I Welcome to this cyber capsule on how to implement eyes redirectionless posture for Windows. 1st, we will.00:02Check the prerequisites we need licensing.00:20Premier to enforce posture. We also need to have the posture updates on ICE under setting posture updates. This makes sure that ICE is aware of the latest antivirus definitions and products.00:23In addition, we need to make sure that we have uploaded the.00:44Secure client under the client provisioning resources. In order to do that, you need to download the cisco secure client from when cisco.com and upload it here from local disk.00:50Once you have downloaded it. And also we need to make sure we have the latest compliance module for windows. In this case this version 434-289-8192. And also.01:05We need to create, configuration profile XML that it will be placed on the computers with the redirectionless agent. We basically need some settings like.01:20The remediation timer could be 15 min. We need the all the rest we leave the default we here we need a discovery host host can be any host in the network that is reachable.01:37The server name rules allows which servers the posture compliance module can connect to. So after this mean any any host on the this lab environment and the call home list is a list of servers that the compliance module would attempt to connect to in order.01:53To download the compliance policy. Once we have this file, XML saved, we will push it on the client computers via your software manager of preference. The file needs to go under.02:12Program data Cisco Cisco secure client is posture and the name is ISC posture CFG.xml. The same profile that we created as XML we need to upload it in this section as well.02:30We will find out here. If it is not here, we will add it from local disk, so we will select the category, it's an administrator or customer created package. It's a agent.02:49Profile, the name will be Windows or wind agent profile. I will select the file from the local computer.03:04The file is located in this folder and you can confirm the MD five just to make sure that the file, the the checksums.03:20From a match. Once we upload that, we will need to create the next element, which.03:36The next element is the agent profile, so we will add.03:56Agent configuration we select the secure client desktop windows. The name will be Windows 515.04:04Agent conf, the compliance model, the one we checked before eh we will not do VPN in this case. The compliance post the ice posture will be the one we just uploaded as well from.04:22The XML and that is going to be it and submit.04:39So we have our agent profile, our agent configuration, and the client, the compliance module and the security client for desktop. Now we will.04:59Work on the client provisioning policy.05:18In this case, we will duplicate the Windows one. The identity group is going to be any operating system or any Windows conditions. We will.05:38Make sure that the, we will posture and client provision devices that are authenticating to the eight oh two.1X network. So we will look for.05:57The authentication method equals PLS or PKI.06:14Then we will use the configuration that we just created. We will not need this. So we do clear selection and we click done.06:29And save. Oh, we need to enable, by the way. So we enabled this policy. This is the client provisioning is just to make sure that the endpoints connect using the.06:44Proposed secure client version in compliance module if it is not the the client provisioning will provision that package. Now we will work on the policy for posture.07:00So there are a lot of pre built policies that check for different conditions or requirements. So we will in this case reuse the windows.07:16Policy or posture, we will use this Windows agent based, so we will edit, and.07:31If you notice it's going to check for any anti malware installation for Windows and any anti malware definition for windows. This is that the definition files are recent for the antivirus. In other conditions we can as well select.07:52From existing conditions, or we can create our own conditions and usually the condition is not there so we need to create a new condition.08:10We will as well select the authentication method to be certificate based and we don't need anything else.08:29So we can Save we will explore real quick the posture conditions for anti malware and antivirus. So let's go to posture.08:46Anti malware. We saw in the posture policy that any anti malware Windows installation, this means any antivirus is installed. But the definitions is going to be five days.09:03Older eh, so we will check that the definitions aren't not older than five days. Now we will check the policy set. Before we do that, we need to make sure we have a redirection.09:19And authorization policy when the posture compliance is unknown. In this case we are pushing or making reference of a quarantine VLAN.09:39That or or ACL that restricts the communication while the posture is underlined, so we will use this when the posture is unknown, and let's go to the policy set.09:56So we have the wireless.1X eh we have authentication, we look for different protocols, but in this case it's MPLS so certificate based authentication, it could be user.10:15Password based or other that one X authentications. We have this, we will disable this policy because this doesn't check for compliance, so we will enable this too.10:31What we will check is that the session posture equals compliant. If not, ICE will check that the endpoint is able to reach out to the policy ServiceNow to determine or download the posture policy. And this is where we apply the.10:46Meraki wireless unknown.11:06The with the quarantine access control list, so we will proceed to test. I will bring the Windows client computer over to this screen. This is the Windows client so far is still it's already.11:08The connected, so we will need to trigger a reauthentication. However, I want to demonstrate that we have already the secure client installed. The client compliance module is also ready to kick off. The ICE posture CFG XML is in the.11:28Corresponding folder, so we will trigger a re authentication by logging off this user. I will also review the all this the live log.11:47Okay, we are interested in this Windows team workstation, so we will try to authenticate here.12:10We can check at the same time.12:37The live log eh we can tell that the authorization policy is user known, so we are checking.12:40Thing for the posture. Let's, the secure client to be loaded. The computer is still logging in the user.13:00Yeah secure client is about to load now.13:17Okay, so the computer was able to connect and we can tell that the profile client provisioning is.13:37Downloading the new compliance module so it can support new antivirus pro products or solutions. So we, I will pause the recording when we complete the.13:48Compliance module download, now the system is scanning for the posture policy, checking for compliance and we see posture compliant. We see some banners popping up here telling.14:07This is to inform the user that posture was being checked and that the the result of that posture check. We can tell here by clicking the informational icon, the different versions the compliance module, but here we can tell the.14:23Posture products, so we can see we have a secure endpoint for anti malware or also Windows update Windows Defender anti malware, bitlocker encryption in Windows firewall. So we will check in ICE.14:44We will click on refresh, we will see the authorization policy. We were in unknowns and then finally we went into user compliant. We can also see some quick reports real quick, so we go to operations reports.15:03And endpoint and posture assessment by this is condition by endpoint. So we can tell here if we check the details.15:20The different checks that we did and the posture status, so thank you for watching. Keep is looking for other cyber capsules. Hope this was helpful for you.15:41
