The Cisco ISE must be configured to disable Wireless Setup for production systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-242641	CSCO-NM-000360	SV-242641r960966_rule		High

Description

ISE Wireless Setup is beta software so is not authorized for use in DoD. Wireless Setup is disabled by default after fresh installation of Cisco ISE. If you upgrade ISE from a previous version, the Wireless Setup menu does not appear. Wireless Setup requires ports 9103 and 9104 to be open. To close those ports, use the CLI to disable Wireless Setup. You can enable Wireless Setup in the ISE CLI with the command application configure ise, picking the option to enable Wireless Setup.

STIG	Date
Cisco ISE NDM Security Technical Implementation Guide	2024-09-10

Details

Check Text (C-45916r822758_chk)

If wireless setup is not availabe in this version of the product, this is not applicable.

Verify Wi-Fi setup has been disabled on a device after initial setup and the device has been placed on the production network.

Show application status Wi-Fi setup.

If wireless setup is not disabled, this is a finding.

Fix Text (F-45873r714232_fix)

Use the application configure command in EXEC mode to disable wireless setup.

application configure disable Wi-Fi setup