WEBVTT

1
00:00.000 --> 00:03.700 align:middle line:84%


2
00:03.700 --> 00:06.160 align:middle line:90%
In the previous video, we
took a look at the defaults

3
00:06.160 --> 00:08.320 align:middle line:90%
for authentication
and authorization.

4
00:08.320 --> 00:10.990 align:middle line:90%
And in this video, I'd like
to walk you through setting up

5
00:10.990 --> 00:13.570 align:middle line:90%
a brand new
authentication policy,

6
00:13.570 --> 00:17.050 align:middle line:90%
and then walk you through how
we can verify that not only it

7
00:17.050 --> 00:20.170 align:middle line:90%
exists, which is pretty cool,
but also that it's working.

8
00:20.170 --> 00:22.210 align:middle line:84%
All that and more starting now.

9
00:22.210 --> 00:23.650 align:middle line:84%
And here's our game plan.

10
00:23.650 --> 00:25.960 align:middle line:90%
We're going to create a
new authentication policy.

11
00:25.960 --> 00:28.630 align:middle line:90%
And let's include three
aspects, that it's

12
00:28.630 --> 00:32.020 align:middle line:90%
going to kick in and be used
if it's from a network access
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.630 --> 00:32.020 align:middle line:90%
going to kick in and be used
if it's from a network access

13
00:32.020 --> 00:34.300 align:middle line:90%
device or switch
that's in site 1.

14
00:34.300 --> 00:35.800 align:middle line:84%
And it is a switch.

15
00:35.800 --> 00:38.618 align:middle line:90%
And we also want to
use Active Directory.

16
00:38.618 --> 00:40.160 align:middle line:90%
And then if the
authentication works,

17
00:40.160 --> 00:42.430 align:middle line:90%
we'll just go ahead and
say, yeah, congratulations.

18
00:42.430 --> 00:44.800 align:middle line:90%
We'll give you full access
regarding authorization.

19
00:44.800 --> 00:47.960 align:middle line:90%
We'll tackle authorization
in a separate video.

20
00:47.960 --> 00:49.150 align:middle line:84%
So that's our game plan.

21
00:49.150 --> 00:52.000 align:middle line:90%
Before we start putting that
together as a new policy set,

22
00:52.000 --> 00:56.890 align:middle line:90%
let's just verify our
network devices real quick.

23
00:56.890 --> 00:58.930 align:middle line:84%
So on this switch, which one?

24
00:58.930 --> 01:00.820 align:middle line:90%
I just want to verify
that it's in site 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:58.930 --> 01:00.820 align:middle line:90%
I just want to verify
that it's in site 1.

25
01:00.820 --> 01:02.230 align:middle line:84%
Yes, good, good, good.

26
01:02.230 --> 01:03.970 align:middle line:84%
And it's device type of switch.

27
01:03.970 --> 01:05.680 align:middle line:90%
If we didn't have
those, it wouldn't

28
01:05.680 --> 01:08.620 align:middle line:90%
be too successful in looking
for those attributes.

29
01:08.620 --> 01:11.260 align:middle line:90%
And as far as external
identity sources,

30
01:11.260 --> 01:14.350 align:middle line:90%
we've got Our-DC, which
represents our domain

31
01:14.350 --> 01:17.050 align:middle line:90%
controller with access
to Active Directory.

32
01:17.050 --> 01:22.270 align:middle line:90%
And as far as that is concerned,
if we look at our groups,

33
01:22.270 --> 01:25.030 align:middle line:90%
we also pulled in four groups
that we can leverage as well.

34
01:25.030 --> 01:25.530 align:middle line:84%
OK.

35
01:25.530 --> 01:26.068 align:middle line:84%
Fantastic.

36
01:26.068 --> 01:28.110 align:middle line:90%
I wanted to make sure
those pieces were in place.

37
01:28.110 --> 01:30.810 align:middle line:90%
And to create or modify our
policy, a quick way of getting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.110 --> 01:30.810 align:middle line:90%
And to create or modify our
policy, a quick way of getting

38
01:30.810 --> 01:32.910 align:middle line:90%
there is hover over
policy, and then

39
01:32.910 --> 01:35.040 align:middle line:84%
just selecting policy sets.

40
01:35.040 --> 01:37.200 align:middle line:90%
Any way you want to
get there is perfect.

