TrustSec Phased Deployment Configuration Guide
Available Languages
Table Of Contents
About Cisco Validated Design (CVD) Program
TrustSec Phased Deployment Configuration Guide
Cisco IOS Software Identity Enhancements
Flexible Authentication Sequencing
IEEE 802.1X and MAB with Downloadable ACLs
IEEE 802.1X and MAB with Downloadable VLAN
Cisco Discovery Protocol Enhancement for Second Port Disconnect
Cisco Secure Access Control System 5.x
Phased Implementation Strategy
Authentication and Authorization Modes
Predeployment LAN Requirements
Pre-TrustSec Switchport Interface Configuration
Verifying Network Infrastructure Before TrustSec is Deployed
Installing Digital Certificates
Adding a Certificate Authority
Configuring Network Access Devices
Connecting to the Active Directory Domain
Setting the Clock for the New Cisco ACS 5.x Appliance
Creating Identity Groups and Identity Store Sequences
Creating Identity Store Sequences
Defining Identity Sources and Authorization Profiles
Creating Service Selection Rules
Configuring Global Identity Settings
Configuring Monitor Mode on the Switch Port
Verifying Access Switch-to-Cisco ACS Server Communication
Verifying Authenticator-to-Authentication Server Communication
Verifying that the Cisco ACS Server Can Communicate with the AD Domain Controller
Verifying Host Network Connectivity and Network Services
Verifying that IP Phones are Working
Verifying that Devices such as IP Cameras Work
Configuring Active Directory Groups
Configuring ACS Policy Elements
Configuring Authorization Profiles
Configuring User and Identity Stores
Adding Authorization Rules for 802.1X Service
Adding Authorization Rules for MAB Service
Verifying Host Network Connectivity and Network Services
Verifying 802.1X-Capable Managed Assets
Verifying Non-802.1X-Capable Managed Assets
Implementing High Security Mode
Modifying Authorization Profiles
Verifying Global Switch VLAN Definition
Verifying Host Network Connectivity and Network Services
Verifying 802.1X-Capable Managed Assets
Verifying Non-802.1X-Capable Managed Assets
Creating a Certificate for a Windows XP Browser
TrustSec Phased Deployment Configuration GuideLast Updated: September 6, 2011
Building Architectures to Solve Business Problems
About Cisco Validated Design (CVD) Program
The CVD program consists of systems and solutions designed, tested, and documented to facilitate faster, more reliable, and more predictable customer deployments. For more information visit http://www.cisco.com/go/designzone.
ALL DESIGNS, SPECIFICATIONS, STATEMENTS, INFORMATION, AND RECOMMENDATIONS (COLLECTIVELY, "DESIGNS") IN THIS MANUAL ARE PRESENTED "AS IS," WITH ALL FAULTS. CISCO AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THE DESIGNS, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
THE DESIGNS ARE SUBJECT TO CHANGE WITHOUT NOTICE. USERS ARE SOLELY RESPONSIBLE FOR THEIR APPLICATION OF THE DESIGNS. THE DESIGNS DO NOT CONSTITUTE THE TECHNICAL OR OTHER PROFESSIONAL ADVICE OF CISCO, ITS SUPPLIERS OR PARTNERS. USERS SHOULD CONSULT THEIR OWN TECHNICAL ADVISORS BEFORE IMPLEMENTING THE DESIGNS. RESULTS MAY VARY DEPENDING ON FACTORS NOT TESTED BY CISCO.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at http://www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
TrustSec Phased Deployment Configuration Guide
© 2011 Cisco Systems, Inc. All rights reserved.
TrustSec Phased Deployment Configuration Guide
This document is designed to help focus and streamline Cisco TrustSec deployments. It includes the following sections:
•
Implementing High Security Mode
•
Phased Deployment Overview
This section includes the following topics:
•
•
•
•
•
Cisco TrustSec Overview
Cisco Trusted Security (TrustSec) is an integrated solution comprising several Cisco products that offer authentication, access control, and user policies to secure network connectivity and resources. Cisco TrustSec facilitates greater security and cost-effective management of changes throughout your organization.
Having a secure TrustSec framework in place helps enterprises better manage employee mobility, reduce network access expenses, and boost overall productivity while lowering operating costs.
The Cisco TrustSec solution provides the following benefits:
•
•
•
•
Cisco IOS Software Identity Enhancements
This section describes Cisco IOS Software features that accommodate the deployment scenarios described in this guide. It includes the following topics:
•
•
•
IEEE 802.1X with Multiauth
Multiple authentication allows more than one host to authenticate on an IEEE 802.1X-enabled switch port. With multiauth, each host must authenticate individually before it can gain access to the network resources.
NoteFlexible Authentication Sequencing
Flexible authentication sequencing provides a flexible timeout and fallback mechanism among IEEE 802.1X, MAC authentication bypass (MAB), and web authentication methods. It also allows switch administrators to control the sequence of the authentication methods. This simplifies the Cisco TrustSec configuration by providing a single-set of configuration commands to handle different types of endpoints connecting to the switch ports. In addition, flexible authentication sequencing allows users to configure any authentication method on a standalone basis; that is, MAB can be configured without requiring IEEE 802.1X configuration.
IEEE 802.1X with Open Access
This feature allows users to have limited network access, such as the Intel Preboot eXecution Environment (PXE) boot server, before IEEE 802.1X authentication. The limited access is optionally controlled by an access control list (ACL) or a virtual LAN (VLAN) that is defined by the switch administrator and applied on the switch port.
IEEE 802.1X and MAB with Downloadable ACLs
This feature allows per-user ACLs to be downloaded from the Cisco Access Control Server (ACS) as policy enforcement after authentication using IEEE 802.1X, MAB, or web authentication.
IEEE 802.1X and MAB with Downloadable VLAN
This feature allows per-port VLAN to be downloaded from the Cisco ACS as policy enforcement after authentication using IEEE 802.1X and MAB.
Multidomain Authentication
This feature allows an IP phone, either Cisco or non-Cisco, and a PC to authenticate on the same switch port while it places them on appropriate voice and data VLANs.
