1 1 00:00:00,030 --> 00:00:02,370 NAC Configuration. 2 2 00:00:02,370 --> 00:00:04,669 In the last lesson, I just briefly introduced the concept 3 3 00:00:04,669 --> 00:00:06,873 of network access control. 4 4 00:00:06,873 --> 00:00:08,754 Network access control provides the means 5 5 00:00:08,754 --> 00:00:11,587 to authenticate users and evaluate device integrity 6 6 00:00:11,587 --> 00:00:14,460 before a network connection is permitted. 7 7 00:00:14,460 --> 00:00:17,667 Now, NAC relies on something known as 802.1X. 8 8 00:00:17,667 --> 00:00:20,829 802.1X Is a standard for encapsulating EAP, 9 9 00:00:20,829 --> 00:00:23,580 which is the extensible authentication protocol, 10 10 00:00:23,580 --> 00:00:26,184 and its communications over a LAN or wireless LAN 11 11 00:00:26,184 --> 00:00:29,220 and it provides port-based authentication. 12 12 00:00:29,220 --> 00:00:30,053 Now, this brings up the concept 13 13 00:00:30,053 --> 00:00:33,300 of what is port-based authentication and port-based NAC. 14 14 00:00:33,300 --> 00:00:35,356 Now, port-based NAC is when a switch or router 15 15 00:00:35,356 --> 00:00:37,266 can perform some sort of authentication 16 16 00:00:37,266 --> 00:00:40,426 of the attached device before we activate that port. 17 17 00:00:40,426 --> 00:00:43,477 So if I just plug into a port and it has 802.1X 18 18 00:00:43,477 --> 00:00:45,936 and port-based NAC on it, and I'm not approved, 19 19 00:00:45,936 --> 00:00:48,510 it's not going to do anything, but if I am approved, 20 20 00:00:48,510 --> 00:00:50,946 it's going to go through a process and let me on the network. 21 21 00:00:50,946 --> 00:00:53,400 Let's talk a little bit about how that works. 22 22 00:00:53,400 --> 00:00:54,233 When a supplicant, 23 23 00:00:54,233 --> 00:00:56,672 which is the name for the host who's requesting access, 24 24 00:00:56,672 --> 00:00:57,966 goes onto the network, 25 25 00:00:57,966 --> 00:01:00,903 they're going to communicate using EAPOL, 26 26 00:01:00,903 --> 00:01:02,856 which is the Extensible Authentication Protocol 27 27 00:01:02,856 --> 00:01:06,016 over LAN Protocol with EAP inside of it. 28 28 00:01:06,016 --> 00:01:07,565 It's going to go to the authenticator, 29 29 00:01:07,565 --> 00:01:09,960 which is that switch that we're talking to. 30 30 00:01:09,960 --> 00:01:11,302 That switch then takes that request 31 31 00:01:11,302 --> 00:01:12,720 and sends it using a protocol 32 32 00:01:12,720 --> 00:01:15,300 over to an authentication server. 33 33 00:01:15,300 --> 00:01:16,470 Usually this uses something 34 34 00:01:16,470 --> 00:01:19,170 like radius or diameter as the protocol. 35 35 00:01:19,170 --> 00:01:20,995 Once the authenticator sends the credentials 36 36 00:01:20,995 --> 00:01:23,730 from the supplicant to the authentication server, 37 37 00:01:23,730 --> 00:01:25,096 it's going to wait for a response. 38 38 00:01:25,096 --> 00:01:27,166 If the authentication server checks their credentials 39 39 00:01:27,166 --> 00:01:29,337 and grants access or denies access, 40 40 00:01:29,337 --> 00:01:32,180 that is going to be sent back to the network access device, 41 41 00:01:32,180 --> 00:01:35,192 in this case, the authenticator or the switch in my diagram. 42 42 00:01:35,192 --> 00:01:36,822 Now, if access is granted, 43 43 00:01:36,822 --> 00:01:38,783 that supplicant then gets rerouted 44 44 00:01:38,783 --> 00:01:41,250 over to the internet or other LAN resources 45 45 00:01:41,250 --> 00:01:44,232 or the right VPN tunnel or to the appropriate VLAN, 46 46 00:01:44,232 --> 00:01:46,198 that allows them to do what they need to do. 47 47 00:01:46,198 --> 00:01:48,821 Now, if they're denied, they're put into a separate area 48 48 00:01:48,821 --> 00:01:50,692 which is basically quarantine or holding, 49 49 00:01:50,692 --> 00:01:52,928 or they can just be rejected altogether. 