WEBVTT

1
00:00.000 --> 00:00.920 align:middle line:84%


2
00:00.920 --> 00:03.140 align:middle line:90%
I still remember when I
was brand new to networking

3
00:03.140 --> 00:05.270 align:middle line:90%
and I thought, well,
a switchboard, you're

4
00:05.270 --> 00:06.740 align:middle line:84%
either connected and it works.

5
00:06.740 --> 00:08.180 align:middle line:90%
You can send any
packets you want

6
00:08.180 --> 00:09.805 align:middle line:90%
or frames you want
through the network.

7
00:09.805 --> 00:10.910 align:middle line:84%
Or it's not working.

8
00:10.910 --> 00:13.550 align:middle line:90%
It's shut down, or
there's a cable problem.

9
00:13.550 --> 00:15.080 align:middle line:84%
And that's it, like very binary.

10
00:15.080 --> 00:15.587 align:middle line:84%
It's good.

11
00:15.587 --> 00:16.170 align:middle line:84%
It's not good.

12
00:16.170 --> 00:19.863 align:middle line:90%
However, in the world of 802.1x,
if we've gone to the setup,

13
00:19.863 --> 00:22.280 align:middle line:90%
which we're going to do in
these subsequent sets of videos

14
00:22.280 --> 00:25.580 align:middle line:90%
coming up after this one,
if we've set up 802.1x with

15
00:25.580 --> 00:28.887 align:middle line:90%
the supplicant configured
correctly, the authenticator,

16
00:28.887 --> 00:31.220 align:middle line:90%
the switch configured correctly
to work with supplicants
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:28.887 --> 00:31.220 align:middle line:90%
the switch configured correctly
to work with supplicants

17
00:31.220 --> 00:33.740 align:middle line:90%
and also with the AAA server,
and then an authentication

18
00:33.740 --> 00:36.170 align:middle line:90%
server, like an identity
services engine--

19
00:36.170 --> 00:39.410 align:middle line:90%
holy spamoly-- once
a user authenticates,

20
00:39.410 --> 00:42.650 align:middle line:90%
based on our authorization
policies on ISE,

21
00:42.650 --> 00:45.140 align:middle line:90%
we can do a lot of
really cool stuff.

22
00:45.140 --> 00:48.020 align:middle line:90%
Let's take a look at our
topology with Bob, the user,

23
00:48.020 --> 00:51.140 align:middle line:90%
and let's just kind of break
the ISE regarding several things

24
00:51.140 --> 00:53.120 align:middle line:90%
that we could do as
far as authorization,

25
00:53.120 --> 00:54.710 align:middle line:84%
which can protect our networks.

26
00:54.710 --> 00:56.210 align:middle line:90%
So let's take it
to this point where

27
00:56.210 --> 00:58.240 align:middle line:84%
Bob has a supplicant running.

28
00:58.240 --> 01:01.280 align:middle line:90%
The authenticator and Bob
are having a back and forth,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.240 --> 01:01.280 align:middle line:90%
The authenticator and Bob
are having a back and forth,

29
01:01.280 --> 01:03.710 align:middle line:90%
basically getting Bob's
information, whether Bob's

30
01:03.710 --> 01:05.780 align:middle line:90%
authenticating with a
username or password,

31
01:05.780 --> 01:07.980 align:middle line:90%
or he's using a
certificate, either way.

32
01:07.980 --> 01:10.250 align:middle line:90%
And then the authenticator
checks the AAA server.

33
01:10.250 --> 01:13.040 align:middle line:90%
And the AAA server sends back
attributes regarding, OK,

34
01:13.040 --> 01:13.998 align:middle line:84%
great, it's Bob.

35
01:13.998 --> 01:14.540 align:middle line:84%
We know that.

36
01:14.540 --> 01:16.375 align:middle line:90%
And here's what
I want you to do.

37
01:16.375 --> 01:17.750 align:middle line:90%
So we're going to
be using RADIUS

38
01:17.750 --> 01:20.182 align:middle line:84%
on this leg of our journey.

