Welcome to the cyber Capsule addressing the implementation of ISE redirectionless posture for Windows Systems.00:12To begin, we will verify the prerequisites. We require licensing from AIR to enforce the posture configuration. Additionally, it is necessary to have the posture updates in ISE under the settings, posture and updates sections. This ensures that ISE remains aware of the most current antivirus definitions and prompt.00:20Lucks?00:40Additionally, it is essential that we ensure the secure client has been uploaded under the client provisioning resources. To accomplish this, please download the Cisco Secure Client from wind cisco.com and thereafter upload it here onto your local disk after you have completed the download. Moreover, it is.00:41Imperative that we verify the presence of the most up to date windows compliance module.01:01In this particular case, it is the following software version. 434-289-8192. Also, we need to generate a config profile in XML format that will be deployed to computers using the redirectless agent.01:06We basically require a collection of settings such as the remediation timer. Duration could be 15 min. We require the following, the remainder should be left at the default. Here we require a discovery host. It can be any host within the network that is accessible.01:22The server name rules specify which servers the posture compliance module is permitted to connect to. An asterisk means any host in this laboratory environment, the call home list consists of the servers that the compliance module will attempt to contact.01:40In order to download the compliance policy for policy enforcement. Once we have this XML file saved, we will distribute it to the client machines and workstations using your preferred software management tool. The files should reside under program data Cisco secure client, ISE posture.01:55And the explicit file name should be ISE posture CFG XML The exact same profile that we previously created in XML format.02:12Should also be uploaded within this section of this interface. We will determine this here and now today. If it is not present here, we will add it from the local disk drive. Therefore, we will pick a category. It is either an administrator package or a customer created package.02:29It is the full agent profile that we are referencing. The name will be Windows or win agent profile properly named. I will select the file from the local computer system. The file is here in this folder.02:44And please confirm MD five the hash to make sure that the file and the checksums match exactly so there is NO discrepancy now. Once we have completed the upload of that file, we will need to create the next element in the sequence.03:08The next element is the agent profile, so we will add it.03:33Settings for agent. We are in the process of selecting the secure client desktop windows. The name that will be used is simply Windows. 515.03:41Agent conference. The compliance module, the one we had checked earlier, is the subject here. In this particular situation, we will not be using a VPN. The post exposure compliance record will be the same item that we have just uploaded as well from the XML file, and that will be all there is to it.04:00We are ready to submit now, and we will await any further instructions. So at this point we haven't.04:18And clearly acknowledge our agent profile together with our agent configuration, the client, the compliance module, and the circuit client designed for desktop use. Now we will proceed to focus our attention on the client provisioning policy with the aim of outlining and governing the steps involved in provisioning for that client.04:39Under these circumstances, we will duplicate the windows version immediately.05:13For the purposes of this policy, the identity group will be defined to include any operating system that may run on endpoint devices, and Windows is explicitly included as a concrete example. Under these conditions, we will ensure that we posture and provision the client devices that are.05:21Authenticating to the eight oh 2.1 X network, verify their compliance, and apply the correct configuration settings so that only compliant trusted devices may access the network. Therefore, we will look for the authentication method to be IPLS or PKI.05:40Then we shall go on to use the, please review the agent configuration that we have just created. We will not require this configuration any longer, so we will clear the current selection and proceed to click done.06:00Followed by save. We also need to enable it by the way, so we go ahead and enable this policy. This step constitutes the client provisioning. Its purpose is simply to ensure that the endpoints established connections using the proposed secure client version.06:17And the compliance module. If this is not the case, the client provisioning process will provision that package as required by the system. At this moment, we will proceed to examine and establish the posture related policy in detail today.06:33There are many predefined policies that evaluate and enforce a range of conditions and requirements that apply in various scenarios. Thus, in this scenario, we will reuse the Windows policy for posture concerns across the platform. We will use this windows agent base as the implementation Foundation for posture res.06:48Related operations. So we will edit now. I exist. Should