Cisco ISE Meets Azure EntraID Real-World Use Cases – TEAP/EAP-TLS

I 1st topic I mentioned that I'm gonna be your host and presenter for today. He's gonna be helping with the lab.00:00Eh, with the with the demo. And of course we are talking here mainly about the use case about IPTLS and ok? Why this is important? Because at the end, it's gonna be critical for us to understand that even if we have some references to our OPC because it's gonna be important to understand the difference.00:19It's not the same. It's gonna be really different and hence we need to have some basis about how this is gonna be working. And that's the reason on the agenda we have the 1st topic which is enhanced security, certificate authentication support. Now, the next one is the rest lookups overgraph API, and this is important because it's gonna show us how everything interacts.00:39Okay, we have some limitations, it's important to know them and understand what's happening here. The radius policy support, which is gonna be important for us to understand how it's gonna be working. If TLS keep mainly here we are gonna deep dive a little bit more in the scenarios itself.00:59How we are gonna be using it and the tip in this scenario, we have two different tips, user and machine, and also just for awareness, the machine with user on prem. Of course, we are gonna be discussing about these specific topics. It's important if you have any questions to let us know through the Slido, we are gonna be interacting there, so feel free to.01:17To reach out at any moment since we have a panel is some panelists answering the questions that you may have there.01:37Now, if you want here are also the the information for the Slido, if there's any any type you want to to join, feel free to join and answer these questions since it's gonna be helping for us to interact.01:44Okay mainly we have AD, AD and Entra, Adian entry, ok?02:04Usually this is expected. A lot of we have some on prem with AD and also the the cloud with hybrid, so that's that's looking good as expected. Hybrid. Perfect. Awesome.02:14Then let's take a quick look on how we can use these different scenarios. In this case the use cases if for us to take advantage of it. Now, let's talk a little bit about the certificate authentication support.02:30This is gonna be important because at the end, we need to understand a lot regarding certificates and how those work. Being honest, on my experience, I have realized that a lot of issues come from the confusion about how these certificates are gonna be used, ok? Or how they they work with us. That's an important topic that we need to clarify.02:47And of course with this information, we are gonna give a little bit of a base knowledge about certificate for you to have a little bit more of understanding or even clarify some doubts that you may have. Now, the 1st topic is what is a certificate?03:07Assigned document that represents an identity. Of course, that's expected, that's clear, but it's important for us to understand how we are gonna be using those certificates. Yes, of course, it represents an identity and it's mainly an identification card to prove who are, who you are or the system is, ok?03:22Why? Because at the end, we may have a lot of information, but it's as we enter to to a building. Usually we are asked for a credential for an ID. That's our way to prove who we are. In this case the certificate it's gonna also represent in this case the computer or the user that it's trying to enter.03:40Has a public key of that entity, that's important because at the end we are gonna rely on the X in 509 digital certificates to transfer transfer public keys for encryption and decryption of messages, ok? Mainly this is to verify the authenticity of the certificates provided by users and devices.03:58Now, of course, it's gonna be important because at the end, we need to differentiate that there are different scenarios and different chains, ok? Now, let's say 1st about the certificate trust, which is important. How does this work? Well, 1st we have our request to the server.04:17This server is gonna answer with a certificate and then we validate that certificate, ok? We need to, of course, know that the certificate that this server is delivering is valid, ok? That's important really, really important. Why? Because actually if you review all the flows, whenever we.04:37They're using certificates in case the TLS.04:57Also, we are gonna have this this similar flow or this specific flow for the authentication on ICE. So that's gonna be important. Some topics that I have seen, e.g., as I mentioned, is topic regarding the server communication. Not everyone understand that whenever ICE is talking to the, to the client or to the to the endpoint.05:00Both of them should authenticate. I send its own certificate to the endpoint, the endpoint should validate that certificate and then the endpoint sends that certificate. Its own certificate to the to validate. In this scenario it's pretty, pretty similar, as you may see here, we have the request to the server.05:20We have the answer with the certificate, the endpoint reviews the certificate. Of course, it generates the symmetric key, client identification. Here it's mainly for us to have at the communication encrypted and once it's verified and encrypted it's gonna have the symmetric encryption from both sides to have that communication, ok?05:37That's the importance of this specific flow. And of course with this information, we are gonna be covered. Now, again, as I mentioned, it's not only to review the eyes or the endpoint certificate, we need to review both of them, ok? Usually whenever we are doing this type of authentication both of them should be aligned and we should.05:58Should have the information.06:17Clear from both sides to understand that this, that the flow is working properly. Otherwise, if one of them is failing, we may face some issues. So it's important for you to have that awareness and understand this specific flow. Now, which are other limitations or constraints? Of course, you.06:19Here we have a verification.06:39Clarification step that it's done by the endpoint and also by the server. Now, how this is executed with the roots eh with the root certificate and intermediate certificates, hence we need to talk about the certificate chain. The certificate chain, it's gonna be really, really important. Why? Because it's another list of certificates that contains.06:41The CA certificates and the cell TLS certificate. Now this is gonna enable the receiver to validate the sender.07:01And that all the CAs are trustworthy. What does it mean? Let's say that in a specific scenario, the endpoint is sending ICE a certificate, just an example with ICE. If ICE may take a look at the certificates and say, ok, the it's valid because it has a.07:09It's it's not expired, it's in signed, but I don't know who signed it, ok? In this scenario, if ICE doesn't know who signed, of course it's gonna be rejected because at the end it's not considered valid Since we don't know if the root certificate is trustworthy or not. What we need to have is of course that root and intermediate certificate.07:29It's in both sides. In the ICE case, we need to have the root certificate and intermediate certificates for the certificates on the endpoint and on the endpoint side, we need to have the root and intermediate certificates for the ICE certificate. Why? Because the endpoint is gonna receive the server certificate, it should validate that certificate, and hence it.07:49It needs to know who signed that certificate, ok? And make sure that those are valid entities before a trusting that specific. So that's really important for us to be aware and understand that this chain is always gonna be critical and really important for us to understand.08:09That should be contained in both sides. Now, let's jump very quickly to the next part, which is the certificate authentication support. Here, we're gonna see some information that it's important. We have.08:27Identity foundation certificates assigned as identity documents. Again, we are proving an identity. And since we are proving an identity, this becomes critical. It's gonna be like I mentioned the ID. We have the trust model which is establishing trust between the supplicant and ICE. This trust model is important because at the end.08:44That's what I mentioned. Whenever we're establishing trust between the supplicant and ice, both of them should have that communication and have should complete that exchange for them to trust in each other. And of course we have the different. Those rules are gonna change. We have certificate for admin portal, if radius still.09:04Of course, each one of these changes according to the requirements. Whenever we're talking about it, e.g., we are talking about the authentications on that one X Whenever we're talking about admin is the administration portal of ICE. Of course, this administration certificate is not only used for the portal, but communication between the nodes.09:26So that's gonna be important for you to have awareness and portal. This is mainly for the external portal that we are gonna manage like the portal of guests, the, in this case the the sponsor portal.09:44And or the BYOD also. So that's those are important of course, we need to understand the differences between them. We have also the the which are gonna be critical, but of course it's gonna depend a lot on the deployment that you have and the scenario. Why? Because again, I.09:57This is always deployed according to the customer's requirements to the scenario that you are facing. E.g..10:17That usually helps us to communicate with other platforms and integrate ICE with other systems to make it a little