In this video, we're going to leverage much
of the configuration that's already been done on the MAC
Authentication Bypass and the 802.1X authentication regarding
the switch, the network access device.
However, there are just a few additional commands
if we want that device to support TrustSec
that we need to add.
So let me share with you the upgraded
gear in my home lab here.
And then I'll walk you through the configuration
of how to make that device sing in the world of TrustSec.
So here's the big change.
I took the existing configuration
that I had on the little 3560 switch, and by the way, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that I had on the little 3560 switch, and by the way,
there is a matrix of support at Cisco
where it talks about which devices,
based on the hardware and the operating system,
which ones support TrustSec and which features in TrustSec.
So I looked up the 3560 and said, yeah, you're out of luck.
It's not doing TrustSec.
But I have a 3750x.
I swapped out the switch it switched to.
And it's now a 3750.
I'll have a console access to it so I can see
console messages and so forth.
And what I've also done is I've got WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And what I've also done is I've got
three devices that are actually connected to the switch.
I've got two coming from Windows clients
and I've got one through my little Raspberry Pi
because I wanted the ability to have three devices that we
could play with once we get this all working to verify, OK,
based on TrustSec, can this device
do x, y, z to that device if they're in different groups
or within groups?
So more detail on the devices that are connected coming up.
But I wanted to focus in this video on the network access
server and a few of the additional commands
that I've implemented to make it work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that I've implemented to make it work.
So let's take a look at the commands.
And then we'll paste them in just
to make sure that you and I are on the same sheet of music.
All right, so here we go.
Leveraging most of the commands that we've already done
and already in place regarding MAC Authentication Bypass
and 802.1X authentication, I want to share with you some
additional commands that are required for TrustSec to work.
We've got the hardware in place.
Let's take a look at the additional commands.
So in configuration mode, cts, for Cisco TrustSec--
that's what cts the acronym is for--
cts authorization list OURSGLIST. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
cts authorization list OURSGLIST.
I just made up a name.
And we're going to leverage that list right here.
In fact, let me just move that up right here.
Boom.
Put it right below. aaa authorization
for network access OURSGLIST group Our-Group.
Now, Our-Group is referring to the radius server group
that we configured previously that talks back to ISE.
It specifies who that ISE server is.
I also put logging verbose on for troubleshooting purposes.
So if a downloadable ACL or a security group ACL comes down
and the syntax isn't right, we can learn about that.
Also, big heads up, if you're doing this in a lab environment WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also, big heads up, if you're doing this in a lab environment
and you remotely connect to a switch that's supporting this,
if you're on a VTY line, like, SSHed in,
make sure you do terminal monitor.
That just totally killed me for a while.
I was, like, I'm not seeing any messages,
no errors, no problems.
And I was, like, oh, you're not on the console.
So that was a total mistake that cost me a lot of time.
I want to pass it on to you to save that time.
So I've got cts logging verbose.
And I also did terminal monitor from my VTY connection.
Then I also specified I want to do Cisco TrustSec WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then I also specified I want to do Cisco TrustSec
role-based enforcement, and then followed by the command
to say which VLANs do you want to enforce it on.
I just said all of them.
If you want to enforce it just on a few VLANs, that's fine.
And then this command right here--
I already had it previously in my config,
but I wanted to enforce it again, reinforce it--
radius-server vsa-- vendor specific
attributes-- send authentication.
Again, that was a little bit of a repeat.
Also, this one is.
So line 99 and 100 here are already in the config if you
did the MAC Authentication Bypass and the 802.1X. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
did the MAC Authentication Bypass and the 802.1X.
Great.
The other thing I added, though, was I added a PAC.
Now, a PAC is a Protected Access Credential.
So I went back into my server configuration,
which I already have a radius key for, and I added a pac key
of Cisco!23.
Now, guess where that has to match?
You'll never guess.
Yeah, it's got to match up on the ISE server
under its Protected Access Credentials.
So I did that already on the ISE server.
But I will walk you through that as well in the very next video
so you have all the pieces. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so you have all the pieces.
And then I typed in exit.
This command here is not done, not done,
in configuration mode.
It's done from privileged mode, the pound symbol.
So I just cts credentials id.
I use this as my ID for this switch.
I also threw in the IP address there
so I'd remember what it was.
And then the password, I specified the password.
I'd mirror that up on the ISE server regarding the CTS
credentials.
Then we could do a show cts pacs just
to verify we have the Protected Access Credentials.
And then, I'll tell you what. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then, I'll tell you what.
In a lab environment, I'm not very patient sometimes.
I mean, ISE takes like 15 or 20 minutes to load, even
on a dedicated ESXi host with, like, 64 gigs of RAM.
Anyway, long story short, in a lab environment,
you want to reboot--
not reboot-- you want to refresh frequently.
So you make a change, and this command right
here, cts refresh environment-data and cts
refresh policy is just going to go out and make sure that it's
up to date with the actual ISE.
And that way it has all the current data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way it has all the current data.
And we can verify that with this as well.
So just to make sure, I think I have all this on the switch,
but just to make sure that because I'm
doing a lot of tinkering, I'm going to go ahead and just take
all this.
And I'm going to put it all in, except for the show command.
So I'll right click.
Copy that.
Lets bring up a terminal.
And this is the 3750x switch that I've got.
I'm going to right-click paste and confirm.
Oh, dot 1x system-auth control.
Let me do a do show run include and a-u-t-h. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me do a do show run include and a-u-t-h.
I want to see any lines in the config that have a-u-t-h in it.
We're running aaa.
There's going to be a lot of them.
Let me go ahead and do that one more time with control
dot 1x system-auth control.
And it didn't like it because I think
it's already in use because it's in the config.
All right, so it's already in the config.
And it took all the other commands.
All right, so let's do some show command.
Show cts pacs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Show cts pacs.
And that's a very, very good sign.
Let me also do a cts refresh or environment-data, and a cts
refresh or policy.
And then if we do a show cts for Cisco TrustSec environment,
boom, that's great.
So this is showing us, among other things, the security
groups.
And check it out, there's the three that we just made.
So we're communicating with the server.
And here's what I'd like to do.
In addition to having the network access
device ready to go for TrustSec, it also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
device ready to go for TrustSec, it also
involves having the ISE server and its communications
with this switch also ready to go
and willing to do TrustSec with it.
So in the next video, we're going
to take a look at setting up the TrustSec components on ISE
so it can communicate with this network access device.
We'll do that next.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.