In the previous video, we took a look at the defaults
for authentication and authorization.
And in this video, I'd like to walk you through setting up
a brand new authentication policy,
and then walk you through how we can verify that not only it
exists, which is pretty cool, but also that it's working.
All that and more starting now.
And here's our game plan.
We're going to create a new authentication policy.
And let's include three aspects, that it's
going to kick in and be used if it's from a network access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to kick in and be used if it's from a network access
device or switch that's in site 1.
And it is a switch.
And we also want to use Active Directory.
And then if the authentication works,
we'll just go ahead and say, yeah, congratulations.
We'll give you full access regarding authorization.
We'll tackle authorization in a separate video.
So that's our game plan.
Before we start putting that together as a new policy set,
let's just verify our network devices real quick.
So on this switch, which one?
I just want to verify that it's in site 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I just want to verify that it's in site 1.
Yes, good, good, good.
And it's device type of switch.
If we didn't have those, it wouldn't
be too successful in looking for those attributes.
And as far as external identity sources,
we've got Our-DC, which represents our domain
controller with access to Active Directory.
And as far as that is concerned, if we look at our groups,
we also pulled in four groups that we can leverage as well.
OK.
Fantastic.
I wanted to make sure those pieces were in place.
And to create or modify our policy, a quick way of getting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And to create or modify our policy, a quick way of getting
there is hover over policy, and then
just selecting policy sets.
Any way you want to get there is perfect.
And here we have our default policy set.
We are going to create a new one in front of that
or on top of that.
And the way you can do that is hit this Plus button
right here.
And let's name it something that we'll recognize in the logs.
That's not going to be a default that we're
going to see anywhere else.
So if we see that policy set name
of Our-Site-1-Switch-Policy-Set, we'll know exactly where
it's coming from.
Now, if we want to get granular on when this policy set kicks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, if we want to get granular on when this policy set kicks
in and is going to be used, we need
to set the conditions, which is right here.
So to set the conditions, we're going
to click on the Plus symbol in the Conditions column here.
And we are simply going to set the conditions that
have to match for this policy set to be used.
And this interface is a little interesting.
You can take these objects over here in the library and drag
them over, like if it's 802.1x wired, great.
Or if it's wireless 802.1x, you can drag and drop them.
Or you can just create your own.
That's what we're going to do here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's what we're going to do here.
Now, click on this.
Click to add an attribute option.
And then down under Dictionary, I click on Dictionaries.
And I'm going to select Device.
And you'll see why here in just a moment.
If our goal is to have this policy set only kick in
if it's a device that is in site 1,
we can click here on Device with Location.
And then we have our options for the operator
equals, not equals, contains, doesn't contain.
If the location equals in the dropdown list, site 1--
boom-- that's one of the conditions.
Now, if we have two conditions that we have to match, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, if we have two conditions that we have to match,
before we want this policy set to kick in,
we can simply add it.
And you just click on New right here.
Click on New.
And what was the other condition?
It was-- oh, site 1, and it has to be a switch.
So go ahead and click on the attribute here.
And specify device type right here.
Then equals.
And it is going to be-- we're looking for switch singular.
And those relate to those two attributes
that we associated with that switch when we created it
in a previous video. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in a previous video.
And you can get really tricky here.
You can do OR instead of AND.
I want those two conditions that they have to exist.
And you can save this as a library condition,
or you can just say, you know what?
I don't want to name it and use it again.
I'm just going to go ahead and click on Use.
And it'll show up here in your policy.
So what we have is we have a policy set called
Our-Site1-Switch-Policy-Set.
And there's two conditions where it has to be at site 1
and it has to be a switch.
And if both of those conditions are met, what authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if both of those conditions are met, what authentication
methods do we want to allow?
So default network access is a large range of many extensible
authentication protocols for 802.1x.
To And that will work here.
Although, we could get very granular
and customize and specify we only
want PEAP or FAST, or something else.
But I'm going to use the default network access.
And then we have this policy set with these conditions.
Now, if it's matched, take it out.
It's going to go ahead and kick into the authentication,
and then subsequently the authorization profiles. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then subsequently the authorization profiles.
Check this out.
To see those, we're going to click
on this little right arrow, this chevron right
here over on the right.
And that expands it out.
It would expand it out, except it's saying, Keith, Keith,
do you want to save your work here?
Do you want to save this policy set?
So I am going to click on Save, and thank it
for reminding me that I need to click on Save there.
And now I can click on this little greater than symbol.
Take a look at the details of the authentication
and the authorization policies associated with this policy set WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the authorization policies associated with this policy set
that we just created.
So here's the summary on top of our policy set.
And then if we want to look at the details
of the authentication policy we simply open it up.
Now, there is a default, which says, use all ID stores.
What we could do is we could modify that,
and say, yeah, we could just use our domain control.
That would work.
Or we could add a new authentication rule
as part of this policy set.
So to create a new rule for the authentication,
just click on the Plus. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just click on the Plus.
And we'll call it Our-authen-dot1x,
because what we're looking for is just dot1x.
And if that's true, we can set a condition saying,
you know what?
We want this authentication policy
to be used if it's only dot1x.
So you can set the condition here, the Plus symbol.
And there's a pre-built library object over here called
Wired_802.1x.
You just drag and drop it.
And boom.
And that's going to be the condition.
