WEBVTT

1
00:00.000 --> 00:01.490 align:middle line:84%


2
00:01.490 --> 00:03.830 align:middle line:90%
One of the coolest
things about controlling

3
00:03.830 --> 00:06.470 align:middle line:90%
based on a user account what
they can do on the network

4
00:06.470 --> 00:08.540 align:middle line:90%
is controlling what they
can do on the network.

5
00:08.540 --> 00:10.610 align:middle line:90%
And we do that with
authorization policies

6
00:10.610 --> 00:11.810 align:middle line:84%
and profiles.

7
00:11.810 --> 00:14.690 align:middle line:90%
A big part of that is
identifying the ingredients,

8
00:14.690 --> 00:17.000 align:middle line:90%
the policy elements that
are going to be pushed down

9
00:17.000 --> 00:20.210 align:middle line:90%
to that user who's connecting
on that port, things such as,

10
00:20.210 --> 00:22.100 align:middle line:84%
what VLANs do they belong to?

11
00:22.100 --> 00:23.720 align:middle line:90%
Or what access
control list do you

12
00:23.720 --> 00:26.660 align:middle line:90%
want to enforce on the user
for their stay on the network?

13
00:26.660 --> 00:29.510 align:middle line:90%
Or what AV pair should
we push to that user?

14
00:29.510 --> 00:32.540 align:middle line:90%
All those are options that we
can implement with 802.1x with
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.510 --> 00:32.540 align:middle line:90%
All those are options that we
can implement with 802.1x with

15
00:32.540 --> 00:34.250 align:middle line:90%
something called
policy elements.

16
00:34.250 --> 00:36.980 align:middle line:90%
And that's what I'd like to
share with you in this video.

17
00:36.980 --> 00:39.500 align:middle line:90%
And here is one way of
getting to policy elements

18
00:39.500 --> 00:41.720 align:middle line:90%
through the tab
for Work Centers,

19
00:41.720 --> 00:43.640 align:middle line:84%
and down under Network Access.

20
00:43.640 --> 00:47.060 align:middle line:90%
And there's an option here for
policy elements right there.

21
00:47.060 --> 00:49.470 align:middle line:90%
Not the only way to get there,
but certainly one of them.

22
00:49.470 --> 00:51.762 align:middle line:90%
So in a policy element, what
we're going to do is this.

23
00:51.762 --> 00:54.260 align:middle line:90%
We're going to go down
to the Results section.

24
00:54.260 --> 00:56.510 align:middle line:90%
And here's where we can
specify allowed protocols,

25
00:56.510 --> 01:00.260 align:middle line:90%
authorization profiles, and
downloadable ACLs, all of which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:56.510 --> 01:00.260 align:middle line:90%
authorization profiles, and
downloadable ACLs, all of which

26
01:00.260 --> 01:02.120 align:middle line:84%
are really, really cool.

27
01:02.120 --> 01:04.370 align:middle line:90%
Let's imagine-- let's start
with downloadable ACLs.

28
01:04.370 --> 01:08.270 align:middle line:90%
Let's imagine that for a
group of people or individuals

29
01:08.270 --> 01:10.520 align:middle line:90%
in a group who
authenticate, we want

30
01:10.520 --> 01:13.040 align:middle line:90%
to push down a
dynamic downloadable

31
01:13.040 --> 01:17.625 align:middle line:90%
ACL that's enforced for them for
their duration on the network.

32
01:17.625 --> 01:20.000 align:middle line:90%
To do that, we're going to
include it in an authorization

33
01:20.000 --> 01:23.690 align:middle line:90%
profile, but we need to define
the downloadable ACL first.

34
01:23.690 --> 01:25.550 align:middle line:84%
To do that, we'll click on Add.

35
01:25.550 --> 01:33.290 align:middle line:90%
And let's create one that
says no ICMP or telnet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:25.550 --> 01:33.290 align:middle line:90%
And let's create one that
says no ICMP or telnet.

