The ISE Core – EAP, Certificates, and Licensing Essentials

Oh today we are gonna be talking about the next section of the big back to basics, the certificates and licensing essentials.00:00I'm gonna be the presenter in Chartinez and Omero is gonna help us with the lab or the specialist here on this session. Now it's important to mention that one important comment on this specific session is we are gonna be covering some of the important concepts that we, we need to understand.00:17Then whenever we are talking about basics regarding ice.00:37Okay? Now, also on the chat we drop a link to the slido. Please feel free to join. There we are there we are gonna have interactions. There's a Q and A If you have any questions, please ask there. Now let's review a little bit of the agenda.00:40As I mentioned, we are gonna bring it methods a little bit about itself, why it's important, then we're gonna jump to certificates and then the licensing. But let's discuss a little bit more about this and the reasons behind it.01:001st a brief introduction here. Of course, if it's gonna be critical on this session because at the end, it's one of the main methods that we have to review the identity, ok? How the conversation is gonna happen and where it's gonna, it's gonna be carried on.01:17This is gonna be critical because again according to this part, we are gonna be taking decisions. If methods are gonna be really, really important because it's gonna find the communication and it's always critical to understand that even if we have the and we have everything configured, this is not only like a work done directly from.01:33From the I side.01:53But also done from the endpoint, ok? So it's always really, let's say important for you to understand those three parts. We are gonna discuss them more in a in a minute, but I wanted to mention that part because sometimes whenever something fails with authentication, we say, hey, you know what? Something is failing maybe.01:54Feeling, not always sometimes yes it happens, but also we need to understand that these three elements are gonna be really important and we're gonna discuss them in a minute in in more in depth. Then we have the certificates, the PKI and how those certificates work, why those are important?02:14Which certificate serve which role? That's gonna be critical for you to understand too, because at the end, ICE is always gonna work, it's gonna work with certificates. And of course if we don't have those certificates clearly identified, we don't have those rules clear clearly understood. Of course we may create confusions and that may bring some difficulties.02:33All this in the day today. We have some recommendations to practices there. Yep, it's always gonna be important to keep an eye on the certificates because at the end without the certificates, some things maybe or may get broken, so it's important to always review and make sure that those are maintained in a healthy state.02:53And finally the licensing. The licensing, it's gonna be always a critical topic because at the end, without licensing we can we cannot work correctly as we expect. So it's gonna be critical for us to understand how that licensing work, which are the differences, and of course.03:13Which advantages we have now with this new licensing model that we are using after. But well, as you can see here, all these elements are gonna be tied up at the end licensing is gonna help us to use the features.03:31If it's gonna be critical because it works together with certificates a lot a lot of times, not only for the APLS but also for authentications itself. We're gonna discuss that, but always make sure that you have these three elements on site because those are gonna be important.03:48Now, let's review a little bit more about the different methods. And here I'm gonna jump a little bit to the next slide. Give me a sec, ok?04:08Here we have exactly the methods and we need to talk about the different elements. Of course, we are gonna have the endpoint, the access set or the network access device and the ISPSN. Why ISPSN and not is because usually the communication for an authentication happens directly to the PSN.04:33Probably a lot of you are aware of that part, but that's gonna be really important and critical to understand. Now, why this is relevant or why it's important? Because at the end, if we don't have these three elements, the authentication is not gonna happen. If one of them is failing.04:51We're gonna see some authentication, and of course whenever we're troubleshooting, it's important to understand each one of this. E.g., the endpoint, it's critical because we are gonna have the supplicant. The supplicant is the one that initiates the communication as you can see here in the slide.05:08So it's gonna be really important for you to understand that the supplicant is critical. Here e.g., we see that the communication people start identity is done through the supplicant. What happens if we don't have a supplicant?05:25Well, of course, what is gonna happen is that the endpoint is not gonna be able to authenticate through that one X There's other options of course we have map, e.g., but always whenever we are looking to do a.1X, we require this applicant from the endpoint side.05:41Now, this supplicant doesn't talk directly to the ice. It's not gonna send the request directly to ice. I have seen also some confusions on that part. It's important to understand that always the one in the middle is a network access device in this case.05:58A switch, a wireless LAN controller is the one that it's gonna be here in the middle and it's gonna be receiving that request. This network access device is the one that knows the different radio server, in this case the ispsns, and of course according to that information and instructions that it has, it's gonna forward.06:12That request the ISPSN, and once the ISPSN receives that part, it's gonna send the challenge. That challenge is gonna request for that specific method exchange that we need to define and after we review this method exchange.06:31We are gonna make an access effect or an authorization. Of course, this is gonna change a little bit according to the protocol that we are using. But e.g., whenever we are talking about different protocols like with MS CHAP version two, which is the most common ITLS 14.06:47Each one of those are gonna change because they are don't work exactly the same. But I'm gonna go a little bit more in depth in the next in the slide. Now, we have also here another important in section because at the end.07:07Those that we saw before on the previous slide, those are the three three main actors, ok? But also we need to understand that there's a four actor and of course we have one access through those four control planes. What does that mean? Well, of course we have the peer.07:26We have the supplicant and identity proof. We have the authenticator which is the switch, the, the wireless LAN controller, the VPN, we have the ice, which is gonna work as the server policy and radius, and of course we have the identity and context. This is critical too because of course ICE connect the identity also.07:42How with internal identity store. We have any store for usernames, we have also endpoints. So ICE can work as a yes, it always does. No, it's not the most common. Usually what we do is we have an active directory. We have also ARSA, we have MDM, we have a lot of.08:02Things with the that we're gonna be using.08:22To have more information for the eyes. Now, important to mention remember here that always we are gonna have three elements on the AA. We have authentication, authorization, and accounting. Those are the three elements that are critical.08:25And of course authentication is gonna approve the authorization decides the access and accounting is gonna provide more reliable information about what's happening and logging for our system. In this case the ice. Enforcement happens at the edge.08:42This is something important too because I have seen a lot of confusion here. Whenever we are doing this flow, the authenticator is the one that it's gonna enforce, ok? It's not gonna happen on the ICE. ICE is gonna take a decision. It's like the brain.09:00It's gonna decide, take that decision, but it's gonna forward that decision to the authenticator. And the authenticator is the one that it's gonna enforce the protection under the specific board or that specific communication. So it's always important to understand this part. Why? Because also a troubleshooting.09:17Whenever it will be nice, if something is failing and we identify that ICE is providing a result, then that means that ICE is working as expected. Mainly what is happen happening is we have a failure authenticator since the ICE is sending the reply.09:35And it maybe lost or maybe the authenticator is not able to apply. So here we need to double check this part. Now, we have also here different methods to change the boundary, and here, please take a quick look at the slide.09:51And I'm gonna explain here in a second. These are the three main ones. Those are gonna be important. Why? Because at the end, whenever we have that visibility, we are gonna be able to take decisions.10:09Some new something that I can tell you at this point of time is that usually, e.g., with MS chat version two, which one was one of the most common let's say method is nothing used anymore. Why? Because Windows eleven has done some updates into the security policy.10:26And they enabled a new security features that block that communication. That's the reason PIP is not being as used as much as in the past. So if you have, if you're using PIP in some previous OS.10:44And you are thinking about moving to Windows eleven, be careful because Windows eleven may experience that fail. So be, be really careful with that part and be always aware that you need to double check and make sure that everything is working correct.10:59Now, we have the 1st one which is IPTLS. IPTLS works mainly with certificates. That's the reason I mentioned before that certificates not only works for IPTLS, but also for communications, we are gonna see the communications, but on this section, IFTLS is gonna be critical.11:15Why? Because if TLS is gonna work by exchanging certificates between the and the endpoint. Important to mention, remember always that this is a two way communication. Even if the endpoint has a valid certificate.11:32If the endpoint is not able to identify or validate the I certificate, that communication is gonna broke, it's gonna break, ok? We're gonna have a