bit more eh let's say stronger in, in reviewing authentications or enforcing policies also can be independent. It depends a lot on the cost on each one of the customer scenarios. I have.10:23I've seen some customers that are only using AI for because it's only important for them to authenticate the devices, but some others are using it very completely with a lot of things and of course all of the certificates maybe used. So it's important for you to have awareness about the certificates and that they change according to what you are using. Okay.10:43Okay. Mainly we're gonna be focusing a little bit more today on the one for the authentication because that's the the important one that we're gonna be taking in account as well as some other.11:03Inside all this flow, but it's important for you to have that awareness. Now, here we have some examples regarding the certificates. Both PSF here, e.g., as you may see, are being used to secure not only their communication.11:16With the administration node, but also with the guest portal for the central web authentication. Remember here that the central web authentication is some communication directly with ice. So whenever you are talking on a guest and you're redirected to that guest portal.11:32The portal is deployed by by ICE, hence the certificate is also shown or it's the one that is saving ICE. And the sponsor portal is being protected with a certificate with the sponsor security demo. This one at the end, this sponsor portal maybe different. Why? It's important for you to have that awareness to.11:47We can also make some certificates. E.g., in, in my experience and what I have seen, usually whenever we are talking about guest certificates, a public entity certificate is deployed. The reason behind it is because at the end, we want the external users which are the guests to see the guest with the guest portal without any issue.12:08Without any alarm about this site is not being secured. So of course they should have a public certificate. The reason behind it is because of course we cannot add that root certificate and intermediate to the guest when they are not from our company or our entity, and we are not touching that computer. So usually that.12:29The public certificate help us to double check this part.12:48Now, the sponsor portal is a little bit different because usually, e.g., the sponsor is used whenever we are talking about internal users. All internal users maybe sponsors. And in that scenario, we can use an internal certificate, which is different from from from the public one. Of course, that can be.12:53Yes, but again, it's important for us to have that certificate overview. In this case, if the PSN one and PSN two are using their own EAP certificates to secure the communications with the endpoints, as you may see here.13:12It becomes important that ah that green tunnel that it's been established by the endpoints and the PSN, which is gonna be starting the communications. And again, we have the PAN and the PSM with the admin certificate to protect the administrative communications.13:26So that's all those are some examples for you to have awareness about how the certificates are gonna be helping us through this part of the, of the communications for the tip and ok? Now, what's important or what's the main difference, which.13:41Or or with a COMMONTLF flow or a deep flow because of course we have TLS flow and for our local network with an on prem active directory, e.g.. And of course that may change whenever we are using Azure. And for that we need to talk about rest lookups over GRAPH.13:59PI, ok?14:19Now, let's talk a little bit about this. Which is a mechanism? We have the authorization and authentication. It's important for you to understand that these two are different, ok? And both of them are gonna be different objectives. Authentication is mainly focusing on reviewing the identity, ok?14:21Who is connecting? As I mentioned, again, the credential, they take a look at your credential and they say, ok, if, in this case let's say I. I can review it with his ID and say, ok, it's valid. He has a credential and I know who he is. But now, is he authorized to enter? He can enter to that resource.14:40Well, that's 2nd part of the authorization, because even if you have your ID and you can present or you can verify who you are, you are not allowed to enter anywhere. So it's important for us to make that difference because it's gonna be critical in this specific step. The mechanism is.14:59We ICE is gonna create via Microsoft Graph API during the authorization phase. Authorization, not authentication. Why? Because the flow itself is the authentication it's gonna happen through certificate, ok? That the authorization is enriched by fetching the user device attributes from the entry ID.15:17Now, those are two steps. The 1st one with the certificate, it's gonna make sure that your identity is valid, that the authentication is passed, sorry. And that and then the authorization is gonna review with the attributes of the user and device that you are authorized to enter to the resources that you are looking.15:37Or you are gonna be given a permission with that information. That's the reason this is really important. Because being honest, I have seen a lot of confusion whenever we are talking about authentication.15:58That we may think that the authentication is a certificate going to the Azure and reviewing it now. The certificate authentication is mainly done through the certificate. Remember that there are different steps for us to validate that certificate. And let's take a little bit more in depth look here. Whenever we present the certificate, we need to validate that certificate.16:09As we mentioned in our previous base of the certificates, then what ICE is gonna be doing, it's gonna receive the certificate of the of the endpoint and it's gonna review.16:29Who signed that certificate? It's gonna review the information and certificate and review if it's valid or not, ok? That's critical. And then we are gonna extract the identity, of course, and query entry ID to get more information about that specific user or endpoint. With that extra information, we are gonna apply a policy.16:38So, which are the policy decisions that we are gonna be taking from the ICE? Authentication, ICE is validating the certificate and that's the authentication. Authorization ICE is gonna query entry ID via graph API to review the information.16:59And use the attributes for policy decisions. And which are the credible attributes? We have group memberships, we have upns, user principal name, user properties or device group and attributes. It's important for you to have that awareness and differentiate those two steps because those are gonna be really important.17:15And here just for awareness, a little bit about our rest example, e.g., here, we have an information about how developer and Microsoft are getting that information. Of course, it's gonna be important because this information regarding rest is gonna be critical for the communications between ICE and the Azure AD. So always make sure to, to have that great.17:34Of communication enabled. Remember that this is gonna be important where we took a look at the communications on the on the last session. If you want to take a look, you can go back to the community site and and we'll check that recording, but it's gonna be important for you to have that rest identification enabled.17:54Now, for limitations, of course we have some limitations yes. Again, it depends a lot on what we are trying to execute. Here let's bring very quickly a table that we have. The ICE protocols support with different ID stores. Here we can see which protocols.18:13Are supported according to the that we are using. That's gonna be really important and critical. Yes, because at the end we know that we are using rest. And REST has some limitations. E.g., we are not gonna be using MS chapp version one or two, even if it's not a lot recommended now with with the guard of microsoft.18:32Also the change that they have been implementing that now.18:52So that's important for us to have awareness, and of course if MD five and chap is also not supported. Here we can use a plain text password, which it depends a lot on what we are trying to achieve, but the most secure would be IFTLS deep TLS and All of them are certificate based. So it's gonna be important.18:57On that section.19:16And here, well, we have the other ID stores for your awareness, internal database, Active Directory, LDAP, radius token, and ODBC. Of course, each one of them, it's gonna have its own pros and cons. We need to take a look and make sure that we are picking the right choice. Of course, if we are talking about Azure, we want to focus on the 1st column.19:17Regarding the limitations, of course, it's important to have awareness that for the TLS support we have AD optional that's a is not necessary, but we can do it, we can enforce a little bit on that section. Why? Because at the end, whenever we are talking about certificates I has the ability to double check with the.19:40Entity, but it's not necessary eh, to implement it that way.20:00Reviewing only the certificate valid validity can be the critical factor for us to take a decision. Of course, if we want to increase that let's say that review and inclu include active Directory to make a double check, we can do it too. Now, on the ROPC.20:05Eh it's important because e.g. we have some limitations here too. We have NO multiple factor authentication, AP password changes, so it's important. The device attributes are gonna be included on ICE three.four patch four and three.five and above important for you to have that awareness because at the end.20:22It's