WEBVTT

1
00:00.000 --> 00:02.410 align:middle line:84%


2
00:02.410 --> 00:04.120 align:middle line:90%
Many years ago, I
had the opportunity

3
00:04.120 --> 00:06.310 align:middle line:90%
to do a network admission
control or network

4
00:06.310 --> 00:08.950 align:middle line:90%
access control project and
here's what they wanted.

5
00:08.950 --> 00:12.250 align:middle line:90%
They wanted a device before
it was allowed on the network

6
00:12.250 --> 00:14.170 align:middle line:90%
to be checked,
interrogated to make

7
00:14.170 --> 00:16.600 align:middle line:90%
sure it had the right version
of antivirus software,

8
00:16.600 --> 00:19.510 align:middle line:90%
that it was up to date, to make
sure it had the minimum patch

9
00:19.510 --> 00:20.470 align:middle line:84%
levels required.

10
00:20.470 --> 00:23.460 align:middle line:90%
And if it wasn't, that
device should be given access

11
00:23.460 --> 00:25.210 align:middle line:90%
to a portion of the
network-- we called it

12
00:25.210 --> 00:28.897 align:middle line:90%
a "quarantine" so it could fix
that, remediate that, and then

13
00:28.897 --> 00:30.730 align:middle line:90%
go back and try again
and get on the network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.897 --> 00:30.730 align:middle line:90%
go back and try again
and get on the network

14
00:30.730 --> 00:31.930 align:middle line:84%
once it was up to snuff.

15
00:31.930 --> 00:34.420 align:middle line:90%
That's a great idea, and
it's called posturing.

16
00:34.420 --> 00:37.490 align:middle line:90%
Now to do it today we
need two major components.

17
00:37.490 --> 00:40.330 align:middle line:90%
One is we need an agent,
a posture agent as part

18
00:40.330 --> 00:43.570 align:middle line:90%
of AnyConnect that runs on the
client that can communicate

19
00:43.570 --> 00:46.450 align:middle line:90%
with a server that has all
the rules regarding what's

20
00:46.450 --> 00:47.140 align:middle line:84%
required.

21
00:47.140 --> 00:50.410 align:middle line:90%
And that server today
is known as ISE.

22
00:50.410 --> 00:52.477 align:middle line:90%
And here is the Identity
Services Engine.

23
00:52.477 --> 00:54.310 align:middle line:90%
And they've got some
really great workflows.

24
00:54.310 --> 00:56.170 align:middle line:90%
In fact, let's take
a look at the version

25
00:56.170 --> 01:01.180 align:middle line:90%
if we go to about I'm currently
on 2.7 but 3.0 just came out.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:56.170 --> 01:01.180 align:middle line:90%
if we go to about I'm currently
on 2.7 but 3.0 just came out.

26
01:01.180 --> 01:02.710 align:middle line:84%
But the concepts are the same.

27
01:02.710 --> 01:04.239 align:middle line:90%
And that is under
Work Centers we

28
01:04.239 --> 01:06.820 align:middle line:90%
have really great workflows,
including posturing.

29
01:06.820 --> 01:08.905 align:middle line:90%
So if we go to Work
Centers and Posture,

30
01:08.905 --> 01:12.730 align:middle line:90%
in here it has a 1, 2,
3 process with Prepare.

31
01:12.730 --> 01:15.280 align:middle line:90%
Prepare our network access
devices like our switches that

32
01:15.280 --> 01:18.460 align:middle line:90%
are doing 802.1x and
authenticating the users.

33
01:18.460 --> 01:19.240 align:middle line:84%
Do updates.

34
01:19.240 --> 01:20.830 align:middle line:90%
ISE in the background
will go out

35
01:20.830 --> 01:24.770 align:middle line:90%
and get the updates regarding
anti-malware patch information.

36
01:24.770 --> 01:28.180 align:middle line:90%
So how does ISE know we're
looking for a Windows 10

37
01:28.180 --> 01:29.380 align:middle line:84%
in this version of a patch?

38
01:29.380 --> 01:31.990 align:middle line:90%
Is because it can do dynamic
updates in the background
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:29.380 --> 01:31.990 align:middle line:90%
Is because it can do dynamic
updates in the background

39
01:31.990 --> 01:33.790 align:middle line:90%
to gather that
information for us.

