WEBVTT

1
00:00.000 --> 00:01.828 align:middle line:84%


2
00:01.828 --> 00:03.620 align:middle line:90%
In this video, we're
going to leverage much

3
00:03.620 --> 00:06.560 align:middle line:90%
of the configuration that's
already been done on the MAC

4
00:06.560 --> 00:10.340 align:middle line:90%
Authentication Bypass and the
802.1X authentication regarding

5
00:10.340 --> 00:12.140 align:middle line:90%
the switch, the
network access device.

6
00:12.140 --> 00:14.990 align:middle line:90%
However, there are just
a few additional commands

7
00:14.990 --> 00:17.090 align:middle line:90%
if we want that device
to support TrustSec

8
00:17.090 --> 00:18.080 align:middle line:84%
that we need to add.

9
00:18.080 --> 00:19.940 align:middle line:90%
So let me share with
you the upgraded

10
00:19.940 --> 00:21.320 align:middle line:84%
gear in my home lab here.

11
00:21.320 --> 00:23.660 align:middle line:90%
And then I'll walk you
through the configuration

12
00:23.660 --> 00:26.505 align:middle line:90%
of how to make that device
sing in the world of TrustSec.

13
00:26.505 --> 00:27.710 align:middle line:84%
So here's the big change.

14
00:27.710 --> 00:29.510 align:middle line:90%
I took the existing
configuration

15
00:29.510 --> 00:32.439 align:middle line:90%
that I had on the little
3560 switch, and by the way,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.510 --> 00:32.439 align:middle line:90%
that I had on the little
3560 switch, and by the way,

16
00:32.439 --> 00:35.000 align:middle line:90%
there is a matrix
of support at Cisco

17
00:35.000 --> 00:37.070 align:middle line:90%
where it talks
about which devices,

18
00:37.070 --> 00:39.170 align:middle line:90%
based on the hardware
and the operating system,

19
00:39.170 --> 00:42.380 align:middle line:90%
which ones support TrustSec
and which features in TrustSec.

20
00:42.380 --> 00:45.640 align:middle line:90%
So I looked up the 3560 and
said, yeah, you're out of luck.

21
00:45.640 --> 00:46.640 align:middle line:84%
It's not doing TrustSec.

22
00:46.640 --> 00:48.860 align:middle line:84%
But I have a 3750x.

23
00:48.860 --> 00:51.710 align:middle line:90%
I swapped out the
switch it switched to.

24
00:51.710 --> 00:54.410 align:middle line:84%
And it's now a 3750.

25
00:54.410 --> 00:56.420 align:middle line:90%
I'll have a console
access to it so I can see

26
00:56.420 --> 00:58.380 align:middle line:84%
console messages and so forth.

27
00:58.380 --> 01:00.320 align:middle line:90%
And what I've also
done is I've got
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.380 --> 01:00.320 align:middle line:90%
And what I've also
done is I've got

28
01:00.320 --> 01:03.860 align:middle line:90%
three devices that are actually
connected to the switch.

29
01:03.860 --> 01:05.690 align:middle line:90%
I've got two coming
from Windows clients

30
01:05.690 --> 01:08.330 align:middle line:90%
and I've got one through
my little Raspberry Pi

31
01:08.330 --> 01:11.510 align:middle line:90%
because I wanted the ability
to have three devices that we

32
01:11.510 --> 01:14.660 align:middle line:90%
could play with once we get
this all working to verify, OK,

33
01:14.660 --> 01:16.880 align:middle line:90%
based on TrustSec,
can this device

34
01:16.880 --> 01:19.430 align:middle line:90%
do x, y, z to that device if
they're in different groups

35
01:19.430 --> 01:20.450 align:middle line:84%
or within groups?

36
01:20.450 --> 01:23.420 align:middle line:90%
So more detail on the devices
that are connected coming up.

37
01:23.420 --> 01:26.720 align:middle line:90%
But I wanted to focus in this
video on the network access

38
01:26.720 --> 01:28.760 align:middle line:90%
server and a few of
the additional commands

39
01:28.760 --> 01:30.923 align:middle line:90%
that I've implemented
to make it work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:28.760 --> 01:30.923 align:middle line:90%
that I've implemented
to make it work.

40
01:30.923 --> 01:32.465 align:middle line:90%
So let's take a look
at the commands.

41
01:32.465 --> 01:33.920 align:middle line:90%
And then we'll
paste them in just

42
01:33.920 --> 01:37.750 align:middle line:90%
to make sure that you and I
are on the same sheet of music.

43
01:37.750 --> 01:39.170 align:middle line:84%
All right, so here we go.