gonna limit what we can do. Of course this type of flows are continuously evolving as you, as you saw with our OPC that was included on the Now in these versions we have now even device attributes which are gonna be important for use for us to make or use our different flows. Now, another important limitation.20:38Is that if you want to use user attributes, we need to have a premium entry the license.20:58Now, this is important for you to have awareness mainly because at the end if we are trying to establish a flow, it's always important to double check at since the beginning the design and how we are gonna build it for us to have all the information and the required steps. Another experience that I can tell you a little bit about my.21:05Whenever I was implementing a few years ago, well, is that if we don't make this in paper and we don't have this really clear from the beginning, sometimes we may face face issues whenever we are working through the different scenarios or implementing the information. So it's always important to have everything if you have any specification.21:24Any details, make sure to share them because at the end it's gonna be critical whenever you are building your different flows.21:44The radius policy support. Now, we need to talk a little bit about the radius policy support and licensing. Of course, this is gonna be important. The intern integration method is gonna be through rest ID store. Of course we need we need to have the as I mentioned for the user attributes a primary licensing Microsoft and required, we need it to.21:56Is that for patch 43.five.22:16For advanced device attribute support, and of course the support attributes are user group memberships, UPN device groups, and device ID. I always is gonna use ID, so that's gonna be important for our authorization stage. The support attributes, again, we have all these.22:18To play and be working with to create the different policies. That's the reason it's really important. And of course, the version for us to have the more advanced or the lasted changes regarding the device or the different attributes that are included.22:38So that's gonna be really, really important for you to have awareness. Again, it's a little bit repetitive yes, but again, this is gonna be part of the races that we're gonna be using. Why? Because at the end, if we don't have this premium license, we are gonna be limited with the different supported attributes that we're gonna be using in the policies. So it's gonna be critical, and I.22:53Again, the version, if it's not the latest three.four batch four and above, in this case three.52, we are not gonna be used to be able to use the advanced device attribute in support so it's important to for you to have that awareness and of course the main part is the rest ID store.23:13Now, let's talk a little bit and see where we can find this information. Of course, we are gonna be reviewing this more detail with I/O in the in the demo, but here let's review 1st. Groups and device attributes on the intra ID integration. If you take a look at administration external identity sources, you're gonna be able to find.23:29The rest information. On that rest information, you will find the entity in this case that you have created for entry ID, and here we are gonna have the groups and the device attributes.23:49These are gonna be important for us to build our policies. Another important topic is the device query. The device query is gonna help us to review exactly the information on the device. Hence, here we're gonna be able to define what information or exactly what we are looking to review. And for.23:59Example in the identity in the device certificate, what information and certificate we are looking for. So it's gonna be important for you to have that awareness where to locate this information in case you are doing this device query.24:19Now, here we have some entry ID example attributes, how we are looking at them. E.g., we have the dictionary with the entry ID device or the entry ID and the attribute that we are looking for. E.g., the external group and of course we can apply that into the policy. Here we have the entry ID external group equals the main users and the device.24:35That it's managed. So it's true. We can, we are gonna be able to deliver a profile.24:55And or even a security group tech. So that's really important for us for us to have awareness, as you may see, everything is linked. Whenever we start to build them, we are gonna have it a little bit more clear with, with the demo. So be a little bit patient to, to take a look at it, but it's important for you to have awareness where to find this. Remember, we are talking about this on the policy.25:00Here we are talking again on policy on the condition studio and here we have the device query and the groups and device attributes, everything here, these two group and device and device query are, are on the sorry about that, are on the intra ID, ok, instance that we have created. So be careful with that part.25:20And it's gonna be important for you to have that awareness.25:40Now, let's jump now a little bit here. Sorry, I moved to the, to the end and now to the beginning. Let me move to the to the right. As I mentioned here, we are on the rest, on the rest and the entry that you have created, so be careful with it. And again, here from the.25:46Device query, it's gonna be on the same place. Always make sure where to look, make sure that you have this menu enabled because again if we are not looking on restantry, we are not gonna find the right information. And now let's jump to this specific question. Which authentication protocol do you prefer or is more.26:01Useful for you. Here, the reason of this question is because I would like to understand which is the the awareness that you have between both of them. Of course.26:21For security purposes it would be better the PTLS, it's always a little more stronger, let's say, but of course it depends a lot on the business flow. Again, ICE is not something that we configure because we have defined that should be configured this way. It's always dependent on the business and the flows that you have and that you.26:32Can modify so sometimes it maybe.26:52Different for each one of the customers. Okay, here we have sent 70 % with and taking advantage of this, I'm gonna explain a little bit about the difference between that it's gonna be important. TIPTLS is gonna help us mainly or the main difference is regarding the chaining, ok?26:55DEEPTLS is gonna help with the authentication chaining between the user and the device. Both of them are gonna be authenticated While the TLS is gonna only authenticate user or computer, not both. So that's the main difference, ok? And it's gonna be critical for decision taking because at the end if we want to authenticate both.27:15The user and the device, of course our option is gonna be always. In case we only want to authenticate the user and not the device or backwards, it's gonna be IFTLS.27:35A good option for it. Perfect, so great. Let's talk 1st about since it's a let's say the the 1st one and let's say the predecessor of the of the now if TLS here is gonna authenticate the same.27:45Mentioned user or computer. How we're gonna be doing that? Well, we need to present the certificate.28:05We need to present the certificate. We are gonna validate that certificate, fetch the attributes and enforce the access. Quite simple or it looks quite simple. Now, it's gonna important to review which is gonna be the workflow because again I separate authentication which is certificate based from the authorization, which is from the graph API.28:101st the supplicant is gonna present the certificate. ICE is gonna validate the certificate.28:32And of course, ICE is gonna fetch the intra ID groups attributes for the subject common name, ok? And with that, it's gonna enforce the access based on the retrieved attributes. It's gonna be really, really important. Again, step one and two are local with the ICE authentication, which is gonna be true certificate and three and four.28:36Are gonna be without graph API, so that's gonna be critical for you to have awareness. Now, being honest, this is quite simple, but usually there are some confusions.28:56Which is user computer authentication in windows? Well, it's important for us to have awareness because we may have certificates for both of them and we maybe only using one of them. I'm not sure if you have experienced this. It depends a lot on each customer, but I remember.29:12Was talking with a customer, he told me, hey, you know what? I'm looking to see the authentication for my user, but I'm seeing the computer name, I'm not seeing the username. And this is precisely because there was an issue while implementing this specific flow, and the flow was checking for the user or.29:28The computer, and of course if the computer was sending the credentials, you were not authenticating the user.29:48That's what I told to the customer at that point of time. So we needed to enforce a little bit on the supplicant side what you needed to check, ok? So that's important for you to have awareness. Now, of course it's gonna be two different authentications. The computer authentication appears in the both app or the reviewed or the user allows.29:55Of events, ok? And the user authentication happens on every network accession when once the user is logging makes the login on the computer. Here, it's important because the computer authentication is gonna review the computer certificate. While the user authentication reviews the user's certificate, that's different.30:15Yes, that's different. So it's really important for us to have awareness and understand where are those