining Y N N Y Y N
- 37. Compliance
- 38. What Is the Cisco ISE Posture Service? PSN MnT ISE Node PANPosture Service in ISE allows you to check the state (posture) forALL the endpoints that are connecting to your ISE-enabled network. The Posture Agents, which are installed on the clients, interact with the Posture Service to enforce security policies on all the endpoints that attempt to gain access to your protected network. Posture Agents enforce security policies on noncompliant endpoints by blocking network access to your protected network. Must have Apex licensing enabled on your ISE devices
- 39. Posture Assessment Does the Device Meet Security Requirements? • Posture = The state-of-compliance with the company’s security policy. • Extends the user / system Identity to include Posture Status. Posture Microsoft Updates Antivirus/ Antispyware Misc Service Packs Hotfixes OS/Browser versions Installation/Signatures File data Services Applications / Processes Registry Keys Patch Management Disk Encryption What is the main difference between Profiling & Posture?
- 40. Posture Enhancements Mac OSx SupportAdded for Custom Checks: File / Service /Application / Disk Encryption • File, Service (daemon, User Agent), and Application (process) checks • File condition, file path can have home or root follow with path. • SHA 256 Check • Property List (plist) Check NOTE: Disk Encryption new for ISE 2.0
- 41. Posture Enhancements - OSx Daemon Check • A daemon is a program that runs in the background as part of the overall system (not tied to user) • A user agent is a process that runs in the background on behalf of a particular user. • ISE 2.0 supports feature to check user agent as well as the daemon
- 42. Posture for all Devices Desktop Posture vs Mobile Posture Focused on Mobile Devices Posture ONLY Requires devices to comply with MDM policy PINLock, JailBroken,APP check and More … ISE + MDM Together Mobile Posture SOLUTION Desktop Compliance checks for Windows and OSx Variety of Checks ranging from OS, Hotfix, AV / AS, Patch Management andMore… ISE can enforce Network Access based onCompliance Desktop Posture ISE can enforce Network Access based on MDMCompliance
- 43. Multiple MDM Support Multiple MDM Vendors Can Be Added To ISE And Used Simultaneously In Policy
- 44. MDM Flow 86 ISE Policy Server VPN If MDM Registration Status EQUALS UnRegistered, then Redirect to MDM for Enrollment If MDM Compliance Status EQUALS NonCompliant, then Redirect to MDM for Compliance Authentication MDM Compliance Status != Compliant Redirect to ISE landing page for MDM enrollment or compliance status https://ise.company.com:8443/guestportal/gateway?sessionId=0A010A...73691A&action=mdm MDMAPI Connect to WLAN=Corp Redirect browser to ISE Cloud MDM Google Play/AppStore
- 45. MDM Remediation 87 ISE Policy Server VPN CoA allows re-authentication to be processed based on new endpoint identity context (MDM enrollment/compliance status). ReAuth MDM Status = Compliant Remove Redirection and apply access permissions for compliant endpoints CoA MDM Agents downloaded directly from MDM Server or Internet App Stores Periodic recheck via API; CoA if not compliant ASA MDMAPI Cloud MDM ReAuth after Comply Compliant = Full Access
- 46. TrustSec
- 47. Campus & DC Segmentation User to DC Access Control How TrustSec/ SGT is used today Server Segmentation Application Protection Secure ContractorAccess BYOD Security Machine- Machine Control Threat DefenceFast Server Provisioning Firewall Rule Reduction PCI & PHI Compliance Network & Role Segmentation
- 48. Segmentation with Security Group Data CentreFirewall Voice Data Suppliers Guest Quarantine Retaining initial VLAN/Subnet Design Regardless of topology or location, policy (Security Group Tag) stays with users, devices, and servers Access Layer Data Tag Supplier Tag Guest Tag Quarantine Tag Aggregation Layer DC-RTP (VDI) Production Servers DC-MTV (SRV1) DC-MTV (SAP1) DC-RTP (SCM2) Destination