39
01:20.182 --> 01:21.640 align:middle line:90%
And we're going to
be communicating

40
01:21.640 --> 01:24.460 align:middle line:90%
with a lot of AV pairs,
attribute value pairs,

41
01:24.460 --> 01:26.510 align:middle line:90%
that instruct this
authenticator, in this case,

42
01:26.510 --> 01:27.770 align:middle line:84%
the switch, on what to do.

43
01:27.770 --> 01:29.800 align:middle line:90%
If this is the port
that Bob is on,

44
01:29.800 --> 01:32.590 align:middle line:90%
here are a few options
that we could push down
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:29.800 --> 01:32.590 align:middle line:90%
here are a few options
that we could push down

45
01:32.590 --> 01:36.010 align:middle line:90%
to this switch with that port
that Bob is connected on.

46
01:36.010 --> 01:38.120 align:middle line:90%
Number one, we
can assign a VLAN.

47
01:38.120 --> 01:40.000 align:middle line:90%
Then we can make a
profile, and then

48
01:40.000 --> 01:42.760 align:middle line:90%
specify that based on this
authorization profile,

49
01:42.760 --> 01:44.500 align:middle line:90%
if Bob gets to that
point, matches it,

50
01:44.500 --> 01:48.100 align:middle line:90%
we want to assign him
to VLAN 80, or 30,

51
01:48.100 --> 01:49.780 align:middle line:84%
or whatever VLAN we choose to.

52
01:49.780 --> 01:53.350 align:middle line:90%
Now, a good security measure
is to take all the unused ports

53
01:53.350 --> 01:55.420 align:middle line:90%
and assign them to
like VLAN 999, which

54
01:55.420 --> 01:59.420 align:middle line:90%
goes nowhere, no services,
no DHCP, no anything.

55
01:59.420 --> 02:01.210 align:middle line:90%
And then when the user
connects on a port,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
01:59.420 --> 02:01.210 align:middle line:90%
And then when the user
connects on a port,

56
02:01.210 --> 02:04.210 align:middle line:90%
the authenticator can find
out who it is, pass it off

57
02:04.210 --> 02:06.100 align:middle line:90%
to the AAA server,
gets a response,

58
02:06.100 --> 02:08.979 align:middle line:90%
and then at that point, we can
put Bob in the correct VLAN.

59
02:08.979 --> 02:11.470 align:middle line:90%
Also, if Bob moves
around, maybe Bob always

60
02:11.470 --> 02:14.170 align:middle line:90%
needs to be in VLAN 80, even if
he's going between buildings,

61
02:14.170 --> 02:15.590 align:middle line:84%
or different locations.

62
02:15.590 --> 02:19.060 align:middle line:90%
And this is one way of doing
it with the AAA and 802.1x.

63
02:19.060 --> 02:20.300 align:middle line:84%
So we could assign a VLAN.

64
02:20.300 --> 02:22.120 align:middle line:90%
Number two, we could
use a downloadable.

65
02:22.120 --> 02:24.910 align:middle line:84%
Let's put D there, an ACL.

66
02:24.910 --> 02:28.390 align:middle line:90%
A downloadable ACL that says
based on Bob connecting,

67
02:28.390 --> 02:30.790 align:middle line:90%
I want you, switch,
says the I server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:28.390 --> 02:30.790 align:middle line:90%
I want you, switch,
says the I server,

68
02:30.790 --> 02:33.460 align:middle line:90%
I want you to implement an
access control list that's

69
02:33.460 --> 02:35.650 align:middle line:90%
going to filter certain
types of traffic,

70
02:35.650 --> 02:37.150 align:middle line:90%
or permit certain
types of traffic.

71
02:37.150 --> 02:39.270 align:middle line:90%
And that way, when
Bob connects here,

72
02:39.270 --> 02:43.090 align:middle line:90%
we never allow him
to use TCP port 23,

73
02:43.090 --> 02:44.890 align:middle line:90%
because that would
mean he's trying

74
02:44.890 --> 02:47.920 align:middle line:90%
to use Telnet somewhere, or
any other insecure management

75
02:47.920 --> 02:50.320 align:middle line:90%
protocols, or whatever we
want to permit or deny.

