Security

The video walks you through configuration of wired 802.1X using PEAP on Cisco ISE. We will look how to configure authentication and authorization policies to support both user and machine authentication, how to restrict network access with DACL, and how to use Machine Access Restriction (MAR) to correlate user and machine sessions to ensure a user can access the network only from a domain (corporate) computer. We will perform testing from both domain and non-domain computers and observe the authentication results.

The video demonstrates how to selectively distribute wired and wireless network settings to Windows domain computers based on Computer security group. This is very useful if you need to deploy or update network settings in a large Windows environment.

• Windows Wired Setting in GPO
• Windows Wireless Setting GPO

The video introduces you to the concept of device profiling and MAC Authentication Bypass (MAB) on Cisco ISE. We will start by going through different type of probing, how devices get profiled with Profiling policies, and how to create an Endpoint Identity Group for the profiled devices to be used in authorization policies. Static MAC address and Identity Group will be configured for devices that cannot be profiled. Cisco IP Phone and Access Point will be used in our demonstration.

The video presents you with Cisco recommended switch and Wireless LAN Controller (WLC) configuration to interoperate with Cisco ISE. Most configurations are for enabling 802.1X and RADIUS, while the remaining (eg. SNMP, DHCP etc) are for providing additional information as part of ISE device profiling. Here we use a Cisco 3750 and vWLC in our demonstration, and we will also add them to Network Device. The video closes by going through the switch configuration validator.