41
01:37.200 --> 01:39.480 align:middle line:90%
And here we have our
default policy set.

42
01:39.480 --> 01:42.530 align:middle line:90%
We are going to create a
new one in front of that

43
01:42.530 --> 01:43.625 align:middle line:84%
or on top of that.

44
01:43.625 --> 01:45.750 align:middle line:90%
And the way you can do that
is hit this Plus button

45
01:45.750 --> 01:46.388 align:middle line:84%
right here.

46
01:46.388 --> 01:48.930 align:middle line:90%
And let's name it something that
we'll recognize in the logs.

47
01:48.930 --> 01:50.520 align:middle line:90%
That's not going to be
a default that we're

48
01:50.520 --> 01:51.670 align:middle line:84%
going to see anywhere else.

49
01:51.670 --> 01:54.150 align:middle line:90%
So if we see that
policy set name

50
01:54.150 --> 01:57.570 align:middle line:90%
of Our-Site-1-Switch-Policy-Set,
we'll know exactly where

51
01:57.570 --> 01:58.710 align:middle line:84%
it's coming from.

52
01:58.710 --> 02:01.890 align:middle line:90%
Now, if we want to get granular
on when this policy set kicks
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.710 --> 02:01.890 align:middle line:90%
Now, if we want to get granular
on when this policy set kicks

53
02:01.890 --> 02:03.480 align:middle line:90%
in and is going to
be used, we need

54
02:03.480 --> 02:05.430 align:middle line:90%
to set the conditions,
which is right here.

55
02:05.430 --> 02:06.972 align:middle line:90%
So to set the
conditions, we're going

56
02:06.972 --> 02:09.570 align:middle line:90%
to click on the Plus symbol
in the Conditions column here.

57
02:09.570 --> 02:11.880 align:middle line:90%
And we are simply going
to set the conditions that

58
02:11.880 --> 02:15.128 align:middle line:90%
have to match for this
policy set to be used.

59
02:15.128 --> 02:16.920 align:middle line:90%
And this interface is
a little interesting.

60
02:16.920 --> 02:19.530 align:middle line:90%
You can take these objects over
here in the library and drag

61
02:19.530 --> 02:23.220 align:middle line:90%
them over, like if it's
802.1x wired, great.

62
02:23.220 --> 02:26.760 align:middle line:90%
Or if it's wireless 802.1x,
you can drag and drop them.

63
02:26.760 --> 02:28.792 align:middle line:84%
Or you can just create your own.

64
02:28.792 --> 02:30.250 align:middle line:90%
That's what we're
going to do here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.792 --> 02:30.250 align:middle line:90%
That's what we're
going to do here.

65
02:30.250 --> 02:31.042 align:middle line:84%
Now, click on this.

66
02:31.042 --> 02:33.420 align:middle line:90%
Click to add an
attribute option.

67
02:33.420 --> 02:36.360 align:middle line:90%
And then down under Dictionary,
I click on Dictionaries.

68
02:36.360 --> 02:37.950 align:middle line:84%
And I'm going to select Device.

69
02:37.950 --> 02:39.850 align:middle line:90%
And you'll see why
here in just a moment.

70
02:39.850 --> 02:42.390 align:middle line:90%
If our goal is to have this
policy set only kick in

71
02:42.390 --> 02:46.080 align:middle line:90%
if it's a device
that is in site 1,

72
02:46.080 --> 02:48.480 align:middle line:90%
we can click here on
Device with Location.

73
02:48.480 --> 02:50.940 align:middle line:90%
And then we have our
options for the operator

74
02:50.940 --> 02:53.760 align:middle line:90%
equals, not equals,
contains, doesn't contain.

75
02:53.760 --> 02:57.660 align:middle line:90%
If the location equals in
the dropdown list, site 1--

76
02:57.660 --> 02:59.870 align:middle line:90%
boom-- that's one
of the conditions.

77
02:59.870 --> 03:02.440 align:middle line:90%
Now, if we have two conditions
that we have to match,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.870 --> 03:02.440 align:middle line:90%
Now, if we have two conditions
that we have to match,

78
03:02.440 --> 03:04.440 align:middle line:90%
before we want this
policy set to kick in,

79
03:04.440 --> 03:05.850 align:middle line:84%
we can simply add it.