- 49. Enforcing Policy Downstream Context Telemetry: • Manager • Windows PC • Compliant Timecard application server Credit Card transaction serverFirewall Enforcement Cisco ISE Classify Mark, Propagate, Enforce • IP Precedence and DiffServ code points • 802.1Q User Priority • MPLS VPN • TrustSec Classify & Mark EnforcePropagation
- 50. Static Classification • IPAddress • VLANs • Subnets • L2 Interface • L3 Interface • Virtual Port Profile • Layer 2 Port Lookup Pre-fix learning Common Classification for Servers, Topology-based policy, etc. 802.1X/ RAS VPNAuthentication WebAuthentication MAC Auth Bypass Common Classification for Mobile Devices SGT Classification Summary SGTAssignment Dynamic Classification Classification
- 51. Dynamic Classification Process in Detail Layer 2 Supplicant Switch / WLC ISE Layer 3 Authorisation DHCP EAPoLTransaction RADIUS Transaction EAPTransaction SGT Authenticated Authorised 0 Policy Evaluation DHCP Lease: 10.1.10.100/24 ARP Probe IP Device Tracking Authorised MAC: 00:00:00:AB:CD:EF SGT =5 Binding: 00:00:00:AB:CD:EF = 10.1.10.100/24 1 2 3 SRC: 10.1.10.1 = SGT 5 00:00:00:AB:CD:EF cisco-av-pair=cts:security-group-tag=0005-01 Make sure that IP Device Tracking is TURNED ON 3560X#show cts role-based sgt-map all details Active IP-SGT Bindings Information IP Address Security Group Source ============================================= 10.1.10.1 10.1.10.100 3:SGA_Device 5:Employee INTERNAL LOCAL Classification
- 52. Traditional TrustSec Tag Assignment & SXP Propagation Access Switch Router DC FW DC Switch HR Servers Fin Servers ISE Directory Enforcement Classification User / Endpoint Propagation
- 53. ISE as SXP Speaker Access Switch DC Switch HR Servers Fin Servers ISE Directory Classification User / Endpoint SXP Tag IP Addr 5 10.10.10.10 5 Fin Servers 10 HR Servers Propagation Enforcement SXP Propagation Router DC FW Does Access Switch needto understandTrustSec?
- 54. Cat3750X Cat6500 Nexus 2248 WLC5508 ASA5585 Enterprise Backbone Cat6500 Nexus 7000 Nexus 5500 End user authenticated Classified as Employee (5) FIB Lookup Destination MAC/Port SGT 20 ISE SRC: 10.1.10.220 5 SRC:10.1.10.220 DST: 10.1.100.52 SGT:5 Web_Dir DST: 10.1.100.52 SGT: 20 Nexus 2248 CRM DST: 10.1.200.100 SGT: 30 SRCDST Web_Dir (20) CRM (30) Employee (5) SGACL-A SGACL-B BYOD(7) Deny Deny Destination Classification Web_Dir: SGT 20 CRM: SGT 30 How is Policy Enforced with SGACL Enforcement
- 56. Anatomy of a Typical Device Administration Session with TACACS+ • TACACS+ Separates Authentication, Authorisation and Accounting • Flexible and extensible • TCP for more reliable accounting • Built-in Goodies such as User Change Password
- 57. Refresh on a Typical TACACS+ Session • Two Main Authorisation stages • SESSION: What can user do duringthis session? • COMMAND: Can the user performthis command? Which TCPport does T+ listen on as default?
- 58. TACACS+ Authorisation: Protocol Level • Authorisation is a single request/response: Header + Attributes Device ISE • Result is FAIL, PASS_ADD, PASS_REPLACE • Fail: Request is not Permitted • PASS_ADD: The permissions asked for are valid, but the operation must also apply these extra attributes (Response Profile) • PASS_REPLACE: The request is permitted, but with this alternative attribute profile Type Author user admin rem_add r office Result PASS_AD D priv-lvl 15
- 59. • Policy Service Node for Protocol Processing • Session Services (e.g. Network Access/RADIUS) On by default • Device Admin Service (e.g. TACACS+) MUST BE ENABLED FOR DEVICE ADMINISTRATION!! 142 ISE Deployment Node Configuration
- 60. Supported Migration paths using Migration Tools Path Segments Tools ACS 4.x to ISE ACS 4.x -> ACS 5.6 ACS 4 Migration Tool ACS 5.6 -> ISE ACS 5 Migration Tool ACS 5.0 – ACS 5.4 to ISE ACS 5.x -> ACS 5.6 ACS 4 Migration Tool ACS 5.6 -> ISE ACS 5 Migration Tool ACS 5.5 - ACS 5.6 to ISE ACS 5.5 - ACS 5.6 to ISE ACS 5 Migration Tool Consider options carefully, especially if migrating from ACS4
- 62. 3rd Party Device (NAD) Support Customers can now deploy ISE services such as Profiling, Posture, Guest and BYOD (on top of the already-working 802.1x) with Network Access Devices (NADs) manufactured by non-Cisco third party vendors.