differences. Here, e.g., we are taking a look at the computer certificate at the at the user certificate, sorry. As you may see here, we have the certificates from the local computer in this section.30:33And we're gonna have the certificate's current user just below. Of course, this local computer section is closed, it's minimized for, for us to see the current user, but here on the personal we are gonna find the certificate. And on that certificate, we're gonna see.30:52That it's issued to Ita Hunt, ok, for this specific lab. So it's gonna be important because this is gonna be a user certificate. And mainly it's validating the identity from ital Hunt in this case scenario. Now.31:08For the computer certificate, as you may see here, we have moved from the from here we have the current user, but now we are on the local computer certificates. Now, we are seeing here that we have an issue too, and we have an identifier.31:24Issued a certificate it doesn't have any identity that we can review directly as even hunt. So it's a different certificate. This one is issued to the computer itself. And of course, that's a certificate that is gonna be reviewed whenever we are doing computer authentication.31:42And that's gonna be really important for us to have awareness. Now, let's review regard a little bit regarding the authorization against infra ID. I have talked about this flow, but you haven't seen this in a graphical fashion. Let's say what happens 1st? Well, the user it's gonna send the it negotiate.31:58Negotiation to the network device, there is gonna be a reply.32:17With the server certificate, the server certificate to the endpoint. Okay, once we receive it from the user and we validate this information, we are gonna have the and certificate validation on the authentication. This is really important because this certificate validation that we are seeing here is the the endpoint certificate.32:21Being validated by by ICE.32:40Once it's validated, the key exchange happens and we are ciphering the communication. Then rest enters directly with the entry ID, we fetch the group's attributes that we have we have talked about, and then the authorization it's gonna be or the radius is gonna server in this case the ice is gonna be the brain. It's gonna take the decision about.32:43This authorization with the groups and attributes and it's gonna send that authorization to the network device to enforce it to the endpoint.33:02So that's gonna be important for you to have awareness on how this works. It's pretty similar to what it happens on the TLS on the, on the local network, but instead of communicating here with a an active directory, probably to get that information regarding group plan attributes or an LDAP, we are talking about a rest through a winter ID.33:09Through restaurant.33:29Now, this is for now how does if the user machine and works? Here, it's gonna be important because we have the power of chaining. It's gonna be critical. The network with NO support for computer and user authentication. This is gonna.33:31Help us enforce a lot more our security. Why?33:51Because we're not validating only the user credentials but also that it's a valid computer. Making us or helping us to enforce policies in the comp in the computer, we can review that, e.g., the computer is something something that belongs or we are not allowing to our.33:55Network and also the user is valid. So it's like a double check here. And of course we have some policy granularity that we can use. E.g., what happens when the machine authentication pass and the user out fails? What happens backwards when the authentication of the user success and the machine out on fails, then we can.34:11This is on how it's gonna act as we can send to remediation limited access. We can create different level of access for those different scenarios. And of course if both are successful.34:31We can have full access. And you can see very quickly with this diagram, if we have the both success, probably we are gonna have the best of everything. We are gonna have all the full access, but of course if we have machine authentication and user out, we are gonna have some combinations there.34:42Now, this is a policy set example for you to have awareness. Whenever we are talking about dip and how we are building those policies, it's gonna be important. Why? Because e.g., we are doing here the 3rd, and then.35:00We're reviewing the different policies. User and machine pass, ok, give up permit access here, which is a full access and enforce with the security group of employees, ok? Now, if we have user pass and machine failed, well in this scenario, I don't want to give a full access because at the end the machine failed. Then we are gonna do our work.35:16With catalyst profiling here, e.g., it's a limited access and we're gonna send two quarantine systems as the SBT enforcement. And of course, if the user failed and the machine passed.35:36We're gonna give again a profile that it's basic and we're gonna enforce here with the workstation. And that way we can make sure that this workstation has limited access and of course NO one can enter if the user has failed, ok? Or is not allowed.35:46Now, this is the scenario or a quick example on the tip. Again, we are gonna review this a little bit more in depth in the lab, but also I want to mention another scenario that we may face, which is tip machine with user on prem.36:06Mainly this is gonna happen when we have the machine entry joint, the user is on prem active directory and we have a combined policy evaluation, ok? It maybe seen a little bit as the best of both worlds because we are gonna be supporting devices while maintaining the legacy on prem AD user accounts.36:21Of course, we need to define policy sets that bridge cloud based device identity with local user identity. That's gonna be the main difference what how we are defining those policies. And mainly how the flow is gonna work. Well, if I can show you really quick, the flow it's gonna work here with the device ID user.36:38We're gonna make sure that we have the tip.36:58And we're gonna make the certificate validation, provide an authorization, and then we are gonna make the user authentication through tip again, but here as you may see, now it's against active directory instead of entry ID and have the authentication. This is mainly for awareness for you to have a little bit more visibility, but this is in.37:01Important for you to have the information and of course know that it exists. Again.37:21It depends a lot on each one of the flows that everyone has, each company or each customer has different flows. So don't eh, don't force this again. It depends a lot on the characteristics, what you are looking to do, what your what do what do you want to review or be compliant with?37:25So double check the information and make sure before you take that decision. Now, let's jump to the demo with. All right, thank you so much Miguel. Let us jump into it. We have a lot to cover and we have about 5 min, but I trust we'll be.37:44Able to do that.38:04Okay, so for the demo, let me pin this scenario because there's gonna be a lot going on and I want to make sure we're all on the same page. So this is our deployment. Here we're gonna log into Azure so be back here in a minute. This is our test PC, but I want to start with this. So from Miguel's.38:06Explanation it talked about the user authorization, the device authorization, and also tip. So for the demo, we have three goals. 1st, let's have a setup where we are using device authorization and we will have conditions that will look at the external ID in Azure or entry ID now.38:26We will check the specific issuer, so the condition will be based on that. And then optionally, but we'll cover that in this demo, we will also look at the intra ID attributes for that user. So once we get that working, we'll know, ok, user authorization, we're good.38:45Next, we'll come to device authorization via entry ID. Again similarly, we'll have conditions looking at the group where the device is in entry ID to give access. We'll add a condition for the certificates as well and then a condition based on entry ID attributes. I believe we'll spend most of our time on the device.38:59Authorization section so once we are able to get user authorization working.39:19And we have device authorization working. Our last.is let's use tip eap chaining, so let's have a session where we want to look at both the user and the device authorization via entry ID, and we're gonna combine, you know, the user and the machine both succeeding. If chaining, we have to make sure that it's also running, then we look at the groups certificates.39:24Sure and also entry ID attributes from both the user and the device. So we'll try to cover all these in 45 min, so bear with me in some areas I'm probably gonna speed up a little bit. But let us start with Azure. So again, we go to our portal portal.Azure.com.39:44And that, and even from the questions I've been seeing in Slido, it's very obvious that in most organizations and as it is expected, you don't have the same person or personnels managing intra ID and ice. And that is expected and I've seen many questions that kind of lean into that as well. So.40:03Again for those on this call, some of you might might have access to your entry ID environment, some of you might not, but this is what the person on the entry ID and oh you know what, let me use entry ID. I I prefer the admin setup there I think we did this in our session last week as well. So again, I'll go through the details of what needs to be done on the entry ID side. This might not be your responsibility, but you need to understand.40:23Standard because you might need to give them guidance. All