We are working our way through the paces with ISE
and integration with the network.
We've trained in how to use Active Directory, which
is a good start.
Next, let's train ISE on how to work with and accept requests
from a network access device such as a Cisco switch.
And here's the play-by-play.
So if you go to the Work Centers tab, and hover there.
And then go to Network Access.
Down here we have Network Resources, and that's one way.
Oh!
I did not save the changes from my last settings. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I did not save the changes from my last settings.
Can I cancel?
Scroll down and click on Save.
You know, when the screen is a little bit bigger
and sometimes that Save button is missing.
Sometimes I forget.
So thank you, ISE, for reminding me to save my changes.
All right, so Work Centers.
And then from Network Access we go down to Network Resources,
click here.
And that will give us the opportunity
to add our network devices.
So we click on Network Devices.
And then click on Add.
It really is that simple.
And we'll go ahead and call this switch 1.
And if you have naming conventions
built into your network gear, that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
built into your network gear, that's
a great idea to help remember where it is.
And I'm going to go ahead and specify the IP
address for that.
We can specify location information.
Oh, you know what?
We really can't.
Let's go ahead and save this.
And I'll show you how we can tweak these,
and why that would be a good idea.
So I've got the IP address of this network access device.
I also want to tell ISE that we want to play RADIUS--
peak RADIUS-- back and forth between ISE and that device.
And to do that, we're going to put a checkbox here,
or checking the checkbox for RADIUS authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or checking the checkbox for RADIUS authentication.
Now, we're going to put in the shared
secret, which I will put in.
We'll configure the same shared secret on the switch.
And then, there's other options here.
But that's the basic defaults that you need.
Now, we'll click on Submit.
One of the benefits of adding additional details
to your network access devices is that you
can include it in policy.
So if we create some location objects, like, site 1, site 2.
And we create some device-type objects,
like, these are switches, these are routers.
We can use all of that in our policies. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can use all of that in our policies.
Then you say if it's a switch at site 1 on a Thursday,
then authenticate, or then give the access.
Let me share with you how we can add a little more very
useful detail to these network access devices
that we're adding.
Take a look.
It would go something like this.
So we have this switch created, but if we
go back to device groups-- take a look at this--
these device groups are what showed up.
And there's not very many by default.
So if we wanted to add site 1 and site 2,
we wanted to add a category for routers and switches, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we wanted to add a category for routers and switches,
we simply use the Add button, here.
And let's create site 1.
Now, here's the trick.
What we could do is create site 1.
It could be the parent--
like, a top-level device.
Or you go ahead and nest it under locations.
So if we put site 1 under locations for all locations,
and save.
Now, check it out.
If we expand all locations-- so we
can create a whole brand new parent or root,
or we can use an existing one.
I'm also going to create one for site 2.
Let's do the same treatment for device types. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's do the same treatment for device types.
Right here, we have device types already pre-built for us.
We'll click on Add.
And let's type in router, meaning it's a router,
and we'll put under device types.
And I already created a couple others previously.
So router, singular.
And let's also create one for switch.
So now, take a look.
Under all device types, we can have classifications.
We can assign these to our network access devices.
It's beautiful.
So we go back to our network device, which is a switch.
We go back to the properties.
Down here under the location, dropdown, site 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Down here under the location, dropdown, site 1.
And device type, dropdown, it's a switch.
It's a great way to add additional detail
into our network access devices so that if we
want to do manipulation of policy
based on where our device is, or what type of a device
it is, then we can use those objects as part
of our policies.
All right, if we go back to network devices,
there we have that one switch.
And we use a process to add additional network access
devices.
So now in this video, we've walked through setting up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now in this video, we've walked through setting up
and network access device in ISE.
Also, using tags regarding a device group.
Now, that's really handy.
Like site 1 or site 2.
Or am I a router or a switch.
Because later in policy, if we want to or need to,
we can make that a condition regarding
authentication or authorization when
we're implementing our policy.
And another cool thing is this, if you didn't initially
set up a device group and set up those attributes,
you can go back later and simply create the device groups,
go back to your network devices, and simply add
those attributes.
And then you can use them in policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then you can use them in policy.
And speaking of policy, that's what our next video is all
about.
About the logic with authentication policies
and authorization policies, where you'd go to see them,
then we'll work our way towards creating, modifying,
and then verifying those policies, as well.
And that'll continue in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.