One of the coolest things about controlling
based on a user account what they can do on the network
is controlling what they can do on the network.
And we do that with authorization policies
and profiles.
A big part of that is identifying the ingredients,
the policy elements that are going to be pushed down
to that user who's connecting on that port, things such as,
what VLANs do they belong to?
Or what access control list do you
want to enforce on the user for their stay on the network?
Or what AV pair should we push to that user?
All those are options that we can implement with 802.1x with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All those are options that we can implement with 802.1x with
something called policy elements.
And that's what I'd like to share with you in this video.
And here is one way of getting to policy elements
through the tab for Work Centers,
and down under Network Access.
And there's an option here for policy elements right there.
Not the only way to get there, but certainly one of them.
So in a policy element, what we're going to do is this.
We're going to go down to the Results section.
And here's where we can specify allowed protocols,
authorization profiles, and downloadable ACLs, all of which WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
authorization profiles, and downloadable ACLs, all of which
are really, really cool.
Let's imagine-- let's start with downloadable ACLs.
Let's imagine that for a group of people or individuals
in a group who authenticate, we want
to push down a dynamic downloadable
ACL that's enforced for them for their duration on the network.
To do that, we're going to include it in an authorization
profile, but we need to define the downloadable ACL first.
To do that, we'll click on Add.
And let's create one that says no ICMP or telnet. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's create one that says no ICMP or telnet.
Let's do that.
No ICMP or telnet.
And that's not a bad idea.
Well, ICMP, they may need, but that's OK for a demo.
And then down here we'll put in the access control list.
It would be like deny icmp any any.
That'll work.
And deny tcp protocol from anywhere
to anywhere if the destination port equals port 23.
And if you're not sure of your syntax, have no fear. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if you're not sure of your syntax, have no fear.
Check this out.
Check dynamic ACL syntax.
It's valid.
Yay!
We'll click on Submit.
Now we have this NoICMP-Telnet dynamic ACL
that can be downloaded to a network access device,
like a switch, and logically enforced for that customer
while they're on the network.
So next, let's go to Authorization Profiles.
This is where we could include things like, what VLAN should
the user be on?
And what dynamic or downloadable ACL should be there?
So if we create--
let's create two profiles. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's create two profiles.
We'll make one for--
let's see here.
Let's do one for ISE-Admins and ACCESS ACCEPT.
That would be great.
And let's go down here and say, for ISE-Admins no access
control list, no worries there.
Let's go ahead and hand out a specific VLAN.
And so for the admins, let's put them in VLAN 30.
And then there's just tons-- security groups,
and voice domain permissions, and just on, and on, and on.
And if you go down further, there's
options for specific AV pairs and other attributes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
options for specific AV pairs and other attributes
that we could push out.
So for the demo, let's go ahead and stick with VLAN.
So I'm going to go ahead and scroll all the way down
and click on Submit.
And now I've got this ISE-Admins that
are going to be in VLAN 30.
Let's create one more for ISE-Operation.
And let's also specify that we want a downloadable ACL.
And it'll give us a list of all the ones that we have.
No ICMP, no telnet, fantastic.
We'll put in VLAN 80 as a demo. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll put in VLAN 80 as a demo.
And then I'll scroll all the way to the bottom,
and we'll click on Submit.
Now, just having these authorization profiles
are not going to do us too much good unless we apply them
as part of a policy set.
So let's go ahead and do that next.
We go to Policy, Policy Sets, just like we
did in the previous video.
And let's play with our--
we already verified that this first policy
set is being matched on.
Let's go ahead and use that.
We'll expand it.
And we'll go down to-- we already also verified
that the authentication policy is kicking in with this rule. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that the authentication policy is kicking in with this rule.
Let's go down to the authorization policy.
And let's apply those authorization profiles
based on group membership.
And here's how we could do that.
I'm going to delete this, If You Authenticated good enough.
And I go over here, and say, Delete.
Get rid of that.
Oh, it's gone.
And let's go ahead and add, plus symbol.
Let's add one called Admins.
And then the conditions for that, for admins, for this, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then the conditions for that, for admins, for this,
they have to be a member of the admins group for ISE
in Active Directory.
To do that, we can click here under the attribute, then down
under Dictionaries.
And then down under Dictionaries, Our-DC,
which is our domain controller for Active Directory.
We'll click there.
And then from there, we want to specify specific group
membership that's required for the authorization we're
about to give.
So if we click on external groups,
and then with the equals in place,
we're going to go ahead and choose from the list here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to go ahead and choose from the list here.
Here's our four groups that we had brought in earlier
from Active Directory.