44
01:39.170 --> 01:41.900 align:middle line:90%
Leveraging most of the commands
that we've already done

45
01:41.900 --> 01:45.260 align:middle line:90%
and already in place regarding
MAC Authentication Bypass

46
01:45.260 --> 01:48.470 align:middle line:90%
and 802.1X authentication, I
want to share with you some

47
01:48.470 --> 01:51.190 align:middle line:90%
additional commands that are
required for TrustSec to work.

48
01:51.190 --> 01:52.710 align:middle line:84%
We've got the hardware in place.

49
01:52.710 --> 01:54.585 align:middle line:90%
Let's take a look at
the additional commands.

50
01:54.585 --> 01:57.800 align:middle line:90%
So in configuration mode,
cts, for Cisco TrustSec--

51
01:57.800 --> 01:59.710 align:middle line:90%
that's what cts the
acronym is for--

52
01:59.710 --> 02:02.630 align:middle line:90%
cts authorization
list OURSGLIST.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.710 --> 02:02.630 align:middle line:90%
cts authorization
list OURSGLIST.

53
02:02.630 --> 02:03.598 align:middle line:84%
I just made up a name.

54
02:03.598 --> 02:05.640 align:middle line:90%
And we're going to leverage
that list right here.

55
02:05.640 --> 02:07.634 align:middle line:90%
In fact, let me just
move that up right here.

56
02:07.634 --> 02:08.134 align:middle line:84%
Boom.

57
02:08.134 --> 02:10.009 align:middle line:90%
Put it right below.
aaa authorization

58
02:10.009 --> 02:12.560 align:middle line:90%
for network access
OURSGLIST group Our-Group.

59
02:12.560 --> 02:16.100 align:middle line:90%
Now, Our-Group is referring
to the radius server group

60
02:16.100 --> 02:18.980 align:middle line:90%
that we configured previously
that talks back to ISE.

61
02:18.980 --> 02:21.030 align:middle line:90%
It specifies who
that ISE server is.

62
02:21.030 --> 02:23.970 align:middle line:90%
I also put logging verbose on
for troubleshooting purposes.

63
02:23.970 --> 02:27.050 align:middle line:90%
So if a downloadable ACL or a
security group ACL comes down

64
02:27.050 --> 02:29.690 align:middle line:90%
and the syntax isn't right,
we can learn about that.

65
02:29.690 --> 02:33.710 align:middle line:90%
Also, big heads up, if you're
doing this in a lab environment
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.690 --> 02:33.710 align:middle line:90%
Also, big heads up, if you're
doing this in a lab environment

66
02:33.710 --> 02:36.890 align:middle line:90%
and you remotely connect to a
switch that's supporting this,

67
02:36.890 --> 02:39.680 align:middle line:90%
if you're on a VTY
line, like, SSHed in,

68
02:39.680 --> 02:41.270 align:middle line:90%
make sure you do
terminal monitor.

69
02:41.270 --> 02:42.470 align:middle line:90%
That just totally
killed me for a while.

70
02:42.470 --> 02:44.210 align:middle line:90%
I was, like, I'm not
seeing any messages,

71
02:44.210 --> 02:45.260 align:middle line:84%
no errors, no problems.

72
02:45.260 --> 02:47.660 align:middle line:90%
And I was, like, oh,
you're not on the console.

73
02:47.660 --> 02:52.443 align:middle line:90%
So that was a total mistake
that cost me a lot of time.

74
02:52.443 --> 02:54.360 align:middle line:90%
I want to pass it on to
you to save that time.

75
02:54.360 --> 02:56.120 align:middle line:84%
So I've got cts logging verbose.

76
02:56.120 --> 02:59.900 align:middle line:90%
And I also did terminal
monitor from my VTY connection.

77
02:59.900 --> 03:02.890 align:middle line:90%
Then I also specified I
want to do Cisco TrustSec
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.900 --> 03:02.890 align:middle line:90%
Then I also specified I
want to do Cisco TrustSec

78
03:02.890 --> 03:06.340 align:middle line:90%
role-based enforcement, and
then followed by the command

79
03:06.340 --> 03:08.390 align:middle line:90%
to say which VLANs do you
want to enforce it on.

80
03:08.390 --> 03:09.800 align:middle line:84%
I just said all of them.

81
03:09.800 --> 03:12.780 align:middle line:90%
If you want to enforce it just
on a few VLANs, that's fine.

82
03:12.780 --> 03:14.310 align:middle line:90%
And then this
command right here--

83
03:14.310 --> 03:16.220 align:middle line:90%
I already had it
previously in my config,

84
03:16.220 --> 03:18.350 align:middle line:90%
but I wanted to enforce
it again, reinforce it--

85
03:18.350 --> 03:20.900 align:middle line:90%
radius-server vsa--
vendor specific

86
03:20.900 --> 03:23.312 align:middle line:90%
attributes-- send
authentication.

