Half the battle in working with ISE
is understanding the logic it goes
through when it gets a request.
So if the switch says, hey, I've got somebody trying
to authenticate via 802.1x.
Boom.
Mr. Authentication Server, here you go.
What does the ISE server do?
What rules does it look at?
And how does it process it?
That, my friend, is what we are going to look
at in detail in this video.
So to set the stage here, we're going
to have this switch acting as the authenticator who
is making requests to the authentication server regarding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is making requests to the authentication server regarding
Bob or the client that's trying to go ahead and connect.
So when that request comes in, there
are two specific processes that we're going to go through.
One is authentication.
It's basically saying, who the heck are you?
And we could be querying the local database
on the ISE server.
We could be asking Active Directory.
And the second piece is if we pass authentication,
the second piece would be the authorization.
You might say, well, Keith, authorization,
does that just full access to the network?
And the answer is it could. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the answer is it could.
Or authorization could also include details such
as, hey, here's a downloadable ACL that's
going to be applied to you.
Or hey, here's an SGT, a Security Group Tag,
or a Scaleable Group Tag that's going
to be applied for this user.
Or hey, you're in VLAN 40, or 50, or 60.
So the authorization is very flexible,
lots of options that we can push down.
And I'd like to share with you some of the defaults that
are in place, and then walk you through that logic of how
it works.
So here on the home page on the ISE appliance,
if we want to look at the policy or authentication
and authorization, we'd go to the Policy tab. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and authorization, we'd go to the Policy tab.
This is one of the ways of getting there, and then
from the dropdown, selecting Policy Sets.
We could also go to Work Centers.
And there's also options for getting to policy sets,
like right here, and here, and here, and here, and here.
So you can get to policy sets anyway you want to.
But there is a Policy tab that you can just go to Policy Sets.
It'll take you right there.
And this default policy set right here
has no conditions, meaning it's not looking-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
has no conditions, meaning it's not looking--
or a switch at site one, or a router at site two,
or anything else specific.
The default is pretty much wide open.
And also, the default is default network access, which
implies that all of the EAP methods that are by default
enabled and will be tried, those can all be used.
We're not limiting it to some specific 802.1x authentication
method.
Now, the tricky part is if this is
a default set, where are the details or the authentication
and the authorization? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the authorization?
And to see those, what we would do
is we'd click on this little arrow over on the far right.
We're going to expand it, and give us the details regarding
this default policy set.
So just as a reminder, we're looking at the default policy
set.
And within that set, we have this authentication policy,
identifying who are you.
And then some exceptions.
And then we have the authorization policy here down
below.
But for now, I'd like to focus on the authentication
and the authorization.
Now, how do we see the details for the authentication policy? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, how do we see the details for the authentication policy?
Simply click on this icon here to expand it.
Now what we're looking at is we're
looking at the default policy set still.
And now we're looking at the authentication policy.
And it has three rules in this policy.
And the way this works is top down.
So as a client is being authenticated,
if they match the conditions here for this rule number one,
it would use the rule over here for that authentication.
If they don't match that, they would then
drop to the next active rule in this authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
drop to the next active rule in this authentication
policy, which in this case would be the default rule.
So it basically means this.
If Bob or some user connects to a switch port that's doing
802.1x, that switch is going to send a request out to the ISE
server.
The ISE server is going to go through
in order, the authentication method,
looking for the first match.
When there's a first match, it's like, great,
that's what I'm going to use.
I'm going to go ahead and authenticate this way.
So this All_User_ID_Stores, which I currently have set,
means any-- it could be local.
It could be the domain controller
with Active Directory. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with Active Directory.
And here is our list of options.
There's also ways of going in and modifying the details,
or each of these.
I'm going to go ahead and leave the All_User_ID_Stores.
And then the next statement is, well,
let's say the user does authenticate.
And maybe Bob logs in.
And he's authenticated against Active Directory.
It all works.
What next?
Well, then we're going to go ahead--
after the authentication is done,
we then go to the authorization policy.
So here at the bottom there's some exceptions
here for local and global, but at the bottom
is where the meat is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is where the meat is.
And this authorization policy is processed from top to bottom.
So we look at the first rule here of the authorization
policy and say, OK, is it wireless access?
And does the identity group name equal endpoint identity group
blacklist?
If so, boom!
You can get black holed.
It's not going to give you any access.
If that doesn't match, it continues
to go down the list in the order that is here.
You can also move these if you want
to until, finally, in our case, because we haven't configured
any of that yet, it's going to have
the basic authenticated access as the rule name. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the basic authenticated access as the rule name.
And the condition for that simply says,
hey, yeah, this user authenticated.
That's great.
And then access is going to be permitted.
So with that authorization rule with all those conditions,
it looks pretty intimidating.
However, here's the takeaway.
In a policy set, there's two main components.
One is regarding authentication, and it's conditional, if then,
like if it's this access point, or this switch,
or if it's at this site, all that's conditional,
then use this way, this method to authenticate.
Maybe it's Active Directory.
Maybe it's a local identity store WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Maybe it's a local identity store
on the ISE server, et cetera.
If the authentication is successful,
it then drops down to the authorization profiles
and the rules in those profiles, looking for this, and that,
and the other.
