{"id":97567,"date":"2020-10-19T14:42:54","date_gmt":"2020-10-19T12:42:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/cisco-ise-nastrojka-gostevogo-dostupa-na-fortiap-chast-3"},"modified":"2020-10-19T14:42:54","modified_gmt":"2020-10-19T12:42:54","slug":"cisco-ise-nastrojka-gostevogo-dostupa-na-fortiap-chast-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/cisco-ise-nastrojka-gostevogo-dostupa-na-fortiap-chast-3","title":{"rendered":"Cisco ISE: Konfigurace hostovac\u00edho p\u0159\u00edstupu na FortiAP. \u010c\u00e1st 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Cisco<\/p>\n

V\u00edtejte ve t\u0159et\u00ed publikaci cyklu \u010dl\u00e1nk\u016f v\u011bnovan\u00fdch Cisco ISE. Odkazy na v\u0161echny \u010dl\u00e1nky v cyklu naleznete n\u00ed\u017ee:<\/p>\n

    \n
  1. \n

    Cisco ISE: \u00davod, po\u017eadavky, instalace. \u010c\u00e1st 1<\/a><\/noindex><\/p>\n<\/li>\n

  2. \n

    Cisco ISE: Vytv\u00e1\u0159en\u00ed u\u017eivatel\u016f, p\u0159id\u00e1v\u00e1n\u00ed LDAP server\u016f, integrace s AD. \u010c\u00e1st 2<\/a><\/noindex><\/p>\n<\/li>\n

  3. \n

    Cisco ISE: Konfigurace hostovac\u00edho p\u0159\u00edstupu na FortiAP. \u010c\u00e1st 3<\/a><\/noindex><\/p>\n<\/li>\n<\/ol>\n

    Tento \u010dl\u00e1nek v\u00e1s pono\u0159\u00ed do problematiky hostitelsk\u00e9ho p\u0159\u00edstupu a poskytne v\u00e1m krok za krokem n\u00e1vod na integraci Cisco ISE a FortiGate pro nastaven\u00ed FortiAP \u2014 p\u0159\u00edstupov\u00e9ho bodu od Fortinet (obecn\u011b plat\u00ed pro jak\u00e9koli za\u0159\u00edzen\u00ed, kter\u00e9 podporuje RADIUS CoA <\/strong>\u2014 Zm\u011bna opr\u00e1vn\u011bn\u00ed.<\/p>\n

    Nav\u00edc p\u0159ikl\u00e1d\u00e1m na\u0161e \u010dl\u00e1nky Fortinet \u2014 v\u00fdb\u011br u\u017eite\u010dn\u00fdch materi\u00e1l\u016f<\/a><\/noindex>.<\/p>\n

    Pozn\u00e1mka<\/em><\/strong>: Za\u0159\u00edzen\u00ed Check Point SMB nepodporuj\u00ed RADIUS CoA.<\/p>\n

    Skv\u011bl\u00fd pr\u016fvodce<\/a><\/noindex> v anglick\u00e9m jazyce popisuje, jak vytvo\u0159it hostitelsk\u00fd p\u0159\u00edstup pomoc\u00ed Cisco ISE na Cisco WLC (Wireless Controller). Poj\u010fme na to!<\/p>\n

    1. \u00davod<\/h2>\n

    Hostitelsk\u00fd p\u0159\u00edstup (port\u00e1l) umo\u017e\u0148uje poskytnout p\u0159\u00edstup k internetu nebo intern\u00edm zdroj\u016fm pro hosty a u\u017eivatele, kter\u00e9 nechcete vpustit do sv\u00e9 m\u00edstn\u00ed s\u00edt\u011b. Existuj\u00ed 3 p\u0159ednastaven\u00e9 typy hostitelsk\u00e9ho port\u00e1lu (Guest portal):<\/p>\n

      \n
    1. \n

      Hotspot Guest portal \u2014 p\u0159\u00edstup k s\u00edti pro hosty je poskytov\u00e1n bez p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f. Obecn\u011b u\u017eivatel\u00e9 mus\u00ed akceptovat \"Politiku pou\u017e\u00edv\u00e1n\u00ed a ochrany soukrom\u00ed\" spole\u010dnosti, ne\u017e z\u00edskaj\u00ed p\u0159\u00edstup k s\u00edti.<\/p>\n<\/li>\n