36
01:33.290 --> 01:34.900 align:middle line:84%
Let's do that.

37
01:34.900 --> 01:36.200 align:middle line:84%
No ICMP or telnet.

38
01:36.200 --> 01:37.580 align:middle line:84%
And that's not a bad idea.

39
01:37.580 --> 01:40.647 align:middle line:90%
Well, ICMP, they may need,
but that's OK for a demo.

40
01:40.647 --> 01:42.980 align:middle line:90%
And then down here we'll put
in the access control list.

41
01:42.980 --> 01:48.740 align:middle line:90%
It would be like
deny icmp any any.

42
01:48.740 --> 01:49.290 align:middle line:84%
That'll work.

43
01:49.290 --> 01:54.090 align:middle line:90%
And deny tcp protocol
from anywhere

44
01:54.090 --> 01:57.950 align:middle line:90%
to anywhere if the destination
port equals port 23.

45
01:57.950 --> 02:00.480 align:middle line:90%
And if you're not sure of
your syntax, have no fear.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:57.950 --> 02:00.480 align:middle line:90%
And if you're not sure of
your syntax, have no fear.

46
02:00.480 --> 02:01.680 align:middle line:84%
Check this out.

47
02:01.680 --> 02:03.780 align:middle line:84%
Check dynamic ACL syntax.

48
02:03.780 --> 02:04.560 align:middle line:84%
It's valid.

49
02:04.560 --> 02:05.220 align:middle line:84%
Yay!

50
02:05.220 --> 02:06.570 align:middle line:84%
We'll click on Submit.

51
02:06.570 --> 02:10.050 align:middle line:90%
Now we have this
NoICMP-Telnet dynamic ACL

52
02:10.050 --> 02:13.260 align:middle line:90%
that can be downloaded to
a network access device,

53
02:13.260 --> 02:16.590 align:middle line:90%
like a switch, and logically
enforced for that customer

54
02:16.590 --> 02:18.390 align:middle line:84%
while they're on the network.

55
02:18.390 --> 02:20.940 align:middle line:90%
So next, let's go to
Authorization Profiles.

56
02:20.940 --> 02:23.640 align:middle line:90%
This is where we could include
things like, what VLAN should

57
02:23.640 --> 02:24.690 align:middle line:84%
the user be on?

58
02:24.690 --> 02:28.440 align:middle line:90%
And what dynamic or downloadable
ACL should be there?

59
02:28.440 --> 02:29.460 align:middle line:84%
So if we create--

60
02:29.460 --> 02:31.920 align:middle line:84%
let's create two profiles.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.460 --> 02:31.920 align:middle line:84%
let's create two profiles.

61
02:31.920 --> 02:33.820 align:middle line:84%
We'll make one for--

62
02:33.820 --> 02:34.510 align:middle line:84%
let's see here.

63
02:34.510 --> 02:39.507 align:middle line:90%
Let's do one for ISE-Admins
and ACCESS ACCEPT.

64
02:39.507 --> 02:40.340 align:middle line:84%
That would be great.

65
02:40.340 --> 02:43.580 align:middle line:90%
And let's go down here and
say, for ISE-Admins no access

66
02:43.580 --> 02:45.780 align:middle line:84%
control list, no worries there.

67
02:45.780 --> 02:49.790 align:middle line:90%
Let's go ahead and hand
out a specific VLAN.

68
02:49.790 --> 02:53.200 align:middle line:90%
And so for the admins,
let's put them in VLAN 30.

69
02:53.200 --> 02:55.270 align:middle line:90%
And then there's just
tons-- security groups,

70
02:55.270 --> 02:58.402 align:middle line:90%
and voice domain permissions,
and just on, and on, and on.

71
02:58.402 --> 02:59.860 align:middle line:90%
And if you go down
further, there's

72
02:59.860 --> 03:03.040 align:middle line:90%
options for specific AV
pairs and other attributes
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:59.860 --> 03:03.040 align:middle line:90%
options for specific AV
pairs and other attributes

73
03:03.040 --> 03:04.060 align:middle line:84%
that we could push out.

