WEBVTT

1
00:00.000 --> 00:01.970 align:middle line:84%


2
00:01.970 --> 00:03.860 align:middle line:90%
Half the battle in
working with ISE

3
00:03.860 --> 00:05.630 align:middle line:90%
is understanding
the logic it goes

4
00:05.630 --> 00:07.093 align:middle line:84%
through when it gets a request.

5
00:07.093 --> 00:09.260 align:middle line:90%
So if the switch says, hey,
I've got somebody trying

6
00:09.260 --> 00:11.040 align:middle line:84%
to authenticate via 802.1x.

7
00:11.040 --> 00:11.540 align:middle line:84%
Boom.

8
00:11.540 --> 00:13.880 align:middle line:90%
Mr. Authentication
Server, here you go.

9
00:13.880 --> 00:15.320 align:middle line:84%
What does the ISE server do?

10
00:15.320 --> 00:16.670 align:middle line:84%
What rules does it look at?

11
00:16.670 --> 00:17.930 align:middle line:84%
And how does it process it?

12
00:17.930 --> 00:19.805 align:middle line:90%
That, my friend, is what
we are going to look

13
00:19.805 --> 00:21.980 align:middle line:84%
at in detail in this video.

14
00:21.980 --> 00:23.770 align:middle line:90%
So to set the stage
here, we're going

15
00:23.770 --> 00:27.350 align:middle line:90%
to have this switch acting
as the authenticator who

16
00:27.350 --> 00:30.290 align:middle line:90%
is making requests to the
authentication server regarding
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:27.350 --> 00:30.290 align:middle line:90%
is making requests to the
authentication server regarding

17
00:30.290 --> 00:33.220 align:middle line:90%
Bob or the client that's
trying to go ahead and connect.

18
00:33.220 --> 00:35.090 align:middle line:90%
So when that request
comes in, there

19
00:35.090 --> 00:38.700 align:middle line:90%
are two specific processes
that we're going to go through.

20
00:38.700 --> 00:40.460 align:middle line:84%
One is authentication.

21
00:40.460 --> 00:43.970 align:middle line:90%
It's basically saying,
who the heck are you?

22
00:43.970 --> 00:46.160 align:middle line:90%
And we could be querying
the local database

23
00:46.160 --> 00:47.210 align:middle line:84%
on the ISE server.

24
00:47.210 --> 00:49.490 align:middle line:90%
We could be asking
Active Directory.

25
00:49.490 --> 00:52.460 align:middle line:90%
And the second piece is
if we pass authentication,

26
00:52.460 --> 00:55.410 align:middle line:90%
the second piece would
be the authorization.

27
00:55.410 --> 00:57.240 align:middle line:90%
You might say, well,
Keith, authorization,

28
00:57.240 --> 00:59.110 align:middle line:90%
does that just full
access to the network?

29
00:59.110 --> 01:00.360 align:middle line:84%
And the answer is it could.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.110 --> 01:00.360 align:middle line:84%
And the answer is it could.

30
01:00.360 --> 01:03.390 align:middle line:90%
Or authorization could
also include details such

31
01:03.390 --> 01:05.865 align:middle line:90%
as, hey, here's a
downloadable ACL that's

32
01:05.865 --> 01:06.990 align:middle line:84%
going to be applied to you.

33
01:06.990 --> 01:09.908 align:middle line:90%
Or hey, here's an SGT,
a Security Group Tag,

34
01:09.908 --> 01:11.450 align:middle line:90%
or a Scaleable Group
Tag that's going

35
01:11.450 --> 01:13.110 align:middle line:84%
to be applied for this user.

36
01:13.110 --> 01:16.170 align:middle line:90%
Or hey, you're in
VLAN 40, or 50, or 60.

37
01:16.170 --> 01:18.127 align:middle line:90%
So the authorization
is very flexible,

38
01:18.127 --> 01:19.710 align:middle line:90%
lots of options that
we can push down.

