Now, the next Nugget, we're going
to be setting up a concept that's
going to be used throughout this series of Nuggets
moving forward.
And that's going to be allowing someone or something
to access our network based on who they are,
based on their identity.
This is a very, very common way to allow access to our network,
but we can use various types of tools, protocols, and softwares
to make this happen.
So let's talk about what identity based authentication
and authorization is, and then in the next couple of Nuggets,
we'll talk about how Cisco takes it up a notch,
and we can actually allow users into our network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we can actually allow users into our network
with some extra tooling.
Let's get going.
Now, when it comes to authenticating to the network
using a username and password.
Well, it's really going to be tough to beat that one.
Right, I mean that's what we all know and love,
and have come to understand, especially,
if you're using multi-factor authentication, that's
going to be a big part to allowing access to the network.
But keep in mind, we're not just talking about allowing access
to the local network.
We're not just allowing people to plug into the switch.
We may also be talking about remote access VPNs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We may also be talking about remote access VPNs.
We may also be talking about bring your own device
environments or even guest access.
So allowing authentication to the network with a username
and password comes in a bunch of different shapes and sizes.
Let's talk about them real quick.
Before we dig deep into the strategy
of identifying users and allowing them access
to the network, we're going to talk about the various ways
they can access the network.
Of course, we've already got the one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Of course, we've already got the one
that we've talked about, where we've
got a switch and somebody brings a laptop from home.
Maybe I can draw a little keyboard here
so it looks like a laptop.
And they plug in to the port at their desk,
which feeds back to the switch.
Do we want to allow them to bring their laptop from home
and plug into the network?
Well, first of all, this could be a corporate issued laptop,
so we trust it.
And we're maintaining it.
Maybe it's getting group policies and things
like that, other ways that we're enforcing it.
But we still want to make sure that they are
exactly who they say they are. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
exactly who they say they are.
Maybe they're not someone spoofing a Mac address.
So what we'll use is, we'll use something like 802.1x that
forces them to type in a username and password when they
connect in.
Specifically, on Windows devices,
this is something that you configure on the NIC itself.
You tell the NIC that when you plug into an 802.1x enabled
switch, you also have to provide credentials.
Now, this could prompt for a username and a password WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, this could prompt for a username and a password
on the end user's device.
It could prompt them on the screen
to type in a username and password.
Or it could be baked into the NIC configuration itself.
We would have configured that when
we issued the laptop to the end user.
But the idea is before this port becomes hot and enabled,
a username and a password must be sent into the switch.
And the switch must verify that username and password
to an authentication server.
There's actually roles that are baked into 802.1x. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's actually roles that are baked into 802.1x.
Now that you've seen the workflow,
we've got the laptop that's providing a username
and password.
This is actually called a supplicant.
And the switch, which is controlling access
to the network, this is called the authenticator.
And it's finding out if this person can actually
authenticate to the network via an authentication server
or an authentication source.
Now, you've already heard about one of these authentication
servers.
This is Identity Services Engine.
But there are a plenty of other resources out there WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But there are a plenty of other resources out there
that could perform this action.
An older version of Cisco products was called ACS.
Even Windows Server has something called the Network
Policy Server.
And the cool thing about each of these items
is they can integrate directly within Active Directory.
So end users don't have to maintain a new username
and password just to access the network, and then
the Active Directory password to access resources
on the network.
They could just use their Active Directory credentials
to access it all.
But the exact same thing could be said about a wireless access
point.
When an end user who may also have the same laptop WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
When an end user who may also have the same laptop
here starts to roam throughout the campus,
they may need to connect wirelessly into the network.
And the same 802.1x mechanisms could take place here.
Now the wireless access point is acting as the authenticator
and is communicating back to the authentication server.
But now consider for a moment that maybe we have a firewall.
And an end user is working at home.
They're trying to connect in over the internet
so that they can access resources
within the enterprise. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
within the enterprise.
Using a remote access VPN technology,
we're obviously going to have to verify their username
and password then.
And while most firewalls have username and password databases
that they can store directly on this specific device,
they could also bounce this authentication off of these
other services, like, ISE, ACS, or NPS using different
protocols, like, RADIUS or TACACS+.
So at this point, we've covered how
end users could get authenticated as they
plug directly into the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
plug directly into the network.
They could use 802.1x.
We've talked about how they could access the network
wirelessly, again, using 802.1x verifying their identity.
And then, we've talked about how they
could use the VPN to connect into the network,
again, verifying their identity by having our firewall bounce
the authentication off of the Identity Services Engine,
or the other resources that we could use.
One last thing that we should talk about is guest services.
Let's talk about guest Wi-Fi.
Now our end user's not using their corporate issued device
anymore. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
anymore.
Now maybe they're using their own personal cell phone
that they want to access the network.
But they have no reason to access internal resources
like a file share using their cell phone.
They really just want to browse the internet and shop on Amazon
and stream Netflix, right?
That's what end users are really trying to do.
They're just trying to go straight out to the internet.
In this environment, we're talking
about bring your own device.
Sometimes the bring your own device purpose is
to access the internal network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to access the internal network.
Sometimes people do bring their own laptop from home in order
to access network services.
If your environment is OK with that,
that's one way that you could handle bring your own device.
Other times, bring your own device
is really only to access guest services, like, guest networks.
So you've got to think about within bring your own device,
there is an enterprise role for it versus a guest role.
Don't just automatically assume that bring your own device
immediately is talking about guest services. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
immediately is talking about guest services.
That's not necessarily the case.
And this is why we still need a level of authentication that's
taking place within the network.
Within bring your own device on the enterprise solution,
our end user who's using their cell phone could potentially
provide 802.1x credentials yet one more time and go straight
to the authentication services and come back,
and then find themselves connected to the internal
network.
Or if they just needed guest services,
they could access a guest Wi-Fi. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they could access a guest Wi-Fi.
As part of the guest Wi-Fi, they may
agree to not access any sort of malicious information.
And they may agree that they will only
be able to access the internet.
So their traffic will be sent outbound towards the internet.
And they'll never be able to communicate
to any other devices internally on the network.
Don't also forget that profiling was an option.
As these devices, all of them, try
to get access to the network, they
can be profiled and placed into certain segments or VLANs WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can be profiled and placed into certain segments or VLANs
based on the type of device that's
trying to access the network.
So if we have a cell phone, we've
identified it as an iPhone.
We haven't explicitly enabled its Mac address within ISE.
And it's not trying to authenticate with 802.1x.
Based on some assumptions we could
make about the profile of the device,
we could automatically place them into a guest network
access situation.
The point that we're trying to make here
is that people need to authenticate with a username
and password.
And they're going to authenticate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And they're going to authenticate
with a username and password in various situations--
hard wired, wireless, VPN, bring your own device
for the enterprise, or bring your own device for the guest.
Now, in the next couple of Nuggets,
we're going to talk about how we can take it up a notch,
specifically with the VPN.
And then we're going to go even further
when we talk about how Cisco TrustSec in security
groups with security group tagging
really enable us to enforce policy at the network access
level.
I hope this has been informative for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I hope this has been informative for you.
And I'd like to thank you for viewing.