74
03:04.060 --> 03:08.733 align:middle line:90%
So for the demo, let's go
ahead and stick with VLAN.

75
03:08.733 --> 03:10.900 align:middle line:90%
So I'm going to go ahead
and scroll all the way down

76
03:10.900 --> 03:12.460 align:middle line:84%
and click on Submit.

77
03:12.460 --> 03:14.470 align:middle line:90%
And now I've got
this ISE-Admins that

78
03:14.470 --> 03:16.000 align:middle line:84%
are going to be in VLAN 30.

79
03:16.000 --> 03:18.610 align:middle line:90%
Let's create one more
for ISE-Operation.

80
03:18.610 --> 03:22.600 align:middle line:90%
And let's also specify that
we want a downloadable ACL.

81
03:22.600 --> 03:25.390 align:middle line:90%
And it'll give us a list of
all the ones that we have.

82
03:25.390 --> 03:28.070 align:middle line:84%
No ICMP, no telnet, fantastic.

83
03:28.070 --> 03:30.520 align:middle line:84%
We'll put in VLAN 80 as a demo.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:28.070 --> 03:30.520 align:middle line:84%
We'll put in VLAN 80 as a demo.

84
03:30.520 --> 03:32.920 align:middle line:90%
And then I'll scroll all
the way to the bottom,

85
03:32.920 --> 03:35.450 align:middle line:84%
and we'll click on Submit.

86
03:35.450 --> 03:38.230 align:middle line:90%
Now, just having these
authorization profiles

87
03:38.230 --> 03:41.150 align:middle line:90%
are not going to do us too
much good unless we apply them

88
03:41.150 --> 03:43.440 align:middle line:84%
as part of a policy set.

89
03:43.440 --> 03:45.000 align:middle line:90%
So let's go ahead
and do that next.

90
03:45.000 --> 03:47.420 align:middle line:90%
We go to Policy, Policy
Sets, just like we

91
03:47.420 --> 03:48.940 align:middle line:84%
did in the previous video.

92
03:48.940 --> 03:50.270 align:middle line:84%
And let's play with our--

93
03:50.270 --> 03:52.160 align:middle line:90%
we already verified
that this first policy

94
03:52.160 --> 03:53.870 align:middle line:84%
set is being matched on.

95
03:53.870 --> 03:55.520 align:middle line:84%
Let's go ahead and use that.

96
03:55.520 --> 03:56.930 align:middle line:84%
We'll expand it.

97
03:56.930 --> 03:59.420 align:middle line:90%
And we'll go down to--
we already also verified

98
03:59.420 --> 04:03.230 align:middle line:90%
that the authentication policy
is kicking in with this rule.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:59.420 --> 04:03.230 align:middle line:90%
that the authentication policy
is kicking in with this rule.

99
04:03.230 --> 04:05.660 align:middle line:90%
Let's go down to the
authorization policy.

100
04:05.660 --> 04:07.640 align:middle line:90%
And let's apply those
authorization profiles

101
04:07.640 --> 04:09.830 align:middle line:84%
based on group membership.

102
04:09.830 --> 04:11.280 align:middle line:84%
And here's how we could do that.

103
04:11.280 --> 04:14.590 align:middle line:90%
I'm going to delete this, If
You Authenticated good enough.

104
04:14.590 --> 04:17.660 align:middle line:90%
And I go over here,
and say, Delete.

105
04:17.660 --> 04:19.170 align:middle line:84%
Get rid of that.

106
04:19.170 --> 04:20.390 align:middle line:84%
Oh, it's gone.

107
04:20.390 --> 04:23.810 align:middle line:90%
And let's go ahead
and add, plus symbol.

108
04:23.810 --> 04:27.620 align:middle line:84%
Let's add one called Admins.