broken communication and the reason behind it is because both should trust each other. The endpoint should trust the ICE and the I should trust the endpoint.11:49How does that work? Well, of course, we need to have certificates on both sides. Both of them should be able to authenticate or validate the each other's certificate, and of course with that information if LS is gonna happen. Now.12:08I received here a very common question about certificates with FTLS and they say, hey, then at which point or at which moment Active Directory reviews that the certificate is vali is valid. It doesn't work that way.12:24It's important to mention that ETLF is gonna review the certificate itself. Whenever we receive a certificate, ICE is gonna review who signed that certificate, which CA signed that certificate, and of course according to that part, it's gonna start reviewing details like.12:40If the name from the endpoint that it's talking to us, it's matching the certificate. It's gonna review that part. It's gonna review the certificate is valid, and of course the date of expiration. If those are compliant and they are valid.12:57The certificate is gonna be accept. Why do I mention this part? Because at the end, again, sometimes we think that this is gonna happen on Active directory. But NO, it happens directly on ICE. And of course, the same happens with the endpoint. It receives a certificate?13:13It's gonna review all all that information and it's gonna say, ok, it's a valid certificate and that is gonna be enough for the PLS to work correctly. Now, why do we have that thought about Active Directory being involved?13:30Well, that is something common because there's another feature in ICE that is gonna allow for Active Directory to do some extra checks, ok? But that's not part mainly of the PLS itself, it's part of the flow on authentication with the certificate authentication profile.13:48So that's gonna be important for you to have awareness, and if you if you want to have more detail about it, of course, if you look for that part, review always the flow on the certificate authentication profile section. E.g., there's a.14:07Another it's an important part because we're gonna have a 3rd party certificate yes and we have we're gonna have the inner identity. The server certificate is gonna which is important and then we are gonna use that inner identity.14:24You have that communication and pass on the credentials. Again, this method was one of the most common. We were using password. We can also use another different method, but the most common was MS job version two, and it was really popular.14:41But currently that one is not in use anymore, do those vulnerabilities and also Microsoft enabling that security. And finally, we have the more complex, which is the TEAP. The TEAP.14:56Is again something important because it's gonna have the ability to have chained methods. What do I mean by this? We're gonna have the user and the machine authentication in one flow. That is gonna be the important part because again once we have both.15:14In one flow, we're gonna be able to not only identify the user but also the computer. And of course that give us the ability to take different decisions. If the user is valid for the computer not, then we can take or give any specific level of access.15:32Backwards is the same information. We can take a different level of access if the computer is valid but the user is not. And if those are valid, we can provide e.g. a full access. And if neither of them are valid, we can react. But that is something important and one of the abilities of this.15:48Now, very important here is to review or reach each authentication as a state transition. We always need to identify what is gonna happen. Again, there are different flows whenever we're authenticating.16:19But it's important to identify each one of these parts. The 1st one, e.g., we have the discover, we have the port control, we have the identify which is the authority, the negotiation for the method, the proof with the TLS or inner method.16:36The session keys with the data and this is an example that I I wanted to provide. Why? Because at the end, whenever we are troubleshooting and we're reviewing any PLS conversation or any conversation, sorry.16:51It's important to understand that there are several steps, ok? We always need to understand which step we are in or where we are getting stuck to make a successful troubleshooting. It's not only like, hey, if we identify here directly the endpoint and it's gonna happen correctly. No, actually.17:07We can have the port control, we can have here e.g. we are looking for the identification, but if we don't have a supplicant e.g. defined on the endpoint, we're not gonna be able to negotiate and select that method.17:26In that case, of course, usually the port is gonna have a full back to map and we are gonna be able to authenticate through a different method, but it's not always the most recommended. So if we are able to do that one x, that would be the best. And of course we need to make sure.17:41That we have the different understanding on the elements. Now, let's go a little bit more in detail and at the general level because at the end, as I mentioned, each one of the is gonna have different, let's say like breakdown communications.17:57The type of of messages that they are gonna use are gonna change. But again, the general flow is gonna be the same. E.g. here we have the client and we're gonna have the client hello. That's always the 1st step.18:15We have here the server hello, the certificate chain, and the client is gonna validate the ICE, ok? This is always important because that certificate or that information that the ICE is providing in this case the certificate, it's gonna be critical.18:30Probably and here I'm gonna take a little bit of a further step, but you have seen on the certificate store that we have any authentication certificate. Well, that certificate is the one that I've uses in this communication. Whenever it starts to talk about it.18:47In this case e.g. if LS, we're gonna see that that certificate is gonna be sent to the endpoint for the endpoint to validate that certificate and make sure that server. What happens a lot of times we enable this flow, but we don't make sure that the endpoint is able to validate that certificate.19:04And of course if the endpoint is not able to validate it, it's not gonna trust that radio server which is and it's gonna reject it. And of course the authentication is never gonna happen. That's the reason it's important for us to make sure that the certificate.19:23Is always valid and of course from the endpoint standpoint, we are able to take a look and validate that certificate. Now, once we are we have validated the the certificate, we are gonna see send also the client certificate and proof.19:38Here for the client sends its own certificate and ICE is gonna validate that certificate, ok? How, again, it's the same process we are gonna be reviewing mainly that it's a valid certificate, it's a with a known certificate.19:57Authority because this is important if the ICE doesn't know that certificate authority, it doesn't have a way to draw that certificate, so it's gonna understand that it's a not valid certificate. So it's important for you to always make sure that the ICE is able to recognize that CA. And not only the root CA, make sure for ICE to know all.20:15The full chain of CA, in this case the root and intermediate certificates. That's always something really, really important.20:34And of course, once we have finished that authentication and those two validations, ICE is gonna provide the author, in this case the validity validity and authorization for that specific endpoint.20:42Now, here we have the PEAP and we have different topics about talking this one. Usually the reason we had the this PAP is because it it is protected. What do we mean by protected? That.21:02The credentials are inside the server authenticated tunnel. What happened before, we could set the credentials, but there was traffic and those credentials were open. Everyone who captured that traffic would be able to see them. So PAP entered to solve that topic.21:19Mainly what happened, we had a DLS tunnel where these communications happen and of course we are also we're going to validate the certificate and expected server identity, but in this case once we had the e.g. version two those.21:37Credentials are sent through this tunnel, tunnel and we are not able to see them because those are already protected. And of course the successor failure also happens inside the tunnel. Again, I'm not gonna stop here a lot because we already have some information.21:55Now we have also here on the on this next slide the TAP. Now, here what it's gonna happen, we're gonna have 1st method with the machine.22:19It's gonna have, of course, a compound result because we are also have a second inner method, ok? This one are gonna combine both of them to have any changing result. As I mentioned, it's gonna provide different results and we are gonna see.22:36Different authorization results according to these compound results. Again, it's gonna be really important for you to understand that we need to work out this on the policies. If we don't identify these compound results on the policies, we are not gonna see that advantage. E.g., if we are seeing.22:52One authentication for the machine succeeded and the user failed, that one should be specified on the policies and that it's gonna have a specific result. We need to create a different authorization policy for the different scenario where the machine fails and the user passes and that should have a different result.23:11That is gonna depend according to our design, but we have that flexibility to have different actions according to what's happening. Now, very quickly, it's important to mention that the policy starts after the protocol proves an identity.23:31Of course we have here the protocol success, we're gonna have the identity context because we have the endpoint device and the session and finally the authorization. After this authorization, it happens. These are some stages that are important and are critical whenever we are trying.23:48To double check. Now, I have been saying this a lot. I'm not gonna stop a lot here, but mainly whenever we're troubleshooting, we need to do it mainly or it works best when we're doing from the outside to the inside. Here e.g. review that the endpoint has all the information.24:07That of course the in this case the switch, the access