Tuesday, 7 June 2022

FTD Integration with ISE-PIC Pxgrid - AD user passive authentication

FTD Integration with ISE-PIC Pxgrid 

- AD user passive authentication


Machine generated alternative text:
Internal 
1721810/24 
v'05 
10825 128/25 
10.8.25.1 
108.25. 
Firepower 
etho / mgmnt 
Mgmt

 

Machine generated alternative text:
L DAP

 


Activate pxGrid and Passive ID services

Machine generated alternative text:
System 
ep oymen 
Identity Management 
Network Resources 
icensing Certificates 
Logging 
Device Portal Management 
pxGrid Services 
Feed Service 
Maintenance 
Hostname 
FQDN 
IP Address 
Node Type 
U pgrade 
Backup & Restore 
Admin Access 
ise-a.clab.com 
10.8.25.150 
Identity Services Engine (ISE) 
Make Primary 
Role STANDALONE 
Administration 
Monitoring 
Role 
Threat Centric NAC 
Settings 
4) 
Other Monitoring Node 
Dedicated MnT 
Policy Service 
Enable Session Services 
Include Node in Node Group 
Enable Profiling Service 
Enable Threat Centric NAC Service 
Enable SXP Service 
Enable Device Admin Service 
Enable Passive Identity Service 
pxG rid 
Reset 
None 
Save

 

FMC integration with AD

Machine generated alternative text:
Overview Analysis 
Clab-AD 
Enter Description 
Policies 
Devices 
Objects 
AMP 
Intelligence 
Edit directory 
Hostname / IP 
Address 
Port 
Encryption 
SSL Certificate 
Status 
Configura non 
10.8.25.190 
389 
O STARTTLS 
Users 
Test 
Domains 
Cancel 
ntegration 
Deploy 
Licenses 
System 
Hea Monito 
Directory 
Realm Configuration 
URL (Hostname/ IP Address and Port) 
10.8.25.190:389 
User Download 
Upda tes 
Encryption 
none 
C) LDAPS 
None 
i 
Test connection 
succeeded

 

 

Machine generated alternative text:
Overview Analysis 
Clab-AD 
Enter Description 
Directo ry 
AD Primary Domain * 
AD Join Username 
AD Join Password 
Directory Username * 
Directory Password * 
Base DN * 
dc=clab,dc.com 
Group DN * 
dc=clab,dc.com 
Group Attribute 
User Session Timeout 
User Agent and ISE/ISE-PIC 
Users 
TS Agent Users 
Captive Portal Users 
Policies 
Devices 
Objects 
AMP 
Intelligence 
Configura non 
domain.com 
ex: 
ex: user@domain 
Test AD Join 
ex: user@domain 
Userf 
User Download 
clab.com 
administrator@clab.com 
administrator@clab.com 
Member 
1440 
1440 
1440 
1440 
1440 
ou=user, dc — 
ex: 
ex: ou=group 
minutes until 
Status 
i 
Test AD join succeeded 
Failed Captive Portal Users 
Guest Captive Portal Users 
* Required Field 
minutes until session released. 
minutes until session released. 
minutes until session released. 
minutes until session released.

 

 

Machine generated alternative text:
Overview Analysis 
Clab-AD 
Enter Description 
Policies 
Devices 
Objects 
AM p 
Intelligence 
Configuration 
Users 
Domains 
Directo ry Realm Configu ration 
Download users and groups 
User Download 
Integratiol 
Gro 
Begin automatic download at 8 
PM America/New York 
Download Now 
Available Groups e 
Search by name 
Enterprise Admins 
Remote Management Users 
IIS IUSRS 
14 
DnsAdmins 
14 
RDS Remote Access Servers 
Hyper-V Administrators 
Group Policy Creator Owners 
Administrators 
Certificate Service DCOM Access 
Domain Computers 
Repeat Every 24 
Hours 
Groups to Include (3) 
Sales 
Executives 
Domain Users 
Add to 
Include 
Add to 
Exclude

 

 