40
01:33.790 --> 01:35.800 align:middle line:90%
And then we need some
software on the clients,

41
01:35.800 --> 01:38.650 align:middle line:90%
and most people are going to
be using the AnyConnect agent.

42
01:38.650 --> 01:41.170 align:middle line:90%
Which AnyConnect
is a VPN software.

43
01:41.170 --> 01:43.570 align:middle line:84%
It's an 802.1x supplicant.

44
01:43.570 --> 01:45.520 align:middle line:90%
There's also a module
for a posture agent

45
01:45.520 --> 01:47.240 align:middle line:84%
that can get that information.

46
01:47.240 --> 01:49.600 align:middle line:90%
So if we have a posture
requirement for compliance

47
01:49.600 --> 01:51.490 align:middle line:90%
that we're running a
certain version of this

48
01:51.490 --> 01:54.160 align:middle line:90%
or a certain version of
that, the AnyConnect agent

49
01:54.160 --> 01:56.380 align:middle line:90%
can make those queries
on the local system,

50
01:56.380 --> 01:58.450 align:middle line:90%
report back to ISE
to see whether or not

51
01:58.450 --> 01:59.590 align:middle line:84%
it's in compliance.

52
01:59.590 --> 02:02.140 align:middle line:90%
And then we're going to create
and implement our policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.590 --> 02:02.140 align:middle line:90%
And then we're going to create
and implement our policy.

53
02:02.140 --> 02:04.510 align:middle line:90%
And part of the policy
elements include conditions.

54
02:04.510 --> 02:06.230 align:middle line:90%
Conditions are what
we're looking for.

55
02:06.230 --> 02:08.919 align:middle line:90%
We're looking for this
vendor's anti-malware software,

56
02:08.919 --> 02:11.020 align:middle line:90%
or this version of
the software, or we're

57
02:11.020 --> 02:13.780 align:middle line:90%
looking for a certain patch or
update on a Windows operating

58
02:13.780 --> 02:16.420 align:middle line:90%
system, be it Windows
7 or Windows 10.

59
02:16.420 --> 02:18.620 align:middle line:90%
And we can also
specify the remediation

60
02:18.620 --> 02:20.740 align:middle line:90%
so that if a device
isn't up to snuff,

61
02:20.740 --> 02:22.420 align:middle line:90%
doesn't have the
right patch, we want

62
02:22.420 --> 02:25.360 align:middle line:90%
to give them some access to
the network so they can fix it.

63
02:25.360 --> 02:26.860 align:middle line:84%
We can call that quarantine.

64
02:26.860 --> 02:29.890 align:middle line:90%
And that boils down to a limited
amount of access so the client,

65
02:29.890 --> 02:33.640 align:middle line:90%
the device has the opportunity
to go out get the update,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.890 --> 02:33.640 align:middle line:90%
the device has the opportunity
to go out get the update,

66
02:33.640 --> 02:35.870 align:middle line:84%
apply it, and then try again.

67
02:35.870 --> 02:39.010 align:middle line:90%
And those are specified as
part of posture requirements,

68
02:39.010 --> 02:40.510 align:middle line:90%
the conditions
that need to exist

69
02:40.510 --> 02:43.240 align:middle line:90%
and then the remediation that we
need if those conditions don't

70
02:43.240 --> 02:43.970 align:middle line:84%
exist.

71
02:43.970 --> 02:47.200 align:middle line:90%
And then we boil that all
together in a posture policy.

72
02:47.200 --> 02:49.030 align:middle line:90%
And there's some amazing
workflows in ISE.

73
02:49.030 --> 02:52.120 align:middle line:90%
So if we go up here to Work
Centers and we have over that,

74
02:52.120 --> 02:53.853 align:middle line:90%
there's a whole
section for posture.

75
02:53.853 --> 02:55.270 align:middle line:90%
And we hover over
here on posture,

76
02:55.270 --> 02:57.395 align:middle line:90%
below that we have all of
our individual components

77
02:57.395 --> 02:59.260 align:middle line:84%
regarding posture assessment.

78
02:59.260 --> 03:02.440 align:middle line:90%
So if we click on Posture, it
takes us to the initial page
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:59.260 --> 03:02.440 align:middle line:90%
So if we click on Posture, it
takes us to the initial page

79
03:02.440 --> 03:03.830 align:middle line:84%
that we were at a moment ago.