edge is able to provide all the information. It's receiving the communication and it's sending all the information to the ICE, then we can review the radius path that the communication between the switch or the controller.24:26With the is being correctly transmitted, that we have the correct share secret, the source IP, reachability, and here just to an example real life, what happens if we have an authentication and we have a routing issue? Well.24:42Usually what happens is that whenever we are, let's saying crossing a device from the section, we identify a specific IP for that device. I have this seen this scenario before. Of course, I received the authentication through that specific IP.24:58Everything looks good. It returns the information to the, to that same IP, but it may get lost. Or another difference, it happens that whenever we are sending the information from the from the switch in this case to the ICE.25:15The information throws through a different path and it's been received from a different IP to the ice, and it doesn't recognize that a specific network access device because it has a different IP. So it's always important to understand that this rate is important and we need to double check it just to make sure that everything is being seen correct.25:33And of course the ICE policy, the policy sets method and authorization rule are important because we need to find that it's working. And finally the Usually this is the best way to do it. Of course, if everything is implemented, what you can do very quickly is go to ICE.25:53Review if ICE is answering and probably from there you can discard these two because if ICE is providing a good answer, these two maybe really discarded and now we need to troubleshoot these three to understand where the issue is being located.26:10And of course important to mention that we have evidence sets that we can use for diagnosis. We have the supplicant level locked here on the endpoint at the switch level or the session state and the interface events raises counters.26:31And on the we have the lablox steps and the if we enable them. On the trust, of course it would be important to review the active directory identity, the CX OCFP, to review mainly that the trust is having.26:50Let's say that evidence and we can identify if there's any issue there. Always make sure to correlate through timestamp and that's gonna be critical for us to be able to troubleshoot correctly and quickly. Now.27:07Let's jump to certificates. Mainly what is a certificate, and I have seen a lot of confusion too here. As I mentioned, certificates are gonna be assigned document that represents an identity. It's an identification card mainly for the computer, ok?27:22It can be public or it can be private, it's gonna depend a lot on what we are doing, but it's gonna have always a public key for that identity. That's gonna be critical because that usually a public certificate can be provided to everyone. And of course.27:41That's gonna happen because we can or we are able to identify that certificate validate. Now, how does this work regarding certificate trust? We request the server, we have an answer with a certificate.27:57And of course the client is gonna identify without a specific and we're gonna verify that specific certificate. That's gonna be critical and we have that symmetric encrypt encryption as part of the certificate trust.28:12Now, something important to mention is that the certificates are not only working for ITLS authentication. That's a common confusion. Of course, we can see here and say, ok, this is pretty common.28:28And how does it impact well yes, but whenever you enter to a browser and request for a page with certificate, this is the flow that it's gonna happen, ok? We are making the request to the server. The server is gonna answer with the certificate.28:43And from there, the client is gonna verify that server certificate, ok? What happens if we the server certificate is not valid? We're gonna see an error on Internet Explorer saying, hey, this site is not trust you. Why? Because the certificate is not valid. The certificate is expired. The.29:00It doesn't match. Those kind of errors that usually we see on Internet Explorer or.29:20Whatever you like prefer to use are mainly an identification about this type of certificate and what's gonna happen if the certificate is valid or not. So taking that in mind, just think about it.29:26Yes, of course, we are seeing here the certificate, we are making sure that it's valid on our browser. And what is related or how does it relate to ICE? Well, these are the roles that we have on ICE. We have the admin.29:41Portal EAP, radius TLS, SAML, and PX grid. All of them are gonna be used in case we are using those features. I'm gonna be honest here. X grid certificate is not gonna be really in use unless you are using.29:59And probably that's the reason some of you are not using it or it's not as important as you think. Now, e.g., day one is one of the, the ones really important because as we saw on the previous section is critical for the communications. Well, the admin, e.g..30:16Is whenever you enter to the administration portal on ICE, you are seeing a certificate warning if you are using usually a self certificate. This outside certificate is shown as an entrosity because your browser, in this case your endpoint or the computer that is entering to that ICE portal doesn't.30:36Trust that admin certificate. That's the reason you are seeing that message. Now if you sign that with a public certificate, of course, in from any computer you enter to the ICE, you're gonna have that validity for the certificate and you are gonna stop seeing that message. But in case you are using.30:55Only your internal network and your own computers or the enterprise computers to enter to that ICE?31:15Then that means could be a private one. Why? Because usually the endpoints or the computers, the corporate computers are configured to trust that those internal certificates, those private that internal entity CA, so in this case.31:22It may happen that you don't need a public one. It depends. The portal one is gonna be again one of the most importants because whenever you are talking or enabling guest portals, BYOD BYOD portals also sponsor portals, well.31:38This portal certificate is gonna impact there. And of course, it's not the same as sponsor to a guest. Whenever you are using a sponsor portal, an internal certificate by an internal CA maybe enough. But of course if you are talking to guests.31:55You don't want usually for the guests to enter to your guest network and see a warning about this connection or this site is not secure. So to avoid this part, if usually whenever we use the public certificate by the way, the.32:11Guess that we don't control the endpoints are not gonna see that specific alarm. Now, just to mention here, the other certificates are gonna be.32:26Equally important, important to mention some important topics. Remember that now also a new certificate limitation was set in place for, for google, from Google it came. Mainly what it means is that now the public certificates cannot be signed as a user and server.32:43Authentication so be careful with that part because if you are looking to do that or sign a certificate, now you cannot, so it would be important to double check and make sure that or you are signing signing that certificate internally or if you need it public, you need to make that difference. So be careful with that part.33:03Now eh, a little bit about certificate examples here we have some of the examples on certificate, we have the admin portal. Admin communication has certificate here. Whenever we're doing authentication, we are gonna see a certificate, e.g., we can see here the sponsor is using a certificate, the admin one.33:24And pretty much on for administration and sponsor portals any, we're gonna see that usually what happens those certificates involved. Again, as I mentioned, those maybe different and even if you want to make different certificates for different portals.33:43You can also do it. Just be aware of that part because it's gonna be important. Now, very quickly certificate change. This is gonna be important for you to understand because the root certificate may have intermediate certificates and those may sign in the certificate. So it's important.34:01Always to have this full let's say chain. Why? Otherwise, we cannot validate everything, correct? In this case, e.g., we have their then entity certificate, we see that we have a chain link with the issuing CI name, which is intermediate CA certificate, which.34:21Itself was signed by the root CA, so that's the importance the root CA signs intermediate and intermediate signs, The sorry the entity certificate. So it's gonna be important for you to have those three.34:40Really identified and understand that these three are important. Here e.g., another way to see is that we have here the list, we have the server or the identity, we have the intermediate CA is the one that signs that list.34:56And of course a hierarchy and the root CA which is the intermediate ca. So it seems always important, always critical for you to understand that this one is.35:12Required as full enough. If we don't have intermediate, we are gonna see failures there. We also have here an important section regarding the and the.35:29The two different directions and why do I mention this part? Because it's gonna be critical for you to understand the difference, ok? Here e.g., the endpoint validates size and the ice validates the endpoint. This is mainly happening on on the LS yes.35:44But here, e.g., whenever we are talking about the endpoint validating the ICE, it's not about the itself. Of course, it's part of the flow, but it's part of the certificate that ICE has here in this section, ok? This certificate is the one.35:59That it's being used here at the flow. That's the reason it's important and I'm linking these two processes here because we are validating that if authentication certificate. The is gonna validate the endpoint yes, this is the information about the endpoint, but it's always for you.36:18Important to know that here we are using that authentication certificate, ok? And of course we're gonna validate that expected server name, the valid time and usage, and we have the complete server chain. And here we have backwards validating the endpoint that it's a trusted client CA.36:36Identity extraction rule, valid time and usage and location policy and reachability. Both required to pass for these two flow