39
01:19.710 --> 01:21.570 align:middle line:90%
And I'd like to share with
you some of the defaults that

40
01:21.570 --> 01:24.150 align:middle line:90%
are in place, and then walk
you through that logic of how

41
01:24.150 --> 01:25.480 align:middle line:84%
it works.

42
01:25.480 --> 01:27.570 align:middle line:90%
So here on the home page
on the ISE appliance,

43
01:27.570 --> 01:29.685 align:middle line:90%
if we want to look at the
policy or authentication

44
01:29.685 --> 01:32.357 align:middle line:90%
and authorization, we'd
go to the Policy tab.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:29.685 --> 01:32.357 align:middle line:90%
and authorization, we'd
go to the Policy tab.

45
01:32.357 --> 01:34.440 align:middle line:90%
This is one of the ways
of getting there, and then

46
01:34.440 --> 01:36.960 align:middle line:90%
from the dropdown,
selecting Policy Sets.

47
01:36.960 --> 01:39.120 align:middle line:90%
We could also go
to Work Centers.

48
01:39.120 --> 01:41.460 align:middle line:90%
And there's also options
for getting to policy sets,

49
01:41.460 --> 01:50.650 align:middle line:90%
like right here, and here,
and here, and here, and here.

50
01:50.650 --> 01:53.580 align:middle line:90%
So you can get to policy
sets anyway you want to.

51
01:53.580 --> 01:56.280 align:middle line:90%
But there is a Policy tab that
you can just go to Policy Sets.

52
01:56.280 --> 01:57.650 align:middle line:84%
It'll take you right there.

53
01:57.650 --> 01:59.910 align:middle line:90%
And this default
policy set right here

54
01:59.910 --> 02:02.640 align:middle line:90%
has no conditions,
meaning it's not looking--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:59.910 --> 02:02.640 align:middle line:90%
has no conditions,
meaning it's not looking--

55
02:02.640 --> 02:05.940 align:middle line:90%
or a switch at site one,
or a router at site two,

56
02:05.940 --> 02:07.260 align:middle line:84%
or anything else specific.

57
02:07.260 --> 02:09.030 align:middle line:90%
The default is pretty
much wide open.

58
02:09.030 --> 02:12.210 align:middle line:90%
And also, the default is
default network access, which

59
02:12.210 --> 02:16.770 align:middle line:90%
implies that all of the EAP
methods that are by default

60
02:16.770 --> 02:19.390 align:middle line:90%
enabled and will be tried,
those can all be used.

61
02:19.390 --> 02:22.890 align:middle line:90%
We're not limiting it to some
specific 802.1x authentication

62
02:22.890 --> 02:23.700 align:middle line:84%
method.

63
02:23.700 --> 02:25.340 align:middle line:90%
Now, the tricky
part is if this is

64
02:25.340 --> 02:29.790 align:middle line:90%
a default set, where are the
details or the authentication

65
02:29.790 --> 02:30.870 align:middle line:84%
and the authorization?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.790 --> 02:30.870 align:middle line:84%
and the authorization?

66
02:30.870 --> 02:32.850 align:middle line:90%
And to see those,
what we would do

67
02:32.850 --> 02:35.840 align:middle line:90%
is we'd click on this little
arrow over on the far right.

68
02:35.840 --> 02:39.000 align:middle line:90%
We're going to expand it, and
give us the details regarding

69
02:39.000 --> 02:41.750 align:middle line:84%
this default policy set.

70
02:41.750 --> 02:44.430 align:middle line:90%
So just as a reminder, we're
looking at the default policy

71
02:44.430 --> 02:44.930 align:middle line:84%
set.

72
02:44.930 --> 02:48.800 align:middle line:90%
And within that set, we have
this authentication policy,

73
02:48.800 --> 02:50.300 align:middle line:84%
identifying who are you.

74
02:50.300 --> 02:51.860 align:middle line:84%
And then some exceptions.

75
02:51.860 --> 02:54.410 align:middle line:90%
And then we have the
authorization policy here down

76
02:54.410 --> 02:55.800 align:middle line:84%
below.

