radius

The video looks into two additional methods of assigning IP address to Cisco ASA AnyConnect VPN client; using DHCP and RADIUS, in addition to the most popular local address pool. We will be using a Windows 2008 DHCP server and Cisco ACS 5.5 RADIUS server in this lab. 

The video explains and demonstrates the relationship between tunnel-group and group-policy on Cisco ASA SSL VPN and compare them to the IPSec counterpart. You will learn different ways to land a user on a tunnel-group and either statically or dynamically assign them to a group-policy. Both pros and cons of each method will be discussed so you can decide which is best suited for your deployment. 

The video explains and demonstrates the relationship between tunnel-group and group-policy on Cisco ASA SSL VPN and compare them to the IPSec counterpart. You will learn different ways to land a user on a tunnel-group and either statically or dynamically assign them to a group-policy. Both pros and cons of each method will be discussed so you can decide which is best suited for your deployment. 

The video demonstrates the use of Endpoint Protection Service (EPS) on Cisco ISE 1.2 to quarantine undesired endpoints. Unlike manually removing an endpoint from the network by shutting down port and the endpoint can potentially be moved to a different port to regain access, although ISE also allow you to exactly this by issuing a port-shutdown CoA, placing host MAC address or IP into EPS quarantine ensures the endpoint remains denied from the network regardless of its point to attachment. A policy can be created to block endpoint traffic by ACL or/and placing them into a unusable VLAN.

The video demonstrates the use of Endpoint Protection Service (EPS) on Cisco ISE 1.2 to quarantine undesired endpoints. Unlike manually removing an endpoint from the network by shutting down port and the endpoint can potentially be moved to a different port to regain access, although ISE also allow you to exactly this by issuing a port-shutdown CoA, placing host MAC address or IP into EPS quarantine ensures the endpoint remains denied from the network regardless of its point to attachment. A policy can be created to block endpoint traffic by ACL or/and placing them into a unusable VLAN.

The video takes you through an upgrade procedure from Cisco ISE 1.1 to 1.2. We will go over some upgrade considerations and pre-requisites and also make sure you are aware of any caveats. Our lab starts with a functioning ISE 1.1 setup, and we will make comparison to the system after being upgraded to ISE 1.2. Although this lab video is for a standalone system, a lot of our discussions and demonstration here also apply to a distributed deployment.