If we want ISE, the Identity Services Engine,
to use Active Directory as one of its identity stores,
we need to configure it to make that happen.
And that's what I'm going to walk you through right now
in this video.
So here we are on the main page for the Identity Services
Engine.
And there's several ways we could
get to the External Identity section, which
is where we're going to go to add
Active Directory as a resource.
We could go to Work Centers, and then we could go down
to Network Access.
And then under there, we have the External Identity Sources.
But you know what?
We also have that in several other places, like under Device WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We also have that in several other places, like under Device
Administration, External Identity Sources.
So however you want to get there is great.
It's under Device Administration and then the subtab
of External Identity Sources.
So to add Active Directory as an identity source,
we'd click on Active Directory.
We then click on Add.
We then specify the name.
Now, the Join Point Name is the name
we're going to refer to in our policies regarding
this directory service that's pulling from Active Directory.
So let's call this Our-DC. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's call this Our-DC.
This is a descriptive name of our domain controller.
You can rename that, as well.
And then we're going to specify the domain.
Now, in my home lab here, I've got ogit.com.
And that's the one I have here in my lab.
So I've got a domain controller that will respond to that.
And we'll click on Submit.
Next, it's asking, hey, do you want
to join to this Active Directory domain?
And I'm going to go ahead and say, yes, I do.
So then we're prompted to put in the credentials for somebody
who has the rights to do that.
So this guy does, administrator.
And I'll put his password.
Then we can also specify the organizational unit WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we can also specify the organizational unit
or accept the default and click on OK and hope for the best.
And I always have, like-- hold my breath for a moment
hoping it happens.
If it doesn't, we try again.
Make sure you have the domain name correct and so forth.
And we'll click on Close.
So now we have this Active Directory domain, ogit.com,
which is acting as an external identity source
that we can query for authenticating users.
Also, check this out.
Besides users, we can also deal with groups
and use the groups from Active Directory. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and use the groups from Active Directory.
So let me show you something real quick on the Active
Directory server.
That's right here.
On this Active Directory server, I've got the user Bob.
I've got the user Luis.
And I've got two groups, one called ISE-Admins,
one called ISE-Operations.
Bob is in the Operations group.
Luis is in the Admins group.
So back here in ISE under Active Directory, if we go to Groups,
you can click on Add.
Check this out.
Select Groups From Directory.
We click on that.
We can then go ahead and just say Retrieve Groups.
And because there's an asterisk there, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And because there's an asterisk there,
it'll just pull all the existing groups from Active Directory.
And we can just choose the ones we want to use.
So you go down the list.
I've got ISE-Admins and ISE-Operations.
I'm going to click on OK.
But let's go back again.
Let me show you how we can sort it
a little bit if we have lots of groups we got to filter down.
I'm going to type in the word "domain" and asterisk.
And that should show us everything
with the word "domain" in it.
I pressed Enter.
I need to click on Retrieve Groups for it to go get it.
Here it comes.
All right.
So if we want to bring Domain Admins and Domain
Users, as well, if we're going to use those WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Users, as well, if we're going to use those
as part of our policy, our Identity Services Engine
can now query Active Directory.
So now that we have integration between ISE and Active
Directory, we have another challenge ahead of us.
And that is, shouldn't we train the Identity Services Engine
about at least one network access device, like a switch?
The answer is absolutely yes.
And I'll walk you through step by step
on how to train ISE about a network access device,
like a switch, in the very next video.
I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.