correctly. What happens if our application certificate certificate expires?36:54We have an issue because then the endpoint is not gonna be able to validate the certificate and the if authentications are gonna be broken. So be careful. This is not empty warning. I have seen many times this issue.37:10Because at the end, we don't understand sometimes that the certificate or the authentication certificate is the one that it's being used to authenticate the with the endpoint, so be careful. Now we have the certificates to service rules.37:26Here as you may see we have different certificates. Again, very quickly admin is for graphic interface and node communication, it's important for you to understand those roles if it's for.1X server identity portal, it's gonna be for guest BYOD portals.37:45A sponsor portals too. And someone for dedicated services. So you may have some of them and or all of them, you can be using admin, and portal and not using SAML e.g. and.38:01TLF to gonna depend a lot on what do you what you are using regarding features but all of them are important. Always try to keep them healthy.38:22Okay, that's gonna be really, really a good practice that I'm never gonna stop saying because at the end if we miss one of these, we may create false alarms and then those false alarms may impact another certificate, so be careful.38:31And also another important thing for you to to have awareness about is that whenever we are reviewing the certificates, we need to make sure that those are valid and that we can certainly review the alarms and the validity. Otherwise we may face issues.38:46Certificate reliability comes from the life cycle. Yes, this is important. It's good for you to have that life cycle in mind. Design, issue, deploy, monitor, renew, and retire. All of them are important because at the end it's gonna be critical on how those are work.39:12Even design, why? Because sometimes you may use directly alternative different or secondary alternative names to the certificate. Of course, if you send a certificate for ice one.cisco.com to put an example.39:27Also you can choose subject alternative names. In this case, the subjective alternative name maybe ice two.cisco.com, ice three.cisco.com and if ICE one is two or ice three present that certificate, all of them are gonna be recognized as valid for the certificate since it contains.39:42Those subject alternative names. So be sign is not something simple, it's something that we need to take in account, something that is critical and we need to always consider. Issue, always make sure that we are issued in the right place, we have the right template.40:02That we have the right EKU and chain, always important. It's not the same if we sign through a private CA that a public CA, so that's that's important and it's gonna affect the deploy, make sure to bind the rules distribute.40:19And also I would say back up, always remember to back up the certificates that is gonna be critical, it's really really very important. Otherwise we may lose sight of that part and if we lose sight of that part, well, whenever something happens, you know that that technology always has a.40:35A risk component. Of course we we what we want to do is always mitigate risk, but there's always a risk and inherent risk. If we have an electrical discharge to the server, if there's any issue with the, with the server itself, if we have any issues.40:53By any chance and we need to redeploy backing up those are gonna be critical. Monitor we have here expiry and service health. It's always important to review the money to have a monitoring in place as part of the process. Don't forget it because sometimes we may lose sight of that expiration date. And of course.41:10If we don't renew and we don't monitor, we may go directly to a failure scenario. Renew, always make sure to overlap before cut over critical so you don't lose any service and you have time to resolve, and finally the retire revoke re remove and document.41:30Very quickly regarding certificates, we are gonna see that usually they leave a signature. We have failures for the pki. PKI, if it's expired not yet valid, we are gonna we can check the the checkbox and validity window we can review the certificate itself.41:51Name or EQ mismatch. The server or client user rejected, probably it was created with an issue, we need to review the SAN profile and the role. E.g., if we created a server usage and it's a client usage, then of course we may see this issue.42:07Missing intermediate, well of course if we are not presenting the complete chain, we are gonna see this issue because at the end, we don't know who's signed, even if we know the root CA. Revocation unreachable, well if we are not able to review, we have to hear the timeout or status validation failure.42:24It will be important to review because sometimes the certificates maybe taken back or revoked. E.g., in case of a big OD a lost device, that certificate maybe revoked and it's important to review. Wrong role or key when the wrong identity is present here.42:42It would be something regarding your role binding and private key, e.g., something important. Whenever you are backing up those certificates, make sure to export the private key to don't forget to export the private key, not only the certificate. Otherwise, you're not gonna be able to restore it.42:58Make sure that you are always exporting the certificate and private key, and with that information, you're gonna be able to restart the certificate anyway. So be careful. And now let's jump very quickly to the licensing.43:16Here licensing has three different independent dimensions. We have mainly the feature subscription, which is gonna be essentials advantage or premier. We have the device administration, the itself.43:33And the platform which is the virtual appliance, ok? Mainly we have here these three different licenses. It's gonna be important for you to make difference because not the three of them work the same way. E.g., the platform one, the VM.43:47We need one license per VM that we are using. It matters the site, NO, it doesn't matter. We have a VM common license. The device administration, it requires one license per node that has enabled the service, ok? So it's gonna be important. In this case, e.g., the node should be PFs, of course.44:03But in case you have four nodes and only two of them are doing you need only two device admin licenses. If you want all your nodes to do tacax, of course, you will need to have as many licenses as the psns that you have.44:21And the feature subscription, which is let's say the most important, we have the essential advantage and premier and those are gonna provide the different features of files. Now, let's do a quick review. Here we have the feature tires and.44:37And it's important to mention that this model. What does that mean? That essentials is gonna be the 1st level. We have triple a.1X yes and easy connect. Profiling BYOD, and ANC.44:52But not only that part advantage contains these features and essentials features. So advant, if we have an advantage, we can do all advantage and all essentials, ok? Because advantage contains all these features.45:09And the premier, of course, add postures MDM compliance and also contains advantage and essential features. In case, e.g., you want to, for all your endpoints to do posture, you don't want to acquire any advantage or essential licensing. You want to acquire only premier licensing because you are interested in posture.45:24In case you have half of your devices doing posture and half of them doing profiling, the other remaining have doing profiling only, then you want premier for the posturing half of them and half advantage because that profiling is gonna be required.45:43Now, very important here we have the license operations, which are gonna be important. We usually have the active endpoints is gonna make a, the consumption, ok? The licenses are usually consumed by endpoint, the ones that we are talking about this, the feature.46:06Subscription. Those are consumed by endpoint and hence it depends a lot on the active endpoints that we have. If we have 50 endpoints, we're gonna consume 50 endpoints, sorry, 50 license. And of course that's gonna change if those endpoints.46:26Stop being authenticated and we have that closure on the session that license is gonna be released, ok? Always make sure to count for the highest feature use. Again, if we're using profiling, it doesn't make any sense to have a lot of essentials because the essentials is not gonna be able to do profiling.46:41And on the same scenario, we have the smart account. Here the smart account is gonna be central entitlement and registration. It's gonna control all the licensing, and if we want to review more detail about consumption and number of licenses, we can review directly the smart account.47:00ICE is gonna show some information regarding how it's been consumed, but again, the smart account is gonna be the central and we can review if we have different virtual accounts, how many licenses we have in each one of those those virtual accounts. The device admin.47:18Again, it's on the smart account, but it's gonna work for PSN as it's service, and that's pretty much it. And for the platform, this is gonna depend according to the VM that we are using or how many Vmiss we are using. Now.47:34This is mainly the the theory of course I want to take a quick look at some key takeaways, but before that, let's go with Omero, review the demo. Okay perfect. Thank you. So, I will start with the.47:51Following eh, the presentation topics if methods, we have these ice three.five patch four which is the latest recommended. So since I'm since Miguel mentioned I support all it methods, but there are.48:07Are like the most common used PLS.48:26Be probably keep is gaining adoption. So one of the best practices to configure your eye solution to work with those that you plan to support. So that way I will start with the.48:30Allowed protocols. Many organizations, ICE administrators forget to do this. They keep using the default network access. One caveat with this, I mean it's built in to help quick but.48:47As well it's like too broad, supports many protocols that are not even implemented nowadays. So that's why I steered administrators to create their own set of allowed protocols that they are gonna be using per use case.49:05So I have the.1X because I separate my policy sets by use case, whether it is wired wireless.1X, but I don't like them to combine with the map or any VPN or or like even services like