87
03:23.312 --> 03:25.020 align:middle line:90%
Again, that was a
little bit of a repeat.

88
03:25.020 --> 03:25.770 align:middle line:84%
Also, this one is.

89
03:25.770 --> 03:29.360 align:middle line:90%
So line 99 and 100 here are
already in the config if you

90
03:29.360 --> 03:32.350 align:middle line:90%
did the MAC Authentication
Bypass and the 802.1X.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:29.360 --> 03:32.350 align:middle line:90%
did the MAC Authentication
Bypass and the 802.1X.

91
03:32.350 --> 03:33.570 align:middle line:84%
Great.

92
03:33.570 --> 03:36.140 align:middle line:90%
The other thing I added,
though, was I added a PAC.

93
03:36.140 --> 03:38.900 align:middle line:90%
Now, a PAC is a Protected
Access Credential.

94
03:38.900 --> 03:41.000 align:middle line:90%
So I went back into my
server configuration,

95
03:41.000 --> 03:44.260 align:middle line:90%
which I already have a radius
key for, and I added a pac key

96
03:44.260 --> 03:46.710 align:middle line:84%
of Cisco!23.

97
03:46.710 --> 03:48.908 align:middle line:90%
Now, guess where
that has to match?

98
03:48.908 --> 03:49.700 align:middle line:84%
You'll never guess.

99
03:49.700 --> 03:51.533 align:middle line:90%
Yeah, it's got to match
up on the ISE server

100
03:51.533 --> 03:54.170 align:middle line:90%
under its Protected
Access Credentials.

101
03:54.170 --> 03:56.030 align:middle line:90%
So I did that already
on the ISE server.

102
03:56.030 --> 03:58.655 align:middle line:90%
But I will walk you through that
as well in the very next video

103
03:58.655 --> 04:00.470 align:middle line:84%
so you have all the pieces.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.655 --> 04:00.470 align:middle line:84%
so you have all the pieces.

104
04:00.470 --> 04:01.970 align:middle line:84%
And then I typed in exit.

105
04:01.970 --> 04:05.330 align:middle line:90%
This command here is
not done, not done,

106
04:05.330 --> 04:06.580 align:middle line:84%
in configuration mode.

107
04:06.580 --> 04:08.720 align:middle line:90%
It's done from privileged
mode, the pound symbol.

108
04:08.720 --> 04:11.360 align:middle line:84%
So I just cts credentials id.

109
04:11.360 --> 04:13.180 align:middle line:90%
I use this as my
ID for this switch.

110
04:13.180 --> 04:14.680 align:middle line:90%
I also threw in the
IP address there

111
04:14.680 --> 04:15.890 align:middle line:84%
so I'd remember what it was.

112
04:15.890 --> 04:17.899 align:middle line:90%
And then the password, I
specified the password.

113
04:17.899 --> 04:21.920 align:middle line:90%
I'd mirror that up on the
ISE server regarding the CTS

114
04:21.920 --> 04:22.770 align:middle line:84%
credentials.

115
04:22.770 --> 04:25.640 align:middle line:90%
Then we could do a
show cts pacs just

116
04:25.640 --> 04:29.030 align:middle line:90%
to verify we have the
Protected Access Credentials.

117
04:29.030 --> 04:30.860 align:middle line:84%
And then, I'll tell you what.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:29.030 --> 04:30.860 align:middle line:84%
And then, I'll tell you what.

118
04:30.860 --> 04:33.230 align:middle line:90%
In a lab environment, I'm
not very patient sometimes.

119
04:33.230 --> 04:36.230 align:middle line:90%
I mean, ISE takes like 15
or 20 minutes to load, even

120
04:36.230 --> 04:40.460 align:middle line:90%
on a dedicated ESXi host
with, like, 64 gigs of RAM.

121
04:40.460 --> 04:44.840 align:middle line:90%
Anyway, long story short,
in a lab environment,

122
04:44.840 --> 04:45.960 align:middle line:84%
you want to reboot--

123
04:45.960 --> 04:48.650 align:middle line:90%
not reboot-- you want
to refresh frequently.

124
04:48.650 --> 04:50.690 align:middle line:90%
So you make a change,
and this command right

125
04:50.690 --> 04:53.660 align:middle line:90%
here, cts refresh
environment-data and cts

126
04:53.660 --> 04:56.570 align:middle line:90%
refresh policy is just going to
go out and make sure that it's

127
04:56.570 --> 04:58.460 align:middle line:84%
up to date with the actual ISE.

128
04:58.460 --> 05:00.532 align:middle line:90%
And that way it has
all the current data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:58.460 --> 05:00.532 align:middle line:90%
And that way it has
all the current data.

129
05:00.532 --> 05:02.240 align:middle line:90%
And we can verify that
with this as well.