For a full list of the new Cisco IOS Software enhancements and additional information, see the following URLs:
Cisco Discovery Protocol Enhancement for Second Port Disconnect
Cisco Discovery Protocol (CDP) is enhanced to add a new type-length-value (TLV) for the IP phone to inform the switch in the event of the PC disconnecting from the IP phone. Upon receiving this notification, the switch can clear the authenticated session security record for the PC. This enables end users to move behind phones without validating security policies, and thus eliminating error disabling of ports.
Cisco Secure Access Control System 5.x
Cisco Secure Access Control System 5.x (ACS 5.x) is the Cisco policy management system for supporting comprehensive, identity-based access control and security. Cisco ACS 5.x is focused on enhanced support for 802.1X. The following are the key enhancements for Cisco ACS 5.x:
•
•
•
•
•
•
Phased Implementation Strategy
The depth and breadth of Cisco TrustSec accommodates a large number of use cases and deployment scenarios. This section describes the following two aspects of the use cases discussed in this guide:
•
Authentication and Authorization Modes
Cisco recommends a phased deployment model that can allow for limited impact on network access while gradually introducing authentication and authorization on the wired network. The phases are as follows:
•
•
•
Monitor Mode
Monitor mode allows for the deployment of the TrustSec authentication methods IEEE 802.1X, MAB, and/or web authentication (WebAuth) without any effect to user or endpoint access to the network. Monitor mode is basically like placing a security camera at the door to monitor and record port access behavior.
With AAA RADIUS accounting enabled, you can log authentication attempts and gain visibility into who and what is connecting to your network with an audit trail. You can discover the following:
•
•
•
•
•
Monitor mode is enabled using 802.1X with the open access and multiauth mode Cisco IOS Software features enabled, as follows:
sw(config-if)#authentication opensw(config-if)#authentication host-mode multi-authThe open access feature transforms the normal behavior of blocking traffic on an 802.1X-enabled port until authentication and authorization are successfully performed. The default behavior of 802.1X is still to block all traffic accept Extensible Authentication Protocol over LAN (EAPoL). However, the open access feature allows the customer/administrator the option of providing unrestricted access to all traffic, even though authentication (802.1X, MAB, and/or WebAuth) is enabled.
All of this is accomplished with no impact to end users or network-attached hosts.
Low Impact Mode (also known as Selective Access Mode)
In this mode, you are able to incrementally increase the security by adding an ingress ACL to the 802.1X-enabled switchport that is configured in open mode. This ACL provides the ability to maintain whatever basic connectivity is required for unauthenticated hosts while selectively providing differentiated access for authenticated users.
An example of how this may be used is providing a host attached to a default port the ability to use Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and perhaps get to the Internet; all while blocking access to internal resources. When a device connected to that switchport authenticates, a dACL is applied to permit all traffic.
High Security Mode
Another option for 802.1X-enabled switch ports is the strict use of the traditional closed mode in conjunction with the use of dynamic VLAN assignment for differentiated access. This is the default behavior of an 802.1X-enabled switch port.
This guide demonstrates how to configure these three identity-enabled modes, allowing you to determine which mode works best for your environment.
Endpoint/User—Use Cases
Most if not all customer environments have a mix of host and users types. These typically fall into the following four primary categories:
•
•
•
•
Managed Hosts/Assets
The host device/asset is managed by the IT department and belongs to one of the following two classes for the purpose of TrustSec:
•
•
Because the devices are managed, the IT department has knowledge of the device and in most cases can install and configure the prerequisite 802.1X supplicant software if it is available.
NoteManaged Users
The end user has some affiliation with the company, either as an employee or subcontractor, and has been provisioned with an identity (username/password, digital certificate, and so on) in the identity IdM system of the company; typically, Microsoft Active Directory or Lightweight Directory Access Protocol (LDAP). The Cisco TrustSec Policy Management Server (ACS) integrates with common IdM systems to allow seamless authentication of user credentials.
NoteUnmanaged Host/Assets
Endpoints that belong to short-term guests or business partners such as consultants, contractors, and customers. Because of legal or liability concerns, most IT departments cannot or are reluctant to install client software such as 802.1X supplicants on these unmanaged host PCs.
Unmanaged Users
Users that are considered short-term guests or business partners such as consultants, contractors, and customers, which are not or will not be provisioned into the traditional company IdM systems.
The key is to be able to accommodate all of the above endpoint/user use cases with a single switch port configuration. This can be accomplished with Cisco IOS Software enhancements; specifically, flexible authentication (FlexAuth) and flexible authentication sequencing. FlexAuth is used in conjunction with a policy or procedure to register the PC MAC addresses of guests and contractors.
Predeployment LAN Requirements
This section includes the following topics:
•
•
•
Assumptions and Prerequisites
The following network services should be installed, configured, and ready for use:
•
•
•
•
For this configuration guide, the following have been preconfigured:
•
•
•
Table 1 AD Users and Passwords
Administrator
aPa$$word0
User1
uPa$$word1
User2
uPa$$word2
Figure 1 shows a diagram of the TrustSec components used in the Cisco testing lab.
