WEBVTT

1
00:00.000 --> 00:01.120 align:middle line:84%


2
00:01.120 --> 00:03.460 align:middle line:90%
If we want ISE, the
Identity Services Engine,

3
00:03.460 --> 00:06.160 align:middle line:90%
to use Active Directory as
one of its identity stores,

4
00:06.160 --> 00:08.170 align:middle line:90%
we need to configure
it to make that happen.

5
00:08.170 --> 00:10.462 align:middle line:90%
And that's what I'm going to
walk you through right now

6
00:10.462 --> 00:11.410 align:middle line:84%
in this video.

7
00:11.410 --> 00:14.110 align:middle line:90%
So here we are on the main
page for the Identity Services

8
00:14.110 --> 00:14.680 align:middle line:84%
Engine.

9
00:14.680 --> 00:16.055 align:middle line:90%
And there's several
ways we could

10
00:16.055 --> 00:18.430 align:middle line:90%
get to the External
Identity section, which

11
00:18.430 --> 00:20.320 align:middle line:90%
is where we're
going to go to add

12
00:20.320 --> 00:22.055 align:middle line:84%
Active Directory as a resource.

13
00:22.055 --> 00:24.305 align:middle line:90%
We could go to Work Centers,
and then we could go down

14
00:24.305 --> 00:25.500 align:middle line:84%
to Network Access.

15
00:25.500 --> 00:28.170 align:middle line:90%
And then under there, we have
the External Identity Sources.

16
00:28.170 --> 00:28.920 align:middle line:84%
But you know what?

17
00:28.920 --> 00:31.540 align:middle line:90%
We also have that in several
other places, like under Device
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:28.920 --> 00:31.540 align:middle line:90%
We also have that in several
other places, like under Device

18
00:31.540 --> 00:33.610 align:middle line:90%
Administration, External
Identity Sources.

19
00:33.610 --> 00:35.470 align:middle line:90%
So however you want
to get there is great.

20
00:35.470 --> 00:38.290 align:middle line:90%
It's under Device Administration
and then the subtab

21
00:38.290 --> 00:40.310 align:middle line:84%
of External Identity Sources.

22
00:40.310 --> 00:43.440 align:middle line:90%
So to add Active Directory
as an identity source,

23
00:43.440 --> 00:45.590 align:middle line:84%
we'd click on Active Directory.

24
00:45.590 --> 00:47.910 align:middle line:84%
We then click on Add.

25
00:47.910 --> 00:49.180 align:middle line:84%
We then specify the name.

26
00:49.180 --> 00:51.430 align:middle line:90%
Now, the Join Point
Name is the name

27
00:51.430 --> 00:53.740 align:middle line:90%
we're going to refer to
in our policies regarding

28
00:53.740 --> 00:56.530 align:middle line:90%
this directory service that's
pulling from Active Directory.

29
00:56.530 --> 01:00.340 align:middle line:84%
So let's call this Our-DC.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:56.530 --> 01:00.340 align:middle line:84%
So let's call this Our-DC.

30
01:00.340 --> 01:02.680 align:middle line:90%
This is a descriptive name
of our domain controller.

31
01:02.680 --> 01:04.459 align:middle line:84%
You can rename that, as well.

32
01:04.459 --> 01:06.260 align:middle line:90%
And then we're going
to specify the domain.

33
01:06.260 --> 01:08.962 align:middle line:90%
Now, in my home lab
here, I've got ogit.com.

34
01:08.962 --> 01:10.670 align:middle line:90%
And that's the one I
have here in my lab.

35
01:10.670 --> 01:13.280 align:middle line:90%
So I've got a domain controller
that will respond to that.

36
01:13.280 --> 01:14.512 align:middle line:84%
And we'll click on Submit.

37
01:14.512 --> 01:15.970 align:middle line:90%
Next, it's asking,
hey, do you want

38
01:15.970 --> 01:18.145 align:middle line:90%
to join to this Active
Directory domain?

39
01:18.145 --> 01:20.020 align:middle line:90%
And I'm going to go
ahead and say, yes, I do.

40
01:20.020 --> 01:22.010 align:middle line:90%
So then we're prompted to put
in the credentials for somebody

41
01:22.010 --> 01:23.750 align:middle line:84%
who has the rights to do that.

42
01:23.750 --> 01:27.100 align:middle line:84%
So this guy does, administrator.

43
01:27.100 --> 01:28.780 align:middle line:84%
And I'll put his password.

44
01:28.780 --> 01:31.270 align:middle line:90%
Then we can also specify
the organizational unit
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:28.780 --> 01:31.270 align:middle line:90%
Then we can also specify
the organizational unit

45
01:31.270 --> 01:36.670 align:middle line:90%
or accept the default and click
on OK and hope for the best.

46
01:36.670 --> 01:40.480 align:middle line:90%
And I always have, like--
hold my breath for a moment

47
01:40.480 --> 01:41.410 align:middle line:84%
hoping it happens.

48
01:41.410 --> 01:42.610 align:middle line:84%
If it doesn't, we try again.

49
01:42.610 --> 01:44.943 align:middle line:90%
Make sure you have the domain
name correct and so forth.

50
01:44.943 --> 01:46.390 align:middle line:84%
And we'll click on Close.