    2. \n

      Sponsored-Guest portal \u2014 p\u0159\u00edstup k s\u00edti a p\u0159ihla\u0161ovac\u00ed \u00fadaje mus\u00ed poskytnout sponzor \u2014 u\u017eivatel odpov\u011bdn\u00fd za vytv\u00e1\u0159en\u00ed hostitelsk\u00fdch \u00fa\u010dt\u016f v Cisco ISE.<\/p>\n<\/li>\n

    3. \n

      Self-Registered Guest portal \u2014 v tomto p\u0159\u00edpad\u011b host\u00e9 pou\u017e\u00edvaj\u00ed existuj\u00edc\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje nebo si sami vytv\u00e1\u0159ej\u00ed \u00fa\u010det s p\u0159ihla\u0161ovac\u00edmi \u00fadaji, av\u0161ak pot\u0159ebuj\u00ed potvrzen\u00ed sponzora pro z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu k s\u00edti.<\/p>\n<\/li>\n<\/ol>\n

      Na Cisco ISE m\u016f\u017eete nasadit v\u00edce port\u00e1l\u016f sou\u010dasn\u011b. Ve v\u00fdchoz\u00edm nastaven\u00ed na hostitelsk\u00e9m port\u00e1lu u\u017eivatel uvid\u00ed logo Cisco a standardn\u00ed obecn\u00e9 fr\u00e1ze. To v\u0161e lze p\u0159izp\u016fsobit a dokonce nastavit prohl\u00ed\u017een\u00ed povinn\u00e9 reklamy p\u0159ed z\u00edsk\u00e1n\u00edm p\u0159\u00edstupu.<\/p>\n

      Nastaven\u00ed hostitelsk\u00e9ho p\u0159\u00edstupu lze rozd\u011blit do 4 hlavn\u00edch f\u00e1z\u00ed: nastaven\u00ed FortiAP, establishment of connectivity between Cisco ISE and FortiAP, creating the guest portal, and configuring access policies.<\/p>\n

      2. Nastaven\u00ed FortiAP na FortiGate<\/h2>\n

      FortiGate je ovlada\u010d p\u0159\u00edstupov\u00fdch bod\u016f a ve\u0161ker\u00e9 nastaven\u00ed se prov\u00e1d\u00ed na n\u011bm. P\u0159\u00edstupov\u00e9 body FortiAP podporuj\u00ed PoE, tak\u017ee jakmile je p\u0159ipoj\u00edte do s\u00edt\u011b p\u0159es Ethernet, m\u016f\u017eete za\u010d\u00edt s nastaven\u00edm.<\/p>\n

      1) Na FortiGate p\u0159ejd\u011bte na z\u00e1lo\u017eku WiFi & Switch Controller > Managed FortiAPs > Create New > Managed AP<\/em>Pou\u017eijte unik\u00e1tn\u00ed s\u00e9riov\u00e9 \u010d\u00edslo p\u0159\u00edstupov\u00e9ho bodu, kter\u00e9 je uvedeno p\u0159\u00edmo na samotn\u00e9m p\u0159\u00edstupov\u00e9m bodu, a p\u0159idejte jej jako objekt. M\u016f\u017ee se tak\u00e9 automaticky objevit, v takov\u00e9m p\u0159\u00edpad\u011b klikn\u011bte Autorizovat <\/em>prav\u00fdm tla\u010d\u00edtkem my\u0161i.<\/p>\n

      \"Cisco<\/p>\n

      2) Nastaven\u00ed FortiAP mohou b\u00fdt v\u00fdchoz\u00ed, jako na screenshotu. D\u016frazn\u011b doporu\u010duji povolit m\u00f3d 5 GHz, proto\u017ee n\u011bkter\u00e1 za\u0159\u00edzen\u00ed nepodporuj\u00ed 2.4 GHz.<\/p>\n

      3) Pot\u00e9 ve z\u00e1lo\u017ece WiFi & Switch Controller > FortiAP Profiles > Vytvo\u0159it nov\u00fd <\/em>vytv\u00e1\u0159\u00edme profil nastaven\u00ed pro p\u0159\u00edstupov\u00fd bod (verze protokolu 802.11, re\u017eim SSID, frekvence kan\u00e1lu a jejich po\u010det).<\/p>\n

      P\u0159\u00edklad nastaven\u00ed FortiAP\"Cisco\"Cisco<\/p>\n<\/p>\n

      4) Dal\u0161\u00edm krokem je vytvo\u0159en\u00ed SSID. P\u0159ejd\u011bte na z\u00e1lo\u017eku WiFi & Switch Controller > SSIDs > Vytvo\u0159it nov\u00fd > SSID. <\/em>Zde je d\u016fle\u017eit\u00e9 nastavit:<\/p>\n