Figure 1 TrustSec Lab Components
Pre-TrustSec Switchport Interface Configuration
The following is a typical switchport configuration before TrustSec implementation:
Interface GigabitEthernet 2/1switchport access vlan 210switchport voice vlan 211switchport mode accessspanning-tree portfastspanning-tree bpduguard enableip verify source vlan dhcp-snoopingetc.end! Comments:! Your configuration may vary. The main thing to note is that we are only using a DATA! and VOICE VLAN initially and no TrustSec features are enabled.The following global switch configuration needs to be applied to the switch to enable DHCP Snooping on the port:
ip dhcp snooping vlan 210-215 <- your vlans may varyno ip dhcp snooping information optionip dhcp snoopingVerify that all hosts, except contractors and rogue APs, are online and working:
Cat6K#show cdp neighborsCapability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,D - Remote, C - CVTA, M - Two-port Mac RelayDevice ID Local Intrfce Holdtme Capability Platform Port IDSEP001BD585391E Fas 2/16 161 H P M IP Phone Port 1SEP0018BAC7BCEE Fas 2/12 175 H P IP Phone Port 1SEP0018BAC7BCFA Fas 2/13 167 H P IP Phone Port 16506-1.identity.com Fas2/48 151 R S I WS-C6506 Gig1/43001DE5EBE5EF Fas 2/8 136 H CIVS-IPC- eth0001DE5EBF900 Fas 2/11 131 H CIVS-IPC- eth0Cat6k#show ip dhcp snooping bindingMacAddress IpAddress Lease(sec) Type VLAN Interface------------------ --------------- ---------- ------------- ---- --------------------00:1B:D5:85:39:1E 10.200.11.202 613050 dhcp-snooping 211 FastEthernet2/1600:18:F8:08:F8:38 10.200.10.203 450645 dhcp-snooping 210 FastEthernet2/1300:18:F8:09:CF:C6 10.200.10.201 358850 dhcp-snooping 210 FastEthernet2/100:18:BA:C7:BC:FA 10.200.11.201 687677 dhcp-snooping 211 FastEthernet2/1300:18:BA:C7:BC:EE 10.200.11.203 687690 dhcp-snooping 211 FastEthernet2/1200:1D:E5:EB:F9:00 10.200.10.206 687692 dhcp-snooping 210 FastEthernet2/1100:1D:E5:EB:F9:00 10.200.10.206 687692 dhcp-snooping 210 FastEthernet2/1100:1D:E5:EB:E5:EF 10.200.10.204 687693 dhcp-snooping 210 FastEthernet2/800:21:86:58:DB:6B 10.200.10.205 444919 dhcp-snooping 210 FastEthernet2/12Total number of bindings: 8Verifying Network Infrastructure Before TrustSec is Deployed
Verify the following before deploying TrustSec:
•
•
•
•
•
•
•
NoteImplementing Monitor Mode
This section describes the global configuration necessary to implement monitor mode. This section includes the following topics:
•
•
•
Monitor Mode Overview
This section describes how to enable TrustSec authentication on the access switch ports and configure the infrastructure to support authentication and accounting. Monitor mode does not disrupt any network services for attached hosts, but enables you to account for and monitor network access attempts from the hosts connecting to your network.
Note that configuration of 802.1X supplicants, or clients, is not a concern here because monitor mode does not enforce authentication. However, if there are hosts with 802.1X enabled, you are able to detect them via the RADIUS accounting logs.
Installing Digital Certificates
To install digital certificates, complete the following steps.
Procedure
Step 1
Unless otherwise configured, use the default username and password: acsadmin/default.
Figure 2 Cisco Secure ACS Login
Step 2
TipFigure 3 Creating a Digital Certificate
Step 3
Figure 4 Selecting Generate Certificate Signing Request
Step 4
a.
b.
c.
Figure 5 Generate Certificate Signing Request
Step 5
Figure 6 Certificate Signing Request
Step 6
You will need to access this CSR from the CA in a later step.
Figure 7 Saving the Certificate Signing Request
Step 7
The Welcome screen appears, as shown in Figure 8.
Figure 8 Microsoft Certificate Services—Welcome Screen
Step 8
The Request a Certificate screen appears, as shown in Figure 9.
Figure 9 Request a Certificate Screen
Step 9
The Advanced Certificate Request screen appears, as shown in Figure 10.
Figure 10 Advanced Certificate Request Screen
Submit a certificate request by using a base-64-encoded CMC or PKCS#10 file, or submit a renewal request by using a base-64-encoded PKCS#7 file (see Figure 11).
Figure 11 Submitting a Certificate Request
Step 10
Figure 12 CSR Opened in a Text Editor
Step 11
Step 12
Figure 13 Submitting a Certificate Request (2)
Step 13
Make a note of the filename and directory in which you saved it.
Figure 14 Certificate Issued
Step 14
Figure 15 Adding a New Certificate
Step 15
Figure 16 Bind CA Signed Certificate Screen
Step 16
Figure 17 Step 2 - Bind CA Signed Certificate Screen
Step 17
You should now see the new digital certificate successfully installed (see Figure 18), and you may delete the old self-signed certificate.
Figure 18 New Digital Certificate Installed
This completes the ACS certificate enrollment section.
Adding a Certificate Authority
To add a certificate authority, complete the following steps.
Procedure
Step 1
Step 2
Step 3
Figure 19 Adding a Certificate Authority
Step 4
Figure 20 Trust Certificate List
Configuring Network Access Devices
To create an RADIUS entry for your access switch, complete the following steps.
Procedure
Step 1
Step 2
a.
b.
c.
Figure 21 Creating a RADIUS Entry for the Access Switch
Connecting to the Active Directory Domain
To connect to the Active Directory domain, complete the following steps.
Procedure
Step 1
a.
b.
Step 2
•
Figure 22 Connection Failed Message
•
Note
Setting the Clock for the New Cisco ACS 5.x Appliance
To set the clock on a new Cisco ACS 5.x appliance, complete the following steps.
Procedure
Step 1
NoteFigure 23 Login Screen
Step 2
ACS5-2/admin# show timezoneStep 3
Step 4
Step 5
ACS5-2/admin(config)# clock timezone <YOURTIMEZONE>Step 6
Step 7
a.
ACS5-2/admin(config)# ntp server time.cisco.comb.
ACS5-2/admin# clock set Jun 24 14:27:00 2011Your ACS appliance should now have the same timezone, time, and date as your Active Directory domain controller.
Step 8
If you had to adjust the timezone, date, and time, go back to the previous step and set up your Active Directory as an external identity store. When you are complete, you should now be able to establish a connection with the active directory, as shown in Figure 24.
Figure 24 Successful Connection to the Active Directory
Creating Identity Groups and Identity Store Sequences
This section includes the following topics:
•
Creating Identity Groups
To create identity groups, complete the following steps.