51
01:46.390 --> 01:49.630 align:middle line:90%
So now we have this Active
Directory domain, ogit.com,

52
01:49.630 --> 01:52.840 align:middle line:90%
which is acting as an
external identity source

53
01:52.840 --> 01:55.870 align:middle line:90%
that we can query for
authenticating users.

54
01:55.870 --> 01:57.430 align:middle line:84%
Also, check this out.

55
01:57.430 --> 01:59.740 align:middle line:90%
Besides users, we can
also deal with groups

56
01:59.740 --> 02:01.540 align:middle line:90%
and use the groups
from Active Directory.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
01:59.740 --> 02:01.540 align:middle line:90%
and use the groups
from Active Directory.

57
02:01.540 --> 02:03.790 align:middle line:90%
So let me show you something
real quick on the Active

58
02:03.790 --> 02:04.780 align:middle line:84%
Directory server.

59
02:04.780 --> 02:05.530 align:middle line:84%
That's right here.

60
02:05.530 --> 02:08.650 align:middle line:90%
On this Active Directory
server, I've got the user Bob.

61
02:08.650 --> 02:10.150 align:middle line:84%
I've got the user Luis.

62
02:10.150 --> 02:12.760 align:middle line:90%
And I've got two groups,
one called ISE-Admins,

63
02:12.760 --> 02:14.750 align:middle line:84%
one called ISE-Operations.

64
02:14.750 --> 02:16.400 align:middle line:84%
Bob is in the Operations group.

65
02:16.400 --> 02:18.460 align:middle line:84%
Luis is in the Admins group.

66
02:18.460 --> 02:21.520 align:middle line:90%
So back here in ISE under Active
Directory, if we go to Groups,

67
02:21.520 --> 02:22.450 align:middle line:84%
you can click on Add.

68
02:22.450 --> 02:23.470 align:middle line:84%
Check this out.

69
02:23.470 --> 02:25.190 align:middle line:84%
Select Groups From Directory.

70
02:25.190 --> 02:26.670 align:middle line:84%
We click on that.

71
02:26.670 --> 02:29.030 align:middle line:90%
We can then go ahead and
just say Retrieve Groups.

72
02:29.030 --> 02:30.613 align:middle line:90%
And because there's
an asterisk there,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:29.030 --> 02:30.613 align:middle line:90%
And because there's
an asterisk there,

73
02:30.613 --> 02:33.552 align:middle line:90%
it'll just pull all the existing
groups from Active Directory.

74
02:33.552 --> 02:35.510 align:middle line:90%
And we can just choose
the ones we want to use.

75
02:35.510 --> 02:36.510 align:middle line:84%
So you go down the list.

76
02:36.510 --> 02:39.830 align:middle line:90%
I've got ISE-Admins
and ISE-Operations.

77
02:39.830 --> 02:41.470 align:middle line:84%
I'm going to click on OK.

78
02:41.470 --> 02:42.470 align:middle line:84%
But let's go back again.

79
02:42.470 --> 02:43.887 align:middle line:90%
Let me show you
how we can sort it

80
02:43.887 --> 02:46.660 align:middle line:90%
a little bit if we have lots of
groups we got to filter down.

81
02:46.660 --> 02:49.570 align:middle line:90%
I'm going to type in the
word "domain" and asterisk.

82
02:49.570 --> 02:51.130 align:middle line:90%
And that should
show us everything

83
02:51.130 --> 02:52.733 align:middle line:84%
with the word "domain" in it.

84
02:52.733 --> 02:53.400 align:middle line:84%
I pressed Enter.

85
02:53.400 --> 02:55.810 align:middle line:90%
I need to click on Retrieve
Groups for it to go get it.

86
02:55.810 --> 02:56.630 align:middle line:84%
Here it comes.

87
02:56.630 --> 02:57.130 align:middle line:84%
All right.

88
02:57.130 --> 02:59.928 align:middle line:90%
So if we want to bring
Domain Admins and Domain

89
02:59.928 --> 03:01.720 align:middle line:90%
Users, as well, if
we're going to use those
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
02:59.928 --> 03:01.720 align:middle line:90%
Users, as well, if
we're going to use those

90
03:01.720 --> 03:04.480 align:middle line:90%
as part of our policy, our
Identity Services Engine

91
03:04.480 --> 03:06.850 align:middle line:84%
can now query Active Directory.

92
03:06.850 --> 03:09.280 align:middle line:90%
So now that we have integration
between ISE and Active

93
03:09.280 --> 03:11.920 align:middle line:90%
Directory, we have another
challenge ahead of us.

94
03:11.920 --> 03:15.280 align:middle line:90%
And that is, shouldn't we train
the Identity Services Engine

95
03:15.280 --> 03:18.400 align:middle line:90%
about at least one network
access device, like a switch?

96
03:18.400 --> 03:20.050 align:middle line:84%
The answer is absolutely yes.

97
03:20.050 --> 03:21.880 align:middle line:90%
And I'll walk you
through step by step

98
03:21.880 --> 03:24.550 align:middle line:90%
on how to train ISE about
a network access device,

99
03:24.550 --> 03:26.650 align:middle line:90%
like a switch, in
the very next video.

100
03:26.650 --> 03:28.210 align:middle line:90%
I'll see you there
in just a moment.

101
03:28.210 --> 03:30.850 align:middle line:90%
Meanwhile, I hope this has
been informative for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
03:28.210 --> 03:30.850 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

102
03:30.850 --> 03:34.110 align:middle line:90%
And I'd like to thank
you for viewing.