77
02:55.800 --> 02:58.280 align:middle line:90%
But for now, I'd like to
focus on the authentication

78
02:58.280 --> 02:59.730 align:middle line:84%
and the authorization.

79
02:59.730 --> 03:03.020 align:middle line:90%
Now, how do we see the details
for the authentication policy?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:59.730 --> 03:03.020 align:middle line:90%
Now, how do we see the details
for the authentication policy?

80
03:03.020 --> 03:05.203 align:middle line:90%
Simply click on this
icon here to expand it.

81
03:05.203 --> 03:06.620 align:middle line:90%
Now what we're
looking at is we're

82
03:06.620 --> 03:08.960 align:middle line:90%
looking at the default
policy set still.

83
03:08.960 --> 03:11.490 align:middle line:90%
And now we're looking at
the authentication policy.

84
03:11.490 --> 03:14.750 align:middle line:90%
And it has three
rules in this policy.

85
03:14.750 --> 03:17.010 align:middle line:90%
And the way this
works is top down.

86
03:17.010 --> 03:20.090 align:middle line:90%
So as a client is
being authenticated,

87
03:20.090 --> 03:23.670 align:middle line:90%
if they match the conditions
here for this rule number one,

88
03:23.670 --> 03:26.752 align:middle line:90%
it would use the rule over
here for that authentication.

89
03:26.752 --> 03:28.460 align:middle line:90%
If they don't match
that, they would then

90
03:28.460 --> 03:31.400 align:middle line:90%
drop to the next active
rule in this authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:28.460 --> 03:31.400 align:middle line:90%
drop to the next active
rule in this authentication

91
03:31.400 --> 03:33.940 align:middle line:90%
policy, which in this case
would be the default rule.

92
03:33.940 --> 03:35.180 align:middle line:84%
So it basically means this.

93
03:35.180 --> 03:38.330 align:middle line:90%
If Bob or some user connects
to a switch port that's doing

94
03:38.330 --> 03:42.550 align:middle line:90%
802.1x, that switch is going to
send a request out to the ISE

95
03:42.550 --> 03:43.050 align:middle line:84%
server.

96
03:43.050 --> 03:45.170 align:middle line:90%
The ISE server is
going to go through

97
03:45.170 --> 03:46.763 align:middle line:90%
in order, the
authentication method,

98
03:46.763 --> 03:47.930 align:middle line:84%
looking for the first match.

99
03:47.930 --> 03:49.640 align:middle line:90%
When there's a first
match, it's like, great,

100
03:49.640 --> 03:50.848 align:middle line:84%
that's what I'm going to use.

101
03:50.848 --> 03:53.020 align:middle line:90%
I'm going to go ahead and
authenticate this way.

102
03:53.020 --> 03:55.610 align:middle line:90%
So this All_User_ID_Stores,
which I currently have set,

103
03:55.610 --> 03:57.740 align:middle line:84%
means any-- it could be local.

104
03:57.740 --> 03:59.240 align:middle line:90%
It could be the
domain controller

105
03:59.240 --> 04:00.560 align:middle line:84%
with Active Directory.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:59.240 --> 04:00.560 align:middle line:84%
with Active Directory.

106
04:00.560 --> 04:02.580 align:middle line:84%
And here is our list of options.

107
04:02.580 --> 04:05.300 align:middle line:90%
There's also ways of going
in and modifying the details,

108
04:05.300 --> 04:06.140 align:middle line:84%
or each of these.

109
04:06.140 --> 04:09.230 align:middle line:90%
I'm going to go ahead and
leave the All_User_ID_Stores.

110
04:09.230 --> 04:11.210 align:middle line:90%
And then the next
statement is, well,

111
04:11.210 --> 04:13.100 align:middle line:90%
let's say the user
does authenticate.

112
04:13.100 --> 04:15.260 align:middle line:84%
And maybe Bob logs in.

113
04:15.260 --> 04:17.810 align:middle line:90%
And he's authenticated
against Active Directory.

114
04:17.810 --> 04:18.829 align:middle line:84%
It all works.

115
04:18.829 --> 04:19.550 align:middle line:84%
What next?