Procedure
Step 1
Step 2
Figure 25 Creating Identity Groups
Step 3
Note
Creating Identity Store Sequences
The identity store sequence allows you to add multiple identity stores to an access service. It attempts each identity store in the sequence, which is extremely flexible. This allows having users such as IP phones, temporary users, admin users, and so on, to be internally defined in ACS without having to add them to the corporate Active Directory or other external LDAP database.
To create identity store sequences, complete the follow steps.
Procedure
Step 1
Step 2
a.
b.
c.
This is used later in the 802.1X access service.
Figure 26 Creating Identity Store Sequences
Using Policy Elements
This section describes the configuration of policy elements. It includes the following topics:
•
•
NoteCreating Access Policies
For this guide, two new access services are created: one for 802.1X, and one for MAC Authentication Bypass (MAB).
Complete the following steps.
Procedure
Step 1
Step 2
a.
b.
c.
d.
Figure 27 Creating Access Services—Step 1
Step 3
Figure 28 Creating Access Services—Step 2
NoteStep 4
Repeat the process above to create a new access service for MAB. The MAB service allows you to recognize network access requests, glean the MAC addresses, and record them in the AAA accounting logs. This helps you monitor and determine what devices, via their MAC addresses, are connecting to the network and where.
Step 5
Step 6
a.
b.
c.
d.
Figure 29 Creating an Access Service for MAB—Step 1
Step 7
Figure 30 Creating an Access Service for MAB—Step 2
Step 8
NoteDefining Identity Sources and Authorization Profiles
After creating the 802.1X and MAB Access Services, define their respective identity sources and authorization profiles by completing the following steps.
Procedure
Step 1
Step 2
Step 3
This is the Identity Store Sequence you created previously, which contains both Active Directory and the internal database.
Figure 31 Setting up the Identity Source
Step 4
Step 5
Step 6
Figure 32 Authorization
Creating Service Selection Rules
In this section, you create two service selection rules: one for 802.1X and a second for MAB. Service selection is a means for Cisco ACS to identify an access service request and associate it with the proper administratively defined access service such as 802.1X, MAB, TACACS+, and so on. This allows for the specialized handling of different types of service requests, as listed in Table 3.
Complete the following steps.
Procedure
Step 1
Step 2
Figure 33 Customize Conditions Screen
Step 3
Step 4
Step 5
a.
b.
c.
d.
e.
f.
g.
Figure 34 Creating the Service Selection Rule (1)
Step 6
Figure 35 Creating the Service Selection Rule (2)
Step 7
a.
b.
c.
Figure 36 Creating the Service Selection Rule (3)
You now see the newly created service selection rule Match-802.1X.
Step 8
Step 9
Step 10
a.
b.
c.
d.
e.
f.
g.
h.
i.
j.
Figure 37 Creating the MAB Service Selection Rule
Configuring the Access Switch
This section describes the configuration of the access switch. It includes the following topics:
•
•
Configuring Global Identity Settings
Configure the global identity commands on the switch to enable TrustSec by using the following commands as a guide:
•
! Enable AAAaaa new-model! Create an 802.1X port-based authentication method listaaa authentication dot1x default group radius! Required for VLAN/dACL assignmentaaa authorization network default group radius! Enables 802.1X Accounting and MABaaa accounting dot1x default start-stop group radius•
! Define the Radius Server and establish the ports to use.! The test keyword will proactively check that the RADIUS server (ACS 5) is still responding.radius-server host [ACS_Server_IP_Address] auth-port 1645 acct-port 1646 test username test-radius! Define the Shared-Secret to be used between ACS & the Switch.! This must match what was entered in ACS.radius-server key [user-defined-shared-key] ! ensure your RADIUS traffic is always sourced from the ip address entered in the RADIUS server. ip radius source-interface [interface_name]! create the user in Global Config for the RADIUS server Test.username test-radius password 0 cisco123•
dot1x system-auth-controlThere are additional features to consider before going into production, such as Inaccessible Authentication Bypass, also known as Critical Auth. For instructions on Inaccessible Authentication Bypass, as well as other identity features, see the following URL: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/dot1x.html#wp1054805
Configuring Monitor Mode on the Switch Port
To configure monitor mode on the switch, add the following TrustSec settings to the access ports:
! Enter the range of interfaces to apply the port configuration tointerface range g2/1-16! Enable pre-authentication open access (non-restricted)authentication open! Enable port-based Authentication on the Interfaceauthentication port-control auto! Enable 802.1X Authentication on the Interfacedot1x pae authenticator! Enable MAC-Auth Bypass on the Interfacemab! Enable multiauth Modeauthentication host-mode multi-auth! multiauth Allows a single IP phone and one or more data clients to independently authenticate! on an authorized port. Each host, or MAC Address, is authenticated individually.
NoteVerifying Monitor Mode
Now that you have enabled the global settings in Cisco ACS and on the switch, as well as the port-specific configuration to enable TrustSec monitor mode, run the validation steps described in this section to verify proper operation.
This section includes the following topics:
•
•
•
•
•
•
Verifying Access Switch-to-Cisco ACS Server Communication
Access the switch console and ping the IP address of your Cisco ACS server.
NoteVerifying Authenticator-to-Authentication Server Communication
This validation exercise verifies that the switch is sending RADIUS messages for those hosts attempting to authenticate to those ports where you have enabled monitor mode. The easiest way to verify this is to check the accounting logs on the Cisco ACS server. Because you are in monitor mode, you should see failed authentication attempts from hosts.
Complete the following steps.
Procedure
Step 1
Figure 38 Monitoring and Reports Screen
Step 2
Depending on your browser behavior settings, either a new browser window or tab within the existing browser window is launched (see Figure 39).
Figure 39 Monitoring and Reports Dashboard
Step 3
You should see failed authentication attempts, as shown in Figure 40. However, remember that because you are in monitor mode and using the Open Access Cisco IOS Software feature, those hosts still have full network access.
Figure 40 Failed Authentication Attempts
Verifying that the Cisco ACS Server Can Communicate with the AD Domain Controller
Access a command-line prompt on the ACS server and ping the IP address of your Microsoft AD Controller.