80
03:05.850 --> 03:08.100 align:middle line:90%
And you just click
on New right here.

81
03:08.100 --> 03:09.075 align:middle line:84%
Click on New.

82
03:09.075 --> 03:10.450 align:middle line:90%
And what was the
other condition?

83
03:10.450 --> 03:13.200 align:middle line:90%
It was-- oh, site 1, and
it has to be a switch.

84
03:13.200 --> 03:16.860 align:middle line:90%
So go ahead and click
on the attribute here.

85
03:16.860 --> 03:20.160 align:middle line:90%
And specify device
type right here.

86
03:20.160 --> 03:21.210 align:middle line:84%
Then equals.

87
03:21.210 --> 03:24.750 align:middle line:90%
And it is going to be-- we're
looking for switch singular.

88
03:24.750 --> 03:26.730 align:middle line:90%
And those relate to
those two attributes

89
03:26.730 --> 03:29.880 align:middle line:90%
that we associated with that
switch when we created it

90
03:29.880 --> 03:31.650 align:middle line:84%
in a previous video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:29.880 --> 03:31.650 align:middle line:84%
in a previous video.

91
03:31.650 --> 03:33.240 align:middle line:90%
And you can get
really tricky here.

92
03:33.240 --> 03:36.000 align:middle line:84%
You can do OR instead of AND.

93
03:36.000 --> 03:38.850 align:middle line:90%
I want those two conditions
that they have to exist.

94
03:38.850 --> 03:41.022 align:middle line:90%
And you can save this
as a library condition,

95
03:41.022 --> 03:42.480 align:middle line:90%
or you can just
say, you know what?

96
03:42.480 --> 03:43.800 align:middle line:90%
I don't want to name
it and use it again.

97
03:43.800 --> 03:45.840 align:middle line:90%
I'm just going to go
ahead and click on Use.

98
03:45.840 --> 03:48.270 align:middle line:90%
And it'll show up
here in your policy.

99
03:48.270 --> 03:50.340 align:middle line:90%
So what we have is we
have a policy set called

100
03:50.340 --> 03:53.550 align:middle line:84%
Our-Site1-Switch-Policy-Set.

101
03:53.550 --> 03:56.640 align:middle line:90%
And there's two conditions
where it has to be at site 1

102
03:56.640 --> 03:58.210 align:middle line:84%
and it has to be a switch.

103
03:58.210 --> 04:00.870 align:middle line:90%
And if both of those conditions
are met, what authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.210 --> 04:00.870 align:middle line:90%
And if both of those conditions
are met, what authentication

104
04:00.870 --> 04:02.700 align:middle line:84%
methods do we want to allow?

105
04:02.700 --> 04:07.920 align:middle line:90%
So default network access is a
large range of many extensible

106
04:07.920 --> 04:09.420 align:middle line:90%
authentication
protocols for 802.1x.

107
04:09.420 --> 04:11.190 align:middle line:84%
To And that will work here.

108
04:11.190 --> 04:12.750 align:middle line:90%
Although, we could
get very granular

109
04:12.750 --> 04:14.670 align:middle line:90%
and customize and
specify we only

110
04:14.670 --> 04:17.279 align:middle line:90%
want PEAP or FAST,
or something else.

111
04:17.279 --> 04:19.890 align:middle line:90%
But I'm going to use the
default network access.

112
04:19.890 --> 04:22.900 align:middle line:90%
And then we have this policy
set with these conditions.

113
04:22.900 --> 04:24.900 align:middle line:90%
Now, if it's
matched, take it out.

114
04:24.900 --> 04:27.960 align:middle line:90%
It's going to go ahead and
kick into the authentication,

115
04:27.960 --> 04:30.695 align:middle line:90%
and then subsequently the
authorization profiles.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:27.960 --> 04:30.695 align:middle line:90%
and then subsequently the
authorization profiles.

116
04:30.695 --> 04:31.320 align:middle line:84%
Check this out.

117
04:31.320 --> 04:32.737 align:middle line:90%
To see those, we're
going to click

118
04:32.737 --> 04:34.830 align:middle line:90%
on this little right
arrow, this chevron right

119
04:34.830 --> 04:36.150 align:middle line:84%
here over on the right.