ISE integration with AD

Machine generated alternative text:
Identity Services Engine 
CISCO 
Home 
Context Visibility 
Operations 
Policy 
Administration 
Work Centers 
Threat Centric NAC 
System 
Identities 
Identity Management 
Network Resources 
Device Portal Management 
pxGrid Services 
Feed Service 
Groups External Identity Sou rces 
Identity Source Sequences Settings 
External Identity Sources 
Certificate Authentication Profile 
Active Directory 
Clab 
LDAP 
ODBC 
RADIUS T0ken 
RSA securiD 
SAML Id Providers 
SOCial Login 
Connection 
Whitelisted Domains 
Passive ID 
Groups 
Attrib utes 
Advanced Settings 
* Join Point Name 
* Active Directory Domain 
Clab 
clab.com 
Diagnostic Tool 
Refresh Table 
0: Join 0: Leave 
D ISE Node 
ise-a_clab.com 
Test User 
ISE Node Role 
STANDALONE 
Status 
Operational 
Domain Contro Iler 
win12_cIab.com 
License Wa 
Click here to do wireless setup and 
Default-First-Slte-Name

 

PassvieID

Machine generated alternative text:
Identity Services Engine 
Cisco 
Home 
Context Visibility 
Operations 
Policy 
Administratio n 
Work Centers 
Lic ense Warning A 
o 
o 
System 
Identities 
Identity Management 
Network Resou rces Device Portal Management 
pxGrid Services Feed Service 
Threat Centric NAC 
Click hereto do wireless setup and visibility setup Do not show this ag 
Groups External Identity Sou rces 
Identity Source Sequences Settings 
External Identity Sources 
Certificate Authentication Profile 
Active Directory 
Clab 
LDAP 
ODBC 
RADIUS T0ken 
RSA securiD 
SAML Id Providers 
SOCial Login 
Connection 
Whitelisted Domains 
Passive ID 
Groups 
PassivelD Domain Controllers 
0 Selected 
Refresh 
Edit 
Trash 
use Existing Agent 
Attrib utes 
config WMI 
Site 
Advanced Settings 
Rows/ Page 
Add Agent 
Go 
1 Total Rows 
Add DCs 
DC Host 
o 
o 
Domain 
clab.com 
IP Address 
win12_clab.com 
Default-First-Site-Name 
Monitor Using 
WMI

 

 

Machine generated alternative text:
Edit Item 
Edit Domain Controller 
Host FQDN 
Description 
user Name * 
Password 
Protocol 
win12.cIab.com 
administrator 
WMI 
Show Password 
Configure 
Test 
Cancel 
x 
Save

 

 

PxGrid create Certificate

Machine generated alternative text:
Identity Services Engine 
CISCO 
System Identity Management 
Home 
Context Visibility 
Operations 
Policy 
Administratio n 
Work Centers 
Network Resources Device Portal Management 
pxGrld Services Feed Service 
Threat Centric NAC 
All Clients 
Web Clients 
Capabilities 
Live Log 
Settings 
Certificates 
Permissions 
Generate pxGrid Certificates 
I want to * 
Common Name (CN) * 
Description 
Certificate Template 
Subject Alternative Name (SAN) 
Certificate Download Format * 
Certificate Password * 
Confirm Password * 
Connected via XMPP ise-a_clab.com 
Generate a single certificate (without a certificate signing request) 
ftd-a_clab.com 
clab pxgrid 
o 
pxGr id_Certific ate_Temp late 
IP address 
Certificate in Privacy Enhanced Electronic Mail (PEM) format, key in PKCS8 PEM format (including certificate chain) 
o 
o 
Reset 
Create

 

Unzip certificate

Machine generated alternative text:
clab certs 
> ISE 
> 1654624920299 cert 
Name 
CertificateServicesEndpointSubCA ise.„ 
CertificateServicesNodeCA ise-a .cer 
CertificateServicesRootCA ise-a .cer 
Date modified 
2022-06-07 2:02 PM 
2022-06-07 2:02 PM 
2022-06-07 2:02 PM 
2022-06-07 2:02 PM 
2022-06-07 2:02 PM 
2022-06-07 2:02 PM 
Type 
Security Certificate 
Security Certificate 
Security Certificate 
Security Certificate 
KEY File 
Security Certificate 
Size 
ftd-a.clab.com 
ftd a.clab.com 
Ise-a.clab.com 
108.20.124.cer 
108.20.124.key 
ise-a.clab.com.cer 
2 KB 
2 KB 
2 KB ise root cert 
2 KB 
2 Kfirepower private key 
2 KB