right.40:43We did some of this last week during the, our PC TTLS with path session. So if you are not on here for that, please feel free to watch the recording. That will give you more details. But the 1st thing I want to do is create an application, and this is the interface between intra ID and ICE. So all the communication.40:46Across those two platforms is gonna be via this application. So let's call this ICE.41:07Because this is based on certificate, so let's default. Let's register that application. So very important this application ID or client's ID and also the tenant's ID, we're gonna need this in our ICE environment. One thing to note here.41:15Last week's session was based on arrow PC, so we had to enable this, but now we're not doing arrow pc, so this can be disabled, which is good. We want to create our secret, which I am gonna save right here. Again, make sure you save this when you create it.41:33Ah alright let's move a bit fast. It's secret. I'm just gonna leave that on the default, and I'm gonna copy that and I don't want to show everything here. Let me make sure.41:48Alright, that's copy it. Looks good. So again, once you go out of here, you won't be able to copy that. You will need to generate a new one. So when you create a secret, always make sure you copy it the 1st time. Alright, after that let's get our token, this helps us to be able to read groups.42:07When we send the request from ICE over to intra ID, alright that looks good. API permissions, very important. Now for this, let me show you a quick documentation before I come back here. This is a very good documentation about ICE and entry ID.42:22Integration and why I want to show you this is you have the user lookup API permissions and the device lookup API permissions. I'm gonna configure all those permissions at the same time. And if you come to the documentation, you will see them here, the group member read all user read.42:41And then we have ones for the device as well. So very good documentation, definitely make a lot of reference to that. So right here, I'm gonna create all those permissions at the same time. So Miguel told us about the Microsoft graph API and that's what we are doing here. It's an application. So let's come into that.42:57Okay, so for group, we need the, you know, let's finish up the user actually user read and user read all. So I need the user read all permission. There we go. Let's add that permission. Alright, good. I need a couple of.43:14Group reads as well. So let's add a group member read for attributes group member, there we go. Group member read all we need that permission as well and we need the device as well. So device.read.43:34Dot all, let's just get everything done once. Now, you need, I will spell this out once I get everything put in because for some if you're doing just user authorization, then we don't need the device read.43:53But because we're gonna be doing both according to the goals we've said, we're doing both user and device. So the basics that you need, we have, where is it group read all, one is missing. Let me add that. We need the group.read that all.44:09Yeah, there we go. That's very important as well. There should be five of them. Yeah, there we go. So we have the user read and user read all and we have the group read all. Those three are the main ones you need for user and device authorization without attributes. But to use user and device attributes, then we need the device.read that all.44:30And group member.all so all these permissions will get us going, so let me grant those permissions. Yes. Okay, so API permissions, we have our secret, so the key details we have here already in place. So we are ready to start. So let's go over to ICE.44:50And create our application interface as well. Let me move that here, make it easier. So let's log into our ICE environment, and I saw someone ask a question about them not being able to do our rest API even though they're ICE three.four. I'm.45:09So I'm on three.four patch five, but the support is available from patch four. So again, check to make sure you're on the right version of ice. I saw that question.45:29Earlier on. Alright, let's move things up a bit faster now. And this is the 1st thing you need to do. Make sure this is enabled rest API. This will take a few seconds. Once that is enabled, we will be able to go into external identity sources.45:38And then set up the rest API store that will communicate to the application we just created. So give that a few seconds and then we should be able to go. All right, there we go. We have the success, so let's go right here. Rest.45:53Let's add and let's call this intra ID sets. Let's give the name uniform intra ID. So we're gonna switch over to our application copy the client's ID, nope.46:09That's what we need. Come over here, we need that client's ID, let's paste it. All right, looks good. Remember the secret I saved that earlier, so let me copy that from where I saved it alright and finally.46:25Device tenant ID, we need that as well and I'll put that here and let's test the connection. All right, successful. So let's save this. Now while we are here for the interest of time, I was gonna do this later, but let's do it.46:45Right now while we are here to save our time. So for user attributes, I will come right in here. Again, there are questions about the intra ID licenses. So again, that's Microsoft beach. So you need to make your inquiries via the link provided, but let's go ahead and add those attributes.47:05Actually let's do the groups and we come back to the attributes but we can do this before as well. Let's make this simple. I'm just gonna do job title accounts enabled ok let's do office location as well because I know I have those in my.47:23Okay, let's save this. And of course we want to add the groups as well. I skipped that, so let's go to that now. And I had questions there were questions about the groups as well. So this is similar to what we do with on prem AD, you know, I speak to AD and pulls the group and then you select the groups that you want.47:41So I'm gonna save this and then let me go do the same thing over on this side to make sure we're on the same page. So this is the application we created. Now, we have existing users and groups just where you have on your AD environment. You have your use, you have your your users and you have your groups. So I have users here.47:59I have groups as well, which as you can see are the three I just pulled CSS group IM and remote, and I also have just one device which we're gonna use when we come to the, the device authorization. So all that is already in here. So ICE is just pulling this information.48:19But something important we need to do is to add the users and groups to the application we created. So under enterprise applications, you need to come in here, which is isot, the application we created, and we need to add whatever groups we know we're gonna be authenticating to. So users and groups.48:35Right now it's empty, so if we didn't add this, our authentications and authorizations will fail. So let's go with IM, I know most of my sessions are gonna come from there, but the device is also added to this. So let's stick with IM and remote.48:54Let's assign. Now this is assigned. So now we have our application, we have the groups assigned and the groups have the users we need. So let's go over to ICE and set up our identity store, the sequence, and try an authentication once we get our policy running, so.49:10Moving a little faster, so bear with me. So let's come here. Okay I have an existing one so we can still use this. So let's see what's inside this profile. So I have a, I have a profile called intra certificate profile. Again, very simple. Remember here we can point to intra ID. I know with AD on prem, we can do that.49:28But with intra ID, we only need the certificate attributes. We can go with the common name or the subject of native names. In my case, I'm going with the common name, so that looks good. Let's save that, and then I'll come over to my identity source sequence.49:47Let us create a sequence, let's call it intra sequence, actually the intra ID sequence and I will select the certificate profile that we just looked at, and I want this to be based on my intra ID certificate store which I just created, so I'll put that in here.50:04And let us submit. All right, something I also encourage which is part of our best practices is also to lock down your protocols. So if we come into policy policy elements results. So we had one last week for ETTLS. I have another one that covers tip.50:22And ETLS. So again, just keeping what we need, IFTLS is enabled, if fast is enabled, we're not really using that today, but we're using Tip as well and within Tip, we're not using MS jobs so that's disabled, we're using etls. So again.50:42Best practice lock down your protocols and only enable what is needed. Alright, let's look at our authorization profiles. We're gonna be using a couple of this. Today we're gonna focus on the IM users and the manager access. So those two I will be using our policy set.50:58And as we discussed last week, we're also pushing in SGT tags. So come into trust sec, I also have IM engineers and IM managers which will be assigning as well. Okay, I think we have all the pieces together. Let's make sure we're not missing anything. We set up the policy before we.51:16Authenticate, we'll go over to the PC, we'll look at the certificate.51:36And then we'll run the authentication. So let's go over for my bookmarks, I should have my policy set. So I have the parents basically just saying, hey, if it's coming from this server and if it's y, that's one X, then match this. But here we have our default network access. We