120
04:36.150 --> 04:39.360 align:middle line:84%
And that expands it out.

121
04:39.360 --> 04:41.770 align:middle line:90%
It would expand it out, except
it's saying, Keith, Keith,

122
04:41.770 --> 04:43.230 align:middle line:90%
do you want to save
your work here?

123
04:43.230 --> 04:44.740 align:middle line:90%
Do you want to save
this policy set?

124
04:44.740 --> 04:47.910 align:middle line:90%
So I am going to click
on Save, and thank it

125
04:47.910 --> 04:50.580 align:middle line:90%
for reminding me that I
need to click on Save there.

126
04:50.580 --> 04:53.530 align:middle line:90%
And now I can click on this
little greater than symbol.

127
04:53.530 --> 04:57.480 align:middle line:90%
Take a look at the details
of the authentication

128
04:57.480 --> 05:00.810 align:middle line:90%
and the authorization policies
associated with this policy set
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:57.480 --> 05:00.810 align:middle line:90%
and the authorization policies
associated with this policy set

129
05:00.810 --> 05:02.150 align:middle line:84%
that we just created.

130
05:02.150 --> 05:04.940 align:middle line:90%
So here's the summary on
top of our policy set.

131
05:04.940 --> 05:06.690 align:middle line:90%
And then if we want
to look at the details

132
05:06.690 --> 05:09.660 align:middle line:90%
of the authentication
policy we simply open it up.

133
05:09.660 --> 05:13.920 align:middle line:90%
Now, there is a default,
which says, use all ID stores.

134
05:13.920 --> 05:17.370 align:middle line:90%
What we could do is
we could modify that,

135
05:17.370 --> 05:19.913 align:middle line:90%
and say, yeah, we could
just use our domain control.

136
05:19.913 --> 05:20.580 align:middle line:84%
That would work.

137
05:20.580 --> 05:24.750 align:middle line:90%
Or we could add a new
authentication rule

138
05:24.750 --> 05:26.250 align:middle line:84%
as part of this policy set.

139
05:26.250 --> 05:28.540 align:middle line:90%
So to create a new rule
for the authentication,

140
05:28.540 --> 05:30.450 align:middle line:84%
just click on the Plus.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
05:28.540 --> 05:30.450 align:middle line:84%
just click on the Plus.

141
05:30.450 --> 05:33.975 align:middle line:90%
And we'll call it
Our-authen-dot1x,

142
05:33.975 --> 05:35.850 align:middle line:90%
because what we're
looking for is just dot1x.

143
05:35.850 --> 05:38.190 align:middle line:90%
And if that's true, we can
set a condition saying,

144
05:38.190 --> 05:38.850 align:middle line:84%
you know what?

145
05:38.850 --> 05:40.267 align:middle line:90%
We want this
authentication policy

146
05:40.267 --> 05:42.150 align:middle line:84%
to be used if it's only dot1x.

147
05:42.150 --> 05:45.840 align:middle line:90%
So you can set the condition
here, the Plus symbol.

148
05:45.840 --> 05:49.020 align:middle line:90%
And there's a pre-built
library object over here called

149
05:49.020 --> 05:51.080 align:middle line:84%
Wired_802.1x.

150
05:51.080 --> 05:52.950 align:middle line:84%
You just drag and drop it.

151
05:52.950 --> 05:53.940 align:middle line:84%
And boom.

152
05:53.940 --> 05:55.482 align:middle line:90%
And that's going to
be the condition.

153
05:55.482 --> 05:57.870 align:middle line:90%
So if an authenticator,
like a switch,

154
05:57.870 --> 06:01.170 align:middle line:90%
is issuing requests for 802.1x
authentication to the identity
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
05:57.870 --> 06:01.170 align:middle line:90%
is issuing requests for 802.1x
authentication to the identity

155
06:01.170 --> 06:03.710 align:middle line:90%
services engine, this
is going to match.

156
06:03.710 --> 06:05.940 align:middle line:90%
So we'll go ahead
and click on Use.

157
06:05.940 --> 06:08.430 align:middle line:90%
And then we can
specify over here

158
06:08.430 --> 06:10.290 align:middle line:90%
what identity store
we want to use.