 

 

Add ISE root Certificate to FMC

Machine generated alternative text:
Overview Analysis 
Policies Devices 
Object Management 
Intrusion Rules 
Trusted CAS 
. Internal CAS 
Affirm Trust-commercial 
AffirmTrust-Networking 
AMP 
Intelligence 
Trusted certificate authority (CA) object represents a CA public key certificate belonging to a trusted CA. You can use external CA objects in SSL policy, realm configurations and ISE/ISE-PIC connection. 
Security Intelligence 
Network Lists and Feeds 
DNS Lists and Feeds 
URL Lists and Feeds 
Sinkhole 
Cipher Suite List 
Distinguished Name 
Individual Objects 
Object Groups 
PKI 
Trusted CAS 
External Certs 
Internal Certs 
Cert Enrollment 
Internal CA Groups 
Trusted CA Groups 
Internal Cert Groups 
External Cert Groups 
DNS Server Group 
SLA Monitor 
Prefix List 
IPv4 Prefix List 
IPv6 Prefix List 
Name 
A-Trust- nQual-01 
A-Trust- nQual-03 
Qual-01 
A-Trust- 
Qual-02 
A-Trust- 
AAA-certificate-services 
AC- RaAz-CerticAmara-S IA. 
Actalis-Authentication-Root-CA 
Add Trust- 
Class-I-CA-Root 
Add Trust- External-CA- Root 
Add Trust-public-CA-Root 
Add Trust-Qualified-CA-Root 
Admin-Root-CA 
AdminCA-CD-T01 
Affirm Trust- Premium 
Import Trusted Certificate Authority 
Name: 
clab 
Certificate Data 
or, choose a file: 
BEGIN CERTIFICATE 
Browse.. 
lue 
—A-Trust- nQual-01, 
-A-Trust-nQuaI-03, C 
-A-Trust-QuaI-01, OF 
-A-Trust-QuaI-02, OF 
MllFKjCCAxKgAw1BAg1QUILyXew8ROSOWODhxzruETANBgkqhklG9wOBAQwFADAv 
MSOwKwYDVQQDDCRDZYOOaWZpY2FOZSBTZY02aWNIcyBSb2901ENBICOgaXNILWEl" 
HhcNMj1wNj 
WZpY2FOZS 
File Upload 
QUAA41CDl'd 
oUttJm5JqBgV 
PDWnZVQQ8/ 
ud1+V9eEHcv 
+2D6w99FDY 
kYsv14AbeICE/ 
kDOgGNIOL 
Y9KQxNq3 
qCS8gkkFPWO 
4rMVukdGzn 
Kx9eNWadbm 
5QIDAQAB001 
BAQDAg 
7rjav8Xv 
3H53qpEXr 
o 
Encrypted, 
Documents > Documents > clab certs 
New folder 
> ISE 
> 1654624920299 cert 
Organize • 
This pc 
Name 
CertificateServicesEndpointSubCA 
CertificateServicesNodeCA ise-a .cer 
CertificateServicesRootCA-ise-a .cer 
8 
3D Objects 
10.6188.150 
Desktop 
Documents 
Downloads 
Music 
Dirt' r 
ftd-a.clab.com 
ftd-a.clab.com 
ise-a.clab.com 
10820.124.cer 
108.20.124.key 
ise-a.clab.com.cer 
Date mod 
2022-06-0 
2022-06-0 
2022-06-0 
2022-06-0 
2022-06-0 
2022-06-0 
File name: CertificateServicesRootCA ise-a .cer

 

 

Machine generated alternative text:
Overview Analysis 
Object Management 
Trusted CAS 
Policies Devices 
Intrusion Rules 
AMP 
Intelligence 
Deploy 
System 
Help 
admin 
clab 
Trusted certificate authority (CA) object represents a CA public key certificate belonging to a trusted CA. You can use external CA objects in SSL policy, realm configurations and ISE/ISE-PIC connection. 
Security Intelligence 
Network Lists and Feeds 
clab 
DNS Lists and Feeds 
URL Lists and Feeds 
Sinkhole 
Value 
CN=Certificate Services Root CA 
Isa-a

 

 