109
04:27.620 --> 04:30.900 align:middle line:90%
And then the conditions for
that, for admins, for this,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:27.620 --> 04:30.900 align:middle line:90%
And then the conditions for
that, for admins, for this,

110
04:30.900 --> 04:35.000 align:middle line:90%
they have to be a member
of the admins group for ISE

111
04:35.000 --> 04:36.440 align:middle line:84%
in Active Directory.

112
04:36.440 --> 04:39.800 align:middle line:90%
To do that, we can click here
under the attribute, then down

113
04:39.800 --> 04:41.210 align:middle line:84%
under Dictionaries.

114
04:41.210 --> 04:43.880 align:middle line:90%
And then down under
Dictionaries, Our-DC,

115
04:43.880 --> 04:47.210 align:middle line:90%
which is our domain controller
for Active Directory.

116
04:47.210 --> 04:48.410 align:middle line:84%
We'll click there.

117
04:48.410 --> 04:51.260 align:middle line:90%
And then from there, we want
to specify specific group

118
04:51.260 --> 04:54.320 align:middle line:90%
membership that's required
for the authorization we're

119
04:54.320 --> 04:55.110 align:middle line:84%
about to give.

120
04:55.110 --> 04:57.820 align:middle line:90%
So if we click on
external groups,

121
04:57.820 --> 04:59.540 align:middle line:90%
and then with the
equals in place,

122
04:59.540 --> 05:01.790 align:middle line:90%
we're going to go ahead and
choose from the list here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:59.540 --> 05:01.790 align:middle line:90%
we're going to go ahead and
choose from the list here.

123
05:01.790 --> 05:04.400 align:middle line:90%
Here's our four groups that
we had brought in earlier

124
05:04.400 --> 05:05.810 align:middle line:84%
from Active Directory.

125
05:05.810 --> 05:08.030 align:middle line:90%
So if we bring in
the ISE-Admins group,

126
05:08.030 --> 05:10.100 align:middle line:90%
this basically says
that the condition

127
05:10.100 --> 05:13.010 align:middle line:90%
is that the user who is
authenticated, if they're

128
05:13.010 --> 05:16.880 align:middle line:90%
a member of ISE-Admins, then
we can go ahead and grant them

129
05:16.880 --> 05:18.640 align:middle line:84%
a specific authorization.

130
05:18.640 --> 05:20.490 align:middle line:90%
So we'll go ahead
and click on Use.

131
05:20.490 --> 05:22.252 align:middle line:90%
And then here in
the Results column,

132
05:22.252 --> 05:23.960 align:middle line:90%
we can specify what
we want to give them.

133
05:23.960 --> 05:27.020 align:middle line:90%
So that included the VLAN
identifier of 30, I believe.

134
05:27.020 --> 05:27.950 align:middle line:84%
And that looks great.

135
05:27.950 --> 05:32.120 align:middle line:90%
And let's create one more
authorization rule for members
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:27.950 --> 05:32.120 align:middle line:90%
And let's create one more
authorization rule for members

136
05:32.120 --> 05:34.490 align:middle line:84%
of the group ICE-Operations.

137
05:34.490 --> 05:36.540 align:middle line:90%
And to do that, we'll
click on the plus symbol.

138
05:36.540 --> 05:39.420 align:middle line:84%
We'll call it ISE-OPS.

139
05:39.420 --> 05:41.902 align:middle line:90%
And the conditions are
very similar to last time,

140
05:41.902 --> 05:43.860 align:middle line:90%
except we're going to
choose a different group.

141
05:43.860 --> 05:47.430 align:middle line:90%
So we'll click on an attribute
in the dictionary's field.

142
05:47.430 --> 05:50.140 align:middle line:90%
And then scroll down to
our domain controller.

143
05:50.140 --> 05:54.270 align:middle line:90%
Then select External Groups
on the down list here.

144
05:54.270 --> 05:56.020 align:middle line:90%
Then if that's correct,
we want to make

145
05:56.020 --> 05:58.685 align:middle line:90%
sure all the parameters
are right, and Use.

