WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:01.020 align:middle line:90%
Now, the next
Nugget, we're going

3
00:01.020 --> 00:02.395 align:middle line:90%
to be setting up
a concept that's

4
00:02.395 --> 00:04.478 align:middle line:90%
going to be used throughout
this series of Nuggets

5
00:04.478 --> 00:05.290 align:middle line:84%
moving forward.

6
00:05.290 --> 00:08.370 align:middle line:90%
And that's going to be
allowing someone or something

7
00:08.370 --> 00:10.860 align:middle line:90%
to access our network
based on who they are,

8
00:10.860 --> 00:12.240 align:middle line:84%
based on their identity.

9
00:12.240 --> 00:15.870 align:middle line:90%
This is a very, very common way
to allow access to our network,

10
00:15.870 --> 00:20.400 align:middle line:90%
but we can use various types of
tools, protocols, and softwares

11
00:20.400 --> 00:21.670 align:middle line:84%
to make this happen.

12
00:21.670 --> 00:24.720 align:middle line:90%
So let's talk about what
identity based authentication

13
00:24.720 --> 00:27.270 align:middle line:90%
and authorization is, and then
in the next couple of Nuggets,

14
00:27.270 --> 00:29.670 align:middle line:90%
we'll talk about how
Cisco takes it up a notch,

15
00:29.670 --> 00:32.280 align:middle line:90%
and we can actually allow
users into our network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.670 --> 00:32.280 align:middle line:90%
and we can actually allow
users into our network

16
00:32.280 --> 00:33.540 align:middle line:84%
with some extra tooling.

17
00:33.540 --> 00:34.440 align:middle line:84%
Let's get going.

18
00:34.440 --> 00:36.690 align:middle line:90%
Now, when it comes to
authenticating to the network

19
00:36.690 --> 00:38.052 align:middle line:84%
using a username and password.

20
00:38.052 --> 00:40.260 align:middle line:90%
Well, it's really going to
be tough to beat that one.

21
00:40.260 --> 00:43.050 align:middle line:90%
Right, I mean that's what
we all know and love,

22
00:43.050 --> 00:45.240 align:middle line:90%
and have come to
understand, especially,

23
00:45.240 --> 00:48.210 align:middle line:90%
if you're using multi-factor
authentication, that's

24
00:48.210 --> 00:51.760 align:middle line:90%
going to be a big part to
allowing access to the network.

25
00:51.760 --> 00:55.380 align:middle line:90%
But keep in mind, we're not just
talking about allowing access

26
00:55.380 --> 00:56.640 align:middle line:84%
to the local network.

27
00:56.640 --> 00:59.430 align:middle line:90%
We're not just allowing people
to plug into the switch.

28
00:59.430 --> 01:03.030 align:middle line:90%
We may also be talking
about remote access VPNs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.430 --> 01:03.030 align:middle line:90%
We may also be talking
about remote access VPNs.

29
01:03.030 --> 01:06.420 align:middle line:90%
We may also be talking
about bring your own device

30
01:06.420 --> 01:09.100 align:middle line:90%
environments or
even guest access.

31
01:09.100 --> 01:12.420 align:middle line:90%
So allowing authentication to
the network with a username

32
01:12.420 --> 01:15.930 align:middle line:90%
and password comes in a bunch
of different shapes and sizes.

33
01:15.930 --> 01:17.550 align:middle line:90%
Let's talk about
them real quick.

34
01:17.550 --> 01:20.400 align:middle line:90%
Before we dig deep
into the strategy

35
01:20.400 --> 01:23.370 align:middle line:90%
of identifying users
and allowing them access

36
01:23.370 --> 01:27.300 align:middle line:90%
to the network, we're going
to talk about the various ways

37
01:27.300 --> 01:28.680 align:middle line:84%
they can access the network.

38
01:28.680 --> 01:30.180 align:middle line:90%
Of course, we've
already got the one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.680 --> 01:30.180 align:middle line:90%
Of course, we've
already got the one

39
01:30.180 --> 01:31.680 align:middle line:90%
that we've talked
about, where we've

40
01:31.680 --> 01:35.640 align:middle line:90%
got a switch and somebody
brings a laptop from home.

41
01:35.640 --> 01:37.630 align:middle line:90%
Maybe I can draw a
little keyboard here

42
01:37.630 --> 01:39.180 align:middle line:84%
so it looks like a laptop.