76
02:50.320 --> 02:52.840 align:middle line:90%
We could dynamically
download an ACL.

77
02:52.840 --> 02:54.318 align:middle line:84%
This switch would apply it.

78
02:54.318 --> 02:56.860 align:middle line:90%
And the switch in the background
is doing IP device tracking.

79
02:56.860 --> 02:58.600 align:middle line:90%
So even if it's
a layer 2 switch,

80
02:58.600 --> 03:00.335 align:middle line:84%
it can still enforce the policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.600 --> 03:00.335 align:middle line:84%
it can still enforce the policy.

81
03:00.335 --> 03:01.210 align:middle line:84%
Pretty amazing stuff.

82
03:01.210 --> 03:04.510 align:middle line:90%
And it can use ARP probes,
and verify what the layer 3

83
03:04.510 --> 03:07.810 align:middle line:90%
address is on that device, and
still manage the properties,

84
03:07.810 --> 03:10.870 align:middle line:90%
and manage the control, or
a user who's connecting.

85
03:10.870 --> 03:11.510 align:middle line:84%
Amazing stuff.

86
03:11.510 --> 03:14.530 align:middle line:90%
So VLAN assignment,
a downloadable ACL.

87
03:14.530 --> 03:21.400 align:middle line:90%
Another option is SGT,
a Security Group Tag.

88
03:21.400 --> 03:23.060 align:middle line:90%
We have a whole set
of videos coming up

89
03:23.060 --> 03:24.690 align:middle line:84%
that's about TrustSec.

90
03:24.690 --> 03:27.640 align:middle line:90%
TrustSec is an amazing
way to implement security

91
03:27.640 --> 03:29.170 align:middle line:90%
across your network
without having

92
03:29.170 --> 03:31.722 align:middle line:90%
to worry about exactly where
people are plugging into
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:29.170 --> 03:31.722 align:middle line:90%
to worry about exactly where
people are plugging into

93
03:31.722 --> 03:32.680 align:middle line:84%
or where they're going.

94
03:32.680 --> 03:34.840 align:middle line:90%
You can set up rules,
and then instead

95
03:34.840 --> 03:36.670 align:middle line:90%
of filtering at
the edges of VLANs,

96
03:36.670 --> 03:39.130 align:middle line:90%
like on layer 3
interfaces, or instead

97
03:39.130 --> 03:42.550 align:middle line:90%
of using downloadable ACLs, we
can use security group tags.

98
03:42.550 --> 03:45.070 align:middle line:90%
And then these end
devices can control based

99
03:45.070 --> 03:46.920 align:middle line:84%
on those tags what's allowed.

100
03:46.920 --> 03:49.600 align:middle line:90%
So we're going to set the rules
with TrustSec about what can

101
03:49.600 --> 03:51.100 align:middle line:84%
go between different groups.

102
03:51.100 --> 03:52.630 align:middle line:84%
Each group has their own tag.

103
03:52.630 --> 03:54.910 align:middle line:90%
And that's a wonderful,
wonderful thing.

104
03:54.910 --> 03:56.590 align:middle line:90%
And also, for another
insight as to what

105
03:56.590 --> 03:59.290 align:middle line:90%
we could push down or
allow that client to do,

106
03:59.290 --> 04:02.380 align:middle line:90%
let me give you a sneak peek
at the Identity Services Engine
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:59.290 --> 04:02.380 align:middle line:90%
let me give you a sneak peek
at the Identity Services Engine

107
04:02.380 --> 04:06.490 align:middle line:90%
profile information that is
just is a laundry list of what

108
04:06.490 --> 04:09.670 align:middle line:90%
we could push down to
enforce control on that port

109
04:09.670 --> 04:11.897 align:middle line:84%
once we have authenticated Bob.

110
04:11.897 --> 04:14.230 align:middle line:90%
And here, a nice one way to
get to those policy elements

111
04:14.230 --> 04:16.060 align:middle line:84%
would be to go to Work Centers.

112
04:16.060 --> 04:18.490 align:middle line:90%
And then under Network
Access Section,

113
04:18.490 --> 04:21.420 align:middle line:90%
we go down to Policy
Elements right here.