159
06:10.290 --> 06:13.530 align:middle line:90%
We can get very granular and
say our domain controller,

160
06:13.530 --> 06:15.427 align:middle line:90%
or we can say
All_User_ID_Stores.

161
06:15.427 --> 06:17.760 align:middle line:90%
So I'm going to say our domain
controller because I know

162
06:17.760 --> 06:19.750 align:middle line:84%
our users already exist there.

163
06:19.750 --> 06:21.860 align:middle line:90%
And if this matches
during the authentication,

164
06:21.860 --> 06:24.360 align:middle line:90%
it won't ever bother with going
to this second option, which

165
06:24.360 --> 06:26.065 align:middle line:90%
is the default. And
once that matches,

166
06:26.065 --> 06:28.440 align:middle line:90%
it's then going to go down to
the authorization policies.

167
06:28.440 --> 06:29.880 align:middle line:84%
Now, this is bad news.

168
06:29.880 --> 06:32.010 align:middle line:90%
We created this
brand new policy set.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
06:29.880 --> 06:32.010 align:middle line:90%
We created this
brand new policy set.

169
06:32.010 --> 06:36.660 align:middle line:90%
The authorization policy, by
default, says, deny access.

170
06:36.660 --> 06:38.010 align:middle line:84%
No matter what happened.

171
06:38.010 --> 06:39.473 align:middle line:90%
I don't care how
you authenticated.

172
06:39.473 --> 06:40.890 align:middle line:90%
I'm just going to
deny you access.

173
06:40.890 --> 06:44.670 align:middle line:90%
So what we could here is
I'm going to click on Plus.

174
06:44.670 --> 06:46.200 align:middle line:90%
I'm going to add a
new authorization

175
06:46.200 --> 06:47.770 align:middle line:84%
rule in this policy.

176
06:47.770 --> 06:50.500 align:middle line:90%
I'm going to call it, If You
Authenticated good enough.

177
06:50.500 --> 06:52.032 align:middle line:90%
And then regarding
the conditions,

178
06:52.032 --> 06:54.240 align:middle line:90%
I want to make sure that
they actually authenticated.

179
06:54.240 --> 06:56.700 align:middle line:90%
So there is an option
for that right here.

180
06:56.700 --> 06:57.450 align:middle line:84%
There we go.

181
06:57.450 --> 07:00.170 align:middle line:90%
Network Access
Authentication Passed.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
06:57.450 --> 07:00.170 align:middle line:90%
Network Access
Authentication Passed.

182
07:00.170 --> 07:01.250 align:middle line:84%
Boom.

183
07:01.250 --> 07:03.440 align:middle line:84%
And I'll click on Use.

184
07:03.440 --> 07:06.000 align:middle line:90%
And then if that's the
case, I will go ahead

185
07:06.000 --> 07:08.070 align:middle line:90%
and use the option of
permit access, which

186
07:08.070 --> 07:11.263 align:middle line:90%
is going to grant access to
the network, and click on Save.

187
07:11.263 --> 07:12.930 align:middle line:90%
So let's take a look
at the big picture.

188
07:12.930 --> 07:14.920 align:middle line:84%
Here's our policy set.

189
07:14.920 --> 07:18.450 align:middle line:90%
It's only going to trigger if
both these conditions are true.

190
07:18.450 --> 07:20.160 align:middle line:90%
If that's the case,
it's then going

191
07:20.160 --> 07:23.340 align:middle line:90%
to run the authentication
rules, which are right here.

192
07:23.340 --> 07:27.120 align:middle line:90%
The first rule is looking for an
802.1x wired connection trying

193
07:27.120 --> 07:30.000 align:middle line:90%
to authenticate, which we
are going to demonstrate here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

194
07:30.000 --> 07:31.000 align:middle line:84%
in a moment.

195
07:31.000 --> 07:33.690 align:middle line:90%
And if that happens, we're going
to use a domain controller,

196
07:33.690 --> 07:36.990 align:middle line:90%
labelled Our-DC for
the authentication.

197
07:36.990 --> 07:38.723 align:middle line:90%
And based on the
authentication passing,

198
07:38.723 --> 07:40.890 align:middle line:90%
it would then get to the
authorization policy, where

199
07:40.890 --> 07:44.880 align:middle line:90%
the first rule says, if you
authenticated good enough,

200
07:44.880 --> 07:47.730 align:middle line:90%
and the conditions are you
passed network authentication,

201
07:47.730 --> 07:49.273 align:middle line:84%
then you're going to get access.