you happen to notice it will be going to check for any anti malware installation for Windows?07:08And any anti malware definition for windows. This is to ensure that the definition files are very recent for the antivirus so that everything stays up to date. In other circumstances, we can also select from existing conditions.07:27Or we can create our own conditions as well. Usually the current condition simply isn't there, so we need to create a new condition. We will also carefully and properly select the appropriate authentication method.07:42To be implemented as certificate based. And we do not require anything else at all so we can save without needing any further thoughts. We will quickly and carefully review the posture requirements.08:02For anti malware and antivirus. So let's navigate to the posture section, anti malware. We observed in the posture policy that there is an anti malware Windows installation present. This clearly indicates that an antivirus program is installed, but the antivirus definitions are going to be about five days out of date.08:22Therefore, we will verify that the antivirus definitions are not older than five days to ensure compliance. Now, we will carefully and thoroughly check the policy set. 1st, we must ensure we have a redirection.08:43Or an authorization policy when posture compliance is unknown. In this case, we are applying or referencing a quarantine VLAN or an ACL that restricts all communication while the posture remains undetermined.09:03Therefore, we will use this approach whenever the posture is unknown, acting as a conservative baseline to guard communication until posture information is reliably available. Let's go to policy set.09:19Thus we are dealing with the wireless one X authentication. We examine authentication options. In this instance, the protocol used as mutual TLS or MTLS, which uses certificate based authentication. It could also rely on a user password based method or.09:37Four other authentication options. We have this configuration described here. We will disable this policy because it does not perform a compliance check, and thus we will enable these two policies. We will verify that the current session posture is compliant with the required policy.09:54If it is not, ISE will verify that the endpoint can contact the policy service at this moment in order to determine or download the posture policy. This is the point at which we implement the Meraki wireless unknown alongside the quarantine access control list.10:11Thus, we shall proceed with the testing procedure now. I will move the Windows client computer over to this display so it can be observed and tested on this screen. This is the Windows client in use here.10:29So far it remains connected already, hence we will need to initiate a reauthentication. However, I would like to clearly demonstrate that we truly already have the secure client installed. The client compliance module is likewise ready to commence. The ISE posture CFG XML file is located in the.10:44Corresponding folder. So we will trigger reauthentication by logging off this user. I will also allocate a bit of time to thoroughly inspect every live log entry.11:04Okay, we are particularly interested in this Windows Ten workstation, so we will proceed to attempt authentication here as part of this ongoing effort.11:21We are able to check the live log at the same time as we go along. And we can tell that the authorization policy.11:52Policy is user known. So we are currently checking for the posture.12:12The secure client is permitted to be loaded. The computer is still logging in the user. Circuit client is about to load now, right here, indeed.12:20Okay, so the computer was able to connect, and we can tell that the profile client provisioning is downloading the new compliance module so it can support the new antivirus products or solutions.12:55So I will pause the recording while we complete the compliance module download. Now the system is scanning for the posture policy, checking for compliance, and we see posture compliant.13:14We are currently seeing multiple banners popping up here, all aimed at informing you that a posture check is being performed, and it's showing the results of that posture check on screen. By clicking the informational icon, you can see the different versions of the compliance module.13:30Whereas here we can identify the posture products for your awareness at this moment in this section. Thus, to verify our system state, we can confirm there is a secure endpoint dedicated to anti malware protection and that Windows update Windows Defender.13:48And anti malware are all present and active. With bitlocker encryption enabled in the Windows firewall settings. Next we will check with an ICE. We will click refresh. We will review the authorization policy, we were in unknown state, and then finally we went to a user compliance status.14:03We can also view a handful of quick reports very quickly than we head to operations reports. An endpoint and posture assessments being performed by endpoint. This condition is determined by the endpoint.14:20Thus we can clearly tell here what is true if we check the details The various assorted checks that we have carried out and the current posture status, so as of now.14:38Thank you for watching today. Keep looking for other cyber capsules right now. Hope this was helpful for you today.14:58