So if we bring in the ISE-Admins group,
this basically says that the condition
is that the user who is authenticated, if they're
a member of ISE-Admins, then we can go ahead and grant them
a specific authorization.
So we'll go ahead and click on Use.
And then here in the Results column,
we can specify what we want to give them.
So that included the VLAN identifier of 30, I believe.
And that looks great.
And let's create one more authorization rule for members WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's create one more authorization rule for members
of the group ICE-Operations.
And to do that, we'll click on the plus symbol.
We'll call it ISE-OPS.
And the conditions are very similar to last time,
except we're going to choose a different group.
So we'll click on an attribute in the dictionary's field.
And then scroll down to our domain controller.
Then select External Groups on the down list here.
Then if that's correct, we want to make
sure all the parameters are right, and Use.
And then we can assign them the profile WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we can assign them the profile
that we created for them.
So from the dropdown list, ICE-Operations, which included
VLAN 80.
It also included a downloadable ACL
that's going to be enforced.
So let's take a look at our work here real quick.
We've got this policy set Our-Site1-Switch-Policy-Set.
These are the conditions that would cause it to match.
If that happens, we then have these authentication policy
Rules then there's an authorization policy.
If they're a member of the group ISE-Operations,
they get that profile for authorization.
If they're a member of the group ISE-Admins, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If they're a member of the group ISE-Admins,
they're going to get that profile.
Once it's saved, we'll go ahead and test it.
So to test it, we'll bring up our client.
And I'm going to right-click on the client.
Go to Properties.
And let's, first of all, test it as Bob.
And click on the Authentication tab.
Replace credentials.
I just want to make sure we're going to try Bob first.
We'll click on OK.
Now, Bob, because he's a member of the Operations
group in Active Directory, he should authenticate,
and that switch for that he's on,
Fa0/1, should now be in VLAN 80. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Fa0/1, should now be in VLAN 80.
Let's verify that.
We can do that.
Here we've got a console port right here.
Let's do a show vlan brief.
So we have the VLANs.
That's great.
Oh, look at that.
VLAN 80 right there.
Fa0/1 is in VLAN 80.
And if we do a show run interface Fa0/1,
you'll notice that by default he's been assigned to VLAN 999.
But the 802.1x authorization forced that to VLAN 80.
Also, check this out.
If you go show access list, look at this access list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you go show access list, look at this access list.
This is the downloadable access list
that was downloaded from the identity services engine
to this switch, which this switch is
now logically enforcing on that port that Bob is connected to.
We can also do a show authentication
sessions interface Fa0/1.
And it will also give us details about the authentication
and authorization on this port.
It knows it's Bob.
Here's Bob's IP address.
Oh, oh, you know Bob should not be able to do?
Bob should not be able to ping based on that downloadable ACL WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Bob should not be able to ping based on that downloadable ACL
that is restricting ICMP.
So if we do a ping--
and here on Bob's computer, let's bring up
a command prompt.
Let's do an ip config.
So he get an IP address via DHCP of 10.80.0.12.
That's the interface that was brought up
and was authenticated.
There is an IP address of the switch, .1.
So if we did a ping, 10.80.0.1, that's not going anywhere.
That's because the switch is stopping it.
If we tried to telnet, it would stop it as well, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we tried to telnet, it would stop it as well,
because the downloadable ACL prevented telnet, and also
blocked all ICMP.
But check this out.
If we do a Control-C and break out of that,
and do an ARP dash a, look at this.
It didn't stop ARP.
So this client, although it couldn't
use ICMP to connect to that device,
it did actually have the ability to go ahead and use ARP.
Let's go in as Luis.
And Luis does not have a downloadable ACL.
And Luis should also be in VLAN 30.
Let's go to Properties of that interface,
and Additional Settings. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and Additional Settings.
And let's replace the credentials.
And let's put in Luis.
And we'll put in his password, click OK.
In the background, that should-- once they click OK,
that should trigger reauthentication, which it is.
Look at that.
Oh, my gosh.
Look at this.
Here's the console.
VLAN 30 has been assigned.
Authentication authorization successful.
So he's on the 10.30 network.
If we do a ping, 10.30.0.1, pings work because there's no
restriction, no downloadable ACL currently in use for Luis. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
restriction, no downloadable ACL currently in use for Luis.
And if we do a show interface status here,
we can now see the Fa0/1 is in VLAN 30.
So in this video we actually created policy elements
that we could then leverage as part of profiles
for authorization, and then we tested them
by verifying that Bob and Luis got
different results with different VLANs,
and a dynamic or downloadable ACL with one of them
based on our authorization policies.
So thanks for joining me in this video on authorization profiles WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So thanks for joining me in this video on authorization profiles
as we implemented them and verified that they worked.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.