202
07:49.273 --> 07:51.690 align:middle line:90%
Now, the other cool thing is
this, because those names are

203
07:51.690 --> 07:54.480 align:middle line:90%
significantly different, our
policy set name is different,

204
07:54.480 --> 07:56.180 align:middle line:90%
the authentication
rule is different,

205
07:56.180 --> 07:57.840 align:middle line:90%
the authorization
rule is different,

206
07:57.840 --> 08:00.210 align:middle line:90%
if we actually test this,
which we're going to,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

206
07:57.840 --> 08:00.210 align:middle line:90%
if we actually test this,
which we're going to,

207
08:00.210 --> 08:04.290 align:middle line:90%
and look at the logs, we'll
be able to visually see

208
08:04.290 --> 08:06.420 align:middle line:90%
that the exact rules
for authentication

209
08:06.420 --> 08:07.907 align:middle line:84%
and authorization were hit.

210
08:07.907 --> 08:10.490 align:middle line:90%
And when you're troubleshooting,
especially with new policies,

211
08:10.490 --> 08:12.090 align:middle line:90%
that's an important
skill to have.

212
08:12.090 --> 08:12.930 align:middle line:84%
Test.

213
08:12.930 --> 08:14.030 align:middle line:84%
Look at the logs.

214
08:14.030 --> 08:16.080 align:middle line:90%
See what went wrong,
or see what went right,

215
08:16.080 --> 08:18.340 align:middle line:90%
and just verify
that it's working.

216
08:18.340 --> 08:20.610 align:middle line:90%
Let's go to the client,
and let's attempt

217
08:20.610 --> 08:23.520 align:middle line:84%
a login as either Bob or Lewis.

218
08:23.520 --> 08:25.680 align:middle line:90%
So to do that, we'll
bring up our client.

219
08:25.680 --> 08:30.420 align:middle line:90%
And I'm just going to bounce the
interface by going to Disable.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

219
08:25.680 --> 08:30.420 align:middle line:90%
And I'm just going to bounce the
interface by going to Disable.

220
08:30.420 --> 08:32.390 align:middle line:90%
And I don't recall if
we put Bob or Lewis in,

221
08:32.390 --> 08:34.140 align:middle line:90%
but they should both
work, because they're

222
08:34.140 --> 08:35.640 align:middle line:84%
both in Active Directory.

223
08:35.640 --> 08:36.809 align:middle line:84%
And we'll just right-click.

224
08:36.809 --> 08:38.919 align:middle line:84%
Enable it.

225
08:38.919 --> 08:41.169 align:middle line:84%
Cross our fingers.

226
08:41.169 --> 08:43.270 align:middle line:90%
That looks pretty
positive right there.

227
08:43.270 --> 08:44.920 align:middle line:84%
Let's go look at the logs.

228
08:44.920 --> 08:48.250 align:middle line:90%
So in ISE we just
go to Operations.

229
08:48.250 --> 08:52.310 align:middle line:90%
And just click on Live
Logs under Radius.

230
08:52.310 --> 08:53.260 align:middle line:84%
And it was Bob.

231
08:53.260 --> 08:53.760 align:middle line:84%
OK.

232
08:53.760 --> 08:54.320 align:middle line:84%
Cool.

233
08:54.320 --> 08:56.150 align:middle line:90%
So that little
indicator there means

234
08:56.150 --> 08:57.380 align:middle line:84%
Bob currently has a session.

235
08:57.380 --> 08:59.090 align:middle line:84%
He's currently authenticated.

236
08:59.090 --> 09:01.550 align:middle line:90%
And if we click on the
detail report here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

236
08:59.090 --> 09:01.550 align:middle line:90%
And if we click on the
detail report here,

237
09:01.550 --> 09:03.200 align:middle line:84%
it'll give us the full scoop.

238
09:03.200 --> 09:05.700 align:middle line:90%
Default. Wait, wait,
wait, wait, wait.

239
09:05.700 --> 09:06.750 align:middle line:84%
That doesn't look right.

240
09:06.750 --> 09:09.950 align:middle line:90%
And that says authentication
policy Default Dot1X

241
09:09.950 --> 09:12.470 align:middle line:90%
and Default Basic
Authenticated Access.