116
04:19.550 --> 04:21.050 align:middle line:90%
Well, then we're
going to go ahead--

117
04:21.050 --> 04:22.790 align:middle line:90%
after the
authentication is done,

118
04:22.790 --> 04:24.755 align:middle line:90%
we then go to the
authorization policy.

119
04:24.755 --> 04:26.630 align:middle line:90%
So here at the bottom
there's some exceptions

120
04:26.630 --> 04:28.520 align:middle line:90%
here for local and
global, but at the bottom

121
04:28.520 --> 04:30.050 align:middle line:84%
is where the meat is.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:28.520 --> 04:30.050 align:middle line:84%
is where the meat is.

122
04:30.050 --> 04:32.730 align:middle line:90%
And this authorization policy
is processed from top to bottom.

123
04:32.730 --> 04:35.360 align:middle line:90%
So we look at the first rule
here of the authorization

124
04:35.360 --> 04:38.360 align:middle line:90%
policy and say, OK,
is it wireless access?

125
04:38.360 --> 04:41.390 align:middle line:90%
And does the identity group name
equal endpoint identity group

126
04:41.390 --> 04:42.260 align:middle line:84%
blacklist?

127
04:42.260 --> 04:43.290 align:middle line:84%
If so, boom!

128
04:43.290 --> 04:44.290 align:middle line:84%
You can get black holed.

129
04:44.290 --> 04:45.873 align:middle line:90%
It's not going to
give you any access.

130
04:45.873 --> 04:47.540 align:middle line:90%
If that doesn't
match, it continues

131
04:47.540 --> 04:50.690 align:middle line:90%
to go down the list in
the order that is here.

132
04:50.690 --> 04:52.220 align:middle line:90%
You can also move
these if you want

133
04:52.220 --> 04:55.880 align:middle line:90%
to until, finally, in our case,
because we haven't configured

134
04:55.880 --> 04:57.350 align:middle line:90%
any of that yet,
it's going to have

135
04:57.350 --> 05:00.200 align:middle line:90%
the basic authenticated
access as the rule name.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
04:57.350 --> 05:00.200 align:middle line:90%
the basic authenticated
access as the rule name.

136
05:00.200 --> 05:02.190 align:middle line:90%
And the condition
for that simply says,

137
05:02.190 --> 05:04.040 align:middle line:90%
hey, yeah, this
user authenticated.

138
05:04.040 --> 05:04.850 align:middle line:84%
That's great.

139
05:04.850 --> 05:07.303 align:middle line:90%
And then access is
going to be permitted.

140
05:07.303 --> 05:09.720 align:middle line:90%
So with that authorization
rule with all those conditions,

141
05:09.720 --> 05:10.928 align:middle line:84%
it looks pretty intimidating.

142
05:10.928 --> 05:12.950 align:middle line:84%
However, here's the takeaway.

143
05:12.950 --> 05:16.680 align:middle line:90%
In a policy set, there's
two main components.

144
05:16.680 --> 05:19.760 align:middle line:90%
One is regarding authentication,
and it's conditional, if then,

145
05:19.760 --> 05:23.270 align:middle line:90%
like if it's this access
point, or this switch,

146
05:23.270 --> 05:26.070 align:middle line:90%
or if it's at this site,
all that's conditional,

147
05:26.070 --> 05:28.250 align:middle line:90%
then use this way, this
method to authenticate.

148
05:28.250 --> 05:29.480 align:middle line:84%
Maybe it's Active Directory.

149
05:29.480 --> 05:30.860 align:middle line:90%
Maybe it's a local
identity store
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:29.480 --> 05:30.860 align:middle line:90%
Maybe it's a local
identity store

150
05:30.860 --> 05:32.460 align:middle line:84%
on the ISE server, et cetera.

151
05:32.460 --> 05:34.475 align:middle line:90%
If the authentication
is successful,

152
05:34.475 --> 05:37.160 align:middle line:90%
it then drops down to the
authorization profiles

153
05:37.160 --> 05:40.190 align:middle line:90%
and the rules in those profiles,
looking for this, and that,

154
05:40.190 --> 05:40.910 align:middle line:84%
and the other.