80
03:03.830 --> 03:05.678 align:middle line:90%
And then we have
Network Devices.

81
03:05.678 --> 03:07.720 align:middle line:90%
Those are the devices that
are controlling access

82
03:07.720 --> 03:08.920 align:middle line:84%
into our network.

83
03:08.920 --> 03:10.540 align:middle line:84%
We have Client Provisioning.

84
03:10.540 --> 03:12.850 align:middle line:90%
Here are some default
provisioning policies.

85
03:12.850 --> 03:15.660 align:middle line:90%
And under Resources it
comes with some defaults.

86
03:15.660 --> 03:16.840 align:middle line:84%
And we can click on Add.

87
03:16.840 --> 03:19.390 align:middle line:90%
And we want to add, for
example, an AnyConnect posture

88
03:19.390 --> 03:21.350 align:middle line:90%
profile that was custom
to our environment,

89
03:21.350 --> 03:23.860 align:middle line:90%
we can it a name and then
just put in all the details

90
03:23.860 --> 03:26.000 align:middle line:90%
regarding how we want
that agent to behave.

91
03:26.000 --> 03:27.610 align:middle line:90%
This is the AnyConnect
posture agent

92
03:27.610 --> 03:30.440 align:middle line:90%
that would be running
on our client devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:27.610 --> 03:30.440 align:middle line:90%
that would be running
on our client devices.

93
03:30.440 --> 03:33.015 align:middle line:90%
So Logging, Stealth
Mode yes or no.

94
03:33.015 --> 03:34.390 align:middle line:90%
Stealth Mode just
basically means

95
03:34.390 --> 03:36.670 align:middle line:90%
it's running without telling
the user a whole bunch

96
03:36.670 --> 03:38.320 align:middle line:90%
of information about
what's going on

97
03:38.320 --> 03:41.590 align:middle line:90%
such as right here where it says
no user interface is provided

98
03:41.590 --> 03:42.892 align:middle line:84%
in Stealth Mode.

99
03:42.892 --> 03:45.100 align:middle line:90%
And then if there's an IP
address change, what do you

100
03:45.100 --> 03:46.420 align:middle line:84%
want to have happen?

101
03:46.420 --> 03:49.582 align:middle line:90%
The Posture Protocol, including
a custom message for devices

102
03:49.582 --> 03:51.040 align:middle line:90%
that are not
compliant, giving them

103
03:51.040 --> 03:53.500 align:middle line:90%
a clue as far as what they
should do or what they can do.

104
03:53.500 --> 03:56.170 align:middle line:90%
Custom messages
for grace periods.

105
03:56.170 --> 03:57.730 align:middle line:84%
And the options continue.

106
03:57.730 --> 04:00.070 align:middle line:90%
We can also customize what
the Client Provisioning
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:57.730 --> 04:00.070 align:middle line:90%
We can also customize what
the Client Provisioning

107
04:00.070 --> 04:01.850 align:middle line:84%
Portal will look like.

108
04:01.850 --> 04:03.130 align:middle line:84%
So here's the default portal.

109
04:03.130 --> 04:04.930 align:middle line:90%
If we click on it,
we can customize

110
04:04.930 --> 04:06.490 align:middle line:84%
it seven ways to Sunday.

111
04:06.490 --> 04:09.440 align:middle line:90%
As we continue, we have our
Policy Elements right here.

112
04:09.440 --> 04:12.940 align:middle line:90%
So here's our conditions as
far as what we're looking for.

113
04:12.940 --> 04:16.848 align:middle line:90%
And let's imagine we are
looking for a specific file.

114
04:16.848 --> 04:18.640 align:middle line:90%
So here's a whole bunch
that came with ISE.

115
04:18.640 --> 04:20.515 align:middle line:90%
If we wanted to look
for a specific file that

116
04:20.515 --> 04:23.500 align:middle line:90%
was not one of these, we could
click on Add and add that.

117
04:23.500 --> 04:26.228 align:middle line:90%
Or if we wanted to look for
a specific registry value,

118
04:26.228 --> 04:28.270 align:middle line:90%
we could use one of these
if it matched our needs

119
04:28.270 --> 04:29.560 align:middle line:84%
or click on Add.

120
04:29.560 --> 04:31.720 align:middle line:90%
Or we could look
for anti-malware.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:29.560 --> 04:31.720 align:middle line:90%
Or we could look
for anti-malware.