when we have when we have other.49:24Platforms that are authenticating against ICE for device management like the FMC Center itself, so I separate them for services for remote access VPN, map, and.1X.49:41So in this demo lab, we are going to support TLS, tip, and tip. Within TLS we have a stateless session resume, which is a feature to.49:58Allow for quicker reauthentication or session when device goes to sleep, e.g.. On the we are supporting the inner method as Miguel was mentioning. Beep is a protected EAP uses the encapsulate the credentials in a tunnel, so those.50:14Credentials are called in the tunnel in our methods. In this case we're supporting MS CHATB two which is.50:33Username and password. It also supports token card which is not a protocol very commonly used, so that way it is unchecked and it also support TLS within the people. However, in the most of the cases.50:40And tip, the benefit added to this protocol in conjunction with Microsoft and Cisco is that it allows the chaining of both the user and the computer on the same session or flow.50:59This helps organizations make sure that the user is connecting from a managed device, basically a computer that belongs to the domain. So that's example for the dog 1XI also do map.51:15Map cannot do anything else other than processes. So we have everything else unchecked. For other like VPN services typically firewalls use.51:31As the main radius implementation for the authentication so we don't need anything else. We may wonder or ask I have seen firewalls authenticating certificates Yes.51:49But the firewall is the one that authenticates the certificate and then extracts the user identity from the certificate and uses that to query the server for authentication and authorization so that happens with one of these protocols here.52:02Okay, so having said that, I'm going to move on to the policy sets. Again, as I mentioned, I separate my use cases on the device type because Meraki and Catalyst and other 3rd parties.52:19They support radius attributes in a different way. So it's a it's a better and common practice to separate your policy set based on on the device type as well on the use case, so you will see we have wireless.1X for Meraki wire.1X for Meraki.52:37And there should be wireless able to catalyst as well somewhere, ok? Your conditions will determine what.52:55Requirements will be needed to meet this policy set, so typically for wireless is obviously wireless.1X and in addition I'm just saying that the device type equals Meraki, again to differentiate from the catalyst access points, from the any other like vendors. And you see here.53:09The allowed protocols I use specifically specifically the ones that I will be supporting in the use case. I don't expect to have.1X protocols on VPN remote access, so I just use VPN.53:28I don't expect to have a plane radios or simply.1X protocols on map use cases. So I only support map on this and.1X obviously on the wireless wired.1X cases use cases, so on.53:43In this particular case, we will review the wired.1X meraki, and to see that I'm using the allowed protocols.1X eh so in my authentication policies I will not support any other.54:00Protocols like map, e.g.. But before going into that, eh, I will like to show the Windows duplicant configuration. So let me bring this screen over here.54:19This is a domain controller on the Microsoft side of the lab and in a large organization it's going to be complex and administratively impossible to configure all the.54:38Clients with the proper supplicant settings so we use in this particular case, group policy objects, there is also MDM like Intune Meraki and others that can also configure the supplicant. But for windows, since it's already like part of the package, GPO should help us.54:52With that. So.55:12We have this group policy that has all the settings for wired and wireless. So we will go to Windows security settings wired triple ieee, eight oh two.three.55:15So, this is just a name, but the important part is the security side. With this, we are selecting a certificate that will be used for authentication and we are also instructing the supplicant to do both computer and user authentication.55:36Eh sequentially. Since this is not tip, it's not going to do the training. However, you can configure training here as well. But for this particular use case, it's going to use a certificate that is present and is going to do a computer authentication when there is NO user logged in.55:54And user wants the, the, the user logs in.56:13And there was a question in the panel before about certificate selection. So here if you click in the advanced, you can, and there was a question if you can use the usage or the certificate issuer. In this particular case for my life.56:17I use the issuer I have and I forgot to show that for the purpose of this demonstration we have I let me zoom out a little bit more.56:37This is the structure of the certificate authority which is an enterprise certificate authority, it's a Microsoft also since I already paid for the Microsoft Active Directory services. I will take advantage of those so I can have a root.56:58Certificate authority which usually doesn't use issue I mean client certificates, it basically delegates that authority to sub CAs or issuing CAs, you will see a.57:14These names interchangeably, sub CA, intermediate CA, issuing CA, most of them are basically the same. So this root authority delegated two entities to issue certificate one is the C4P.57:29Subca which will be issuing certificates for windows computers, basically all the Windows installed base in the organization and also delegated to the MDM in this case Meraki, an authority to issue certificates on its behalf, so.57:48Any MDM managed device like iPhones tablets, MacBooks will have a NDM issued certificate, ok? So going back to the group policy, I'm telling the supplicant.58:07Or suggesting the supplicant how to select the certificate from the client certificate database for this particular. So if the certificate was issued by the issuing authority or sub CA or even the root.58:22It will be the one selected for that authentication. Alternatively you can use the EKU, but I haven't done it personally so you can play with this as well. And what else also I'm telling the supplicant which certificate authorities.58:40To trust for it. So this is when ICE presents the IP certificate to the client. As Miguel was mentioning is a two way trust. So both ICE and the client will send the certificate to each other, but 1st of all, the client needs to trust the.59:00The ICE certificate before it can send credentials, right? We will not send credentials over to someone we don't know or we don't trust. So in this section of the supplicant I'm telling the client to trust the certificate issued by these authorities. So even if I present a new certificate.59:17From another you name it, the client is going to reject that certificate. Finally what else we can figure here? These are optional advanced settings single sign on, this basically means.59:37The authentication will happen before even the user logs in so that's for the computer authentication. Okay, user computer, that's it. There is another section where we push the trusted certificates to the client.59:55The active directory basically the enterprise PKI certificates to the client, but I need to recall I think it's here public key policies. If we go to the yes, here it is. This is where we push.01:00:14The route and sub CA certificates to the Windows client computer. Finally, this group policy is enforced to all domain computers so you can be specific to a group if you are testing these policies et cetera, you go.01:00:30And select a.01:00:50Special group of computers where you can test this policy. So again, this is a, the Cisco way to do it but always refer to the Microsoft or whatever your endpoint management provider is so you can test this safely without disrupting your.01:00:52Production environment. So next what I will talk about is the how is eyes going to.01:01:12Differentiate between the certificates I mentioned we have the MDM and the enterprise PKI certificates eh so even infrastructure certificates, e.g., phones.01:01:27Access points, printers, many IoT devices nowadays support.1X but we have this question. What certificates do we use the manufacturer install certificate?01:01:43Or should we like push a certificate to the device? Both options are available. And however, for the purpose of this lab, I use the manufacturer installed certificate, so I need to differentiate between that certificate and the one issued by a Windows computer.01:02:01For that we go to administration, identity management external identity sources. So we will see here a certificate authentication profile. The certificate authentication profile tells eyes where to look.01:02:18Up for the user identity, whether if it is a phone or a person or a computer from the active directory. So we have a preloaded which is built in. Don't forget, I mean, don't pay attention to that. I created my own device authentication certificate authentication profile.01:02:33Since I'm not going to look into Active Directory for a phone subject ID, I use not applicable. There is not going to be a phone user ID in Active directory. I simply care about.01:02:53Where I will look for the identity and the subject common name or any subject or alternative name. This is pretty straightforward. But for Active directory, let's say you want to, in addition to validate the certificate is issued by your enterprise PKI.01:03:11You want to validate that the user belongs to a certain AD group or that the computer belongs to the domain computers. In that case, we use the connection or linkage to the active directory.01:03:30So we are telling ICE with this certificate authentication profile to get the user ID from any subject or alternative name attribute in the certificate to look it up into Active directory.01:03:45So here we are not managing passwords. It's just the user ID. So ICE basically will take the user identity, let's say J Smith and we'll look it up in Active Directory to see if the user is valid or existing and.01:04:00That the user is not disabled. And also obviously we can check the group membership and is the user part of administrators or employees or developers etc. So we can do segmentation or do role based access control.01:04:18So I was thinking the certificate template. So, going back to our domain controller, we have the certificate services. This is the sub CA.01:04:36If you remember that