146
05:58.685 --> 06:00.310 align:middle line:90%
And then we can assign
them the profile
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:58.685 --> 06:00.310 align:middle line:90%
And then we can assign
them the profile

147
06:00.310 --> 06:01.352 align:middle line:84%
that we created for them.

148
06:01.352 --> 06:04.800 align:middle line:90%
So from the dropdown list,
ICE-Operations, which included

149
06:04.800 --> 06:05.530 align:middle line:84%
VLAN 80.

150
06:05.530 --> 06:07.990 align:middle line:90%
It also included
a downloadable ACL

151
06:07.990 --> 06:09.320 align:middle line:84%
that's going to be enforced.

152
06:09.320 --> 06:11.590 align:middle line:90%
So let's take a look at
our work here real quick.

153
06:11.590 --> 06:15.030 align:middle line:90%
We've got this policy set
Our-Site1-Switch-Policy-Set.

154
06:15.030 --> 06:17.440 align:middle line:90%
These are the conditions
that would cause it to match.

155
06:17.440 --> 06:20.860 align:middle line:90%
If that happens, we then have
these authentication policy

156
06:20.860 --> 06:24.160 align:middle line:90%
Rules then there's an
authorization policy.

157
06:24.160 --> 06:26.320 align:middle line:90%
If they're a member of
the group ISE-Operations,

158
06:26.320 --> 06:29.050 align:middle line:90%
they get that profile
for authorization.

159
06:29.050 --> 06:31.420 align:middle line:90%
If they're a member of
the group ISE-Admins,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:29.050 --> 06:31.420 align:middle line:90%
If they're a member of
the group ISE-Admins,

160
06:31.420 --> 06:33.160 align:middle line:90%
they're going to
get that profile.

161
06:33.160 --> 06:36.120 align:middle line:90%
Once it's saved, we'll
go ahead and test it.

162
06:36.120 --> 06:38.500 align:middle line:90%
So to test it, we'll
bring up our client.

163
06:38.500 --> 06:40.360 align:middle line:90%
And I'm going to
right-click on the client.

164
06:40.360 --> 06:41.680 align:middle line:84%
Go to Properties.

165
06:41.680 --> 06:44.020 align:middle line:90%
And let's, first of
all, test it as Bob.

166
06:44.020 --> 06:45.990 align:middle line:90%
And click on the
Authentication tab.

167
06:45.990 --> 06:46.960 align:middle line:84%
Replace credentials.

168
06:46.960 --> 06:49.550 align:middle line:90%
I just want to make sure
we're going to try Bob first.

169
06:49.550 --> 06:51.248 align:middle line:84%
We'll click on OK.

170
06:51.248 --> 06:53.290 align:middle line:90%
Now, Bob, because he's a
member of the Operations

171
06:53.290 --> 06:56.410 align:middle line:90%
group in Active Directory,
he should authenticate,

172
06:56.410 --> 06:58.570 align:middle line:90%
and that switch
for that he's on,

173
06:58.570 --> 07:02.260 align:middle line:84%
Fa0/1, should now be in VLAN 80.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

173
06:58.570 --> 07:02.260 align:middle line:84%
Fa0/1, should now be in VLAN 80.

174
07:02.260 --> 07:03.040 align:middle line:84%
Let's verify that.

175
07:03.040 --> 07:03.665 align:middle line:84%
We can do that.

176
07:03.665 --> 07:05.870 align:middle line:90%
Here we've got a
console port right here.

177
07:05.870 --> 07:08.105 align:middle line:84%
Let's do a show vlan brief.

178
07:08.105 --> 07:08.980 align:middle line:84%
So we have the VLANs.

179
07:08.980 --> 07:09.592 align:middle line:84%
That's great.

180
07:09.592 --> 07:10.300 align:middle line:84%
Oh, look at that.

181
07:10.300 --> 07:11.500 align:middle line:84%
VLAN 80 right there.

182
07:11.500 --> 07:13.690 align:middle line:84%
Fa0/1 is in VLAN 80.