NoteVerifying Host Network Connectivity and Network Services
Now that you have enabled 802.1X and MAB in Open Mode, once again verify that the hosts connected to these ports still have network access as they did before enabling these TrustSec features.
Complete the following steps.
Procedure
Step 1
conf tint range f2/1-16 (or the range of ports you configured)shutno shutendNotice the console messages on your terminal showing 802.1X and MAB authentication attempts and failures as shown in Figure 41. This is normal output. Depending on the authentication order commands, the switch ports first attempt 802.1X and then MAB, because these are the two TrustSec features you enabled.
Figure 41 Console Message Output
However, because you have enabled open mode, connectivity should not be affected at all. To verify this, perform the following steps.
Step 2
For example, show auth session int f2/1. You should notice an output similar to the one shown in Figure 42, indicating that the host failed authentication where the status shows Authz Failed. You should also notice that the port attempted 802.1X and then failed over to MAB, both indicating they failed over.
Figure 42 Sample Status Output
Step 3
Step 4
For example, got to Start > Run > CMD and click OK (see Figure 43).
Figure 43 Accessing the Command Prompt
Step 5
Your output should be similar to that shown in Figure 44. Notice the host has an IP address.
Figure 44 Sample ipconfig Output
Step 6
For example, type ping 10.200.1.117 for the Microsoft AD Server, or use the IP address you assigned your AD server. Your output should be similar to that shown in Figure 45.
Figure 45 Verifying Network Connectivity
Step 7
Figure 46 Logging into Windows PC Domain
Step 8
This example uses a default page on the Windows AD Server.
Figure 47 Accessing the Web Server
Verifying that IP Phones are Working
Check to see that the IP phones have obtained IP addresses and verify that they have a dial tone, indicating they have associated with the Cisco Call Manager.
Verifying that Devices such as IP Cameras Work
To verify that your IP cameras work, complete the following steps.
Procedure
Step 1
Step 2
After you have authenticated, you see whatever your camera is viewing (see Figure 48). You may need to adjust the focus ring to focus the video.
Figure 48 Accessing the IP Camera
Implementing Low Impact Mode
This section includes the following topics:
Low Impact Mode Overview
Low impact mode enables you to incrementally increase the security level by configuring an ingress port ACL on the Open Access TrustSec-enabled port. This provides basic connectivity for guests, contractors, and unauthenticated hosts while selectively limiting access to introduce a higher level of access security.
Additionally, differentiated access can be accommodated based on successful authentication and authorization by combining downloadable ACLs (dACLs) with the Cisco TrustSec-enabled port, which uses 802.1X, MAB, and/or WebAuth.
Combined with dACLs for successfully authenticated users and hosts, you can create profiles to grant or deny access to network resources based on need and your security policies, as shown in Table 4. This enables differentiated services while still maintaining secure network connectivity for legacy hosts.
Configuring Cisco ACS
This section includes the following topics:
•
•
•
Configuring Active Directory Groups
Before configuring policies, you need to select some Active Directory groups so they are available for subsequent steps.
Complete the following steps.
Procedure
Step 1
Figure 49 Active Directory
Step 2
Figure 50 Active Directory—Directory Groups
Step 3
a.
b.
Figure 51 Selecting Group Names
Notec.
The window shown in Figure 52 appears, showing the Directory Groups you selected.
Figure 52 Selected Directory Groups
Step 4
Configuring ACS Policy Elements
This section describes how to create and/or modify the three ACS policy components listed in Table 5, which are linked together for the authorization policies.
This is an extensible approach that allows you to differentiate various types of request per access service, and to create and apply different policy based on groups.
The three dACLs listed in Table 6 will be used in the authorization profiles.
Note
Complete the following steps.
Procedure
Step 1
Figure 53 Downloadable Access Control Lists
Step 2
Step 3
Figure 54 Creating a dACL
Step 4
Step 5
After you have created all three dACLs, you should see the information shown in Figure 55 under the Downloadable ACLs section.
Figure 55 Three dACLs
Configuring Authorization Profiles
For low impact mode, create the five authorization profiles listed in Table 7. These profiles will be associated with identity groups and access services.
To create the five authorization profiles, complete the following steps.
Procedure
Step 1
Step 2
Figure 56 Authorization Profiles—General Tab
Step 3
Figure 57 Authorization Profiles—Common Tasks Tab
Step 4
a.
b.
c.
Step 5
Step 6
Step 7
Figure 58 Authorization Profiles—General Tab
Figure 59 Authorization Profiles—Common Tab
Step 8
Step 9
In the Value drop-down menu in the ACLS section, select CorpUserACL.
Figure 60 Authorization Profiles—General Tab
Figure 61 Authorization Profiles—Common Tasks Tab
Step 10
In the Value drop-down menu in the ACLS section, select ContractorACL.
Figure 62 Authorization Profiles—General Tab
Figure 63 Authorization Profiles—Common Tasks Tab
Step 11
Figure 64 Authorization Profiles
Configuring Access Policies
This section includes the following topics:
•
•
•
Configuring User and Identity Stores
Table 8 lists the identity groups used in this section.
Adding a Contractor Identity Group
To create the Contractor identity group, complete the following steps.
Procedure
Step 1
Step 2
Step 3
Creating Internal Identity Stores—Host for MAB
Next you will create entries for managed host devices and assign them to identity groups. These entries are used to provide authentication and authorization using MAB.
The information listed in Table 9 is provided as an example.
NoteUse Table 10 to record your own MAC addresses to accommodate the use cases described in this guide.
To create entries for managed host devices and assign them to identity groups, complete the following steps.
Procedure
Step 1
Figure 65 Users and Identity Stores—Hosts
Step 2
Step 3
a.
b.
c.
Figure 66 Users and Identity Stores—Create
Step 4
After you have entered all the MAC addresses for your pilot, your host database should look like the screen shown in Figure 67.