little paint that I used to demonstrate the the certificate authority for from Microsoft, this is 2nd node, the sub CA issuing CA. If we click on issued certificate, we'll see that we can see that it has issued certificates for mostly.01:04:51Users, when we see web is a a certificate to be used for web services like a portal and when use when you see WS is a workstation, that means a computer certificate. When you see user that's a user certificate.01:05:12So those come from the certificate templates. If we click manage, we have here the certificate templates. So we have the user, the subject names is going to be built from the active directory information.01:05:30And he's going to use the user principal name. For the computer, the workstation, the subject name is going to be built from Active Directory as well, but we will include two attribute to the DNS name and the UPN. This is important because computers use a slightly different method of authentication against.01:05:46Is an active directory.01:06:06So there is as well a GPO to provision these certificates to computers and users when they are being added to the domain or when a new user logs into a computer that has never logged before, that certificate will be issued. So.01:06:10That certificate as we see here is going to be issued to that user. So this certificate authentication profile can be used in an identity source sequence or can be used directly into the authentication policy.01:06:30Which I think I'm going to show next. I think I missed the MDM yeah, the MDM, this can be used for the MDM as well because the.01:06:45MDM is not tied to the active directory. So we will simply trust the certificate from the MDM if it is valid certificate and is issued by a authority that we trust. So.01:07:01I'm going to show you, on the catalyst, which is our wired.1X and map switch, how it is basically configured. So, 1011.01:07:16So we have a typical access port configured for access and voice VLAN is mode access. A device tracking is for segmentation and and.01:07:37Segmentation and enforcement in case we are applying like downloadable access control list, we are using the authentication commands, the access session the.1X pae authenticator sometime outs and etc. So this is how it works on the switch side so we can still see the.01:07:52Active access sessions. We have two, they are mapped we have a phone on the voice domain and a device on the data domain, so if we do the detailed.01:08:111012. We can see a couple of information here. E.g., when we talk about the licensing, you will see that we consume an SGT.01:08:27That means we are using a context sharing or segmentation and the if that this particular endpoint is being shared with a 3rd party or another Cisco product like secure network analytics, firepower management center.01:08:43It will consume an advantage license eh but also we can see we are pushing an access control list dynamic. The, the phone successfully authenticated using Map and it's authorized in the voice domain, so it was basically placed on the VLAN to ten.01:09:01So it will get an IP from that VLAN and it will try to connect to the call manager to receive any like configuration. And what else on the switch side? I think that's it.01:09:19Now, I will jump to the authentication policies. So here is where all these put together. Let's see the wired one is Meraki. I think there was a question in the panel before about.01:09:38A step by step guide to implement ETLS and migrate away from peep. The good news is you can have both together. Eh, the recommendation is to set your TLS authentication policies on the top.01:09:55So you can enforce like having most of the authentication going to certificate based. If you put the pip on top, basically you will, if there are many devices going through pip, they will actually authenticate using PIP, so you enforce TLS 1st, all you will filter out all the valid ones on TLS and.01:10:10Leave the rest to be. So let's pay close attention here. I have this name EPLS Corp. These are the authentications from Windows computers basically, where the issuer.01:10:31Common names contain this domain connect for pet is just a fake domain all the certificates issued by these two authorities here on the s the root and the sub CA on the left.01:10:48Have that name in the issuer. The MDM doesn't, the phone, the Cisco phone with using certificate, it doesn't have that, so it will basically make sure that I'm authenticating all the Windows computers from my organization.01:11:05And I'm using the identity source sequence or the certificate profile C four. Let's see if that is an identity source sequence actually or is it, the certificate profile? No, this is a a sequence.01:11:24But basically I'm just telling use the certificate based profile, authentication profile and use Active directory. That's the only two things that I'm telling it to use. I have seen because I do a lot of health checks to customers that many customers have here internal endpoints, e.g..01:11:41Oh command, Internal endpoints are MAC addresses. There is NO reason to have internal endpoints here. If you have multiple AdS, yeah, that's fine. You can use all the AdS here, but not internal endpoints or guests. Why do we have guests in a.1x? Right, Doesn't make sense, even.01:11:58You waste CPU cycles, so don't do that. Just tie it to the actual source of the identity you are that you are applying to trying to identify. Okay, so I'm going to go back to the policy set wired.01:12:16Make sure this is the one. Next we have the MDM. So if you see there is a little different, the certificate issuer organizational unit contains 4105131. That's the actual Meraki MDM.01:12:33Identifier. So any certificates issued by this MDM on the right will meet that criteria. So and you see I'm using the AD cert. Why?01:12:51Ah, because I was wrong. Yeah, in Meraki we are embedding the user ID in the certificate common name or subject alternative name, either because I'm looking at any of those. So I'm actually able to.01:13:05In the MDM managed device, whether it's a MacBook, a phone, a tablet, I can extract the user ID as well compare against ID groups and provide like a tag, a developer, a finance person, a maintenance person, whatever. So.01:13:21Eh, that's why I do that on the MDM, but on the infrastructure we have a phone or an access point that is using or a printer that is using a certificates so in this case you see another difference, the issuer common name is Cisco manufacturing.01:13:40So all the phones that come out of the Cisco factory have a integrated certificate called Make manufacturer installed certificate that it can be used for authentication. I mean, the difference between using the.01:13:57And make an enterprise PKI is that anyone can bring a Cisco phone and connect it. But not everyone can bring a Cisco phone with enterprise PKI and connected, right? So there's a little difference. Again, you will need you can you cannot impersonate a Cisco phone certificate or.01:14:13That's gonna be safe, but in this case for this particular demo, i'm using the integrated certificate. And finally, the PIP, I can also allow peep. So for that question in the panel before, you can implement it.01:14:32In the same use case, in the same flow, I mean but you can differentiate. You can also use this information on the authentication policy name to to run reports. So when you go to operation system operation reports, you can look for only those authentications that happen with this particular policy.01:14:48You don't need any certificate based authentication or certificate profile, you can use directly the identity source which in this case is the active directory. Meaning those are going to be credentials.01:15:14Type or gather from the supplicant from the windows computer. And as a best practice, the default should be the access in all the authentication and authorizations within the policy set. That's our Cisco best practice. I don't care anything else. If I have something else here, that means.01:15:25A very particular flavor of radius may flow down here and be authenticated. I don't want that. I don't want to support if the TLS, I don't want to support fast.01:15:44With fast, e.g., is deprecated. So if for some someone like playing with the supplicant tweak the protocols and change it too fast or TTLS or something weird that I don't support, it may flow down to the default and pass, so we don't we don't want that deny.01:16:00Now let's move to the authorization policy. Cisco phone, ok, how can I tell you are a Cisco phone? Well, the issuer contains Cisco manufacturing and the certificate on your phone starts with CP. That's the build in identity and that certificate, and we will see that in the live log.01:16:21Now if you are an MDM, ok, if you were this your certificate was issued by the MDM then you are allowed as Meraki and I tag you as employee. If you are a computer, you authenticating using certificate, but in your certificate you had your computer UPN.01:16:39Eh, so when I queries Active Directory against that UPN it will find out that it's a part of the domain computer, and I'm going to demo that real quick. A contractor while the user belongs to the contractor and the user group.01:16:57Mentioned something about chaining. We can do that. So we basically match on the network access tunnel equals tip and the chaining result is both user and machine succeeded.01:17:14If that is the case, you are allowed, if you are not that is not the case you are denied. Finally, well, this is for another demo for posture which will not cover in this time but we have that's what they are disabled. And lastly, we have the employee if you authenticating using the certificate.01:17:28And you belong to the main user, you are an employee and you are allowed to the network. So let's go to the live log. I'm going to bring over this here and we are going to.01:17:46Ah, come on, if I can type my password correctly, we're powering up a Windows machine that is managing this domain, ok? So the computer is powering up, putting up.01:18:06Yeah, we can see not network access for now. It's authenticating. So if I go to the live log windows.01:18:23Eleven 002 is that the one? Let's trigger the user authentication.01:18:40There you go.01:19:01Let's see last 3 h is it here I want to see the windows 1100 records.01:19:06Which Windows, that's windows five, this one. This computer.01:19:22Here, is virtual, it's running on a host on a Linux host that is connected to the.1X switch. So the Linux host was not powered off. So when I powered