183
07:13.690 --> 07:17.410 align:middle line:90%
And if we do a show
run interface Fa0/1,

184
07:17.410 --> 07:21.370 align:middle line:90%
you'll notice that by default
he's been assigned to VLAN 999.

185
07:21.370 --> 07:26.020 align:middle line:90%
But the 802.1x authorization
forced that to VLAN 80.

186
07:26.020 --> 07:27.610 align:middle line:84%
Also, check this out.

187
07:27.610 --> 07:30.940 align:middle line:90%
If you go show access list,
look at this access list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

187
07:27.610 --> 07:30.940 align:middle line:90%
If you go show access list,
look at this access list.

188
07:30.940 --> 07:32.830 align:middle line:90%
This is the
downloadable access list

189
07:32.830 --> 07:35.410 align:middle line:90%
that was downloaded from
the identity services engine

190
07:35.410 --> 07:37.180 align:middle line:90%
to this switch,
which this switch is

191
07:37.180 --> 07:41.180 align:middle line:90%
now logically enforcing on that
port that Bob is connected to.

192
07:41.180 --> 07:43.060 align:middle line:90%
We can also do a
show authentication

193
07:43.060 --> 07:46.405 align:middle line:84%
sessions interface Fa0/1.

194
07:46.405 --> 07:48.780 align:middle line:90%
And it will also give us
details about the authentication

195
07:48.780 --> 07:50.950 align:middle line:84%
and authorization on this port.

196
07:50.950 --> 07:52.380 align:middle line:84%
It knows it's Bob.

197
07:52.380 --> 07:53.770 align:middle line:84%
Here's Bob's IP address.

198
07:53.770 --> 07:57.560 align:middle line:90%
Oh, oh, you know Bob
should not be able to do?

199
07:57.560 --> 08:01.730 align:middle line:90%
Bob should not be able to ping
based on that downloadable ACL
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

199
07:57.560 --> 08:01.730 align:middle line:90%
Bob should not be able to ping
based on that downloadable ACL

200
08:01.730 --> 08:03.410 align:middle line:84%
that is restricting ICMP.

201
08:03.410 --> 08:04.572 align:middle line:84%
So if we do a ping--

202
08:04.572 --> 08:06.322 align:middle line:90%
and here on Bob's
computer, let's bring up

203
08:06.322 --> 08:07.520 align:middle line:84%
a command prompt.

204
08:07.520 --> 08:09.310 align:middle line:84%
Let's do an ip config.

205
08:09.310 --> 08:12.800 align:middle line:90%
So he get an IP address
via DHCP of 10.80.0.12.

206
08:12.800 --> 08:14.640 align:middle line:90%
That's the interface
that was brought up

207
08:14.640 --> 08:15.820 align:middle line:84%
and was authenticated.

208
08:15.820 --> 08:19.310 align:middle line:90%
There is an IP address
of the switch, .1.

209
08:19.310 --> 08:25.550 align:middle line:90%
So if we did a ping, 10.80.0.1,
that's not going anywhere.

210
08:25.550 --> 08:27.920 align:middle line:90%
That's because the
switch is stopping it.

211
08:27.920 --> 08:30.440 align:middle line:90%
If we tried to telnet,
it would stop it as well,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

211
08:27.920 --> 08:30.440 align:middle line:90%
If we tried to telnet,
it would stop it as well,

212
08:30.440 --> 08:33.710 align:middle line:90%
because the downloadable ACL
prevented telnet, and also

213
08:33.710 --> 08:35.048 align:middle line:84%
blocked all ICMP.

214
08:35.048 --> 08:35.840 align:middle line:84%
But check this out.

215
08:35.840 --> 08:38.510 align:middle line:90%
If we do a Control-C
and break out of that,

216
08:38.510 --> 08:41.325 align:middle line:90%
and do an ARP dash
a, look at this.

217
08:41.325 --> 08:42.500 align:middle line:84%
It didn't stop ARP.

