ISE Policy Migration Runbook

netapi ise get-policy-sets

# Authentication rules (authc = get-auth-rules)
netapi ise authc "Domus-Wired MAB"
netapi ise authc "Domus-Wired 802.1X"
netapi ise authc "Domus-Secure 802.1X"
netapi ise authc "Domus-IoT iPSK"

# Authorization rules (authz = get-authz-rules)
netapi ise authz "Domus-Wired MAB"
netapi ise authz "Domus-Wired 802.1X"
netapi ise authz "Domus-Secure 802.1X"
netapi ise authz "Domus-IoT iPSK"

Name: Domus_ZeroTrust_Protocols

Allowed Methods:
  [x] EAP-TLS
  [ ] PEAP (DISABLED - password-based)
  [ ] EAP-FAST (DISABLED)
  [ ] EAP-MD5 (DISABLED - insecure)
  [ ] PAP/ASCII (DISABLED)
  [ ] CHAP (DISABLED)
  [ ] MS-CHAPv1 (DISABLED)
  [ ] MS-CHAPv2 (DISABLED)

EAP-TLS Settings:
  [x] Allow EAP-TLS
  [x] Enable Stateless Session Resume
  Client Certificate Required: Yes

# Create zero-trust allowed protocols
netapi ise create-allowed-protocols "Domus_ZeroTrust_Protocols" \
  --eap-tls \
  --no-peap \
  --no-eap-fast \
  --no-eap-md5 \
  --description "Zero-trust: EAP-TLS certificate authentication only"

# MAB only - NO EAP flags = host-lookup only (default)
netapi ise create-allowed-protocols "Domus_HOST_ONLY" \
  -d "MAB only - IoT, APs, printers, static MAC devices"

# Certificate-based (EAP-TLS + TEAP + TTLS)
netapi ise create-allowed-protocols "Domus_TEAP_TLS_TTLS" \
  --eap-tls \
  --eap-teap \
  --eap-ttls \
  -d "Cert auth: Linux TLS, Windows TEAP, Printer TTLS"

# CRITICAL: Disable host lookup on cert protocol (created with it ON by default)
netapi ise update-allowed-protocols "Domus_TEAP_TLS_TTLS" --no-host-lookup

# Set EAP-TLS as preferred protocol
netapi ise update-allowed-protocols "Domus_TEAP_TLS_TTLS" \
  --preferred-eap EAP_TLS \
  --enable-preferred

# Admin full access
netapi ise create-dacl "Domus_dACL_Admin" \
  -d "Full access for domain admins" \
  --acl "permit ip any any"

# Research limited access (VLAN 40)
netapi ise create-dacl "Domus_dACL_Research" \
  -d "Research network access - limited scope" \
  --acl "permit ip any any"

# User standard access
netapi ise create-dacl "Domus_dACL_User" \
  -d "Standard user network access" \
  --acl "permit ip any any"

# IoT restricted access
netapi ise create-dacl "Domus_dACL_IoT" \
  -d "IoT restricted - local LAN only" \
  --acl "permit ip any 10.50.0.0 0.0.255.255; deny ip any any"

# Onboarding quarantine (semicolon-separated ACL lines)
netapi ise create-dacl "Domus_dACL_Quarantine" \
  -d "Quarantine - DHCP/DNS only for posture" \
  --acl "permit udp any any eq 67; permit udp any any eq 68; permit udp any any eq 53; permit tcp any any eq 443; deny ip any any"

# Admin profile (DATA_VLAN, full access)
netapi ise create-authz-profile "Domus_Profile_Admin" \
  --vlan DATA_VLAN \
  --dacl "Domus_dACL_Admin" \
  --descr "Domain admins - full access"

# Research profile (RESEARCH_VLAN, research access)
netapi ise create-authz-profile "Domus_Profile_Research" \
  --vlan RESEARCH_VLAN \
  --dacl "Domus_dACL_Research" \
  --descr "Research users - VLAN 40 access"