And we can create our own custom authorization
profiles that specify what we want
to do based on the conditions.
The reason that's important is because we
could have Bob, who's a member of group one,
and Louise, who's a member of group two, in Active Directory.
And based on those group memberships,
we assign them different authorization profiles.
We could put Bob in VLAN 80. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We could put Bob in VLAN 80.
We could put Louise in VLAN 30.
We could do a downloadable ACL that
would control the access for a user
based on their authorization profile we assign to them.
All of that is coming up.
And I'm super excited about showing you.
But for here, the basics, I wanted
to share with you that a policy set has two major parts--
the authentication policy and the authorization policy,
how you're going to be authenticated.
And then what you get once you've been authenticated
with the authorization policy.
And with this default policy in place WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And with this default policy in place
and with Active Directory currently set
up that we did a couple of videos ago,
let's go ahead and do a quick test just
to verify that the basic authentication
and authorization policies are kicking in,
and verify that they work.
And here's one way of testing it.
I've got a Windows machine that I introduced
in the lab set up videos.
And I'm connected with Remote Desktop
to this laptop over its Wi-Fi connector.
And Ethernet 2 is connected to the switch port that is
currently already setup with 802.1x.
We'll have a separate set of videos just on setting up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll have a separate set of videos just on setting up
the switch for that purpose.
So I'm going to right-click on this guy, enable it,
and survey says, authentication failed.
And that's because I haven't configured a username
or password there.
So what we can do is right-click on this interface.
Go to Properties.
And this is on Windows 10 machine,
how we could specify the authentication details
for 802.1x.
Click on the Authentication tab.
And here's how I currently have it setup.
We'll take a closer look at this in later videos.
But I specify that I'm using Microsoft Protected WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But I specify that I'm using Microsoft Protected
EAP, or PEAP for short.
Click on the Settings for that.
I also said don't bother verifying the server's
identity, but I also did take from the ISE machine--
the ISE machine.
Hey, I'm at the hotel.
I need the ice machine.
I also did get the certificate off of ISE.
And I did specify it as a trusted CA.
Now, you could either get the certificate
and say it's trusted, or simply say don't verify it.
And then down under the selected authentication method,
I used EAP-MSCHAP v2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I used EAP-MSCHAP v2.
So I'm going to go ahead and click OK.
And then to add the password, I clicked here
on Additional Settings.
Also, I said remember my credentials
for this connection, I don't want that to happen,
because I want to change the users from time to time.
So if we click on Additional Settings,
User Authentication, yes, then Save Credentials.
I'm going to go ahead and put in Bob's information.
There's his password.
And we'll click on OK, and OK, and OK. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll click on OK, and OK, and OK.
And in the background, I'm show you what the switch is doing.
This is a console to the switch, which is handy,
by the way, when you're labbing this up, or practicing,
to have all those interfaces open that you need to so you
can see what's happening.
So here it says it was successful.
And here it doesn't have an error.
That's fine.
But let me leave you with this thought of how you can really
verify it, and that's this.
If you hover over Operations back on ISE,
and you go down to Live Logs right here, under Live Logs,
it's going to give you the scoop of what's really going on. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's going to give you the scoop of what's really going on.
So this icon here represents that we have a current session.
I mean, Bob's logged in.
And over here on the right we have the detailed report.
So if we want to click on that detailed report,
it will open up a separate window.
And this gives us all the details.
Look at that.
This is the authentication policy, default.
And then it used for authentication-- it used .1x.
That was the name, literally.
Go back real quick.
Policy, Policy Sets.
There we go.
So there is the policy set called Default. Expand that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So there is the policy set called Default. Expand that.
It then had an authentication policy called .1x.
And then there was an authorization policy
at the very end, which it matched
on, which was the basic authenticated access,
network access, location passed.
If we go back to that log, all that information
is there, including what authentication policy hit,
what authorization policy hit.
Oh, oh, oh.
You know what?
I've got to share with you something else really
important.
Because you could have thousands and thousands of people logging
in, if there's a repeat login, like Bob logs in five times, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in, if there's a repeat login, like Bob logs in five times,
by default, it just summarizes those with a repeat count.
And it doesn't show the details.
So if you're labbing this up and you really want
to see the individual logs, and did the method change
for the authentication authorization,
this next step is just for you.
So here's what I did.
I went to Work Centers, and I went to Settings, so
Network Access Settings.
And check this out.
Under Protocols, I expanded that one to radius.
And then under suppression of reports,
I deselected, I removed the check WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I deselected, I removed the check
from those checkboxes that said, Suppress Repeated Failed
Clients, and also Suppress repeated
successful authentication.
And the reason I did that, the reason
I did that was because when you're labbing this up,
you want to see each and every single log as a separate event.
So that'll help if you're labbing this up
and you want to see the differences every time you
make a change.
That's the way to see it in the logs.
So in this introduction to the policy sets for authentication,
authorization, we kind of got a little sneak peek
at how it works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at how it works.
But I think the most effective way
to really see it in action is to create new authentication
and new authorization profiles that leverage Active Directory,
that download access control list,
and set VLAN IDs that you can see in action.
And all that is coming up in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.