Cisco ISE Pod Walkthrough

0What you'll build

By the end of this walkthrough you will have:

• A functional Active Directory domain (nh.lab) running on Windows Server 2016
• An Enterprise Certificate Authority (AD-CS) issuing certificates from the same Windows Server
• A Cisco ISE 3.0 appliance joined to that domain, pulling user identities from AD, and trusting certs from the CA
• A Win 10 client domain-joined to nh.lab with a user EAP-TLS certificate
• 802.1X authentication on SW1 / SW2 talking RADIUS to ISE
• End-to-end test: client plugs into SW1 → switch asks ISE → ISE validates the cert → port goes up with the right VLAN

1Boot order (do this exactly)

ISE is slow to come up (~6–8 min on fresh boot). Win Server takes ~4 min. Boot in this order so by the time you switch to ISE, the others are ready.

1. Start WinServer2016 first — clock is the AD reference; ISE needs it for cert validation. Wait until you see the lock screen.
2. Start SW1, SW2, R1, R2 — IOL devices boot in 15–20 sec.
3. Start Cisco ISE — wait for localhost login: on the telnet console.
4. Start Win 10 last — needs DNS from WinServer to resolve nh.lab.

2Set up Windows Server 2016 as Domain Controller + CA

2.1 — First-time setup (~3 min)

Open the Win Server console (VNC). At the lock screen press Ctrl+Alt+Del (the PNetLab toolbar has a button for this). Default credentials are Administrator / Pa$$w0rd (varies by image vintage — try P@ssw0rd if the first fails).

2.2 — Set static IP on the ISE-Mgmt interface

Network and Sharing Center → Ethernet → Properties → IPv4 → Use the following:

IP:      192.168.10.20
Mask:    255.255.255.0
Gateway: 192.168.10.1
DNS:     127.0.0.1   (we'll be our own DNS)

2.3 — Rename + promote to Domain Controller

1. Server Manager → Local Server → Computer name → dc01. Reboot.
2. Server Manager → Manage → Add Roles and Features → check Active Directory Domain Services AND DNS Server. Install.
3. When done, click the yellow flag → Promote this server to a domain controller.
4. Add a new forest with root domain name nh.lab.
5. DSRM password: NhRecovery1! (write it down, you'll only need it for disaster recovery).
6. Click Next through DNS warnings (expected — we're the DNS now), through NetBIOS (auto), through paths. Install. Server reboots.

2.4 — Install AD Certificate Services (the CA part)

1. Server Manager → Add Roles → Active Directory Certificate Services.
2. After install, click the yellow flag → Configure Active Directory Certificate Services.
3. Role: Certification Authority. Setup type: Enterprise CA. Type: Root CA. New private key, default crypto.
4. CA name: nh-lab-CA. Validity: 10 years. Default paths. Configure.

2.5 — Create a test user in AD

Server Manager → Tools → Active Directory Users and Computers → nh.lab → Users → right-click → New User. Name testuser, password Pa$$w0rd1, password never expires. Add to Domain Users (already default).

3First-boot the ISE appliance

3.1 — Connect to the ISE telnet console

In PNetLab, click the ISE node → it opens a telnet console in a new tab. You'll see localhost login: after ~6 min from cold boot.

3.2 — Run the setup wizard

login:    setup
hostname: ise01
ip:       192.168.10.10
netmask:  255.255.255.0
gateway:  192.168.10.1
dns:      192.168.10.20      <-- the WinServer
nameserver: nh.lab
ntp:      192.168.10.20
timezone: UTC
admin username: admin
admin password: NhAdmin1!

ISE writes config, reboots, then spends ~15–25 min bringing up the application stack. You'll see a lot of Application Server is not yet ready messages — normal.

3.3 — Reach the ISE admin GUI from Win 10

1. Open Edge on the Win 10 node.
2. Browse to https://192.168.10.10 — accept the self-signed cert warning (it's the bootstrap cert, you'll replace it next).
3. Log in as admin / NhAdmin1!.

4Join ISE to the AD domain

1. ISE GUI → Administration → Identity Management → External Identity Sources → Active Directory.
2. Click Add. Join Point Name: NHLAB. Domain: nh.lab. Submit.
3. On the next screen click Join at the top. Username: Administrator, Password: the Administrator password from §2.1.
4. Wait ~30 sec. Status should turn green ("Operational").
5. Tabs at top: Groups → Add → Select from Directory → search Domain Users → add. Save.

5Configure 802.1X on SW1

5.1 — Connect to SW1 console

Click SW1 in PNetLab → telnet console opens. Press Enter to get a prompt. enable, then conf t.

5.2 — Minimal config

hostname SW1
ip routing
!
! L3 interface on ISE-Mgmt for RADIUS
interface Ethernet0/0
 no switchport
 ip address 192.168.10.5 255.255.255.0
 no shutdown
!
! AAA + RADIUS
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
!
radius server ise01
 address ipv4 192.168.10.10 auth-port 1812 acct-port 1813
 key NhRadius1
!
! Global dot1x
dot1x system-auth-control
!
! Access port toward the Win 10 client (we'll use e0/1)
interface Ethernet0/1
 switchport mode access
 switchport access vlan 100
 authentication port-control auto
 dot1x pae authenticator
 spanning-tree portfast
!
end
write memory

5.3 — Register SW1 as a Network Device in ISE

1. ISE GUI → Administration → Network Resources → Network Devices → Add.
2. Name: SW1. IP: 192.168.10.5.
3. RADIUS Authentication Settings → Shared Secret: NhRadius1 (must match the switch config).
4. Save.

6Domain-join the Win 10 client + request a user cert

1. On Win 10 (VNC console): set DNS to 192.168.10.20 (the WinServer).
2. System Properties → Change → Domain → nh.lab → enter Administrator creds.
3. Reboot. Log in as NH\testuser.
4. Open certmgr.msc → Personal → Certificates → right-click → All Tasks → Request New Certificate.
5. Pick the default User template. Enroll. Done.

7Create the ISE policy + verify end-to-end

1. ISE GUI → Policy → Policy Sets.
2. Default Policy Set → edit the Authentication policy → ensure EAP-TLS is allowed and Identity Store is set to NHLAB.
3. Authorization policy → Add a rule: If NHLAB:ExternalGroups EQUALS nh.lab/Users/Domain Users Then assign PermitAccess.
4. Save.

Verify

1. On Win 10: Settings → Network → Ethernet → Properties → check Enable IEEE 802.1X authentication. Method: Microsoft: Smart Card or other certificate. Settings → pick the user cert template.
2. Unplug + replug the cable (or shut/no shut e0/1 on SW1).
3. On SW1: show authentication sessions interface e0/1 → should show Authorized with the test user.
4. ISE GUI → Operations → RADIUS → Live Logs → green checkmark for the auth event.

8Troubleshooting cheatsheet