155
05:40.910 --> 05:42.980 align:middle line:90%
And we can create our
own custom authorization

156
05:42.980 --> 05:45.260 align:middle line:90%
profiles that
specify what we want

157
05:45.260 --> 05:46.760 align:middle line:84%
to do based on the conditions.

158
05:46.760 --> 05:48.468 align:middle line:90%
The reason that's
important is because we

159
05:48.468 --> 05:50.660 align:middle line:90%
could have Bob, who's
a member of group one,

160
05:50.660 --> 05:53.870 align:middle line:90%
and Louise, who's a member of
group two, in Active Directory.

161
05:53.870 --> 05:55.640 align:middle line:90%
And based on those
group memberships,

162
05:55.640 --> 05:58.860 align:middle line:90%
we assign them different
authorization profiles.

163
05:58.860 --> 06:00.560 align:middle line:84%
We could put Bob in VLAN 80.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
05:58.860 --> 06:00.560 align:middle line:84%
We could put Bob in VLAN 80.

164
06:00.560 --> 06:02.590 align:middle line:84%
We could put Louise in VLAN 30.

165
06:02.590 --> 06:05.060 align:middle line:90%
We could do a
downloadable ACL that

166
06:05.060 --> 06:07.040 align:middle line:90%
would control the
access for a user

167
06:07.040 --> 06:09.560 align:middle line:90%
based on their authorization
profile we assign to them.

168
06:09.560 --> 06:10.640 align:middle line:84%
All of that is coming up.

169
06:10.640 --> 06:12.307 align:middle line:90%
And I'm super excited
about showing you.

170
06:12.307 --> 06:13.940 align:middle line:90%
But for here, the
basics, I wanted

171
06:13.940 --> 06:17.350 align:middle line:90%
to share with you that a policy
set has two major parts--

172
06:17.350 --> 06:21.410 align:middle line:90%
the authentication policy
and the authorization policy,

173
06:21.410 --> 06:23.330 align:middle line:90%
how you're going to
be authenticated.

174
06:23.330 --> 06:25.940 align:middle line:90%
And then what you get once
you've been authenticated

175
06:25.940 --> 06:28.190 align:middle line:84%
with the authorization policy.

176
06:28.190 --> 06:30.140 align:middle line:90%
And with this default
policy in place
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
06:28.190 --> 06:30.140 align:middle line:90%
And with this default
policy in place

177
06:30.140 --> 06:31.850 align:middle line:90%
and with Active
Directory currently set

178
06:31.850 --> 06:33.740 align:middle line:90%
up that we did a
couple of videos ago,

179
06:33.740 --> 06:36.080 align:middle line:90%
let's go ahead and
do a quick test just

180
06:36.080 --> 06:38.720 align:middle line:90%
to verify that the
basic authentication

181
06:38.720 --> 06:41.240 align:middle line:90%
and authorization
policies are kicking in,

182
06:41.240 --> 06:43.100 align:middle line:84%
and verify that they work.

183
06:43.100 --> 06:44.660 align:middle line:90%
And here's one
way of testing it.

184
06:44.660 --> 06:47.480 align:middle line:90%
I've got a Windows
machine that I introduced

185
06:47.480 --> 06:49.220 align:middle line:84%
in the lab set up videos.

186
06:49.220 --> 06:51.350 align:middle line:90%
And I'm connected
with Remote Desktop

187
06:51.350 --> 06:54.140 align:middle line:90%
to this laptop over
its Wi-Fi connector.

188
06:54.140 --> 06:56.990 align:middle line:90%
And Ethernet 2 is connected
to the switch port that is

189
06:56.990 --> 06:59.070 align:middle line:90%
currently already
setup with 802.1x.

190
06:59.070 --> 07:01.790 align:middle line:90%
We'll have a separate set
of videos just on setting up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
06:59.070 --> 07:01.790 align:middle line:90%
We'll have a separate set
of videos just on setting up

191
07:01.790 --> 07:03.270 align:middle line:84%
the switch for that purpose.