242
09:12.470 --> 09:13.700 align:middle line:84%
And it is using the defaults.

243
09:13.700 --> 09:15.603 align:middle line:84%
That is not hitting our policy.

244
09:15.603 --> 09:17.520 align:middle line:90%
That's not hitting the
policy we just created.

245
09:17.520 --> 09:19.640 align:middle line:84%
Let's go find out why.

246
09:19.640 --> 09:23.120 align:middle line:90%
And if it's because I didn't
hit Save, shame on me.

247
09:23.120 --> 09:25.410 align:middle line:84%
So we'll go back to Policy Sets.

248
09:25.410 --> 09:28.100 align:middle line:90%
And we have
Our-Site-1-Switch-Policy-Set.

249
09:28.100 --> 09:30.732 align:middle line:84%
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

249
09:28.100 --> 09:30.732 align:middle line:84%


250
09:30.732 --> 09:33.200 align:middle line:84%
The device is switch.

251
09:33.200 --> 09:36.742 align:middle line:90%
Let's go back and verify
with our network resources

252
09:36.742 --> 09:38.200 align:middle line:90%
that we have that
set up correctly.

253
09:38.200 --> 09:42.540 align:middle line:90%
Here's switch one,
site 1, switch.

254
09:42.540 --> 09:45.400 align:middle line:84%
To me that looks good.

255
09:45.400 --> 09:47.075 align:middle line:84%
I don't see a problem with that.

256
09:47.075 --> 09:48.035 align:middle line:84%
Go back to our policy.

257
09:48.035 --> 09:51.110 align:middle line:84%


258
09:51.110 --> 09:55.430 align:middle line:90%
And if we expand that, what's
happening based on the log

259
09:55.430 --> 10:00.920 align:middle line:90%
file, it said it was doing
default, not this policy,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

259
09:55.430 --> 10:00.920 align:middle line:90%
file, it said it was doing
default, not this policy,

260
10:00.920 --> 10:03.180 align:middle line:84%
and not this policy set.

261
10:03.180 --> 10:06.070 align:middle line:90%
I'm just trying
to figure out why.

262
10:06.070 --> 10:11.190 align:middle line:84%
So that was the policy set.

263
10:11.190 --> 10:16.630 align:middle line:90%
Here's our first rule for
authentication, Wired_ 802.1X.

264
10:16.630 --> 10:18.770 align:middle line:84%
Our domain controller.

265
10:18.770 --> 10:21.380 align:middle line:84%
We should use authentication.

266
10:21.380 --> 10:26.620 align:middle line:90%
And then for authorization, oh,
man, and it was using default,

267
10:26.620 --> 10:28.140 align:middle line:84%
I think, everything.

268
10:28.140 --> 10:29.760 align:middle line:84%
Hmm.

269
10:29.760 --> 10:31.110 align:middle line:84%
Well, let's try it again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

269
10:29.760 --> 10:31.110 align:middle line:84%
Well, let's try it again.

270
10:31.110 --> 10:32.790 align:middle line:84%
This all looks correct to me.

271
10:32.790 --> 10:34.300 align:middle line:84%
Let's go back.

272
10:34.300 --> 10:38.100 align:middle line:90%
I'm going to disable
that interface.

273
10:38.100 --> 10:39.750 align:middle line:84%
Someone connected to my switch.

274
10:39.750 --> 10:41.560 align:middle line:90%
I'm going to peek at
the switch real quick.

275
10:41.560 --> 10:43.360 align:middle line:84%
So the interface is down.

276
10:43.360 --> 10:49.565 align:middle line:84%


277
10:49.565 --> 10:50.940 align:middle line:90%
I really would
like this to work,

278
10:50.940 --> 10:52.770 align:middle line:90%
because everything
looks correct to me.

279
10:52.770 --> 10:55.572 align:middle line:84%


280
10:55.572 --> 10:57.770 align:middle line:84%
Attempting to authenticate.

281
10:57.770 --> 10:58.930 align:middle line:84%
Authenticating successful.

282
10:58.930 --> 11:00.970 align:middle line:84%
Authorization.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

282
10:58.930 --> 11:00.970 align:middle line:84%
Authorization.