 

Add ISE pxGrid certificate and key to FMC

 

Machine generated alternative text:
Overview Analysis 
Object Management 
Internal Certs 
Policies Devices 
Intrusion Rules 
AMP 
Intelligence 
Deploy 
O Add Internal Cert 
System 
Internal certificate object represents a server public 
key certificate belonging to your organization. You can use internal certificate objects and groups in SSL rules, ISE/ISE-PIC connection and captive portal configuration. 
Security Intelligence 
Network Lists and Feeds 
DNS Lists and Feeds 
URL Lists and Feeds 
Sinkhole 
Cipher Suite List 
Distinguished Name 
Individual Objects 
Object Groups 
p KI 
Internal CAS 
Trusted CAS 
External Certs 
Internal Certs 
Cert Enrollment 
Internal CA Groups 
Trusted CA Groups 
Internal Cert Groups 
External Cert Groups 
DNS Server Group 
SLA Monitor 
Prefix List 
IPv4 Prefix List 
IPv6 Prefix List 
Name 
Self- Signed 
Add Known Internal Certificate 
Value 
CN=ftd-a.clab.com, ORG=BNS, OU=IT, C=CA 
Name: 
clab- pxgrid 
Certificate Data or, choose a file: 
BEGIN CERTIFICATE 
Browse.. 
ftd-a.clab.com 10.8.20.124.cer 
MllE5zCCAs+gAw1BAg1QDEyMxBbgRK6JUM68XGsTjANBgkqhklG9wOBAQsFADA3 
MT UwMwYDVQQDDCxDZXJOaWZpY2FOZSBTZXJ2aWNIcyBFbmRwb21udCBTdW1gQOEg 
LSBpc2UtYTAeavOyMjA2MDYxODAxNTIaavOyNDA2MDYxODAxNTIaMBkxFzAVBgNV 
BAMMDmZOZC1hLmNsYW1uY29tM11B1jANBgkqhklG9wOBAQEFAAOCAQ8AM11BCgKC 
QEApcopdBOGgOcoZL90Uc8A2cONA/bnt68UZ97ZLNAuvBBkN0RLQvUILHyhdULk 
ECXXax92DKaUxkh4ETOPD5cZFIeDCbc8AACOc.xWOtwGEFOdsp4c1001LNvfJPr 
Qr3ERDBPr4R109USMuCv/eCLvgVIS6nnJxttc2FkeGRe1KLxUpTtjgtajCAQ LIAI 
bNOyUDxWc9PIWgukVIDr2aeghls1e+Y+nZubAURETLJ2qLVgZiBH79dz2putvEa 
Key or, choose a file: 
Browse.. 
ftd-a.clab.com 10.8.20.124.key 
BEGIN ENCRYPTED PRIVATE KEY 
MllE9jA0BgoqhklG9wOBDAEDMB0EFBg+HLC5cy188zhyJSMVTsDAqHfAg11AASC 
BMhMd7JJp8fCZzMfv3nHaMb4V7Ky1AeQQG4qK511xhgL81EW01WuJNfUHjsSgdt 
pLpYpreMMzcCDMkWHSpDSzkW7JLX2TRvqAuvwyvfz343VKPIQ9e81VBhKdOwDgk1 
K4FLxxlgPJvUSEAmm+OiPNmLNDj76XarOeV9d17bYfd4212viRhyHHf7Kz+u1y 
04d3S1b03KLIGWqtozvDCS9EgHMcYE61B74065KP26SOyh117cnb29sT6/Ydx87 
Lh67mkUEDt+4g1pAErfNhmpe124a/Wpgnb5N67tJGWh6sCulfg1NnJD6ZgYZ517 
ebAYeCBbNxMdXpLIBrMOMtM/1ePaQ+PZbF/5UiL1jyGenSJGcEViFtp713Mugo 
GrpnxGQSqNuLxS16TShURzEOy01C286p78M4ucOorYqV/bBJ61vwGzu/BctGh 
Encrypted, and the password is:

 