Figure 67 Internal Hosts
NoteConfiguring Internal Identity Stores—Users for 802.1X
Next you will create entries for managed host devices and assign them to identity groups. These are used to provide authentication and authorization, using 802.1X for identities that are not maintained in your external identity management (IdM) system.
NoteThe information shown in Table 11 is provided as an example.
Table 11 Managed Host Device Information
CP-7961G-SEP001BD585391E
Cisco 7961G 802.1X-capable IP Phone
password
IP Phones
Use Table 12 to record your own MAC addresses to accommodate the use cases described in this guide.
To create entries for managed host devices and assign them to identity groups, complete the following steps.
Procedure
Step 1
Figure 68 Internal Users
Step 2
Step 3
a.
b.
c.
This password must match the one you configured on your host. In this case, pa$$Word4 is used for the password on the Cisco 7961G IP Phone.
Figure 69 Creating an Entry
Step 4
Figure 70 Identity Groups
Step 5
You should now see your entry in the Internal Users database, as shown in Figure 71.
Figure 71 Internal Users Database
Adding Authorization Rules for 802.1X Service
For low impact mode, you will now add new authorization rules to allow for differentiated services between the various groups or classes of users and hosts.
Adding an 802.1X-Capable Phones Authorization Rule
Complete the following steps.
Procedure
Step 1
Figure 72 Network Access Authorization Policy
Step 2
Step 3
a.
b.
c.
Figure 73 Creating an Authorization Policy
d.
Figure 74 Attribute List
e.
f.
g.
Figure 75 Network Device Groups
Step 4
Step 5
Step 6
Figure 76 Authorization Profiles List
Step 7
Click Save Changes.
Adding 802.1X-CorpUserRule
Complete the following steps.
Procedure
Step 1
Step 2
a.
b.
c.
d.
e.
f.
Figure 77 Creating an Authorization Policy
Step 3
Figure 78 Network Device Groups
Step 4
Step 5
Figure 79 Clicking Add V
Step 6
Step 7
Figure 80 Authorization Profiles List
Step 8
Step 9
Now you should see both the Match-1X-Phone-Authz and the 802.1X-CorpUserRules as authorizations for 802.1X (see Figure 81).
Figure 81 Network Access Authorization Policy
For now, this is all you will create for 802.1X in low impact mode. If your organization has more types of wired 802.1X devices, you may want to try adding more.
As demonstrated in the previous exercises, you used the previously created dACLs and authorization profiles in creating these specific authorization rules for 802.1X. Next, you will do a similar configuration of authorization rules for MAB.
Adding Authorization Rules for MAB Service
MAB IP Phones Rule
In this section you will set up an identity source and authorization rule to match IP phones in the MAB access service. This ensures that the MAB authenticated phones are put into the voice VLAN for proper access. All successfully authenticated non-802.1X phones obtain the Phone-Authz profile, which allows full access to the voice VLAN with no ACL restrictions; that is, permit ip any any.
Complete the following steps.
Procedure
Step 1
Step 2
Step 3
a.
b.
c.
Figure 82 Selecting Internal Hosts
Step 4
Step 5
a.
b.
c.
Figure 83 Creating an Authorization Policy
Step 6
Figure 84 Attributes List
Step 7
Step 8
Figure 85 Network Device Groups
Step 9
Step 10
Figure 86 Authorization Profiles List
Step 11
Step 12
Adding a MAB Contractor Rule
To add a MAB contractor rule, complete the following steps.
Procedure
Step 1
Step 2
a.
b.
c.
Figure 87 Creating an Authorization Policy
Step 3
Figure 88 Attribute List
Step 4
Step 5
Figure 89 Network Device Groups
Step 6
Step 7
Figure 90 Authorization Profiles List
Step 8
Step 9
Adding a MAB MediaNet Rule
To add a MAB MediaNet rule, complete the following steps.
Procedure
Step 1
Step 2
a.
b.
c.
Figure 91 Creating an Authorization Policy
d.
Figure 92 Attribute List
Step 3
Step 4
Figure 93 Network Device Groups
Step 5
Step 6
Figure 94 Authorization Profiles List
Step 7
Step 8
You should have now three authorization rules for MAB, as shown in Figure 95:
•
•
•
These apply differentiated authorization policy per group type.
Figure 95 MAB Authorization Policies
Configuring the Switch
This section includes the following topics:
Global Switch Default ACLs
Apply the following pre-authentication ACL to be applied to the TrustSec-enabled ports:
ip access-list extended PRE-AUTHremark Allow DHCPpermit udp any eq bootpc any eq bootpsremark Allow DNSpermit udp any any eq domainremark Allow Websensepermit tcp any any eq 15871remark Deny access to HOdeny ip any 10.0.0.0 0.255.255.255deny ip any 192.168.0.0 0.0.255.255deny ip any 172.16.0.0 0.15.255.255remark Allow access to internetpermit tcp any any eq wwwpermit tcp any any eq 443To enable dACLs, you must first configure your access switch to allow communications using the cisco-av-pair attribute with the value aaa:event=acl-download. To enable this functionality, enter the following command in the global configuration of the switch. Failure to add this command results in failed authentication/authorization requests.
conf tradius-server vsa sendendSwitch Port Configuration
Access your switch console and add ip access-group PRE-AUTH to the TrustSec-enabled ports you have configured for this exercise:
interface range fa2/1-16shutswitchport access vlan 210switchport voice vlan 211switchport mode accessip access-group PRE-AUTH inauthentication host-mode multi-domainauthentication openauthentication port-control automabdot1x pae authenticatorip verify source vlan dhcp-snoopingno shutYou are adding only one new line to the configuration (ip access-group PRE-AUTH in) and modifying the host-mode from multiauth to multidomain, which restricts one host in the voice VLAN and one host in the data VLAN. You can use the above configuration as a reference to the other configuration items that should be enabled on the low impact identity-enabled ports.
Configuring the Endpoint Host
For the purposes of this TrustSec phased deployment demonstration, the 802.1X client configuration is limited to Windows XP, the Cisco Secure Services Client (SSC), and PEAP as the authentication protocol.