114
04:21.420 --> 04:23.140 align:middle line:90%
And from here,
under Results, this

115
04:23.140 --> 04:25.390 align:middle line:90%
is where we can find
Authorization Profiles.

116
04:25.390 --> 04:28.480 align:middle line:90%
And I'm just going to create
a new one as an example.

117
04:28.480 --> 04:29.610 align:middle line:84%
And so we could name it.

118
04:29.610 --> 04:33.010 align:middle line:90%
And as we scroll down, we can
identify a downloadable ACL.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:29.610 --> 04:33.010 align:middle line:90%
And as we scroll down, we can
identify a downloadable ACL.

119
04:33.010 --> 04:35.650 align:middle line:90%
We get assigned a security
group, a VLAN assignment,

120
04:35.650 --> 04:38.740 align:middle line:90%
a voice domain permission,
reauthorization,

121
04:38.740 --> 04:42.140 align:middle line:90%
a MACSec policy, interface
templates, and the list

122
04:42.140 --> 04:43.370 align:middle line:84%
just goes on, and on, and on.

123
04:43.370 --> 04:45.912 align:middle line:90%
If that weren't enough, we also
have these advanced attribute

124
04:45.912 --> 04:47.150 align:middle line:84%
settings.

125
04:47.150 --> 04:48.930 align:middle line:90%
And that list goes
on, and on, and on.

126
04:48.930 --> 04:51.082 align:middle line:90%
So if we went to Cisco,
and then from there

127
04:51.082 --> 04:52.540 align:middle line:90%
we have a whole
bunch of attributes

128
04:52.540 --> 04:53.700 align:middle line:84%
that we could push down.

129
04:53.700 --> 04:55.960 align:middle line:90%
So there's just lots
and lots of options

130
04:55.960 --> 04:58.020 align:middle line:90%
that we can do based
on authentication

131
04:58.020 --> 05:00.490 align:middle line:90%
and what type of authorization
we're going to do for a user
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:58.020 --> 05:00.490 align:middle line:90%
and what type of authorization
we're going to do for a user

132
05:00.490 --> 05:01.713 align:middle line:84%
or for a group.

133
05:01.713 --> 05:03.130 align:middle line:90%
That's very flexible,
and gives us

134
05:03.130 --> 05:05.890 align:middle line:90%
the opportunity to deploy
the exact authorization

135
05:05.890 --> 05:08.170 align:middle line:90%
policy that we want,
or a given user

136
05:08.170 --> 05:09.372 align:middle line:84%
once they've authenticated.

137
05:09.372 --> 05:11.080 align:middle line:90%
Now, the great news
is that even if we're

138
05:11.080 --> 05:14.260 align:middle line:90%
using MAC authentication bypass,
where we have a device that

139
05:14.260 --> 05:16.930 align:middle line:90%
doesn't support a supplicant, we
can still do the authentication

140
05:16.930 --> 05:19.000 align:middle line:90%
based on that layer 2 address,
sort of like the license plate

141
05:19.000 --> 05:20.140 align:middle line:84%
only, the MAC address.

142
05:20.140 --> 05:23.150 align:middle line:90%
And then based on that MAC
address being identified,

143
05:23.150 --> 05:25.240 align:middle line:90%
we can also apply
specific policies,

144
05:25.240 --> 05:27.490 align:middle line:90%
and have authorization
and specific access

145
05:27.490 --> 05:28.300 align:middle line:84%
for those devices.

146
05:28.300 --> 05:29.410 align:middle line:84%
Here's a case in point.

147
05:29.410 --> 05:31.900 align:middle line:90%
Let's imagine you've got
a whole bunch of internet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:29.410 --> 05:31.900 align:middle line:90%
Let's imagine you've got
a whole bunch of internet

148
05:31.900 --> 05:34.390 align:middle line:90%
of things devices that
don't have supplicants.

149
05:34.390 --> 05:36.430 align:middle line:90%
We can go ahead and we
can authenticate them

150
05:36.430 --> 05:38.170 align:middle line:84%
based on their layer 2 address.