43
01:39.180 --> 01:41.130 align:middle line:90%
And they plug in to
the port at their desk,

44
01:41.130 --> 01:42.930 align:middle line:84%
which feeds back to the switch.

45
01:42.930 --> 01:46.110 align:middle line:90%
Do we want to allow them to
bring their laptop from home

46
01:46.110 --> 01:47.910 align:middle line:84%
and plug into the network?

47
01:47.910 --> 01:51.120 align:middle line:90%
Well, first of all, this could
be a corporate issued laptop,

48
01:51.120 --> 01:52.320 align:middle line:84%
so we trust it.

49
01:52.320 --> 01:53.610 align:middle line:84%
And we're maintaining it.

50
01:53.610 --> 01:55.710 align:middle line:90%
Maybe it's getting group
policies and things

51
01:55.710 --> 01:57.990 align:middle line:90%
like that, other ways
that we're enforcing it.

52
01:57.990 --> 01:59.880 align:middle line:90%
But we still want to
make sure that they are

53
01:59.880 --> 02:01.710 align:middle line:84%
exactly who they say they are.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.880 --> 02:01.710 align:middle line:84%
exactly who they say they are.

54
02:01.710 --> 02:05.020 align:middle line:90%
Maybe they're not someone
spoofing a Mac address.

55
02:05.020 --> 02:09.509 align:middle line:90%
So what we'll use is, we'll
use something like 802.1x that

56
02:09.509 --> 02:13.470 align:middle line:90%
forces them to type in a
username and password when they

57
02:13.470 --> 02:14.430 align:middle line:84%
connect in.

58
02:14.430 --> 02:16.570 align:middle line:90%
Specifically, on
Windows devices,

59
02:16.570 --> 02:19.860 align:middle line:90%
this is something that you
configure on the NIC itself.

60
02:19.860 --> 02:23.910 align:middle line:90%
You tell the NIC that when you
plug into an 802.1x enabled

61
02:23.910 --> 02:26.740 align:middle line:90%
switch, you also have
to provide credentials.

62
02:26.740 --> 02:30.360 align:middle line:90%
Now, this could prompt for
a username and a password
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:26.740 --> 02:30.360 align:middle line:90%
Now, this could prompt for
a username and a password

63
02:30.360 --> 02:32.153 align:middle line:84%
on the end user's device.

64
02:32.153 --> 02:33.570 align:middle line:90%
It could prompt
them on the screen

65
02:33.570 --> 02:35.410 align:middle line:90%
to type in a username
and password.

66
02:35.410 --> 02:38.573 align:middle line:90%
Or it could be baked into
the NIC configuration itself.

67
02:38.573 --> 02:39.990 align:middle line:90%
We would have
configured that when

68
02:39.990 --> 02:42.250 align:middle line:90%
we issued the laptop
to the end user.

69
02:42.250 --> 02:46.530 align:middle line:90%
But the idea is before this
port becomes hot and enabled,

70
02:46.530 --> 02:50.760 align:middle line:90%
a username and a password
must be sent into the switch.

71
02:50.760 --> 02:54.930 align:middle line:90%
And the switch must verify
that username and password

72
02:54.930 --> 02:57.060 align:middle line:84%
to an authentication server.

73
02:57.060 --> 03:00.660 align:middle line:90%
There's actually roles
that are baked into 802.1x.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:57.060 --> 03:00.660 align:middle line:90%
There's actually roles
that are baked into 802.1x.

74
03:00.660 --> 03:02.520 align:middle line:90%
Now that you've
seen the workflow,

75
03:02.520 --> 03:05.730 align:middle line:90%
we've got the laptop
that's providing a username

76
03:05.730 --> 03:06.490 align:middle line:84%
and password.

77
03:06.490 --> 03:09.240 align:middle line:90%
This is actually
called a supplicant.

78
03:09.240 --> 03:11.940 align:middle line:90%
And the switch, which
is controlling access

79
03:11.940 --> 03:15.330 align:middle line:90%
to the network, this is
called the authenticator.

80
03:15.330 --> 03:17.910 align:middle line:90%
And it's finding out if
this person can actually

81
03:17.910 --> 03:21.420 align:middle line:90%
authenticate to the network
via an authentication server

82
03:21.420 --> 03:23.102 align:middle line:84%
or an authentication source.

83
03:23.102 --> 03:25.560 align:middle line:90%
Now, you've already heard about
one of these authentication

84
03:25.560 --> 03:26.080 align:middle line:84%
servers.