50 50 00:01:52,928 --> 00:01:57,000 Now, what I just showed you is the simplest form of 802.1X 51 51 00:01:57,000 --> 00:01:59,068 but we can actually use a broader NAC solution 52 52 00:01:59,068 --> 00:02:01,786 that allows administrators to devise policies or profiles 53 53 00:02:01,786 --> 00:02:04,733 describing a minimum security level configuration 54 54 00:02:04,733 --> 00:02:06,272 that all the devices must meet 55 55 00:02:06,272 --> 00:02:08,790 before being granted network access. 56 56 00:02:08,790 --> 00:02:10,295 What I just showed you was a very basic model 57 57 00:02:10,295 --> 00:02:12,253 that relied on a username and password, 58 58 00:02:12,253 --> 00:02:14,213 but if we go to a broader NAC solution, 59 59 00:02:14,213 --> 00:02:16,481 we can test for many different things. 60 60 00:02:16,481 --> 00:02:19,567 So what are some key features of a NAC solution? 61 61 00:02:19,567 --> 00:02:21,990 Well, we might have a posture assessment, 62 62 00:02:21,990 --> 00:02:23,111 we might have remediation, 63 63 00:02:23,111 --> 00:02:25,688 and we might have pre and post-admission controls. 64 64 00:02:25,688 --> 00:02:27,333 Let's talk about each of these. 65 65 00:02:27,333 --> 00:02:29,640 First, we have a posture assessment, 66 66 00:02:29,640 --> 00:02:31,363 and this is the process of assessing the endpoint 67 67 00:02:31,363 --> 00:02:33,870 for compliance with the health policy. 68 68 00:02:33,870 --> 00:02:35,400 Now, when we talk about the health policy, 69 69 00:02:35,400 --> 00:02:37,266 this is a list of things that we're going to check that device 70 70 00:02:37,266 --> 00:02:39,487 and see if it has and if it meets those things. 71 71 00:02:39,487 --> 00:02:41,561 For instance, I might check and make sure 72 72 00:02:41,561 --> 00:02:43,290 that I run up any virus scan 73 73 00:02:43,290 --> 00:02:45,073 so they're not bringing any malware into my network. 74 74 00:02:45,073 --> 00:02:47,633 I might check the firmware level or the OS patch level 75 75 00:02:47,633 --> 00:02:49,334 of that device that's tryna connect. 76 76 00:02:49,334 --> 00:02:51,351 I might check if they have a host-based firewall 77 77 00:02:51,351 --> 00:02:52,798 or host-based IDS, 78 78 00:02:52,798 --> 00:02:54,965 or that they have an up-to date antivirus definitions 79 79 00:02:54,965 --> 00:02:56,333 on that machine. 80 80 00:02:56,333 --> 00:02:57,555 I can scan their registry 81 81 00:02:57,555 --> 00:03:00,000 or perform a file signature verification. 82 82 00:03:00,000 --> 00:03:01,144 There's all sorts of things you can put 83 83 00:03:01,144 --> 00:03:02,955 as part of this health policy, 84 84 00:03:02,955 --> 00:03:04,864 but essentially, during the posture assessment 85 85 00:03:04,864 --> 00:03:07,543 when you connect to my network, I'm going to check your device 86 86 00:03:07,543 --> 00:03:09,395 and see if you meet my standards. 87 87 00:03:09,395 --> 00:03:11,286 Next, we go into remediation. 88 88 00:03:11,286 --> 00:03:13,184 Now, if you don't meet my standards, 89 89 00:03:13,184 --> 00:03:15,165 this is the process and procedures that occurs 90 90 00:03:15,165 --> 00:03:18,780 when your device doesn't meet the minimum security policy. 91 91 00:03:18,780 --> 00:03:21,480 For instance, let's say your antivirus was out of date, 92 92 00:03:21,480 --> 00:03:23,184 we might give you the latest virus definitions, 93 93 00:03:23,184 --> 00:03:25,267 run another scan, and when that passes, 94 94 00:03:25,267 --> 00:03:27,726 then we would say, "You now meet the requirements 95 95 00:03:27,726 --> 00:03:29,905 and you can go back and be admitted to my network." 96 96 00:03:29,905 --> 00:03:32,536 Next, we have pre and post-admission control. 