192
07:03.270 --> 07:06.820 align:middle line:90%
So I'm going to right-click
on this guy, enable it,

193
07:06.820 --> 07:10.650 align:middle line:90%
and survey says,
authentication failed.

194
07:10.650 --> 07:14.170 align:middle line:90%
And that's because I haven't
configured a username

195
07:14.170 --> 07:15.075 align:middle line:84%
or password there.

196
07:15.075 --> 07:17.200 align:middle line:90%
So what we can do is
right-click on this interface.

197
07:17.200 --> 07:18.333 align:middle line:84%
Go to Properties.

198
07:18.333 --> 07:19.750 align:middle line:90%
And this is on
Windows 10 machine,

199
07:19.750 --> 07:22.870 align:middle line:90%
how we could specify the
authentication details

200
07:22.870 --> 07:23.950 align:middle line:84%
for 802.1x.

201
07:23.950 --> 07:25.470 align:middle line:84%
Click on the Authentication tab.

202
07:25.470 --> 07:27.178 align:middle line:90%
And here's how I
currently have it setup.

203
07:27.178 --> 07:29.390 align:middle line:90%
We'll take a closer look
at this in later videos.

204
07:29.390 --> 07:31.830 align:middle line:90%
But I specify that I'm
using Microsoft Protected
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

204
07:29.390 --> 07:31.830 align:middle line:90%
But I specify that I'm
using Microsoft Protected

205
07:31.830 --> 07:34.140 align:middle line:84%
EAP, or PEAP for short.

206
07:34.140 --> 07:35.900 align:middle line:84%
Click on the Settings for that.

207
07:35.900 --> 07:38.230 align:middle line:90%
I also said don't bother
verifying the server's

208
07:38.230 --> 07:42.490 align:middle line:90%
identity, but I also did
take from the ISE machine--

209
07:42.490 --> 07:43.550 align:middle line:84%
the ISE machine.

210
07:43.550 --> 07:44.530 align:middle line:84%
Hey, I'm at the hotel.

211
07:44.530 --> 07:45.760 align:middle line:84%
I need the ice machine.

212
07:45.760 --> 07:48.880 align:middle line:90%
I also did get the
certificate off of ISE.

213
07:48.880 --> 07:51.650 align:middle line:90%
And I did specify
it as a trusted CA.

214
07:51.650 --> 07:53.500 align:middle line:90%
Now, you could either
get the certificate

215
07:53.500 --> 07:56.110 align:middle line:90%
and say it's trusted, or
simply say don't verify it.

216
07:56.110 --> 07:58.960 align:middle line:90%
And then down under the
selected authentication method,

217
07:58.960 --> 08:01.810 align:middle line:84%
I used EAP-MSCHAP v2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

217
07:58.960 --> 08:01.810 align:middle line:84%
I used EAP-MSCHAP v2.

218
08:01.810 --> 08:03.700 align:middle line:90%
So I'm going to go
ahead and click OK.

219
08:03.700 --> 08:06.940 align:middle line:90%
And then to add the
password, I clicked here

220
08:06.940 --> 08:07.930 align:middle line:84%
on Additional Settings.

221
08:07.930 --> 08:09.850 align:middle line:90%
Also, I said remember
my credentials

222
08:09.850 --> 08:12.130 align:middle line:90%
for this connection, I
don't want that to happen,

223
08:12.130 --> 08:14.520 align:middle line:90%
because I want to change
the users from time to time.

224
08:14.520 --> 08:16.570 align:middle line:90%
So if we click on
Additional Settings,

225
08:16.570 --> 08:20.200 align:middle line:90%
User Authentication, yes,
then Save Credentials.

226
08:20.200 --> 08:22.450 align:middle line:90%
I'm going to go ahead and
put in Bob's information.

227
08:22.450 --> 08:24.710 align:middle line:84%
There's his password.

228
08:24.710 --> 08:30.290 align:middle line:90%
And we'll click on
OK, and OK, and OK.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

228
08:24.710 --> 08:30.290 align:middle line:90%
And we'll click on
OK, and OK, and OK.