# User profile (DATA_VLAN, standard access)
netapi ise create-authz-profile "Domus_Profile_User" \
  --vlan DATA_VLAN \
  --dacl "Domus_dACL_User" \
  --descr "Standard domain users"

# IoT profile (IOT_VLAN, restricted)
netapi ise create-authz-profile "Domus_Profile_IoT" \
  --vlan IOT_VLAN \
  --dacl "Domus_dACL_IoT" \
  --descr "IoT devices - restricted access"

# AP profile (DATA_VLAN, for access points - no dACL for wireless)
netapi ise create-authz-profile "Domus_Profile_AP" \
  --vlan DATA_VLAN \
  --descr "Access points - trunk native VLAN"

# Quarantine profile (QUARANTINE_VLAN, posture remediation)
netapi ise create-authz-profile "Domus_Profile_Quarantine" \
  --vlan QUARANTINE_VLAN \
  --dacl "Domus_dACL_Quarantine" \
  --descr "Quarantine for posture remediation"

# MAB policy set (IoT, APs, static MAC devices)
# Condition: Service-Type = Call Check (MAB request from switch)
netapi ise create-policy-set "Domus_MAB" \
  --allowed-protocols "Domus_HOST_ONLY" \
  --condition-attr "Service-Type" \
  --condition-value "Call Check" \
  -d "MAB - IoT, APs, printers, static MAC"

# 802.1X policy set (certificate-based auth)
# Condition: Service-Type = Framed (EAP request from supplicant)
netapi ise create-policy-set "Domus_8021X" \
  --allowed-protocols "Domus_TEAP_TLS_TTLS" \
  --condition-attr "Service-Type" \
  --condition-value "Framed" \
  -d "802.1X - EAP-TLS/TEAP/TTLS certificate auth"

# Get the policy set ID and Default rule ID
POLICY_ID=$(netapi ise --format json get-policy-sets | jq -r '.[] | select(.name=="Domus_MAB") | .id')
RULE_ID=$(netapi ise --format json authc "Domus_MAB" | jq -r '.[0].rule.id')

# Update Default auth rule via direct API
curl -s -k -X PUT "https://${ISE_PAN_IP}/api/v1/policy/network-access/policy-set/${POLICY_ID}/authentication/${RULE_ID}" \
  -H "Authorization: Basic $(echo -n ${ISE_API_USER}:${ISE_API_PASS} | base64)" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "rule": {
      "default": true,
      "name": "Default",
      "rank": 0,
      "state": "enabled",
      "condition": null
    },
    "identitySourceName": "Internal Endpoints",
    "ifAuthFail": "REJECT",
    "ifUserNotFound": "CONTINUE",
    "ifProcessFail": "DROP"
  }'

# Verify the fix
netapi ise authc "Domus_MAB"
# Should show: Identity Source = Internal Endpoints, If Not Found = CONTINUE

# List all dACLs - verify Domus_dACL_* exist
netapi ise get-dacls | grep Domus_

# List all authorization profiles - verify Domus_Profile_* exist
netapi ise get-authz-profiles | grep Domus_

# List all allowed protocols - verify Domus_HOST_ONLY and Domus_TEAP_TLS_TTLS
netapi ise get-allowed-protocols | grep Domus_

# List policy sets - verify Domus_MAB and Domus_8021X
netapi ise get-policy-sets

# Compare old 802.1X vs new Domus_8021X
echo "=== OLD: Domus-Wired 802.1X ==="
netapi ise authz "Domus-Wired 802.1X"

echo "=== OLD: Domus-Secure 802.1X ==="
netapi ise authz "Domus-Secure 802.1X"

echo "=== NEW: Domus_8021X ==="
netapi ise authz "Domus_8021X"