don't want that. We want to use.51:40Years.52:00What we just reviewed which is tip and with just ETLS. So definitely we want to save that. So anything that is not using the ETLS protocol is not gonna match that. So that's a good way to lock things down. Authentication, let's keep it simple. Anything doing ETLS is fine. So let's call this.52:01Intra EPTLS, and we'll keep just one condition that just says hey if it's an EPTLS flow, we're good to go. Let's keep that simple. And here we'll pick our sequence, don't forget we created that earlier, so entra ID sequence, that's what we need.52:21Our options, we are rejecting and we are dropping if it doesn't match or if it doesn't authenticate successfully. Like Miguel explained, these authentication is against ICE, not against inter ID. If you watch, when we created a certificate profile, it was not making reference to entraid. So.52:40We will look at the attributes from the certificate and that will be used during authorization. All right, let's create a simple authorization rule. Let's actually go for everything right away. Alright, let's do.52:57Let's just say user authorization and let's pick a couple of conditions here. So again, if you remember the documentation we looked at, we want entry ID group.53:14We want the certificate issuer and we want entry ID attributes, so let's take three of those. So 1st of all entry ID group. So come in here, you can try to do it from the main oh sorry not that actually we want to do it from the dropdown, so you get all the options, so entry ID certificates.53:30So let's do external group external group is IM, we want that. Let's look at the certificate issuer, so let's say new, click on this certificate condition. We wanna go with let's go with our dictionaries right there. Certificates.53:51Let's say the issuer common name equals again we'll look I'll show you this in a minute, but I know it's and the last one we want to have an intra ID based attributes, so let's add one intra ID based attributes.54:10That one we want all conditions here. All right, there we go. Yeah, because that's clicking into uncheck that, let's Okay so let's come back to entry ID search.54:32And let's do job title if it contains manager, and I'll show you where all these details will be pulled from. So if it contains the word manager, so again, I will review this information to show you where that needs to match.54:47So these are the conditions we want to use. Let us pick IAM, there should be an IAM user here. And because you know actually because we are doing this right away, you know what, let's manager access.55:06And let's do I M managers here as well because we're checking in person as a manager, so let's save this. Now just to make sure we understand where all these attributes are being pulled from, the user we are authorizing with.55:21From Azure is gonna be Ethan, and these are the attributes it has. So things we're gonna review, the user principal name. This needs to match the common name and the certificate which we're gonna review next. So again, keep an eye on this. Very important. This needs to match.55:37And the common name of our certificate, the other attributes we are pulling, those are from here. So office location is Miami. We are not using that at the moment. Job title, identity and access security manager, so again we said if it contains what manager, that is enough for us.55:57But these are some other attributes we picked, so when you're setting up that policy in ICE, make sure that we did enter our ID, those attributes are available and they match. If not, it's gonna fail. So now let me show you the certificate in ICE before we go over to our endpoints.56:13Definitely keeping an eye on time. Alright, so if you look at the certificate on my side for authentication, so again this was issued by the same certificate CA, so that's great. So if you come to my trusted store, I do have a root certificate.56:32So as Miguel was saying, that trust needs to be established. There are times when the issuer for your authentication sets on ICE will be different from the issuer on the endpoints and that is fine. But you need to make sure that the trusted certificate store has the route for both.56:54The ICE issuer and the endpoints issuer. So that's the most important criteria. All right, let's over to the endpoints. Where are the action is gonna happen and let us look at our certificates. Yes.57:10And for the sake of time, I'm gonna pull in both the user and the certificates and we're gonna review those together because I know we are definitely on a crunch. Alright, so that's the user certificates. Let's do the same for the machine certificate.57:26Okay, alright, so let's review the user certificate in our personal store certificate. So again, this is the UPN name on intra ID. So if this name and the UPN on intra ID do not match, the user authorization will fail.57:44This needs to match, so that's very important and we have that here as well. So subject. We have that here and we should be good to go. And as we can see the issuer we said laughs, that's another conditions, so we say that as here so I think all the details match, so we should be good to authenticate.58:04All right, let's give it a shot and see what happens. So let's come into our adapter. Okay I need to enable this. All right, so this is failing. I'm gonna cancel that's because it's trying to do a different protocol. So let us review and see what we have.58:23Authentication, yep so we still have this set to TLS, we want to change that to smart or other certificate and we want to come into the setting, make sure the certificate, everything looks good. Yeah, we see it in there, so that looks good.58:40Now for user I'm gonna set this to just user authentication. Again, user computer will be fine, but just to make it more specific, let's go with the user and let's say ok and we should try yeah we get that prompt, that's ok. All right. Fingers crossed out works right the 1st time, so we can move over to device authorization. Yeah, that's looking.58:57Good it's identifying the network. So let's go over to ICE and view the policy, the live logs. Okay, great. So this is what we want to see. We look at the details, but just from here we can see ETLS protocol, it matched our intra ETLS authentication, user authorization matched.59:17We have manager access, which is great and our SGT group IAM managers, so that's awesome. 1st time we got it working, that's good to see. So again, spend time going through these details, look at all the exchange, the protocol.59:36So that way if you have a session that is not working, you know where to review. There was a question with respect to how we can check the AD groups within ICE, and you can't really log into ICE to find that information, but after authentication, as you can see here.59:52And we will have that information because ICE mixed that query and we received it from entry ID, so you can see that from your logs, but you can really go to a section within ICE and say, hey, what are the groups for this user? We need to go to enter ID for that. Again, we see all the details, so all these are conditions you can use. So again, these are all those attributes we pulled. We said the.01:00:08Location in Miami, so again all this were pulled from intra ID and they can use any of these attributes in your.01:00:28Policy. All right, so 1st one is checked off. We have successfully completed user authorization via entry ID. Let's go into device authorization. This is my interesting and you need to be careful here because it can take a bit of tweaking to get it to work.01:00:36So let's go back to, our identity store. Let's come here. Rest. So again, the same store, we don't need to make changes on the intra ID side. We already have that. Number one thing you need to have is a device query.01:00:53We need to enable this as Miguel showed in the presentation for device authorization. So, number one, let's enable that. When it's enabled, there are two options. Enter ID, device name, enter a device ID. So just to explain these two clearly while we are here, let's go over to enter ID.01:01:09Come over to my device, all devices. So this PC is this and let me just show you, let me just show how to verify that if you want to be sure, if we come in here, let's go to settings and from settings we can look at.01:01:28The system. Let's go to work access I believe is where it is. Yeah, access and work. So again, this will show you so again you see it and the same UPN we have telling you, ok, this guy is registered and.01:01:45And we have that information here, which is good.01:02:05And we can also look at the PC name, view PC name. Again, you see that name here. Let's scroll down. So again, IL VM windows ten, we can see all that matches up to what we have in entry ID. So again, that tells you this device that is registered here in entry ID.01:02:08And that piece that we're looking at is the same entity. Now, if you come in here, this name is the display name. So what we have in ICS saying, hey, you can either use entra ID device name, that means this name or you can use.01:02:28Enter ID device ID, which is what we're gonna use. Device ID needs to match this. So those are the key parameters when you're doing device authorization. This entity has to be exactly what you have in your certificate. We are doing device ID, not what you have if you register the device via MDM intune. That ID.01:02:48Is different from this device ID, so be mindful of that. So these are our options. So let's go back to ICE and get it done as quickly as possible.01:03:07Alright, so I'm good with device ID because that's what I have in my certificate, so to make it simple, let's come back to certificates here, come