283
11:00.970 --> 11:01.930 align:middle line:84%
Well, he authenticated.

284
11:01.930 --> 11:05.730 align:middle line:90%
Let's go take a look
at the logs again.

285
11:05.730 --> 11:10.480 align:middle line:90%
So on the ISE page, we'll
go to Operations, Live Logs.

286
11:10.480 --> 11:13.190 align:middle line:84%
I'm going to click on Refresh.

287
11:13.190 --> 11:15.200 align:middle line:84%
Make sure-- oh, there we go.

288
11:15.200 --> 11:17.420 align:middle line:90%
Over on the right-hand
side, look at that.

289
11:17.420 --> 11:19.460 align:middle line:90%
So if we look at the
timestamps, too, we

290
11:19.460 --> 11:22.370 align:middle line:84%
can verify when we retried.

291
11:22.370 --> 11:25.310 align:middle line:90%
Over here on the right it's
showing the authentication

292
11:25.310 --> 11:26.750 align:middle line:84%
policy that was used.

293
11:26.750 --> 11:29.990 align:middle line:90%
So for the
authentication policy,

294
11:29.990 --> 11:32.370 align:middle line:90%
it used
Our-Site-Switch-1-Policy-Set,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

294
11:29.990 --> 11:32.370 align:middle line:90%
it used
Our-Site-Switch-1-Policy-Set,

295
11:32.370 --> 11:33.150 align:middle line:84%
fantastic.

296
11:33.150 --> 11:36.090 align:middle line:90%
And for the
authorization policy,

297
11:36.090 --> 11:38.180 align:middle line:84%
it used the correct one as well.

298
11:38.180 --> 11:39.830 align:middle line:90%
Maybe I just didn't
allow the log

299
11:39.830 --> 11:41.997 align:middle line:90%
to update quite fast enough,
because I didn't change

300
11:41.997 --> 11:43.870 align:middle line:84%
a thing since we configured it.

301
11:43.870 --> 11:46.916 align:middle line:90%
So let me take a look at
the report one more time.

302
11:46.916 --> 11:49.090 align:middle line:84%
Oh, yeah, there you go.

303
11:49.090 --> 11:50.410 align:middle line:84%
Maybe I was too aggressive.

304
11:50.410 --> 11:52.090 align:middle line:90%
And I didn't give a
chance for the logs

305
11:52.090 --> 11:53.620 align:middle line:84%
to catch up with my viewing.

306
11:53.620 --> 11:55.590 align:middle line:90%
But this is what
I'd expect to see--

307
11:55.590 --> 11:57.390 align:middle line:84%
the authentication policy.

308
11:57.390 --> 11:59.010 align:middle line:84%
So here's our policy set.

309
11:59.010 --> 12:01.510 align:middle line:90%
And within that policy set, we
use the authentication policy
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

309
11:59.010 --> 12:01.510 align:middle line:90%
And within that policy set, we
use the authentication policy

310
12:01.510 --> 12:02.560 align:middle line:84%
of this.

311
12:02.560 --> 12:04.570 align:middle line:90%
And regarding
authorization, we use

312
12:04.570 --> 12:10.270 align:middle line:90%
from the same policy set this
authorization policy, which

313
12:10.270 --> 12:12.220 align:middle line:90%
basically said, hey,
if you authenticated,

314
12:12.220 --> 12:13.310 align:middle line:84%
you're getting access.

315
12:13.310 --> 12:15.520 align:middle line:90%
So now that we've had a
taste of what we can do,

316
12:15.520 --> 12:17.290 align:middle line:90%
as far as controlling
the authentication

317
12:17.290 --> 12:20.350 align:middle line:90%
and authorization, I'd like
to crank it up a little bit

318
12:20.350 --> 12:23.470 align:middle line:90%
with something called
a policy element.

319
12:23.470 --> 12:26.260 align:middle line:90%
We'll take a closer look at
those in the very next video.

320
12:26.260 --> 12:27.970 align:middle line:90%
So I'll see you there
in just a moment.

321
12:27.970 --> 12:30.550 align:middle line:90%
Meanwhile, I hope this has
been informative for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

321
12:27.970 --> 12:30.550 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

322
12:30.550 --> 12:33.780 align:middle line:90%
And I'd like to thank
you for viewing.