# Compare old MAB vs new Domus_MAB
echo "=== OLD: Domus-Wired MAB ==="
netapi ise authz "Domus-Wired MAB"

echo "=== OLD: Domus-IoT iPSK ==="
netapi ise authz "Domus-IoT iPSK"

echo "=== NEW: Domus_MAB ==="
netapi ise authz "Domus_MAB"

# Trigger authentication from test workstation
# (on modestus-aw): sudo systemctl restart wpa_supplicant

# Check authentication result via DataConnect
netapi ise dc query "SELECT TIMESTAMP, POLICY_SET_NAME, AUTHORIZATION_RULE, AUTHORIZATION_PROFILE, PASSED FROM RADIUS_AUTHENTICATIONS WHERE CALLING_STATION_ID = '14:F6:D8:7B:31:80' ORDER BY TIMESTAMP DESC FETCH FIRST 5 ROWS ONLY"

# Verify certificate OU was matched
netapi ise dc query "SELECT TIMESTAMP, SUBJECT_COMMON_NAME, SUBJECT_ORGANIZATIONAL_UNIT, POLICY_SET_NAME FROM RADIUS_AUTHENTICATIONS WHERE CALLING_STATION_ID = '14:F6:D8:7B:31:80' ORDER BY TIMESTAMP DESC FETCH FIRST 3 ROWS ONLY"

# Check RADIUS auth details for OU matching
netapi ise dc query "SELECT SUBJECT_ORGANIZATIONAL_UNIT, AUTHORIZATION_RULE, PASSED FROM RADIUS_AUTHENTICATIONS WHERE PASSED = 1 AND EAP_TYPE = 'EAP-TLS' ORDER BY TIMESTAMP DESC FETCH FIRST 10 ROWS ONLY"

# Extract certificate subject fields with awk
CERT_FILE="/etc/ssl/certs/<hostname>-eaptls.pem"
openssl x509 -in "$CERT_FILE" -noout -subject | \
  awk -F', ' '{gsub(/^subject=/, "", $1); for(i=1;i<=NF;i++) print $i}'

openssl x509 -in /etc/ssl/certs/modestus-razer-eaptls.pem -noout -subject | \
  awk -F', ' '{gsub(/^subject=/, "", $1); for(i=1;i<=NF;i++) print $i}'

O=Domus-Infrastructure
OU=Domus-Admins
CN=modestus-razer.inside.domusdigitalis.dev

# Disable in order (least impactful first)
netapi ise update-policy-set "Domus-IoT iPSK" --state disabled
netapi ise update-policy-set "Domus-Wired MAB" --state disabled
netapi ise update-policy-set "Domus-Secure 802.1X" --state disabled
netapi ise update-policy-set "Domus-Wired 802.1X" --state disabled

netapi ise get-policy-sets

# Expected output:
# ┌─────────────┬──────────┬───────────────────────┐
# │ Policy Set  │ State    │ Allowed Protocols     │
# ├─────────────┼──────────┼───────────────────────┤
# │ Domus_MAB   │ enabled  │ Domus_HOST_ONLY       │
# │ Domus_8021X │ enabled  │ Domus_TEAP_TLS_TTLS   │
# │ Default     │ enabled  │ Default Network Access│
# └─────────────┴──────────┴───────────────────────┘

# Watch for failed authentications after cutover
netapi ise dc query "SELECT TIMESTAMP, CALLING_STATION_ID, POLICY_SET_NAME, FAILURE_REASON, PASSED FROM RADIUS_AUTHENTICATIONS WHERE TIMESTAMP > SYSDATE - INTERVAL '10' MINUTE ORDER BY TIMESTAMP DESC FETCH FIRST 20 ROWS ONLY"

# Check which policy sets are being hit
netapi ise dc query "SELECT POLICY_SET_NAME, COUNT(*) as AUTH_COUNT FROM RADIUS_AUTHENTICATIONS WHERE TIMESTAMP > SYSDATE - INTERVAL '1' HOUR GROUP BY POLICY_SET_NAME"