I still remember when I was brand new to networking
and I thought, well, a switchboard, you're
either connected and it works.
You can send any packets you want
or frames you want through the network.
Or it's not working.
It's shut down, or there's a cable problem.
And that's it, like very binary.
It's good.
It's not good.
However, in the world of 802.1x, if we've gone to the setup,
which we're going to do in these subsequent sets of videos
coming up after this one, if we've set up 802.1x with
the supplicant configured correctly, the authenticator,
the switch configured correctly to work with supplicants WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the switch configured correctly to work with supplicants
and also with the AAA server, and then an authentication
server, like an identity services engine--
holy spamoly-- once a user authenticates,
based on our authorization policies on ISE,
we can do a lot of really cool stuff.
Let's take a look at our topology with Bob, the user,
and let's just kind of break the ISE regarding several things
that we could do as far as authorization,
which can protect our networks.
So let's take it to this point where
Bob has a supplicant running.
The authenticator and Bob are having a back and forth, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The authenticator and Bob are having a back and forth,
basically getting Bob's information, whether Bob's
authenticating with a username or password,
or he's using a certificate, either way.
And then the authenticator checks the AAA server.
And the AAA server sends back attributes regarding, OK,
great, it's Bob.
We know that.
And here's what I want you to do.
So we're going to be using RADIUS
on this leg of our journey.
And we're going to be communicating
with a lot of AV pairs, attribute value pairs,
that instruct this authenticator, in this case,
the switch, on what to do.
If this is the port that Bob is on,
here are a few options that we could push down WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here are a few options that we could push down
to this switch with that port that Bob is connected on.
Number one, we can assign a VLAN.
Then we can make a profile, and then
specify that based on this authorization profile,
if Bob gets to that point, matches it,
we want to assign him to VLAN 80, or 30,
or whatever VLAN we choose to.
Now, a good security measure is to take all the unused ports
and assign them to like VLAN 999, which
goes nowhere, no services, no DHCP, no anything.
And then when the user connects on a port, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then when the user connects on a port,
the authenticator can find out who it is, pass it off
to the AAA server, gets a response,
and then at that point, we can put Bob in the correct VLAN.
Also, if Bob moves around, maybe Bob always
needs to be in VLAN 80, even if he's going between buildings,
or different locations.
And this is one way of doing it with the AAA and 802.1x.
So we could assign a VLAN.
Number two, we could use a downloadable.
Let's put D there, an ACL.
A downloadable ACL that says based on Bob connecting,
I want you, switch, says the I server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I want you, switch, says the I server,
I want you to implement an access control list that's
going to filter certain types of traffic,
or permit certain types of traffic.
And that way, when Bob connects here,
we never allow him to use TCP port 23,
because that would mean he's trying
to use Telnet somewhere, or any other insecure management
protocols, or whatever we want to permit or deny.
We could dynamically download an ACL.
This switch would apply it.
And the switch in the background is doing IP device tracking.
So even if it's a layer 2 switch,
it can still enforce the policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it can still enforce the policy.
Pretty amazing stuff.
And it can use ARP probes, and verify what the layer 3
address is on that device, and still manage the properties,
and manage the control, or a user who's connecting.
Amazing stuff.
So VLAN assignment, a downloadable ACL.
Another option is SGT, a Security Group Tag.
We have a whole set of videos coming up
that's about TrustSec.
TrustSec is an amazing way to implement security
across your network without having
to worry about exactly where people are plugging into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to worry about exactly where people are plugging into
or where they're going.
You can set up rules, and then instead
of filtering at the edges of VLANs,
like on layer 3 interfaces, or instead
of using downloadable ACLs, we can use security group tags.
And then these end devices can control based
on those tags what's allowed.
So we're going to set the rules with TrustSec about what can
go between different groups.
Each group has their own tag.
And that's a wonderful, wonderful thing.
And also, for another insight as to what
we could push down or allow that client to do,
let me give you a sneak peek at the Identity Services Engine WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let me give you a sneak peek at the Identity Services Engine
profile information that is just is a laundry list of what
we could push down to enforce control on that port
once we have authenticated Bob.
And here, a nice one way to get to those policy elements
would be to go to Work Centers.
And then under Network Access Section,
we go down to Policy Elements right here.
And from here, under Results, this
is where we can find Authorization Profiles.
And I'm just going to create a new one as an example.
And so we could name it.
And as we scroll down, we can identify a downloadable ACL. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And as we scroll down, we can identify a downloadable ACL.
We get assigned a security group, a VLAN assignment,
a voice domain permission, reauthorization,
a MACSec policy, interface templates, and the list
just goes on, and on, and on.
If that weren't enough, we also have these advanced attribute
settings.
And that list goes on, and on, and on.
So if we went to Cisco, and then from there
we have a whole bunch of attributes
that we could push down.
So there's just lots and lots of options
that we can do based on authentication
and what type of authorization we're going to do for a user WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and what type of authorization we're going to do for a user
or for a group.
That's very flexible, and gives us
the opportunity to deploy the exact authorization
policy that we want, or a given user
once they've authenticated.
Now, the great news is that even if we're
using MAC authentication bypass, where we have a device that
doesn't support a supplicant, we can still do the authentication
based on that layer 2 address, sort of like the license plate
only, the MAC address.
And then based on that MAC address being identified,
we can also apply specific policies,
and have authorization and specific access
for those devices.
Here's a case in point.
Let's imagine you've got a whole bunch of internet WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's imagine you've got a whole bunch of internet
of things devices that don't have supplicants.
We can go ahead and we can authenticate them
based on their layer 2 address.
And then based on identifying what devices those are--
thermostats, or refrigerators, or whatever they are--
we can then apply authorization profiles
to give them just the amount of access that they need,
and not anymore, which is really important,
because we have an internet of things device.
Sometimes the security wasn't thought out
when they were putting those things together.
And if they're compromised and they
can be leveraged for an attack on our network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can be leveraged for an attack on our network,
we don't want that IP camera, or we don't want that thermostat,
or whatever it is, we don't want it
to start doing probing to weird addresses or using protocols
that it doesn't need, because if it's compromised,
it could be a vector for an attack in our network.
So by controlling those, authenticating them,
and authorizing them only for certain protocols
or certain addresses, a wonderful thing.
So in this video, we've taken a look at what some
of the options are once we've authenticated a user,
whether it's 802.1x, or MAC authentication bypass based WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
whether it's 802.1x, or MAC authentication bypass based
on its layer 2 address.
We have lots of options available to us regarding what
we want to do and allow on that port
once authentication has happened.
Now, the next set of videos, here's what I'd like to do.
I'd like to share with you some of the details in my little
playground that I've set up to configure and demonstrate ISE,
including 802.1x, MAC authentication bypass,
and also TrustSec.
So in the next video, I'll introduce you
to the lab environment, share with you exactly what I'm
using, and then we'll proceed with the configuration
of each of these elements.
So I look forward to seeing you in that set of videos as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I look forward to seeing you in that set of videos as well.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.