Before installing Cisco SSC on your Windows XP PC, make sure you do not have any other 802.1X supplicant installed or configured. If you do, remove the supplicant and reboot before starting the next procedure.
To configure the endpoint host, complete the following steps.
Procedure
Step 1
You need both of the following installation applications:
•
•
Step 2
Figure 96 Cisco SSC Installer
Step 3
Figure 97 Installation Directory
The two screens shown in Figure 98 show the installation progress
Figure 98 Installation Progress
Step 4
Step 5
You are required to reboot.
Figure 99 Reboot Screen
Step 6
Step 7
Step 8
Figure 100 Welcome and Select Cisco SSC Version Screens
Step 9
a.
b.
c.
d.
Step 10
Figure 101 Client Policy and Authentication Policy Screens
Step 11
Step 12
Figure 102 Network Media and Wired Network Settings Screens
Step 13
a.
b.
c.
d.
Step 14
Figure 103 Connection Settings and Network Connection Type Screens
Step 15
Step 16
Figure 104 Machine Authentication (EAP) Method and EAP PEAP Settings Screens
Step 17
Step 18
Figure 105 Machine Credentials and User Authentication (EAP) Method Screens
Step 19
Step 20
Figure 106 EAP PEAP Settings and User Credentials Screens
Step 21
Step 22
Figure 107 Networks and Validation Screens
Step 23
Repeat the SCC and Management Utility configuration for other PCs that you are using in this demonstration.
NoteVerifying Low Impact Mode
This section includes the following topics:
•
•
•
NoteVerifying Host Network Connectivity and Network Services
A quick way to gain insight into the IP addresses associated with the ports and MAC addresses is to run the show ip dhcp snooping binding Cisco IOS Software CLI switch command (see Figure 108).
Figure 108 show ip dhcp snooping binding Output
Comparing this with the original lab diagram shown in Figure 1, you can see that all of the devices are connected and have an IP address. You also see which VLAN they are in and their MAC addresses. The only exception is the rogue AP on port f2/14.
Another useful IOS show command is show authentication sessions. This displays the state of all TrustSec-enabled switch ports on that switch. Figure 109 and Figure 110 show port-specific derivatives of this command.
Figure 109 show authenticated sessions Output
Figure 110 show cdp neighbors Output
Another quick summary view is to look at the Authentication and Authorization logs within ACS Reporting and Monitoring (see Figure 111).
Figure 111 Authentication and Authorization Logs (1)
The screenshot in Figure 112 is the same list of hosts, which has been scrolled to the right to show the rest of the data available.
Figure 112 Authentication and Authorization Logs (2)
As shown, all of the administratively allowed devices have successfully authenticated and received the authorization policy as prescribed. Note that the host with the MAC address 00-06-25-04-C2-95 failed authentication. By having this log, we know that someone has plugged in a rogue device on switch id-4503-2 on port 50214 (i.e, F2/14). Per policy in Low Impact mode, this device is allowed to gain an IP address and access limited resources per the PRE-AUTH ACL. However, this allows you to also send someone out to determine what the device is and whether it should be on your network.
Verifying 802.1X-Capable Managed Assets
802.1X Cisco IP Phone
This simple verification step verifies that the phone has an IP address and has connected to the Call Manager. One easy test is to pick up the phone and see whether it has dial tone. If it does, chances are everything is working just fine.
For further verification look at the switch port status, as shown in Figure 113.
Figure 113 Switch Port Status
Figure 113 shows that the phone successfully authenticated via 802.1X and was placed in the VOICE VLAN.
Windows XP and Cisco SSC 802.1X Supplicant/Client
Complete the following steps.
Procedure
Step 1
Figure 114 SSC Icon in the Tray Bar
This loads the SSC dialog window, showing the status of your connection (see Figure 115).
Figure 115 Connection Status
Step 2
Figure 116 Switch Port Status
Verifying Non-802.1X-Capable Managed Assets
Cisco IP Phone (no 802.1X Supplicant)
Verify that the phone has dial tone and check the authentication status of the switch port. Two non-802.1X phones are on ports F2/12 and F2/13. You can also determine where they are connected by using the following Cisco IOS Software CLI commands:
•
•
•
You can also check the AAA logs from ACS.
Figure 117 shows the output for show authentication sessions interface f2/12 & f2/13.
Figure 117 show authentication sessions interface f2/12 & f2/13 Output
As shown in the output from these Cisco IOS show commands, two devices are authenticated on each port: a phone and a PC. The phones are placed in the VOICE VLAN and the PCs in the DATA VLAN.
For port F2/12, the phone and the PC are both authenticated via MAB. On port F2/13, the phone is authenticated via MAB and the PC is authenticated via 802.1X. Both ports have the same configuration. This is the power of FlexAuth combined with multiauth.
You can also repeat the validation steps performed in the "Verifying Monitor Mode" section for a complete validation.
Implementing High Security Mode
This section includes the following topics:
•
•
High Security Mode Overview
Low impact mode may fulfill initial access security requirements for many organizations. For those that need stricter access controls may choose to deploy high security mode.
High security mode returns to the traditional closed mode of 802.1X, in conjunction with dynamic VLAN assignment for differentiated access. Although high security mode represents a more traditional deployment model, the new Cisco IOS FlexAuth feature set can be used to create a flexible, adaptable deployment.
FlexAuth allows you to configure secondary authentication methods to 802.1X, such as MAB and/or Web Authentication for guest access. Additionally, FlexAuth allows you to re-order the sequence of authentication. For example, you can try MAB before 802.1X.
Because you are moving from monitor or low impact mode, the base infrastructure configuration is already in place. Here you need to modify only the authorization profiles and switch port configurations.
Modifying Authorization Profiles
For high security mode, you are going to modify the five existing authorization profiles. The authorization is changed from dACLs to VLANs.
Table 13 lists the authorization profiles for all three modes.
To modify existing authorization profiles, first access the ACS web interface and go to Policy Elements > Authorization and Permissions > Network Access > Authorization Profiles (see Figure 118).
Figure 118 Authorization Profiles Screen
From here, modify the existing profiles by completing the following steps.