to computer, let's close this, make it easy to see. There we go. All right, look at computer.01:03:16Certificates. As you can see, it was issued to this. So this is my common name and I'm telling ICE that is what I want to use common name and it's enter device ID. So again, you see the correlation between entry ID, ICE and the end endpoints. All those three need to.01:03:33If not, it's gonna fail.01:03:53And I was still debugging this morning, trying to sort some of that out. So entry ID is in place within the common name. Now this is where it gets interesting. I was actually gonna run a session that would fail, but we have literally less than 20 min and we are still gonna do tip. So unfortunately I won't be able to do that live but let me show you all the details. Now.01:03:54It is not wrong to use a predefined regex type, but when you do that, make sure you check this very well. This as common name and the OUI and if I put that in here, so what this is saying is.01:04:14Whatever format you use here, if I validate it, that is exactly what your certificate needs to push across to enter ID when we are doing the verification. If what you have in this device query does not match, it's gonna fail. Because ICE is gonna say, hey, I have been programmed to use this query.01:04:32So when I'm sending across device authorization information to enter ID, this is the format I'm using. So if the certificate you're sending to me has something else that doesn't meet this format, it's not gonna match and I'm gonna tell you it didn't match and it's gonna fail. And so my intention was to actually use this because it will fail, but again, that's another 10 min which we don't have. So let me show you.01:04:52Know what the debug looks like.01:05:12Which I thought I was gonna I was gonna do live but we don't have time so again we always we always have this backup when we do this demo. So again, this was one I ran this again you can see this was like 05:00 A.M. this morning, that's 1 h ahead. And this is what happened when I use exactly what is configured here right now with just the.01:05:14CN and the OU.01:05:33Hopefully you can see this well. So again during the debug, it's gonna say, hey, ok, I'm starting this process for device authorization. I need to check the subject name. That's the format we've chosen is a subject name format, and it's looking here and this is interesting part you need to look at. Oh, by the way, this is ice PSC debugs in case. So this is ice psc.01:05:35The debugs we're looking at not rest ID. So it's saying, hey, this is what I pulled from the ICE configuration. So again, we see that format here, this regex formats, which is exactly what I have here. So this.01:05:55And this is a perfect match, and he's saying, ok, this is what I'm expecting, but this is what the certificate is sending to me. The certificate sends the CN, the OU, the O, the S, the C, and he's saying, well, this, and these are not exactly the same thing.01:06:11So you're telling me to use just this pat and I can't find a pattern. So you get this debug that says pattern not matched. And once you get this, it's gonna drop everything. It's gonna tell you user upn or and device UPN cannot be empty because it says hey, if it doesn't match I'm not gonna use it, so it's gonna fail. Now, the.01:06:28Resolution for that is also explained in this documentation that I referenced earlier.01:06:48Let's just scroll down a little bit. So this is a very good documentation and you will see the regex formats explained here. So very good explanations. Again, we're not gonna go into detail, but you need to use a regex pattern that matches your certificate exactly and you will see how I did that in a.01:06:54Minute. So after I did this and it failed, I'm gonna show you what I I worked on. So I have my user certificates and I know what it looks like. So let's come back here. This is our user certificate. Let's come to subject. So this is my certificate I know I have the CN.01:07:13The OU organization, the states, and the country. So these are the parameters I have, which I have put here in this notepad. So that's my common name, organizational units, organization, states, and ok so we'll send it across under the country. So when I'm putting in the regex.01:07:31It has to be exactly the same. Even when I copied the regex from here, it was different. So again if we copy this.01:07:51Let me show you how I edited this to match exactly what I have. You copy that, I paste that here. You will see there's a little difference. I don't mind if we spend most of the time here because this is the most important part. So if you watch.01:07:58The defaults we have on that website also has location, which some of your certificates might have, but my certificate does not have location. So if I use that regex format and I paste this in, it's gonna fail because my certificate does not have location. So that's why I removed this.01:08:14And then now it matches exactly what I have. So in the interest of time, let's go ahead and put this into ICE and there's a ver there's a verification option within ICE as well to make sure this matches. So let's go back over to ICE, our device query common name. So I'm gonna say hey I'm gonna use a custom one again.01:08:32There are details here explaining the stuff.01:08:52That we're doing so you can come in here to get some more details, but now I'm gonna paste this and I'm gonna paste exactly what my certificate looks like. So again, this is a format. It doesn't mean the detail must be exactly the same because different users will authenticate and they're gonna have different device ID.01:08:54But the format is what we are putting in. So this is a regex function, so it's about the format. All right, so now if I validate this successful, so we're good to go. All right, let us save this. This is very, very important. I knew we're gonna spend time here, so that's why I want to do the field option.01:09:13Alright, so we have device query, all good. Let's come to device attributes and let us add some attributes as well. So let's go with display name and let's go with operating system. We cannot do account enabled as well, but let's keep it a bit simple. I think those three. And again, there is a list of the.01:09:31Compatible attributes on that link as well. So let's take with these three. I think we should be able to make it in time now with this. Alright, so all set up. We have those details we have the device information, we have.01:09:49I set up and we have our endpoint ready, so let us create our policy set. Policy policy set. We're gonna use the same one. We already have tip enabled in our protocol. I'm gonna leave the authentication simple, let's keep it as TLS.01:10:05Authorization to make this go a bit faster, I'm gonna duplicate this above and we just gonna update the name to device. Alright fingers crossed, everything works right the 1st time and we don't need to troubleshoot. All right, so another.01:10:21Important information and this is intra ID set for user authorization.01:10:41For device authorization, this needs to change. Miguel showed us that in the presentation as well, and this is the difference. So we have intra ID sets and entry ID sets device. So when we are doing device authorization, anything that relates to the device query needs to be pulled from intra ID device.01:10:46So let's select that and we're doing external groups, and we want to do I M for that. Again, the certificate is the same issuer so I'm gonna leave that. I'm gonna change the attributes so for device, let's go with display name, yeah.01:11:03Display name if it's let's not say equals because it's gonna vary for different users. So let's say if it contains and let's assume the format is the 1st name and Windows VM windows or VM when because what we have here is my name.01:11:23VM windows ten. So let's just go with so long after that's VM and windows, we are good. We expect every user to have that. So VM and Windows across and let's add one more let's do operating system as well. So let's do new.01:11:39All right, I'm really gonna push it. We got 10 min. So let's do operating system because the windows. So again, just to make sure we lock that down. Let's do a use on this. Let's give the same for the sake of time. Let's save this. Alright, let's see. Hopefully that works the 1st time.01:11:54Of course we need to change our authorization here well not authorization our supplicant configuration. Let's change that from user to machine. So computer authentication, let's say ok on that, we do ok on that.01:12:13Alright, awesome. Work the 1st time. That's good. And if we come to live logs, we will see all that information. So now you see we've gone from the UPN to the device ID, so that's, that's beautiful, that's good to see. Again, we matched all that device authorization. All right, let's go through those details real quick and we have ten.01:12:3110 min or less than 10 min to cover tips, so I'm really gonna fly into tip now.01:12:50So again, I just want to show you all those attributes. We pulled out all the information. Yeah, this is very important. So we got the display name operating system. Awesome. Okay, great, great, great. Good to see that work the 1st time. Now finally, let's go into the tip. The good thing with tip is we've already done user successfully. We.01:12:55We've done device successfully so all we are trying to do now is put them together. And if you're trying to do tip, if that is your requirement, try to do user separate and device separate 1st.01:13:15Make sure those work successfully before you do a tip. I've seen lots of customers trying to do tip 1st and they don't even know where it's failing, they're dealing with user issues or device issues and