85
03:26.080 --> 03:28.380 align:middle line:90%
This is Identity
Services Engine.

86
03:28.380 --> 03:30.718 align:middle line:90%
But there are a plenty of
other resources out there
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:28.380 --> 03:30.718 align:middle line:90%
But there are a plenty of
other resources out there

87
03:30.718 --> 03:32.010 align:middle line:84%
that could perform this action.

88
03:32.010 --> 03:35.970 align:middle line:90%
An older version of Cisco
products was called ACS.

89
03:35.970 --> 03:38.580 align:middle line:90%
Even Windows Server has
something called the Network

90
03:38.580 --> 03:39.867 align:middle line:84%
Policy Server.

91
03:39.867 --> 03:41.700 align:middle line:90%
And the cool thing about
each of these items

92
03:41.700 --> 03:44.250 align:middle line:90%
is they can integrate directly
within Active Directory.

93
03:44.250 --> 03:47.160 align:middle line:90%
So end users don't have
to maintain a new username

94
03:47.160 --> 03:49.470 align:middle line:90%
and password just to access
the network, and then

95
03:49.470 --> 03:52.215 align:middle line:90%
the Active Directory
password to access resources

96
03:52.215 --> 03:52.840 align:middle line:84%
on the network.

97
03:52.840 --> 03:54.720 align:middle line:90%
They could just use their
Active Directory credentials

98
03:54.720 --> 03:55.740 align:middle line:84%
to access it all.

99
03:55.740 --> 03:59.230 align:middle line:90%
But the exact same thing could
be said about a wireless access

100
03:59.230 --> 03:59.730 align:middle line:84%
point.

101
03:59.730 --> 04:02.670 align:middle line:90%
When an end user who may
also have the same laptop
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
03:59.730 --> 04:02.670 align:middle line:90%
When an end user who may
also have the same laptop

102
04:02.670 --> 04:04.950 align:middle line:90%
here starts to roam
throughout the campus,

103
04:04.950 --> 04:08.370 align:middle line:90%
they may need to connect
wirelessly into the network.

104
04:08.370 --> 04:11.850 align:middle line:90%
And the same 802.1x mechanisms
could take place here.

105
04:11.850 --> 04:15.510 align:middle line:90%
Now the wireless access point
is acting as the authenticator

106
04:15.510 --> 04:18.220 align:middle line:90%
and is communicating back to
the authentication server.

107
04:18.220 --> 04:22.260 align:middle line:90%
But now consider for a moment
that maybe we have a firewall.

108
04:22.260 --> 04:24.630 align:middle line:90%
And an end user is
working at home.

109
04:24.630 --> 04:26.810 align:middle line:90%
They're trying to connect
in over the internet

110
04:26.810 --> 04:29.310 align:middle line:90%
so that they can
access resources

111
04:29.310 --> 04:30.780 align:middle line:84%
within the enterprise.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:29.310 --> 04:30.780 align:middle line:84%
within the enterprise.

112
04:30.780 --> 04:33.360 align:middle line:90%
Using a remote access
VPN technology,

113
04:33.360 --> 04:35.880 align:middle line:90%
we're obviously going to
have to verify their username

114
04:35.880 --> 04:37.020 align:middle line:84%
and password then.

115
04:37.020 --> 04:40.800 align:middle line:90%
And while most firewalls have
username and password databases

116
04:40.800 --> 04:43.740 align:middle line:90%
that they can store directly
on this specific device,

117
04:43.740 --> 04:47.040 align:middle line:90%
they could also bounce this
authentication off of these

118
04:47.040 --> 04:50.760 align:middle line:90%
other services, like, ISE,
ACS, or NPS using different

119
04:50.760 --> 04:54.330 align:middle line:90%
protocols, like,
RADIUS or TACACS+.

120
04:54.330 --> 04:56.220 align:middle line:90%
So at this point,
we've covered how

121
04:56.220 --> 04:58.290 align:middle line:90%
end users could get
authenticated as they

122
04:58.290 --> 05:00.110 align:middle line:84%
plug directly into the network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:58.290 --> 05:00.110 align:middle line:84%
plug directly into the network.

123
05:00.110 --> 05:01.810 align:middle line:84%
They could use 802.1x.