Machine generated alternative text:
Overview Analysis 
Object Management 
Internal Certs 
Policies Devices 
Intrusion Rules 
AMP 
Intelligence 
Deploy 
System 
Help 
admin 
Fil ter 
Internal certificate object represents a server public key certificate belonging to your organization. You can use internal certificate objects and groups in SSL rules, ISE/ISE-PIC connection and captive portal configuration. 
Security Intelligence 
Network Lists and Feeds 
DNS Lists and Feeds 
URL Lists and Feeds 
Sinkhole 
File List 
Cipher Suite List 
clab- pxgrid 
Self- Signed 
Valu 
CN=ftd-a.clab.com 
=ftd-a.clab.com, ORG=BNS, OU=IT, C=CA 
CN

 

 

 

 

FMC and ISE pxGrid Integration

Machine generated alternative text:
Overview 
Cisco CSI 
Analysis 
Realms 
Policies 
Devices 
Objects 
eStreamer 
AMP 
Intelligence 
Configuration 
Users 
Domains 
Integration 
Updates 
Deploy 
Licenses 
e 
Help 
System 
Health Monitoring 
Identity Sources 
Host Input Client 
Smart Software Satellite Packet Analyzers 
You have unsaved changes 
admir 
Tool 
Cancel 
Identity Sources 
Service Type 
Primary Host Name/IP Address * 
Secondary Host Name/IP Address 
pxGrid Server CA * 
VINT server CA * 
FMC Server Certificate * 
ISE Network Filter 
* Required Field 
Identity Services Engine 
ise-a.clab.com 
clab 
clab 
clab- pxgrid 
Test 
User Aqent 
ex. 10.89.31.0/24, 192.168.8.0/24, .

 

ISE approve pxgrid client

Machine generated alternative text:
Identity Services Engine 
Cisco 
System Identity Management 
Home 
Context Visibility Operations 
Policy 
Administratio n 
Work Centers 
Network Resources Device Portal Management 
pxGrld Services Feed Service 
Threat Centric NAC 
Lic ense Warning A 
Click here to do wireless setup and visibility setup Do not show thi± 
All Clients 
Web Clients 
Capabilities 
Live Log 
Settings 
Certificates 
•Approve 
Enable Disable 
Client Name 
ise-bridge-ise-a 
ise-mnt-ise-a 
ise-pubsub-ise-a 
ise-fanout-ise-a 
Ise-ad min-ise-a 
firesig 
Refresh Total Pending Approval(o) 
Group Decline O Delete 
o 
Permissions 
Status 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Iselecteditem 1 - 6 of 6 
Auth Method 
Certificate 
Certificate 
Certificate 
Certificate 
Certificate 
Certificate 
Show 25 
per page 
Log 
V iew 
V iew 
V iew 
V iew 
V iew 
V iew 
Page 
Description 
Capabilities 
Capabilities(0 Pub 
, 4 sub) 
Capabilities(2 Pub 
, 1 sub) 
Capabilities(0 Pub, 
O sub) 
Capabilities(0 Pub, 
O sub) 
Capabilities(4 Pub, 
2 sub) 
Capabilities(0 Pub 
, 1 sub) 
Client Group(s) 
Internal 
Inter nal 
Internal 
Inter nal 
Internal

 

 

Machine generated alternative text:
Overview 
Cisco CSI 
Analysis 
Realms 
Policies 
Devices 
Objects 
eStreamer 
AMP 
Intelligence 
Configuration 
Users 
Domains 
Integration 
Upda tes 
Deploy 
Licenses 
e 
Health 
Monitor 
Identity Sources 
Host Input Client 
Smart Software Satellite Packet Analyzers 
You have unsaved changes 
Identity Sources 
Service Type 
Primary Host Name/IP Address * 
Secondary Host Name/IP Address 
pxGrid Server CA * 
VINT server CA * 
FMC Server Certificate * 
ISE Network Filter 
* Required Field 
ise-a.clab.com 
clab 
clab 
clab- pxgrid 
Test 
User Aqent 
ex. 10.89.31.0/24, 192.168.8.0/24, 
Status 
i 
ISE connection sta tus: 
Primary hos Success 
Additional Logs

 

 

Save

 