this computer on, basically.01:19:37The switch didn't detect the actual port coming up. So that's why we see that event occurred like yesterday, that's when that computer actually authenticated, so we can see the computer authentication here. The live log is the source of truth. The live log is your source of truth.01:19:53For any troubleshooting, any like.01:20:13Making sure that things are working as you expect and you start by checking the overview, which authentication policy did we match? It was the.1X meraki, let's. Remember the one that looks for the certificate issuer common name contains the domain.01:20:16Connect for pet. And which authorization policy we match the wire.1X meraki, TLS computer. Remember the one that was making sure it was TLS and the domain computer? Other attributes you can see that it was TLS, NO I'm sorry. This is the.01:20:35Oh yeah, the protocol TLS.1X, you can see even the TLS version somewhere, some attributes on the actual, this is the what I was talking about the UPN the dollar sign. This is the tricky part when authenticating computers to Active directory.01:20:54Using certificates. So that certificate that I demonstrated is the one that works for computers. And you can see somewhere here that is member of the main computers.01:21:14Oh yeah, here, AD group names correct. Okay, now that the user authenticated, so let's go back to 60 min and 20 records. This is the user when it authenticated.01:21:32So we can see again check your overview, we match the corporate issuer certificate and the TLS contractor. This is because this user particularly belongs to the AD group contractors.01:21:49And this was to demonstrate another segmentation webinar but for the purpose of this one serves the same eh we can validate the user AD group membership, we can validate the.01:22:06Yeah, here are the group names, the certificate, some certificate attribute, not everything comes here. If you want to see additional, you may do a capture or what is it called? Capture packet capture.01:22:23On the eyes or on the switch side as well. So you can get all or additional details in the certificates both on the eyes and the and the client. So we have a successful connection here, so let me see what is what is next on the.01:22:42Demo guide, let's see here MDM certificate like yeah I'm going to do since Miguel was talking about certificates.01:23:05I'm going to go to that way. You remember our architecture on the certificate authority in ICE we need to upload these certificates so they can be trusted.01:23:20So we got to, and this is our one time only, you don't have to do it every time unless you replace like the the certificate that is expiring. E.g., this expires on 2027, so I don't have to concern until like early March.01:23:36Next year that I need to renew this certificate and bring it over but here we have the MDM, the root, and the subca, we have some Cisco manufacturing which are the ones trusted for the phone. I forgot to mention the phone. Let's see here.01:23:54Here is the phone. This is a phone using.1X So the authentication policy that was matched was the TLS infrastructure, if you remember from my policy set, the authentication section I had like four or five of them.01:24:15For each use case and the authorization, the Cisco phones, and what else we can see here like the certificate details basically the issue of name is manufacturing CA three.01:24:32And what else we have here? Subject to use some of the attributes on the certificate, the common name. So if you remember one of the conditions in the authorization was that the user common name or subject common name begin began with cp-so that's.01:24:47No phones can be like rewritten. The Mick cannot be replaced as far as I know, at least when I was like a little bit more involved into the telephony things, certificates on the phones cannot be especially the mic.01:25:08But you can also always provide one from the call manager and that can be issued by your certificate authorities as well. So that could be like a 3rd area here, like, like the voice system issue and CA, something like that.01:25:24Okay so I was going to the MDM. I did something in purpose here on the trusted certificates and Miguel was talking about this, but I will.01:25:42What I will do is go to the live log and I'm going to turn on this device here. You cannot see the device because it's an android tablet, but don't worry about it. You will see the actual.01:25:56Result. So this android tablet is enrolled with the MDM, so I'm gonna activate Wi-Fi. I'm looking at the tablet and it says hey connection error. And if I go to the live log.01:26:12Whoops. Yeah, it was wireless.meraki, but it failed. So let's check the details. Well, we have two problems here. One is the endpoint is being suppressed.01:26:27That means even if I retry many times to reconnect, it will not succeed because I see silently dropping. It's a feature to prevent like denial of service or like chatting misconfigured supplicants.01:26:45To like overload ice so I will take an advantage I will tell you how to like troubleshoot that overcome that. But this is the important part because a non CA in the client certificate chain, so.01:27:01What can I see from that client certificate? No TLS one three oh one that's good. No, I don't see main much information. I would need to capture but I don't have time for that.01:27:20But I, again, I, I said I intentionally introduce a problem here. If you see a difference between the MDM, the route and the subca, I'm missing the endpoints. So Miguel covered this part. What is the certificate trusted for?01:27:37If we want to authenticate clients using a certificate, we need to set this little checkbox here for client authentication. Cisco services is the opposite is when ICE goes to the Cisco portal to get something like smart licensing.01:27:53Profiler feed, posture feeds, client provisioning feeds. I think those are the maybe PX grid cloud as well, yeah. So when you have a certificate in the trusted is for that to trust authentication of Cisco services or NO?01:28:13This particular certificate is not being used for that. It's for clients so I will leave that checked. The other I leave them unchecked and I save. Okay, let's go back to the live log and reattempt on this device.01:28:30To authenticate. Let's go to ice. Oh, remember I mentioned suppression if you get or end up.01:28:46Having an endpoint being suppressed like you disable enable the port, you should not show, you power off the the wireless powered on and nothing happens, nothing shows here in the live log. You can come here to the live log three dots and do bypass suppression filter for 1 h. That will give us 1 h of trouble.01:29:04During time but now that is resolved, there you go. Now it passes authentication. Yeah. So let's see. We match the TLS MDM.01:29:23Authentication policy and the MDM Android authorization policy, but this is on the wireless. Let's see policy set wireless Meraki. Here we have three authentication policies because we don't have phones, e.g. wireless phones. So we have corporate devices.01:29:42In MDM devices. But we have authorization. We have MDM android. This is another topic for some reason I'm not able to check compliance on the android, but I do.01:30:02And I'm able to do iPad, iPhones. So we matched this policy because the actual Android device wasn't like actually really determined to be compliant with the MDM, so it went down.01:30:20And it matched the MDM android, which basically just makes sure that it's a certificate issue with device and the certificate issuer contains the MDM manager. Let's review real quick the iPad compliant.01:30:37So let's try to connect this to the wireless, the iPad. What is the, it is actually connected already, so.01:30:55This is the Apple device, look for the authentication. It also matched the authentication MDM, but it did match the MDM compliant. This means ICE was able to query. I think there was a question about Intune and querying.01:31:11Eh Attributes from Intune but marketing are slightly different but they like they serve the same purpose. We can check compliance against the device in the MDM. So if I go to reports.01:31:29The External mobile device here is the MDM, we can see that Meraki, No, the access point, the Apple ID, the Apple Apple iPad, sorry. It is registered.01:31:49It's compliant with MDM, I'm sorry this is a MacBook, on the other hand, yeah, this is the it's not rooted, so don't go like oh it's it's red, NO, it's not rooted and it doesn't have this encryption but it has a pin log, it has a compliance with the MDM and it's registered.01:32:07Okay, so I'm not going to go too far on compliance posture but I think I covered the troubleshooting and the live logs, so this is actually your source of truth, everything is going to be here if they are packets are right to ICE.01:32:27It should show here if it didn't arrive, don't even scratch your head and and troubleshoot ice. Troubleshoot the network access device troubleshoot the network why the packet is not arriving to ice. Even if a secret is mismatched, you will see that here so.01:32:42If there is nothing here, ICE is not receiving anything. Live session is another tool like for licensing that Miguel was mentioning, we can see the type of license we consume. The posture on the.01:32:59IPad consumer premier and the all the rest con consumer an advantage and this is because I'm sharing context with FMC for additional segmentation.01:33:17So if I integrate ICE with a 3rd party or a Cisco product that supports like a context exchange, ICE will report that as an advantage license. So if I go to.01:33:35Analysis sessions, all of these are being exchanged from ICE, so they are consuming an advantage license. We saw that you're an accruder, we saw, we saw that room.01:33:54So those users are consuming an advantage license. Let's see. I think so I covered like a lot of methods, certificate authentication profiles, supplicant configuration.01:34:10Authorization and authentication separation, even MDM so I haven't covered much about certificate, but it's not also that many much that we can, but I will show you.01:34:25How it is. So for every node, we have a system certificate, this is a standalone single node in a lab deployment so we don't have many other nodes, but when you have more than one you see them listed here.01:34:43So you can have certificates individually per node, as Miguel described, there are best practices or recommendations but every organization can do what they prefer. There is organizations that