151
05:38.170 --> 05:40.750 align:middle line:90%
And then based on identifying
what devices those are--

152
05:40.750 --> 05:44.170 align:middle line:90%
thermostats, or refrigerators,
or whatever they are--

153
05:44.170 --> 05:46.780 align:middle line:90%
we can then apply
authorization profiles

154
05:46.780 --> 05:49.540 align:middle line:90%
to give them just the amount
of access that they need,

155
05:49.540 --> 05:51.640 align:middle line:90%
and not anymore, which
is really important,

156
05:51.640 --> 05:54.190 align:middle line:90%
because we have an
internet of things device.

157
05:54.190 --> 05:56.575 align:middle line:90%
Sometimes the security
wasn't thought out

158
05:56.575 --> 05:58.450 align:middle line:90%
when they were putting
those things together.

159
05:58.450 --> 05:59.800 align:middle line:90%
And if they're
compromised and they

160
05:59.800 --> 06:01.750 align:middle line:90%
can be leveraged for an
attack on our network,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

160
05:59.800 --> 06:01.750 align:middle line:90%
can be leveraged for an
attack on our network,

161
06:01.750 --> 06:04.990 align:middle line:90%
we don't want that IP camera, or
we don't want that thermostat,

162
06:04.990 --> 06:06.470 align:middle line:90%
or whatever it is,
we don't want it

163
06:06.470 --> 06:09.730 align:middle line:90%
to start doing probing to weird
addresses or using protocols

164
06:09.730 --> 06:12.340 align:middle line:90%
that it doesn't need,
because if it's compromised,

165
06:12.340 --> 06:14.750 align:middle line:90%
it could be a vector for
an attack in our network.

166
06:14.750 --> 06:17.387 align:middle line:90%
So by controlling those,
authenticating them,

167
06:17.387 --> 06:19.345 align:middle line:90%
and authorizing them only
for certain protocols

168
06:19.345 --> 06:22.410 align:middle line:90%
or certain addresses,
a wonderful thing.

169
06:22.410 --> 06:24.460 align:middle line:90%
So in this video, we've
taken a look at what some

170
06:24.460 --> 06:26.810 align:middle line:90%
of the options are once
we've authenticated a user,

171
06:26.810 --> 06:30.110 align:middle line:90%
whether it's 802.1x, or MAC
authentication bypass based
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
06:26.810 --> 06:30.110 align:middle line:90%
whether it's 802.1x, or MAC
authentication bypass based

172
06:30.110 --> 06:31.270 align:middle line:84%
on its layer 2 address.

173
06:31.270 --> 06:33.850 align:middle line:90%
We have lots of options
available to us regarding what

174
06:33.850 --> 06:35.770 align:middle line:90%
we want to do and
allow on that port

175
06:35.770 --> 06:37.487 align:middle line:90%
once authentication
has happened.

176
06:37.487 --> 06:39.820 align:middle line:90%
Now, the next set of videos,
here's what I'd like to do.

177
06:39.820 --> 06:42.670 align:middle line:90%
I'd like to share with you some
of the details in my little

178
06:42.670 --> 06:46.660 align:middle line:90%
playground that I've set up to
configure and demonstrate ISE,

179
06:46.660 --> 06:50.710 align:middle line:90%
including 802.1x, MAC
authentication bypass,

180
06:50.710 --> 06:52.043 align:middle line:84%
and also TrustSec.

181
06:52.043 --> 06:53.710 align:middle line:90%
So in the next video,
I'll introduce you

182
06:53.710 --> 06:56.002 align:middle line:90%
to the lab environment, share
with you exactly what I'm

183
06:56.002 --> 06:58.387 align:middle line:90%
using, and then we'll proceed
with the configuration

184
06:58.387 --> 06:59.470 align:middle line:84%
of each of these elements.

185
06:59.470 --> 07:02.260 align:middle line:90%
So I look forward to seeing you
in that set of videos as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
06:59.470 --> 07:02.260 align:middle line:90%
So I look forward to seeing you
in that set of videos as well.

186
07:02.260 --> 07:04.780 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

187
07:04.780 --> 07:08.100 align:middle line:90%
And I'd like to thank
you for viewing.