ISE approve again

Machine generated alternative text:
Identity Services Engine 
Cisco 
System Identity Management 
Home 
Context Visibility Operations 
Policy 
Administratio n 
Network Resources Device Portal Management 
pxGrld Services Feed Service 
All Clients 
b Clients 
Capabilities 
Live Lo 
Settings 
Refresh 
Certificates 
Permissions 
Enable Disable 
Approve 
Group Decline Delete 
o 
Description 
0 
Client Name 
ise-bridge-ise-a 
ise-ad min-ise-a 
ise-fanout-ise-a 
ise-pubsub-ise-a 
ise-mnt-ise-a 
otal Pending Approval(l) 
Capabilities 
Capabilities(0 Pub 
, 4 sub) 
Capabilities(4 Pub, 
2 sub) 
Capabilities(0 Pub, 
O sub) 
Capabilities(0 Pub, 
O sub) 
Capabilities(2 Pub 
, 1 sub) 
Capabilities(0 Pub , 
O sub) 
Capabilities(0 Pub, 
O sub) 
Work Centers 
Threat Centric NAC 
Status 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Pending 
Offline (XMPP) 
Inter 
Inter 
Inter 
Inter 
Inter 
iseage nt-fmc-a_ c lab _ c om-20de445c 9c499df00edeb b. _

 

Machine generated alternative text:
Identity Services Engine 
CISCO 
System Identity Management 
Home 
Context Visibility Operations 
Policy 
Administratio n 
Network Resources Device Portal Management 
pxGrid Services Feed Service 
All Clients 
Web Clients 
Capabilities 
Live Log 
Settings 
Certificates 
Permissions 
Enable Disable 9Approve 
Client Name 
ise-bridge-ise-a 
ise-ad min-ise-a 
ise-fanout-ise-a 
ise-pubsub-ise-a 
ise-mnt-ise-a 
Refresh Total Pending Approval(o) 
Decline O Delete 
O Group 
Description 
Capabilities 
Capabilities(0 Pub 
, 4 sub) 
Capabilities(4 Pub, 
2 sub) 
Capabilities(0 Pub, 
O sub) 
Capabilities(0 Pub, 
O sub) 
Capabilities(2 Pub 
, 1 sub) 
Capabilities(0 Pub 
, 1 sub) 
Capabilities(0 Pub, 
O sub) 
Work Centers 
Threat Centric NAC 
Status 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Online (XMPP) 
Offline (XMPP) 
Click here to do wireless setl 
-7 of 7 
Client Group(s) 
Internal 
Inter nal 
Internal 
Inter nal 
Internal 
iseage nt-fmc-a_ clab_c om-20de445c 9c499df00edebb. 
firesig

 

 

Identity Policy

Machine generated alternative text:
Overview Analysis 
Access Control Identity 
Clab-ldentity 
Enter Description 
Devices Objects AMP Intelligence 
Deploy 
System 
Help 
admin 
Network Discovery Applica tion Detectors 
Rules 
Active Authentication 
Editing 
Name 
Name 
Administrator Rules 
Ac tion 
This category is empty 
Standard Rules 
Rule - clab-id-rule 
clab- id- rule 
Passive Authentication 
Correlation 
Rea 1m: 
Add to 
Source 
Actions 
e Enabled 
Move 
Clab- AD 
Authentication Protocol: HTTP Basic 
Networks 
Zones 
clab- id- rule 
Available Zones e 
VLAN Tags 
PO rts 
Exclude HI-rp User-Agents: 
Destination Zones (O) 
You have unsaved changes 
Auth Protocol 
Realm & Settings 
tion 
Root Rules 
This category is empty 
Source Zones (1) 
Inside 
Search by name 
Inside 
Outside

 

 

Machine generated alternative text:
Editing 
Name 
Ac tion 
Rule - clab-id-rule 
clab- id- rule 
Passive Authentication 
e Enabled 
Move 
Networks 
Zones 
Available Networks e 
VLAN Tags 
PO rts 
o 
Realm: Clab-AD 
Authentication Protocol: HTTP Basic 
Source Networks (1) 
Exclude HI-rp User-Agents: 
Destination Networks (O) 
Realm & Settings 
N etworks 
IPv4-Private-All- 
any ipv4 
any ipv6 
Geolocation 
10.8.25.128/25 
internal network 
RFc1918 
Add to 
Source 
Add to 
Destination 
IPv4-Benchmark-Tests

 

 