- 63. Cisco Session ID & Redirect NAD: “show authentication session” ISE: Detailed Authentication Report https://ise14.example.com:8443/guestportal/gateway?C0A8013C00000618B3C1CAFB&portal=&action=cwa Browser: URL-redirect for Web Auth C0A8013C00000618B3C1CAFB NAS IPAddress Session Count Time Stamp
- 64. • Type: None / Static / Dynamic • None – NAD does not have usable redirection method • Static – NAD requires ISE generated URL tobe applied to local device config • Dynamic – NAD can receive redirect via RADIUS authorisation URL Parameter Names • Defines the format of vendor redirect • Allows ISE to parse needed information from redirected requests URL Redirection Static URL, Dynamic URL and URL Format
- 65. What is Change of Authorisation (CoA) The EndPoint needs a new Policy ( ISE 2.0 = RFC 3576 & RFC5176) Example Cisco CoA operations Terminatesession Terminate session with port bounce Re-authenticate session Disable host port Session Query – For Active Services – For Complete Identity – Service Specific Service Activate Service De-activate Service Query CoA options are NAD-specific COAPorts Port 1700, type = Cisco COA Port 3799, type = RFC 5176
- 66. RFC 5176 What is Change of Authorisation (CoA) The EndPoint needs a new Policy (RFC 3576 & RFC 5176) • Disconnect Message (DM) • Also known as “Packet of Disconnect (PoD)” or “CoA Session Terminate” • Terminate user session(s) on a NAS and discard all associated session context. Disconnect-Request Disconnect-ACK/NAK • Change-of-Authorisation (CoA) Messages • Also known as “Authorise Only” or “CoA Push” • CoA-Request packets contain information for dynamically changing session authorisations. CoA-Request CoA-ACK/NAK
- 67. My 3rd Party NAD does not support COA ReAuth/ COA Push ISE 2.0 can perform “COAStiching” Web Auth: EnterCredentials Full Access PSN CWASuccess CoATerminate New Auth Request EmployeeAccess Hold session open for 20 seconds Matching request received < 20 sec; return policy for employee user Session 002 Session 001 Accntg Stop 1 2 3 4 5 6
- 68. 3rd-Party NADs – Supported Features • AAA • 802.1X (since 1.0) • MAB (since 1.2.) • LWA to local portal (since 1.0) • CoA • Profiling (with CoA) • Guest • Hotspot • Central Web Authentication (CWA) • Sponsored guest flow • Self-Registration guest flow • ISE hosted portals Features Vary By Vendor, Platform, and Versions! Posture BYOD Device registration Supplicant Provisioning Certificate Provisioning Self-Service device management (MyDevices) Single/Dual SSID TrustSec Dynamic SGT and SXP Listener
- 69. Adding 3rd-Party NADS to facilitate policy management Network Access Device Configuration • Administration > Network Resource > Network Devices • Be sure to set the Device Profile correctly !! • Enter Network Device Type and Location info Optional: Override default CoA Port per NAD
- 70. Current Vendor Test Results Vendor Verified Series Tested Model / Firmware Supported / Validated use cases CoA Profiler Posture Guest /BYOD Aruba Wireless 7000, InstantAP 7005-US/6.4.1.0 ✔ ✔ ✔ ✔ Motorola Wireless RFS 4000 Wing v5.5 ✔ ✔ ✔ ✔ HP Wireless 830 (H3C) 8P/3507P35 ✔ ✔ ✔ ✔ HP Wired HP 5500 HI Switch Series (H3C) A5500-24G-4SFP HI/5.20.99 ✔ ✖ ✖ ✖ HP Wired HP 3800 Switch Series (ProCurve) 3800-24G-POE-2SFP (J9573A) KA.15.16.000. 6 ✖ ✖ ✖ ✖ Brocade Wired ICX 6610 24/08.0.20aT7f3 ✔ ✔ ✖ ✖ Ruckus Wireless ZD1200 9.9.0.0 build 205 ✔ ✔ ✖ ✖ Additional 3rd party NAD Support: Requires identification of device properties/capabilities and to creation of a custom NAD profile in ISE. More detailed guide to be published. ✔ Requires CoA support Requires CoA & url- redirect support Requires CoA & url- redirect support