According to CiscoPress SISE ebook, BYOD:
---
For Android:
"The NSP portal displays the device registration page with the Device ID field
prepopulated with the MAC address of the endpoint."
- you can see this also in the video at time 4:20:
https://youtu.be/z0sRiffVdpg?t=264
-
For Apple iOS, there are 2 certificates in the BYOD flow:
1. Device Enrollment
■ CN=device-UDID
■ SAN=MAC-Address
---
2. Device Provisioning
■ CN=Username
■ SAN=MAC-Address
---
UDID is NOT hostname, just some numeric value and exists only for Apple.
UDID according to Cisco is: "UDID Value. Match based on Unique Device Identifier (Apple specific)"
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
- Example of UDID (it is just number):
https://messapps.com/allcategories/development/finding-ios-devices-udid-via-itunes-2/
---
(continuation in comment)
Even thought CN can be MAC address (Device ID) in case of Android, this is NOT true for Apple iOS.
So B (hostname in CN) is NOT correct according to me.
See issued BYOD certificates here (screenshot in the section Manage issued certificates):
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-2093653871
---
Endpoint certificate is NOT mandatory for BYOD.
"While ISE supports various EAP types for 802.1X authentication, with ISE BYOD, there are three EAP Types that can be used; EAP-TLS, EAP-PEAP-MSCHAPv2, and EAP-FAST"
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
---
(continuation in comment)
So correct will be D:
"In ISE 2.2 (when using the Network Setup Assistant app version 2.2.X and Android version 6.0, 7.0 or newer) during the onboarding process, the Android device will make a certificate request directly to the ISE-server using the Enrollment over Secure Transport (EST) protocol.
Due to this change, the firewall port that has to be open between the Android device and the ISE-server has changed as well to port TCP 8084."
https://www.wiresandwi.fi/blog/android-byod-ise-22-changes
I haven't found any mention of EST support on iOS, just SCEP.
The correct answer is actually D.
CN is locked to $username$
SAN is locked to MAC address.
Android does use EST for certificate enrollment.
These two articles have this information.
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
https://community.cisco.com/t5/security-knowledge-base/android-byod-provisioning-error-quot-certificate-generation/ta-p/3733734
The answer here is B.
The CN field have the FQDN of the the local computer, hostname + domain.
The D answer is not bad but is saying that Android use EST for certificate enrollment while the other vendors uses SCEP, I mean IT CAN BE USED, BUT IS NOT MANDATORY other vendors will use different protocols also for the certificate enrollments.
The B answer shoul be true because actually the CN field contain the hostname of the device.
Windows for example have also this protocol:
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/446a0fca-7f27-4436-965d-191635518466
The Common Name (CN), also known as the Fully Qualified Domain Name (FQDN), is the characteristic value within a Distinguished Name (DN). Typically, it is composed of Host Domain Name and looks like, "www.digicert.com" or "digicert.com"
remember that the host domain name is the hostname of that device.
For example if the name of your computer is PIPPO and you will join to the AD cisco.com the FQDN / CN will be PIPPO.cisco.com
It should be B. When configuring certificates for Bring Your Own Device (BYOD), it is important to consider populating the CN (Common Name) field with the endpoint host name. The CN field should contain the host name or FQDN (Fully Qualified Domain Name) of the endpoint device. This allows the certificate to be properly validated when the device connects to the network. The CN field helps ensure that the device is correctly identified and authorized for network access.
WHat about D?
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html
I am thinking D. Android uses EST and other OS uses SCEP
Alternative Name (SAN) Currently, only value available is the MAC Address. The MAC Address is pulled from the RADIUS session from the endpoint that initiated the BYOD flow. This is one way ISE allows admin user to tie the certificate to the actual endpoint that it was signed for.
i would go with B,
"CN is auto populated with the username that is going through the BYOD flow. Other attributes can be entered here to reflect the site. If differentiating different endpoint or users based on certificate is needed, then any of the attributes here can be changed and can be used during AuthZ to provide differentiated access. For instance if OU=HR, the endpoint can have access to HR resources, while other endpoints cannot access HR resources"
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
MacOS and Windows devices: Employee clicks Register in the BYOD portal to download and install the supplicant provisioning wizard (Network Setup Assistant), which configures the supplicant and provides the certificate (if necessary) used for EAP-TLS certificate-based authentication. The issued certificate is embedded with the device's MAC address and employee's username.
As per the
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867,
it should be B. CN is populated with username. SAN can only have MAC address.
Correct answer is might be A or C.
Device Encrollment CSR is:
SAN = Username
CN = Device-UDID
User CSR is:
SAN = MAC Address
CN = Username
Any thoughts which is better?
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
327c7c8
4 days agoNikoTomas
5 months agoNikoTomas
5 months agoNikoTomas
5 months ago[Removed]
6 months, 1 week agoXBfoundX
8 months agoXBfoundX
8 months agoXBfoundX
8 months agoXBfoundX
8 months agothol119
8 months, 2 weeks agoCCNP21
12 months agoTomMarvolo
1 year, 1 month agorhylos
1 year, 1 month agorhylos
1 year, 1 month agorhylos
1 year, 1 month agomatan24
1 year, 3 months agoRuss
1 year, 7 months agokornalt
1 year, 5 months agoHereim
1 year, 5 months agokthekillerc
2 years, 2 months agoCisco_SecCol_111
2 years, 9 months ago