Machine generated alternative text:
Editing Rule - clab-id-rule 
Name 
Ac tion 
clab- id- rule 
Passive Authentication 
e Enabled 
Move 
Rea 1m: 
Clab-AD 
Authentication Protocol: HTTP Basic 
Exclude HI-rp User-Agents: 
Zones 
Realm * 
Networks 
VLAN Tags 
Clab-AD 
PO rts 
Use active authentication if passive or VPN identity cannot be established 
* Required Field

 

 

 

 

ACP

 

Category 

Machine generated alternative text:
Overview Analysis 
Access Control Access Control 
Devices Objects 
Network Discovery 
AMP Intelligence 
Application Detectors 
SSL Policy: None 
Deploy I 
System Help 
admin 
Correlation 
Actions 
ACP 
Enter Description 
Prefilter Policy: Prefilter 
Rules 
Security Intelligence 
Cancel 
You have unsaved changes 
Identity Policy: Clab-ldentity_ 
Policy Assignments (1) 
HTTP Responses 
Dest Zones 
Advanced 
Logging 
Source Net... 
Dest Netw... 
Inheritance Settings 
O 
Add Rule Search Rules 
Add Category 
Filter by Device 
Name 
Source Zo... 
Show Rule Conflicts 
Applications Source Ports Dest Ports 
VLAN Tags 
URLs 
ISE/SGT At... 
Action 
Mandatory - ACP (-) 
Inside-outside (-) 
There are no rules in this category. Add Rule 
Default- ACP (-) 
There are no rules in this section. Add Rule or Add Category 
Defa u It Action 
Access Control: Block All Traffic

 

Create rule

Machine generated alternative text:
Prefilter Policy: Prefilter 
Rules 
Security Intelligence 
Editing 
Name 
Ac tion 
SSL Policy• 
. None 
Rule - clab-passive-authen 
clab- passive- authen 
Allow 
Identity Policy: Clab-ldentity 
Filter by Device 
Name 
Source Z 
VLAN Tags 
Users 
e Enabled 
PO rts URLs 
Move 
SGT/ISE Attributes 
Networks 
Zones 
vailable Zones e 
Search by name 
Inside 
Outsid 
Applications 
Add to 
Source 
Add to 
Destination 
into Category 
6 
Inside-outside 
Inspection Logging 
Destination Zones (1) 
— Outside 
Comments 
Mandatory - ACP (1-1) 
Inside-outside (1-1) 
clab- passive-auth Inside 
Default - ACP (-) 
There are no rules in this section. 
Default Action 
Source Zones (1) 
Inside

 

 

Machine generated alternative text:
Editing Rule - clab-passive-authen 
Name clab- passive- authen 
e Enabled 
PO rts URLs 
Move 
SGT/ISE Attributes 
into Category 
Ac tion 
Allow 
Networks 
Zones 
Available Networks e 
Networks 
any 
any-IPV4 
any-Ipv6 
VLAN Tags 
Users Applica tions 
Inside- Outside 
Inspection Logging 
Destination Networks (O) 
any 
Enter an IP address 
Comments 
Add To 
Source 
Networks 
Add to 
Des tina bon 
Source Networks (1) 
Source 
10.8.25.128/25 
Enter an IP address 
Original Client 
Geoloca tion 
Ipv4 
Ipv4 
Ipv4 
Ipv4 
Ipv4 
-Benchmark-Tests 
-Link-Local 
-Multicast 
-Private- 10.0.0.0 
-8 
-Private-172.16.0.0 12

 

 

Machine generated alternative text:
Editing Rule - clab-passive-authen 
Name clab- passive- authen 
e Enabled 
Move 
SGT/ISE Attributes 
into Category 
Add to Rule 
Inside- Outside 
Ac tion •e 
Allow 
Zones Networks 
Available Realms e 
Search by name or value 
Special Identities 
Clab-AD 
VLAN Tags 
Users 
Applications 
Available IJsers 
PO rts 
URLs 
Inspection 
Selected IJsers (1) 
Clab-AD/Sales 
Logging 
Comments 
Search by name or value

 

Machine generated alternative text:
Editing 
Name 
Ac tion 
Rule - clab-passive-authen 
clab- passive- authen 
Allow 
e Enabled 
Applications 
Move 
SGT/ISE Attributes 
into Category 
Users 
PO rts 
URLs 
Inside- Outside 
Inspection 
Zones Networks VLAN Tags 
Log at Beginning of Connection 
Log at End of Connection 
File Events: 
Send Connection Events to: 
e Event Viewer 
Comments 
Syslog Server (Using default syslog configuration in Access Control Logging) Show Overrides 
O SNMP Trap 
Select an SNMP Alert Configuration...