229
08:30.290 --> 08:32.870 align:middle line:90%
And in the background, I'm show
you what the switch is doing.

230
08:32.870 --> 08:35.148 align:middle line:90%
This is a console to the
switch, which is handy,

231
08:35.148 --> 08:37.440 align:middle line:90%
by the way, when you're
labbing this up, or practicing,

232
08:37.440 --> 08:39.815 align:middle line:90%
to have all those interfaces
open that you need to so you

233
08:39.815 --> 08:41.010 align:middle line:84%
can see what's happening.

234
08:41.010 --> 08:42.559 align:middle line:90%
So here it says
it was successful.

235
08:42.559 --> 08:44.150 align:middle line:90%
And here it doesn't
have an error.

236
08:44.150 --> 08:44.990 align:middle line:84%
That's fine.

237
08:44.990 --> 08:47.810 align:middle line:90%
But let me leave you with this
thought of how you can really

238
08:47.810 --> 08:49.670 align:middle line:84%
verify it, and that's this.

239
08:49.670 --> 08:52.960 align:middle line:90%
If you hover over
Operations back on ISE,

240
08:52.960 --> 08:58.060 align:middle line:90%
and you go down to Live Logs
right here, under Live Logs,

241
08:58.060 --> 09:01.060 align:middle line:90%
it's going to give you the
scoop of what's really going on.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

241
08:58.060 --> 09:01.060 align:middle line:90%
it's going to give you the
scoop of what's really going on.

242
09:01.060 --> 09:03.890 align:middle line:90%
So this icon here represents
that we have a current session.

243
09:03.890 --> 09:05.570 align:middle line:84%
I mean, Bob's logged in.

244
09:05.570 --> 09:07.962 align:middle line:90%
And over here on the right
we have the detailed report.

245
09:07.962 --> 09:09.920 align:middle line:90%
So if we want to click
on that detailed report,

246
09:09.920 --> 09:12.040 align:middle line:90%
it will open up a
separate window.

247
09:12.040 --> 09:13.720 align:middle line:90%
And this gives us
all the details.

248
09:13.720 --> 09:14.380 align:middle line:84%
Look at that.

249
09:14.380 --> 09:17.050 align:middle line:90%
This is the authentication
policy, default.

250
09:17.050 --> 09:20.020 align:middle line:90%
And then it used for
authentication-- it used .1x.

251
09:20.020 --> 09:22.060 align:middle line:84%
That was the name, literally.

252
09:22.060 --> 09:23.190 align:middle line:84%
Go back real quick.

253
09:23.190 --> 09:25.280 align:middle line:84%
Policy, Policy Sets.

254
09:25.280 --> 09:26.330 align:middle line:84%
There we go.

255
09:26.330 --> 09:30.820 align:middle line:90%
So there is the policy set
called Default. Expand that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

255
09:26.330 --> 09:30.820 align:middle line:90%
So there is the policy set
called Default. Expand that.

256
09:30.820 --> 09:33.895 align:middle line:90%
It then had an authentication
policy called .1x.

257
09:33.895 --> 09:35.650 align:middle line:90%
And then there was an
authorization policy

258
09:35.650 --> 09:37.810 align:middle line:90%
at the very end,
which it matched

259
09:37.810 --> 09:41.140 align:middle line:90%
on, which was the basic
authenticated access,

260
09:41.140 --> 09:43.130 align:middle line:84%
network access, location passed.

261
09:43.130 --> 09:45.700 align:middle line:90%
If we go back to that
log, all that information

262
09:45.700 --> 09:48.990 align:middle line:90%
is there, including what
authentication policy hit,

263
09:48.990 --> 09:50.470 align:middle line:84%
what authorization policy hit.

264
09:50.470 --> 09:51.267 align:middle line:84%
Oh, oh, oh.

265
09:51.267 --> 09:51.850 align:middle line:84%
You know what?

266
09:51.850 --> 09:53.850 align:middle line:90%
I've got to share with
you something else really

267
09:53.850 --> 09:54.760 align:middle line:84%
important.