it's all kind of mixed up, so get each one to work individually and then after that we can go and then do tips. So let's come back to our bookmarks.01:13:27Policy set, and because of time, we're not gonna do the three versions for user succeeded machine field, machine field, user succeeded, and we're just gonna go with both and working successfully. So let's add.01:13:46Cause now we're doing more than just tips, so let's add another function here. No I don't like it when he looks this way. Let's just say new the same thing. Let's do network access and we want to do the tunnel here. We want to make sure it is tip.01:14:02Alright, use that. Okay, good. So ETLS and zip. Awesome. Again, nothing else is gonna change here for the store. And let's do, you know what, let's duplicate this. It's always makes life easier.01:14:21Duplicates above and let's make this device and user to make it easier, let's put user and device, user device authorization. Alright, so what are our conditions? Again, again, always make reference to what you were asked to do.01:14:38So each chaining needs to be in there.01:14:58Certificates issuer needs to be in there chaining and then the other attributes, ok, so let's do that. So I already have some of them here. Certificate is in here, external group is here. So let's add if chaining, so new, Scroll up, let's say network access.01:15:01Needs to be, yeah, actioning this results, and this is where you see those options that Miguel mentioned user and machine both succeeded, user failed machine succeeded, user succeeded machine failed. So in production, you would have policies for all three conditions and you would want.01:15:22To give different levels of access or when user failed and machine succeeded or user succeeded and machine failed. But again for the sake of this demo on our time I'm gonna go with this.01:15:42All right, we have eap chaining, we have certificates. Now we want conditions for both the user and the device. So we already have one for the device here. We're checking device external group. We're checking device display name, we're checking device operating system. So let's add some.01:15:52User based attributes as well. So that way we're checking everything. All right, again for the user, we coming to set not set device. So let's go with external group. Let's also say I am because that's.01:16:10Be in the same group. Let's add location saying the user needs to be located in Miami because we have that in intra ID. And again in reality you won't need eight conditions, but just to show you that you can pull attributes from both the user.01:16:26And the device, let's say job title again like we used earlier, not equals this time contains. So be careful when you use those details to make sure we're matching. Location is Miami and title contains manager. All right, we are almost there guys. We are almost there. We have 5 min.01:16:41To wrap it up. Okay, so again this is Lensey, we you won't, you shouldn't have this in production with all those conditions, but let's make sure we can verify everything. If chaining is in there or user machine, we're checking the group's certificate condition is in there, three device conditions, three user conditions. All right.01:17:01Alright fingers crossed. This works 1st time as well. I will expect it to because we've done each one and it works. So let's we're just putting it all together now. Of course we need to come here and make the change saying we want to use both user.01:17:21And computer, so user or computer. All right, we'll look at those details together and we should be good to go. All right, that worked 1st time as well. Good. So trust me, when you're doing this nine out of ten times, it's not gonna work the 1st time. You might need to move things around especially reviewing things with your certificate.01:17:36Sure UPN is in the device ID, doing the queries, reviewing all that. Sometimes you need to do debugs.01:17:56To really understand what's going on. I wish we had time to look at the debug slide, but I think you you get the points. Oh, did I show you the debug when it passed? So this is the failed one and this is when it worked. Again, basically just gonna see that the regex and this match, and it's gonna tell you there's a match in the pattern. So pattern matched for the machine flow, so again, that's.01:18:02How you know that's working. Again, this is ISPSC debugs and this is what your final live logs we look at, and we can wrap up this session. Let me just show you that and we are done. All right, live logs, I'm going to refresh that. Where's our active session?01:18:22Let's see what's going on let's review that. Okay let's make sure we have tip in there. I know we are out of time, but let me check what did we miss?01:18:41Let's check that real quick and we'll be back. Policy set Tip is enabled, yeah, protocol is fine. Authentication tip. Yeah, let me see my logs are just not pulling. Yeah, we have everything.01:18:56Yeah, I think it's just catching an old session. We have 4 min. Okay, but this is a successful setup, and all this would work now, but we are out of time. I need to hand it over back to Miguel. All right, so quick addition at the end. We were definitely out of time when we're covering the the tip and we kind of rush things a little.01:19:12Bit so even though we add the device and everything set up, if you're watching ICE, this was the last one we did at 01:25 just before the session ended and.01:19:32We add IFTLS, but again we're trying to do tip and again we are matching the defaults here. So we add the policy configured for tip, and that's because even though we add everything done correctly on ICE, on the endpoint, we only changed some part of the supplicant, so again we change this to user or computer authentication.01:19:45And but while we're rushing, we didn't change this to tip.01:20:05This was on smart smart cat or other certificate, which we used for the user authorization and device authorization and authentication. But the last thing we had to do was just to change this to tip, come to settings, make sure we set the insights or by default, this will be set to none. So we have to cho choose certificate for client and certificate for machine as well.01:20:08And we just say ok to that, do ok to that. So that was just the part we missed. But doing that now you see another success. So again, everything we did on ICE was correct. We just didn't change that supplicant, and if you refresh this, you see another successful authentication for Tip. We see both the user and the machine credentials.01:20:28And if we look at the details, you will see all the information from both the user. So we see the username is both the username, the UPN, and also the device ID and all the details we pulled, and it will also show that we add it training. So again.01:20:49That's something we definitely want to make sure we add or change. So again, keep chaining and all that looks good. I just said to see if we could add this little information at the end to make sure we covered the two completely. So Miguel, back to you. I wanted to jump quick and say, on the question of of lookups.01:21:05Active directory, we have that capability.01:21:25Because of the active Directory join and there are much broader built in functionalities there, so we can go in and say, I want to just do a user lookup, give me back all the groups this user is a member of. The graph API while I believe it does support it, it's just not built into the product yet. So that's.01:21:29Something we may have as a feature request.01:21:48All right. Thank you, Tim. Perfect. Thank you very much team are you. Now let's review a few key key takeaways. Being honest is really quick.01:21:52Here we have a very quickly on. It's gonna be important for you to consider this information because at the end as I mentioned, each customer has its own flow, each company has different scenarios, different endpoints, different everything. So it's really good to always take a look, double check and make sure that whatever you need is whatever you are.01:22:09So in this scenario, you review the topic here e.g. identity user or machine against it, which is both basis certificate against change, and remember here is changed because we are gonna authenticate both.01:22:30Computer and machine. Policy richness medium tip high. Well entry use we have here the group attribute lookup and group attribute looks for both. So always consider this part, it's gonna be important.01:22:45And remember that this decision should be taken considering all the factors that you may have. Now, what's next? Eh, 1st I would like to ask you to please answer the survey that it's gonna, you are gonna receive or you're gonna have after this meeting.01:23:00And also there's gonna be a post up post any follow up questions on the.01:23:20On the side, here's the QR if you want to enter I'm gonna leave it here. Also, there are gonna be some upcoming events with segmentation journey on July. If you want a be in the in the lookup because we're gonna release these different segmentation journeys from the foundations of my.01:23:27Network segmentation unlock unlocking Cisco traffic and seamless segmentation integration.01:23:47The three theories are gonna be working through the segmentations journey. Let's say the foundation is the basic, then we are gonna be talking mainly about processing and then the integrations and how to enhance. And finally, we have some additional resources with the cyber capsules, also here we have both qrs in case you wanted them in English or Spanish.01:23:52And feel free to review and look at this information. Thank you very much for your time today and we'll see you in the next expert insight series.01:24:10