218
08:42.500 --> 08:44.390 align:middle line:90%
So this client,
although it couldn't

219
08:44.390 --> 08:47.060 align:middle line:90%
use ICMP to connect
to that device,

220
08:47.060 --> 08:49.850 align:middle line:90%
it did actually have the
ability to go ahead and use ARP.

221
08:49.850 --> 08:51.920 align:middle line:84%
Let's go in as Luis.

222
08:51.920 --> 08:54.020 align:middle line:90%
And Luis does not have
a downloadable ACL.

223
08:54.020 --> 08:56.300 align:middle line:90%
And Luis should
also be in VLAN 30.

224
08:56.300 --> 08:59.270 align:middle line:90%
Let's go to Properties
of that interface,

225
08:59.270 --> 09:00.500 align:middle line:84%
and Additional Settings.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

225
08:59.270 --> 09:00.500 align:middle line:84%
and Additional Settings.

226
09:00.500 --> 09:02.150 align:middle line:90%
And let's replace
the credentials.

227
09:02.150 --> 09:03.380 align:middle line:84%
And let's put in Luis.

228
09:03.380 --> 09:05.120 align:middle line:90%
And we'll put in his
password, click OK.

229
09:05.120 --> 09:08.210 align:middle line:90%
In the background, that
should-- once they click OK,

230
09:08.210 --> 09:10.890 align:middle line:90%
that should trigger
reauthentication, which it is.

231
09:10.890 --> 09:11.450 align:middle line:84%
Look at that.

232
09:11.450 --> 09:12.020 align:middle line:84%
Oh, my gosh.

233
09:12.020 --> 09:12.830 align:middle line:84%
Look at this.

234
09:12.830 --> 09:13.840 align:middle line:84%
Here's the console.

235
09:13.840 --> 09:16.310 align:middle line:84%
VLAN 30 has been assigned.

236
09:16.310 --> 09:18.800 align:middle line:90%
Authentication
authorization successful.

237
09:18.800 --> 09:20.630 align:middle line:84%
So he's on the 10.30 network.

238
09:20.630 --> 09:26.420 align:middle line:90%
If we do a ping, 10.30.0.1,
pings work because there's no

239
09:26.420 --> 09:30.920 align:middle line:90%
restriction, no downloadable
ACL currently in use for Luis.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

239
09:26.420 --> 09:30.920 align:middle line:90%
restriction, no downloadable
ACL currently in use for Luis.

240
09:30.920 --> 09:35.930 align:middle line:90%
And if we do a show
interface status here,

241
09:35.930 --> 09:39.930 align:middle line:90%
we can now see the
Fa0/1 is in VLAN 30.

242
09:39.930 --> 09:42.980 align:middle line:90%
So in this video we actually
created policy elements

243
09:42.980 --> 09:45.230 align:middle line:90%
that we could then leverage
as part of profiles

244
09:45.230 --> 09:48.050 align:middle line:90%
for authorization, and
then we tested them

245
09:48.050 --> 09:50.870 align:middle line:90%
by verifying that
Bob and Luis got

246
09:50.870 --> 09:52.690 align:middle line:90%
different results
with different VLANs,

247
09:52.690 --> 09:55.730 align:middle line:90%
and a dynamic or downloadable
ACL with one of them

248
09:55.730 --> 09:58.160 align:middle line:90%
based on our
authorization policies.

249
09:58.160 --> 10:01.430 align:middle line:90%
So thanks for joining me in this
video on authorization profiles
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

249
09:58.160 --> 10:01.430 align:middle line:90%
So thanks for joining me in this
video on authorization profiles

250
10:01.430 --> 10:04.128 align:middle line:90%
as we implemented them and
verified that they worked.

251
10:04.128 --> 10:05.420 align:middle line:84%
I'll see you in the next video.

252
10:05.420 --> 10:08.030 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

253
10:08.030 --> 10:11.240 align:middle line:90%
And I'd like to thank
you for viewing.