124
05:01.810 --> 05:04.430 align:middle line:90%
We've talked about how they
could access the network

125
05:04.430 --> 05:08.228 align:middle line:90%
wirelessly, again, using 802.1x
verifying their identity.

126
05:08.228 --> 05:09.770 align:middle line:90%
And then, we've
talked about how they

127
05:09.770 --> 05:12.470 align:middle line:90%
could use the VPN to
connect into the network,

128
05:12.470 --> 05:16.220 align:middle line:90%
again, verifying their identity
by having our firewall bounce

129
05:16.220 --> 05:19.220 align:middle line:90%
the authentication off of
the Identity Services Engine,

130
05:19.220 --> 05:21.260 align:middle line:90%
or the other resources
that we could use.

131
05:21.260 --> 05:24.800 align:middle line:90%
One last thing that we should
talk about is guest services.

132
05:24.800 --> 05:26.630 align:middle line:84%
Let's talk about guest Wi-Fi.

133
05:26.630 --> 05:29.720 align:middle line:90%
Now our end user's not using
their corporate issued device

134
05:29.720 --> 05:30.320 align:middle line:84%
anymore.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:29.720 --> 05:30.320 align:middle line:84%
anymore.

135
05:30.320 --> 05:34.010 align:middle line:90%
Now maybe they're using
their own personal cell phone

136
05:34.010 --> 05:35.970 align:middle line:90%
that they want to
access the network.

137
05:35.970 --> 05:39.140 align:middle line:90%
But they have no reason to
access internal resources

138
05:39.140 --> 05:41.090 align:middle line:90%
like a file share
using their cell phone.

139
05:41.090 --> 05:44.540 align:middle line:90%
They really just want to browse
the internet and shop on Amazon

140
05:44.540 --> 05:45.690 align:middle line:84%
and stream Netflix, right?

141
05:45.690 --> 05:48.170 align:middle line:90%
That's what end users
are really trying to do.

142
05:48.170 --> 05:50.870 align:middle line:90%
They're just trying to go
straight out to the internet.

143
05:50.870 --> 05:52.400 align:middle line:90%
In this environment,
we're talking

144
05:52.400 --> 05:54.650 align:middle line:84%
about bring your own device.

145
05:54.650 --> 05:58.640 align:middle line:90%
Sometimes the bring your
own device purpose is

146
05:58.640 --> 06:00.920 align:middle line:84%
to access the internal network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:58.640 --> 06:00.920 align:middle line:84%
to access the internal network.

147
06:00.920 --> 06:05.210 align:middle line:90%
Sometimes people do bring their
own laptop from home in order

148
06:05.210 --> 06:06.830 align:middle line:84%
to access network services.

149
06:06.830 --> 06:08.750 align:middle line:90%
If your environment
is OK with that,

150
06:08.750 --> 06:11.330 align:middle line:90%
that's one way that you could
handle bring your own device.

151
06:11.330 --> 06:13.700 align:middle line:90%
Other times, bring
your own device

152
06:13.700 --> 06:18.393 align:middle line:90%
is really only to access guest
services, like, guest networks.

153
06:18.393 --> 06:20.810 align:middle line:90%
So you've got to think about
within bring your own device,

154
06:20.810 --> 06:25.850 align:middle line:90%
there is an enterprise role
for it versus a guest role.

155
06:25.850 --> 06:29.150 align:middle line:90%
Don't just automatically assume
that bring your own device

156
06:29.150 --> 06:32.090 align:middle line:90%
immediately is talking
about guest services.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
06:29.150 --> 06:32.090 align:middle line:90%
immediately is talking
about guest services.

157
06:32.090 --> 06:34.020 align:middle line:84%
That's not necessarily the case.

158
06:34.020 --> 06:38.060 align:middle line:90%
And this is why we still need a
level of authentication that's

159
06:38.060 --> 06:39.530 align:middle line:84%
taking place within the network.

160
06:39.530 --> 06:42.800 align:middle line:90%
Within bring your own device
on the enterprise solution,

161
06:42.800 --> 06:46.010 align:middle line:90%
our end user who's using their
cell phone could potentially

162
06:46.010 --> 06:50.660 align:middle line:90%
provide 802.1x credentials yet
one more time and go straight

163
06:50.660 --> 06:52.910 align:middle line:90%
to the authentication
services and come back,

164
06:52.910 --> 06:55.820 align:middle line:90%
and then find themselves
connected to the internal

165
06:55.820 --> 06:56.330 align:middle line:84%
network.