121
04:31.720 --> 04:33.220 align:middle line:90%
So we could use one
of these things,

122
04:33.220 --> 04:34.630 align:middle line:84%
is anti-malware present?

123
04:34.630 --> 04:35.960 align:middle line:84%
Or we could create our own.

124
04:35.960 --> 04:38.890 align:middle line:90%
So I created a custom one
called Our Anti-malware.

125
04:38.890 --> 04:41.080 align:middle line:90%
I specified it was for
Windows 10 Enterprise.

126
04:41.080 --> 04:42.460 align:middle line:84%
I specified the vendor.

127
04:42.460 --> 04:45.850 align:middle line:90%
And then I specified we're
looking for a version 4.x.

128
04:45.850 --> 04:46.970 align:middle line:84%
So that's the condition.

129
04:46.970 --> 04:49.300 align:middle line:90%
So if this is part of a
policy and that condition

130
04:49.300 --> 04:52.390 align:middle line:90%
wasn't matched, we'd also want
to have a remediation for that.

131
04:52.390 --> 04:54.970 align:middle line:90%
So under Remediations
we go to Anti-malware.

132
04:54.970 --> 04:58.040 align:middle line:90%
Under Anti-malware I created
one called Update Malware Bytes.

133
04:58.040 --> 05:00.192 align:middle line:90%
This specifies the details
for that remediation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
04:58.040 --> 05:00.192 align:middle line:90%
This specifies the details
for that remediation.

134
05:00.192 --> 05:01.900 align:middle line:90%
Or if we had a condition
that was looking

135
05:01.900 --> 05:04.210 align:middle line:90%
for a firewall, such
as Firewall Condition,

136
05:04.210 --> 05:06.407 align:middle line:90%
and we were looking for
that under Remediation,

137
05:06.407 --> 05:07.990 align:middle line:90%
we have to have
something for firewall

138
05:07.990 --> 05:09.970 align:middle line:84%
as well, so that's right here.

139
05:09.970 --> 05:11.470 align:middle line:84%
And we could click on Add.

140
05:11.470 --> 05:12.690 align:middle line:84%
We could give it a name.

141
05:12.690 --> 05:15.280 align:middle line:90%
specify the operating
system it applies to.

142
05:15.280 --> 05:17.770 align:middle line:90%
And then down under
Vendor Name go Specify

143
05:17.770 --> 05:21.190 align:middle line:90%
the Firewall Vendor that should
be present on that system.

144
05:21.190 --> 05:23.230 align:middle line:90%
And then we Create
Posture Policies

145
05:23.230 --> 05:26.710 align:middle line:90%
and then include those policies
as part of Policy Sets.

146
05:26.710 --> 05:29.110 align:middle line:90%
And another way of
getting to Remediations we

147
05:29.110 --> 05:30.370 align:middle line:84%
could go to Policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:29.110 --> 05:30.370 align:middle line:84%
could go to Policy.

148
05:30.370 --> 05:33.820 align:middle line:90%
And then under Policy Elements,
if we click on Results and then

149
05:33.820 --> 05:36.580 align:middle line:90%
under Posture if we expand
that on the left, here

150
05:36.580 --> 05:38.445 align:middle line:90%
once again we have the
Remediation Actions.

151
05:38.445 --> 05:41.450 align:middle line:90%
This is the same list we
saw in the workflow as well.

152
05:41.450 --> 05:43.267 align:middle line:84%
So we go to Anti-malware.

153
05:43.267 --> 05:45.100 align:middle line:90%
There's the two defaults
that came with ISE,

154
05:45.100 --> 05:46.790 align:middle line:90%
and then there's the
one I made as well.

155
05:46.790 --> 05:48.820 align:middle line:90%
So Thanks for joining me
in this video regarding

156
05:48.820 --> 05:52.410 align:middle line:90%
posture assessment using the
AnyConnect agent and ISE.

157
05:52.410 --> 05:53.750 align:middle line:84%
I'll see you in the next video.

158
05:53.750 --> 05:56.200 align:middle line:90%
Meanwhile, I hope this has
been informative for you

159
05:56.200 --> 05:59.500 align:middle line:90%
and I'd like to thank
you for viewing.

160
05:59.500 --> 06:00.000 align:middle line:84%