use like a wild sand certificate for everything.01:34:59Some organizations don't like that or security teams don't like that. So you can use individual certificates. In this case I'm using the enterprise signed certificate for administration.01:35:17So let me show you again the root certificate, the serial number ends in C and four AC four. Check on that. If I go to the sub CA.01:35:31Oops not not edit, sorry, this view view Let's go back. Sub CA BU oops. View ok view. There is a little difference with the other I didn't have like this hierarchy or branch or.01:35:49Yeah, so this certificate is the issuing CA, but the certificate that issued this certificate serial number is 4C4 that's my room. Similar to the MDM, we should see the issuer.01:36:07Serial number for AC four, ok. And this has its own serial number, but that's how it goes. It goes like chain daisy chaining if you want. So in ICE, the admin portal and if authentication certificate is issued by that.01:36:23Same authority, the route which I shouldn't have done, I should have gotten the certificate from the sub CA and that was my bad, but if it was issued by the sub CA I should see three and like.01:36:43Steps here but if we click on the route again it's 48C4. So there is the relationship between the certificates. And if you remember from the group policy management, I pushed the root and the sub CA to the client computer, so that means.01:36:58If I eh, from any managed device connect to the ICE portal, I will be trusted or that connection will be trusted. If I go to here, like the admin.01:37:16And I go to detail serial number I'm sorry from the issuer serial number for aC4. So everything is tied together. This time certificate is presented to clients when they are connecting to the.1X networks.01:37:31So the client can use the public key on this certificate to encapsulate or encrypt the credentials for that authentication section or portion of the authentication.01:37:48Portal. There was a question as well on the panel and and I think we sent the response if we have usages for these certificates individual, you can do.01:38:06As you want, but issuings a lot of certificates for internal devices using public key infrastructure like like public CAs can be costly.01:38:18So why don't leverage the already paid certificate services for like from Microsoft for any internal usage like if NO devices external will be.01:38:35Doing that one X authentication on your network that shouldn't be doing, they should connect to like guests, right? So that is when we recommend having an externally signed or publicly signed certificate for guest services in this case, this particular one. This one issued by zero SSL.01:38:52This is a public authority. So we can see here the chain. This certificate was issued by this, which the time was issued by. So delegated to say.01:39:10The authority to issue certificate public certificate that are trusted. So if I connect to this as a guest on a personal device, I shouldn't receive a warning on the certificate instead if I was using the enterprise signed certificate.01:39:26For guests usages and my guest devices will be complaining because they don't trust this authority what else do I have to licensing?01:39:44Before we have like 15 min left, I want to go to licensing. From this page you can register ICE to your smart account. Traditional licensing is not not anymore supported in ICE, so.01:40:00If we need to have licensings in this smart account. A account is like a big container that a given organization will receive the licenses in that place. But within the smart account we have virtual accounts. So those are virtual buckets or containers where we can drop licenses.01:40:18And Consume from there.01:40:38And some organizations put everything on the default, which is created with a smart account, but it's not like the best practice because they will be all mixed up like e.g. licenses, telephony license or IP licenses, network.01:40:40Data center licenses, firewall licenses, everything will be there like all messed up. So what we recommend to do is create virtual accounts. Let's say you have a, a nice deployment in North America one in Europe.01:40:59Middle East, you have one in Asia pacific. You create three buckets, one for each region, you drop the licenses there and you register the ICE to the corresponding virtual account. So when we register with a token, the token is generated from the smart.01:41:14Account virtual account, we enter the token here and click register, and we also subscribe to the different tiers, essentials, advantage, Premier, device admin VM. How do we subscribe while depending on the features we will use, if we will use posture.01:41:30Enforcement threat centric mac. We can enable premier. If we are not going to use that, we can uncheck. I'm not going to use PX grid any any like profiling policies and authorization. I will uncheck that.01:41:48Or maybe I will only use Premier and advantage. I can because Miguel was explaining the the nested doll model. So if I'm not planning on doing essentials, I only have Premier and advantage. I can also uncheck this. This one is using a device administration per node and a VM license per node, so I am in compliance I don't have any like.01:42:02Yeah, here you can see compliance compliance, it says release entitlement because I'm not consuming any essentials for now, but if I were consuming one essentials it should show one here. We can also get reports.01:42:22We can see the licensing from live log, I mean live sessions we were seeing that here, but also we can go to reports, it's audits.01:42:39License usage. So you can get hourly license consumption or you can do like a time range, a month back, a year back, you can do custom and even export that report.01:42:55Let's say the 1st 02:15 go yeah you will see here the blue is advantage peak, the green is premier.01:43:13So I have been like fluctuating up and down because I'm playing with the lab like having multiple different use cases, bringing devices and connecting them how to see how they profile how they work so I can I can.01:43:28See that. So this can help me calculate my licensing over time. So when there is a renewal coming up, I can see well my peak has been 500 and I, I should be around 500 plus 20 %, I don't know, and.01:43:43I think that's it. Let me see if I'm missing any other or there are any live questions in the last 12 min or you want to wrap up? I'm done with the demo. Any live questions maybe that are.01:44:00Related to the subject because I I saw some of like that were like very very like away from what we are communicating today. No I don't think there's any any questions right now. Okay, ok. It was a pleasure and.01:44:19Provide this demo, ok. Well, very quickly, let's review a little bit about the key takeaways I want to mention. We have a, what I suggest is to make mainly six questions before going to production.01:44:36And this is important because it's important to take a decision about 1st which method we are gonna use and of course this is gonna be critical to take decisions again something that I like to mention and that you need to understand that it's critical is planning and design.01:44:52Never please start planning and design. Whenever you are trying to implement something, it's always good to spend enough time on that on that specific section, designing and planning because that is gonna be the the foundation for everything else.01:45:12So this is part of that. Which identity reached policy, it's gonna be important to review what are we looking of course understand which are the endpoints that we are gonna be seeing. Sometimes I have seen that e.g. supplicants are sending computer information instead of user information. It's important to double check and make sure.01:45:28That we have visibility and full awareness about the identities that we are gonna be used. Who validates each certificate? That's gonna be important for you to have like that awareness. We already talked or mentioned a lot of things regarding certificates, but he's never.01:45:48A lot because I think it's really important for you to have awareness. And of course renewal about disruption it's important again critical for you to to double check your monitoring define a process, please.01:46:05Consider it because it's something that will help you a lot whenever you are doing maintenance to doing certificates to avoid any type of disruption. And of course remember where will the failure appear mainly why? Because this is important for you to have like that.01:46:22Specific method whenever you want to troubleshoot review to make sure that you have full visibility that you know where elements you need to to take a look at because if we are troubleshooting and we have only access twice, of course, we may have that lost if we don't have full visibility, it's important to have all those elements and have.01:46:40That awareness, that we need to review each one of them.01:47:00And of course licensing, that's gonna be also another important critical part. Remember to review, you have always a target, you are targeting for the highest feature and in this case dimension what you are looking and not also the current usage, always remember to mention for feature using.01:47:03Consider in some future because we never know if we are gonna implement now wire we have wireless and we want to do wireless or we want to do VPNs or we want to do IoT devices, so we are gonna be including probably a lot of things on our network and that maybe considered for this specific scenario. So.01:47:24Let's make sure to to keep a track on it and that would be all for today. Thank you very much for your time. Just for awareness, we have here some additional resources that you can like you can use mainly you are gonna find a lot of the information on the community.01:47:43There's really good guide guides there that you can take a look at. We have of course some services for where you can get some support and finally a little bit that I want to bother you with is with feedback. You're gonna receive a.01:48:02Are a form for the feedback after this session, please feel that survey. It's always important for us to receive your feedback. It's really valuable and help us continue improving, please. And also here you are gonna find two qrs for security success capsules where you're gonna find information.01:48:20With in English and Spanish for you to take a look, review and learn a little bit more. Thank you very much for for your time. I'll see you on the next security series.01:48:38