Modifying the Phone-Authz Profile
Step 1
Figure 119 Modifying the Phone-Authz Profile
Step 2
Step 3
Figure 120 Authorization Profiles—Common Tasks Tab
Step 4
Repeat these steps for the rest of the Authz profiles created, using Table 13 to map the appropriate VLANs to these profiles.
Modifying the Managed-Asset-Authz Profile
Step 1
Figure 121 Modifying Managed-Asset-Authz Profile
Step 2
a.
b.
c.
Figure 122 Authorization Profiles—Common Tasks Tab
Step 3
Modifying the MediaNet-Authz Profile
Step 1
Figure 123 Modifying the MediaNet-Authz Profile
Step 2
a.
b.
c.
Figure 124 Authorization Profiles—Common Tasks Tab
Step 3
Modifying the CorpUser-Authz Profile
Step 1
Figure 125 Modifying the CorpUser-Authz Profile
Step 2
a.
b.
c.
Figure 126 Authorization Profiles—Common Tasks Tab
Step 3
Modifying the Contractor Authorization Profile
Step 1
Figure 127 Modifying the Contractor-Authz Profile
Select the Common Tasks tab (see Figure 128) and do the following:
a.
b.
c.
Figure 128 Authorization Profiles—Common Tasks Tab
Step 2
Verifying Global Switch VLAN Definition
Verify that the VLANs listed in Table 14 are enabled on the TrustSec-enabled switch.
Figure 129 shows the output for the show run | begin vlan internal command.
Figure 129 show run | begin vlan internal Output
Configuring the Switch Port
Access your switch console and remove ip access-group PRE-AUTH in and authentication open on all of the TrustSec-enabled ports you have configured in the previous monitor and low impact modes:
interface range fa2/1-16shutswitchport access vlan 210switchport voice vlan 211switchport mode accessip access-group PRE-AUTH in <- Remove this entryno ip access group PRE-AUTH inauthentication open <- Remove this entryno authentication openauthentication host-mode multi-domainauthentication port-control automabdot1x pae authenticatorip verify source vlan dhcp-snoopingno shutWhen complete, make sure you bounce the affected interfaces by using the shut and then the no shut commands.
Verifying High Security Mode
This section includes the following topics:
•
•
•
NoteVerifying Host Network Connectivity and Network Services
The show authentication sessions Cisco IOS command is useful to display the state of all TrustSec-enabled switch ports on that switch. Figure 130 shows a port-specific derivative of this command.
Figure 130 show authenticated sessions Output
You can also see the authentication status for a specific port; for example, show authentication session int f2/1 (see Figure 131).
Figure 131 show authentication session int f2/1 Output
For another quick summary view, look at the Authentication and Authorization logs within ACS Reporting and Monitoring (see Figure 132).
Figure 132 Authentication and Authorization Logs (1)
The screenshot shown in Figure 133 is the same list of hosts, which has been scrolled to the right to show the rest of the data available.
Figure 133 Authentication and Authorization Logs (2)
As shown, all the administratively allowed devices have successfully authenticated and received the authorization policy as prescribed. Note that the host with the MAC address 00-06-25-04-C2-95 failed authentication. By having this log, you know that someone has plugged in a rogue device on switch id-4503-2 on port 50214 (that is, F2/14). Per policy in high security mode, this device is not allowed to gain access to the network.
Verifying 802.1X-Capable Managed Assets
802.1X Cisco IP Phone
In this simple verification step, verify that the phone has an IP address and has connected to the Call Manager. One easy test is to pick up the phone and see whether it has dial tone. If it does, chances are everything is working just fine.
For further verification, you can look at the switch port status (see Figure 134).
Figure 134 Switch Port Status
As shown, the phone successfully authenticated via 802.1X, was placed in the VOICE VLAN, and the host mode is multidomain.
Windows XP and Cisco SSC 802.1X Supplicant/Client
Step 1
Figure 135 Cisco SSC Icon in the Tray Bar
This loads the SSC dialog window showing the status of your connection (see Figure 136).
Figure 136 Connection Status
Step 2
Figure 137 Switch Port Status
Verifying Non-802.1X-Capable Managed Assets
Cisco IP Phone (no 802.1X Supplicant)
Verify dial tone and look at the authentication status of the switch port. From before, two non-802.1X-capable phones are on ports F2/12 and F2/13. You can also determine where they are connected from the following Cisco IOS commands:
•
•
•
You can also check the AAA logs from ACS.
Figure 138 shows the output for the show authentication sessions interface f2/12 & f2/13 command.
Figure 138 show authentication sessions interface f2/12 and f2/13 Output
As shown from the output of these Cisco IOS show commands, two devices are authenticated on each port: a phone and a PC. The phones are placed in the VOICE domain and the PCs in the DATA domain.
For port F2/12, the phone and the PC are both authenticated via MAB. On port F2/13, the phone is authenticated via MAB and the PC is authenticated via 802.1X. Both ports have the same configuration. This is the power of FlexAuth and multiauth.
Furthermore, using the show vlan command, you can see that interface f2/12 is in both the VOICE and CONTRACTOR VLANs (see Figure 139).
Figure 139 show vlan Output
The phone that is in the VOICE domain has been placed in the VOICE VLAN and the PC that is in the DATA domain is in the CONTRACTOR VLAN.
You can also repeat the validation steps performed in the "Verifying Monitor Mode" section for a complete validation.
Creating a Certificate for a Windows XP Browser
To create a certificate for your Windows XP browser, complete the following steps.
Procedure
Step 3
Figure 140 Microsoft Certificate Services Screen
Step 4
Figure 141 Selecting a Certificate to Download
Step 5
NoteFigure 142 Opening the Certificate
Figure 143 Certificate Import Wizard and Select Certificate Store Screens
Figure 144 Completing the Certificate Import Wizard Screen
Figure 145 Warning Message
Figure 146 Success Message
References
TrustSec 1.99 Documents
•
•
•
•
•
•
•
•
Related Documents
•
•
•
•
•
Feedback