130
05:02.240 --> 05:04.740 align:middle line:90%
So just to make sure, I think
I have all this on the switch,

131
05:04.740 --> 05:06.438 align:middle line:90%
but just to make
sure that because I'm

132
05:06.438 --> 05:08.980 align:middle line:90%
doing a lot of tinkering, I'm
going to go ahead and just take

133
05:08.980 --> 05:11.450 align:middle line:84%
all this.

134
05:11.450 --> 05:14.190 align:middle line:90%
And I'm going to put it all in,
except for the show command.

135
05:14.190 --> 05:15.350 align:middle line:84%
So I'll right click.

136
05:15.350 --> 05:16.220 align:middle line:84%
Copy that.

137
05:16.220 --> 05:18.770 align:middle line:84%
Lets bring up a terminal.

138
05:18.770 --> 05:21.530 align:middle line:90%
And this is the 3750x
switch that I've got.

139
05:21.530 --> 05:25.640 align:middle line:90%
I'm going to right-click
paste and confirm.

140
05:25.640 --> 05:27.790 align:middle line:84%
Oh, dot 1x system-auth control.

141
05:27.790 --> 05:32.140 align:middle line:90%
Let me do a do show run
include and a-u-t-h.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
05:27.790 --> 05:32.140 align:middle line:90%
Let me do a do show run
include and a-u-t-h.

142
05:32.140 --> 05:36.700 align:middle line:90%
I want to see any lines in the
config that have a-u-t-h in it.

143
05:36.700 --> 05:37.540 align:middle line:84%
We're running aaa.

144
05:37.540 --> 05:39.490 align:middle line:90%
There's going to
be a lot of them.

145
05:39.490 --> 05:43.740 align:middle line:90%
Let me go ahead and do that
one more time with control

146
05:43.740 --> 05:46.570 align:middle line:84%
dot 1x system-auth control.

147
05:46.570 --> 05:48.130 align:middle line:90%
And it didn't like
it because I think

148
05:48.130 --> 05:50.088 align:middle line:90%
it's already in use
because it's in the config.

149
05:50.088 --> 05:52.720 align:middle line:84%


150
05:52.720 --> 05:55.015 align:middle line:90%
All right, so it's
already in the config.

151
05:55.015 --> 05:56.892 align:middle line:90%
And it took all
the other commands.

152
05:56.892 --> 05:58.600 align:middle line:90%
All right, so let's
do some show command.

153
05:58.600 --> 06:00.873 align:middle line:84%
Show cts pacs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
05:58.600 --> 06:00.873 align:middle line:84%
Show cts pacs.

154
06:00.873 --> 06:02.290 align:middle line:90%
And that's a very,
very good sign.

155
06:02.290 --> 06:09.730 align:middle line:90%
Let me also do a cts refresh
or environment-data, and a cts

156
06:09.730 --> 06:13.330 align:middle line:84%
refresh or policy.

157
06:13.330 --> 06:18.035 align:middle line:90%
And then if we do a show cts
for Cisco TrustSec environment,

158
06:18.035 --> 06:18.950 align:middle line:84%
boom, that's great.

159
06:18.950 --> 06:21.380 align:middle line:90%
So this is showing us, among
other things, the security

160
06:21.380 --> 06:21.880 align:middle line:84%
groups.

161
06:21.880 --> 06:24.870 align:middle line:90%
And check it out, there's
the three that we just made.

162
06:24.870 --> 06:26.510 align:middle line:90%
So we're communicating
with the server.

163
06:26.510 --> 06:27.813 align:middle line:84%
And here's what I'd like to do.

164
06:27.813 --> 06:29.480 align:middle line:90%
In addition to having
the network access

165
06:29.480 --> 06:32.510 align:middle line:90%
device ready to go
for TrustSec, it also
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
06:29.480 --> 06:32.510 align:middle line:90%
device ready to go
for TrustSec, it also

166
06:32.510 --> 06:35.810 align:middle line:90%
involves having the ISE
server and its communications

167
06:35.810 --> 06:38.540 align:middle line:90%
with this switch
also ready to go

168
06:38.540 --> 06:40.285 align:middle line:90%
and willing to do
TrustSec with it.

169
06:40.285 --> 06:41.660 align:middle line:90%
So in the next
video, we're going

170
06:41.660 --> 06:45.020 align:middle line:90%
to take a look at setting up
the TrustSec components on ISE

171
06:45.020 --> 06:47.528 align:middle line:90%
so it can communicate with
this network access device.

172
06:47.528 --> 06:48.320 align:middle line:84%
We'll do that next.

173
06:48.320 --> 06:50.780 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

174
06:50.780 --> 06:54.000 align:middle line:90%
And I'd like to thank
you for viewing.