So if an authenticator, like a switch,
is issuing requests for 802.1x authentication to the identity WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is issuing requests for 802.1x authentication to the identity
services engine, this is going to match.
So we'll go ahead and click on Use.
And then we can specify over here
what identity store we want to use.
We can get very granular and say our domain controller,
or we can say All_User_ID_Stores.
So I'm going to say our domain controller because I know
our users already exist there.
And if this matches during the authentication,
it won't ever bother with going to this second option, which
is the default. And once that matches,
it's then going to go down to the authorization policies.
Now, this is bad news.
We created this brand new policy set. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We created this brand new policy set.
The authorization policy, by default, says, deny access.
No matter what happened.
I don't care how you authenticated.
I'm just going to deny you access.
So what we could here is I'm going to click on Plus.
I'm going to add a new authorization
rule in this policy.
I'm going to call it, If You Authenticated good enough.
And then regarding the conditions,
I want to make sure that they actually authenticated.
So there is an option for that right here.
There we go.
Network Access Authentication Passed. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Network Access Authentication Passed.
Boom.
And I'll click on Use.
And then if that's the case, I will go ahead
and use the option of permit access, which
is going to grant access to the network, and click on Save.
So let's take a look at the big picture.
Here's our policy set.
It's only going to trigger if both these conditions are true.
If that's the case, it's then going
to run the authentication rules, which are right here.
The first rule is looking for an 802.1x wired connection trying
to authenticate, which we are going to demonstrate here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in a moment.
And if that happens, we're going to use a domain controller,
labelled Our-DC for the authentication.
And based on the authentication passing,
it would then get to the authorization policy, where
the first rule says, if you authenticated good enough,
and the conditions are you passed network authentication,
then you're going to get access.
Now, the other cool thing is this, because those names are
significantly different, our policy set name is different,
the authentication rule is different,
the authorization rule is different,
if we actually test this, which we're going to, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if we actually test this, which we're going to,
and look at the logs, we'll be able to visually see
that the exact rules for authentication
and authorization were hit.
And when you're troubleshooting, especially with new policies,
that's an important skill to have.
Test.
Look at the logs.
See what went wrong, or see what went right,
and just verify that it's working.
Let's go to the client, and let's attempt
a login as either Bob or Lewis.
So to do that, we'll bring up our client.
And I'm just going to bounce the interface by going to Disable. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'm just going to bounce the interface by going to Disable.
And I don't recall if we put Bob or Lewis in,
but they should both work, because they're
both in Active Directory.
And we'll just right-click.
Enable it.
Cross our fingers.
That looks pretty positive right there.
Let's go look at the logs.
So in ISE we just go to Operations.
And just click on Live Logs under Radius.
And it was Bob.
OK.
Cool.
So that little indicator there means
Bob currently has a session.
He's currently authenticated.
And if we click on the detail report here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we click on the detail report here,
it'll give us the full scoop.
Default. Wait, wait, wait, wait, wait.
That doesn't look right.
And that says authentication policy Default Dot1X
and Default Basic Authenticated Access.
And it is using the defaults.
That is not hitting our policy.
That's not hitting the policy we just created.
Let's go find out why.
And if it's because I didn't hit Save, shame on me.
So we'll go back to Policy Sets.
And we have Our-Site-1-Switch-Policy-Set.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The device is switch.
Let's go back and verify with our network resources
that we have that set up correctly.
Here's switch one, site 1, switch.
To me that looks good.
I don't see a problem with that.
Go back to our policy.
And if we expand that, what's happening based on the log
file, it said it was doing default, not this policy, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
file, it said it was doing default, not this policy,
and not this policy set.
I'm just trying to figure out why.
So that was the policy set.
Here's our first rule for authentication, Wired_ 802.1X.
Our domain controller.
We should use authentication.
And then for authorization, oh, man, and it was using default,
I think, everything.
Hmm.
Well, let's try it again. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, let's try it again.
This all looks correct to me.
Let's go back.
I'm going to disable that interface.
Someone connected to my switch.
I'm going to peek at the switch real quick.
So the interface is down.
I really would like this to work,
because everything looks correct to me.
Attempting to authenticate.
Authenticating successful.
Authorization. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Authorization.
Well, he authenticated.
Let's go take a look at the logs again.
So on the ISE page, we'll go to Operations, Live Logs.
I'm going to click on Refresh.
Make sure-- oh, there we go.
Over on the right-hand side, look at that.
So if we look at the timestamps, too, we
can verify when we retried.
Over here on the right it's showing the authentication
policy that was used.
So for the authentication policy,
it used Our-Site-Switch-1-Policy-Set, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it used Our-Site-Switch-1-Policy-Set,
fantastic.
And for the authorization policy,
it used the correct one as well.
Maybe I just didn't allow the log
to update quite fast enough, because I didn't change
a thing since we configured it.
So let me take a look at the report one more time.
Oh, yeah, there you go.
Maybe I was too aggressive.
And I didn't give a chance for the logs
to catch up with my viewing.
But this is what I'd expect to see--
the authentication policy.
So here's our policy set.
And within that policy set, we use the authentication policy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And within that policy set, we use the authentication policy
of this.
And regarding authorization, we use
from the same policy set this authorization policy, which
basically said, hey, if you authenticated,
you're getting access.
So now that we've had a taste of what we can do,
as far as controlling the authentication
and authorization, I'd like to crank it up a little bit
with something called a policy element.
We'll take a closer look at those in the very next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.