166
06:56.330 --> 06:58.910 align:middle line:90%
Or if they just
needed guest services,

167
06:58.910 --> 07:01.520 align:middle line:84%
they could access a guest Wi-Fi.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
06:58.910 --> 07:01.520 align:middle line:84%
they could access a guest Wi-Fi.

168
07:01.520 --> 07:03.410 align:middle line:90%
As part of the guest
Wi-Fi, they may

169
07:03.410 --> 07:07.160 align:middle line:90%
agree to not access any sort
of malicious information.

170
07:07.160 --> 07:09.200 align:middle line:90%
And they may agree
that they will only

171
07:09.200 --> 07:10.720 align:middle line:84%
be able to access the internet.

172
07:10.720 --> 07:13.220 align:middle line:90%
So their traffic will be sent
outbound towards the internet.

173
07:13.220 --> 07:15.200 align:middle line:90%
And they'll never be
able to communicate

174
07:15.200 --> 07:18.350 align:middle line:90%
to any other devices
internally on the network.

175
07:18.350 --> 07:22.100 align:middle line:90%
Don't also forget that
profiling was an option.

176
07:22.100 --> 07:24.890 align:middle line:90%
As these devices,
all of them, try

177
07:24.890 --> 07:26.960 align:middle line:90%
to get access to
the network, they

178
07:26.960 --> 07:31.370 align:middle line:90%
can be profiled and placed
into certain segments or VLANs
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

178
07:26.960 --> 07:31.370 align:middle line:90%
can be profiled and placed
into certain segments or VLANs

179
07:31.370 --> 07:32.990 align:middle line:90%
based on the type
of device that's

180
07:32.990 --> 07:34.620 align:middle line:84%
trying to access the network.

181
07:34.620 --> 07:36.740 align:middle line:90%
So if we have a
cell phone, we've

182
07:36.740 --> 07:38.690 align:middle line:84%
identified it as an iPhone.

183
07:38.690 --> 07:43.220 align:middle line:90%
We haven't explicitly enabled
its Mac address within ISE.

184
07:43.220 --> 07:46.400 align:middle line:90%
And it's not trying to
authenticate with 802.1x.

185
07:46.400 --> 07:48.140 align:middle line:90%
Based on some
assumptions we could

186
07:48.140 --> 07:50.150 align:middle line:90%
make about the
profile of the device,

187
07:50.150 --> 07:53.210 align:middle line:90%
we could automatically place
them into a guest network

188
07:53.210 --> 07:54.483 align:middle line:84%
access situation.

189
07:54.483 --> 07:56.150 align:middle line:90%
The point that we're
trying to make here

190
07:56.150 --> 07:58.760 align:middle line:90%
is that people need to
authenticate with a username

191
07:58.760 --> 07:59.660 align:middle line:84%
and password.

192
07:59.660 --> 08:01.070 align:middle line:90%
And they're going
to authenticate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
07:59.660 --> 08:01.070 align:middle line:90%
And they're going
to authenticate

193
08:01.070 --> 08:04.700 align:middle line:90%
with a username and password
in various situations--

194
08:04.700 --> 08:09.380 align:middle line:90%
hard wired, wireless,
VPN, bring your own device

195
08:09.380 --> 08:12.512 align:middle line:90%
for the enterprise, or bring
your own device for the guest.

196
08:12.512 --> 08:13.970 align:middle line:90%
Now, in the next
couple of Nuggets,

197
08:13.970 --> 08:16.520 align:middle line:90%
we're going to talk about how
we can take it up a notch,

198
08:16.520 --> 08:18.260 align:middle line:84%
specifically with the VPN.

199
08:18.260 --> 08:20.030 align:middle line:90%
And then we're going
to go even further

200
08:20.030 --> 08:23.120 align:middle line:90%
when we talk about how
Cisco TrustSec in security

201
08:23.120 --> 08:25.010 align:middle line:90%
groups with security
group tagging

202
08:25.010 --> 08:28.820 align:middle line:90%
really enable us to enforce
policy at the network access

203
08:28.820 --> 08:29.430 align:middle line:84%
level.

204
08:29.430 --> 08:31.138 align:middle line:90%
I hope this has been
informative for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

204
08:29.430 --> 08:31.138 align:middle line:90%
I hope this has been
informative for you.

205
08:31.138 --> 08:33.640 align:middle line:90%
And I'd like to thank
you for viewing.