Many years ago, I had the opportunity
to do a network admission control or network
access control project and here's what they wanted.
They wanted a device before it was allowed on the network
to be checked, interrogated to make
sure it had the right version of antivirus software,
that it was up to date, to make sure it had the minimum patch
levels required.
And if it wasn't, that device should be given access
to a portion of the network-- we called it
a "quarantine" so it could fix that, remediate that, and then
go back and try again and get on the network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go back and try again and get on the network
once it was up to snuff.
That's a great idea, and it's called posturing.
Now to do it today we need two major components.
One is we need an agent, a posture agent as part
of AnyConnect that runs on the client that can communicate
with a server that has all the rules regarding what's
required.
And that server today is known as ISE.
And here is the Identity Services Engine.
And they've got some really great workflows.
In fact, let's take a look at the version
if we go to about I'm currently on 2.7 but 3.0 just came out. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we go to about I'm currently on 2.7 but 3.0 just came out.
But the concepts are the same.
And that is under Work Centers we
have really great workflows, including posturing.
So if we go to Work Centers and Posture,
in here it has a 1, 2, 3 process with Prepare.
Prepare our network access devices like our switches that
are doing 802.1x and authenticating the users.
Do updates.
ISE in the background will go out
and get the updates regarding anti-malware patch information.
So how does ISE know we're looking for a Windows 10
in this version of a patch?
Is because it can do dynamic updates in the background WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Is because it can do dynamic updates in the background
to gather that information for us.
And then we need some software on the clients,
and most people are going to be using the AnyConnect agent.
Which AnyConnect is a VPN software.
It's an 802.1x supplicant.
There's also a module for a posture agent
that can get that information.
So if we have a posture requirement for compliance
that we're running a certain version of this
or a certain version of that, the AnyConnect agent
can make those queries on the local system,
report back to ISE to see whether or not
it's in compliance.
And then we're going to create and implement our policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we're going to create and implement our policy.
And part of the policy elements include conditions.
Conditions are what we're looking for.
We're looking for this vendor's anti-malware software,
or this version of the software, or we're
looking for a certain patch or update on a Windows operating
system, be it Windows 7 or Windows 10.
And we can also specify the remediation
so that if a device isn't up to snuff,
doesn't have the right patch, we want
to give them some access to the network so they can fix it.
We can call that quarantine.
And that boils down to a limited amount of access so the client,
the device has the opportunity to go out get the update, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the device has the opportunity to go out get the update,
apply it, and then try again.
And those are specified as part of posture requirements,
the conditions that need to exist
and then the remediation that we need if those conditions don't
exist.
And then we boil that all together in a posture policy.
And there's some amazing workflows in ISE.
So if we go up here to Work Centers and we have over that,
there's a whole section for posture.
And we hover over here on posture,
below that we have all of our individual components
regarding posture assessment.
So if we click on Posture, it takes us to the initial page WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we click on Posture, it takes us to the initial page
that we were at a moment ago.
And then we have Network Devices.
Those are the devices that are controlling access
into our network.
We have Client Provisioning.
Here are some default provisioning policies.
And under Resources it comes with some defaults.
And we can click on Add.
And we want to add, for example, an AnyConnect posture
profile that was custom to our environment,
we can it a name and then just put in all the details
regarding how we want that agent to behave.
This is the AnyConnect posture agent
that would be running on our client devices. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that would be running on our client devices.
So Logging, Stealth Mode yes or no.
Stealth Mode just basically means
it's running without telling the user a whole bunch
of information about what's going on
such as right here where it says no user interface is provided
in Stealth Mode.
And then if there's an IP address change, what do you
want to have happen?
The Posture Protocol, including a custom message for devices
that are not compliant, giving them
a clue as far as what they should do or what they can do.
Custom messages for grace periods.
And the options continue.
We can also customize what the Client Provisioning WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can also customize what the Client Provisioning
Portal will look like.
So here's the default portal.
If we click on it, we can customize
it seven ways to Sunday.
As we continue, we have our Policy Elements right here.
So here's our conditions as far as what we're looking for.
And let's imagine we are looking for a specific file.
So here's a whole bunch that came with ISE.
If we wanted to look for a specific file that
was not one of these, we could click on Add and add that.
Or if we wanted to look for a specific registry value,
we could use one of these if it matched our needs
or click on Add.
Or we could look for anti-malware. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or we could look for anti-malware.
So we could use one of these things,
is anti-malware present?
Or we could create our own.
So I created a custom one called Our Anti-malware.
I specified it was for Windows 10 Enterprise.
I specified the vendor.
And then I specified we're looking for a version 4.x.
So that's the condition.
So if this is part of a policy and that condition
wasn't matched, we'd also want to have a remediation for that.
So under Remediations we go to Anti-malware.
Under Anti-malware I created one called Update Malware Bytes.
This specifies the details for that remediation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This specifies the details for that remediation.
Or if we had a condition that was looking
for a firewall, such as Firewall Condition,
and we were looking for that under Remediation,
we have to have something for firewall
as well, so that's right here.
And we could click on Add.
We could give it a name.
specify the operating system it applies to.
And then down under Vendor Name go Specify
the Firewall Vendor that should be present on that system.
And then we Create Posture Policies
and then include those policies as part of Policy Sets.
And another way of getting to Remediations we
could go to Policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
could go to Policy.
And then under Policy Elements, if we click on Results and then
under Posture if we expand that on the left, here
once again we have the Remediation Actions.
This is the same list we saw in the workflow as well.
So we go to Anti-malware.
There's the two defaults that came with ISE,
and then there's the one I made as well.
So Thanks for joining me in this video regarding
posture assessment using the AnyConnect agent and ISE.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.