268
09:54.760 --> 09:58.930 align:middle line:90%
Because you could have thousands
and thousands of people logging

269
09:58.930 --> 10:02.940 align:middle line:90%
in, if there's a repeat login,
like Bob logs in five times,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

269
09:58.930 --> 10:02.940 align:middle line:90%
in, if there's a repeat login,
like Bob logs in five times,

270
10:02.940 --> 10:06.337 align:middle line:90%
by default, it just summarizes
those with a repeat count.

271
10:06.337 --> 10:07.670 align:middle line:84%
And it doesn't show the details.

272
10:07.670 --> 10:09.730 align:middle line:90%
So if you're labbing this
up and you really want

273
10:09.730 --> 10:12.010 align:middle line:90%
to see the individual logs,
and did the method change

274
10:12.010 --> 10:14.230 align:middle line:90%
for the authentication
authorization,

275
10:14.230 --> 10:16.730 align:middle line:84%
this next step is just for you.

276
10:16.730 --> 10:17.960 align:middle line:84%
So here's what I did.

277
10:17.960 --> 10:21.430 align:middle line:90%
I went to Work Centers,
and I went to Settings, so

278
10:21.430 --> 10:23.440 align:middle line:84%
Network Access Settings.

279
10:23.440 --> 10:24.370 align:middle line:84%
And check this out.

280
10:24.370 --> 10:27.700 align:middle line:90%
Under Protocols, I expanded
that one to radius.

281
10:27.700 --> 10:29.950 align:middle line:90%
And then under
suppression of reports,

282
10:29.950 --> 10:32.110 align:middle line:90%
I deselected, I
removed the check
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

282
10:29.950 --> 10:32.110 align:middle line:90%
I deselected, I
removed the check

283
10:32.110 --> 10:35.200 align:middle line:90%
from those checkboxes that
said, Suppress Repeated Failed

284
10:35.200 --> 10:37.180 align:middle line:90%
Clients, and also
Suppress repeated

285
10:37.180 --> 10:38.560 align:middle line:84%
successful authentication.

286
10:38.560 --> 10:40.750 align:middle line:90%
And the reason I
did that, the reason

287
10:40.750 --> 10:43.360 align:middle line:90%
I did that was because when
you're labbing this up,

288
10:43.360 --> 10:47.200 align:middle line:90%
you want to see each and every
single log as a separate event.

289
10:47.200 --> 10:49.090 align:middle line:90%
So that'll help if
you're labbing this up

290
10:49.090 --> 10:51.173 align:middle line:90%
and you want to see the
differences every time you

291
10:51.173 --> 10:52.000 align:middle line:84%
make a change.

292
10:52.000 --> 10:53.830 align:middle line:90%
That's the way to
see it in the logs.

293
10:53.830 --> 10:56.830 align:middle line:90%
So in this introduction to the
policy sets for authentication,

294
10:56.830 --> 10:59.350 align:middle line:90%
authorization, we kind of
got a little sneak peek

295
10:59.350 --> 11:00.220 align:middle line:84%
at how it works.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

295
10:59.350 --> 11:00.220 align:middle line:84%
at how it works.

296
11:00.220 --> 11:02.080 align:middle line:90%
But I think the
most effective way

297
11:02.080 --> 11:06.010 align:middle line:90%
to really see it in action is
to create new authentication

298
11:06.010 --> 11:09.260 align:middle line:90%
and new authorization profiles
that leverage Active Directory,

299
11:09.260 --> 11:10.840 align:middle line:90%
that download
access control list,

300
11:10.840 --> 11:13.450 align:middle line:90%
and set VLAN IDs that
you can see in action.

301
11:13.450 --> 11:16.130 align:middle line:90%
And all that is coming
up in the next video.

302
11:16.130 --> 11:18.110 align:middle line:90%
So I'll see you there
in just a moment.

303
11:18.110 --> 11:20.590 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

304
11:20.590 --> 11:23.880 align:middle line:90%
And I'd like to thank
you for viewing.