 

 

Machine generated alternative text:
Overview Analysis 
Access Control Access Control 
Devices Objects 
Network Discovery 
AMP Intelligence 
Application Detectors 
SSL Policy: None 
Correlation 
Actions 
Users 
Clab-AD/Sale 
Deploy 
Identity Policy: Clab-ldentity_ 
System 
ACP 
Enter Description 
Prefilter Policy: Prefilter 
Rules 
Security Intelligence 
Help 
admin 
Cancel 
Policy Assignments (1) 
HTTP Responses 
Dest Zones 
Outside 
Logging 
Source Net... 
10.8.25.128/ 
Advanced 
Dest Netw... ¯ 
Inheritance Settings 
Show Rule Conflic ts O 
Add Rule Search Rules 
Add Ca tegory 
Filter by Device 
Name 
Source Zo... 
VLAN Tags 
Any 
Applications 
Any 
ISE/SGT At... 
Source Ports Dest Ports 
Mandatory - ACP (1-1) 
Inside-outside (1-1) 
clab- passive- auti Inside 
Default- ACP (-) 
There are no rules in this section. 
Defa u It Action 
Any 
Any 
Any 
Any 
Any 
Action 
Allow 
Add Rule or Add Category 
Access Control: Block All Traffic

 

 

 

 

Testing:

 

Clab\monica.cheng login WIN 7

 

Passive ID active session report

Machine generated alternative text:
Identity Services Engine 
Cisco 
Network Access 
Guest Access 
Home 
Context Visibility 
Operations 
Posture 
Reports 
Policy 
Administration 
Work Centers 
TrustSec BYOD Profiler 
Device Administration 
LJpdated 
PassivelD 
Overview 
Providers 
Export Summary 
My Reports 
Reports 
• Passive ID Reports 
Subscribers 
Certificates Troubleshoot 
Lic ense Warning A 
Click here to do wireless setup and visibility setug 
+ My Reports 
From 2022-06-07 To 2022-06-07 
AD Connector Operations 
Administrator Logins 
Change Configuration Audit 
Current Active Sessions 
Health Summary 
Operations Audit 
PassivelD 
pxGrid Administrator Audit 
System Diagnostic 
user Change Password Audit 
Current Active Sessions O 
Reports exported in last 7 days 
0 
Initiated 
Tue Jun 07 EDT 2022 
Tue Jun 07 EDT 2022 
Session Time 
O Identity 
Identity 
Monica_cheng 
Administrator 
Rows/ Page 
Filter 
Endpoint ID 
Endpoint ID 
Tue Jun 07 EDT 2022 
Tue Jun 07 EDT 2022 
2

 

Machine generated alternative text:
Analysis 
Policies 
Overview 
Context Explorer 
Connections 
Active Sessions 
Devices Objects AMP Intelligence 
Active Sessions 
Correlation 
Advanced 
Search 
Realm X 
Clab-AD 
Bookmark This Page 
Deploy 
Report Designer 
System 
Help 
Intrusions 
Files 
User X 
monica 
Hosts 
Users 
Dashboard View Bookmarks 
ad' 
Searc 
Table View of Active Sessions ) Active Sessions 
Search Constraints (Edit Search Save Search) 
Jump to... 
Login Time X 
Last Seen X 
Authentication 
X 
Current IP 
X 
2022-06-07 15: 18:42 2022-06-07 15: 18:42 
cheng_(Clab- AD\monlca. cheng 
, LDAP) 
Passive Authentication 
10.8.25.219 
Username X 
monica. cheng 
X 
First 
Name 
monica 
Last X 
Name 
cheng 
E-Mail X 
monica.cheng@wlab.com 
Disabled Ct 
Departmer 
staff (clab) 
Page 
View All 
1 of 1 
Displaying row 1 of 1 rows 
Logout

 

No comments:

Post a Comment