97 97 00:03:32,536 --> 00:03:33,660 This is the point 98 98 00:03:33,660 --> 00:03:35,893 at which the client devices are granted or denied access 99 99 00:03:35,893 --> 00:03:38,400 based on their compliance with the health policy. 100 100 00:03:38,400 --> 00:03:40,514 So again, your laptop connects to my network. 101 101 00:03:40,514 --> 00:03:42,517 We look at your computer, we say, 102 102 00:03:42,517 --> 00:03:43,832 "You don't have the latest things we want." 103 103 00:03:43,832 --> 00:03:45,960 We put you into remediation. 104 104 00:03:45,960 --> 00:03:48,420 At this point, this was a pre-admission control. 105 105 00:03:48,420 --> 00:03:49,980 We said, "You don't meet our standards. 106 106 00:03:49,980 --> 00:03:51,780 Go over here and get fixed up." 107 107 00:03:51,780 --> 00:03:53,220 Then once you meet those standards 108 108 00:03:53,220 --> 00:03:55,495 and we allow you to connect, that becomes post-admission. 109 109 00:03:55,495 --> 00:03:57,390 We're going to admit you to the network 110 110 00:03:57,390 --> 00:03:58,530 and make sure you're there. 111 111 00:03:58,530 --> 00:04:00,712 Now, post-admission might be doing additional checks 112 112 00:04:00,712 --> 00:04:02,490 on you periodically. 113 113 00:04:02,490 --> 00:04:04,392 For instance, if you connect your laptop to my network, 114 114 00:04:04,392 --> 00:04:07,027 maybe every four hours, I'm going to check again and say, 115 115 00:04:07,027 --> 00:04:08,345 "Do you have the latest security updates? 116 116 00:04:08,345 --> 00:04:10,260 Do you have the latest antivirus?" 117 117 00:04:10,260 --> 00:04:12,690 And if you remain compliant, you get to stay here. 118 118 00:04:12,690 --> 00:04:13,888 If you're not, we might pull you off 119 119 00:04:13,888 --> 00:04:15,925 and put you in remediation again. 120 120 00:04:15,925 --> 00:04:18,780 All of this is going to be based on your health policy 121 121 00:04:18,780 --> 00:04:20,477 and the endpoint health policy is just one 122 122 00:04:20,477 --> 00:04:22,920 of the different rule-based methods that you can use 123 123 00:04:22,920 --> 00:04:25,140 for granting or denying access. 124 124 00:04:25,140 --> 00:04:26,501 There's more than just the health policy, though. 125 125 00:04:26,501 --> 00:04:28,748 We can do it based on other features too. 126 126 00:04:28,748 --> 00:04:32,471 For instance, I might use time-based, location-based, 127 127 00:04:32,471 --> 00:04:35,858 role-based, or rule-based methods to allow you to access 128 128 00:04:35,858 --> 00:04:38,130 or deny you access to my network. 129 129 00:04:38,130 --> 00:04:39,450 When I deal with time-based, 130 130 00:04:39,450 --> 00:04:40,605 this is going to define access periods 131 131 00:04:40,605 --> 00:04:43,890 for given hosts on using a time-based schedule. 132 132 00:04:43,890 --> 00:04:45,900 For example, you might work in a company 133 133 00:04:45,900 --> 00:04:47,448 that only operates from nine to five, 134 134 00:04:47,448 --> 00:04:49,830 and so if you try to log in at two in the morning, 135 135 00:04:49,830 --> 00:04:51,259 you could be denied access. 136 136 00:04:51,259 --> 00:04:53,100 Now, in my company, that wouldn't work 137 137 00:04:53,100 --> 00:04:55,015 because I have employees on both sides of the world, 138 138 00:04:55,015 --> 00:04:56,982 and so while I'm sleeping at two in the morning, 139 139 00:04:56,982 --> 00:04:58,394 so my employees over in Asia 140 140 00:04:58,394 --> 00:05:00,870 are actually accessing our networks, 141 141 00:05:00,870 --> 00:05:02,506 but we can make it so that they can only access 142 142 00:05:02,506 --> 00:05:03,836 during their daytime hours 143 143 00:05:03,836 --> 00:05:06,570 and we can only access during our daytime hours. 144 144 00:05:06,570 --> 00:05:07,476 That would be a method of doing that 145 145 00:05:07,476 --> 00:05:08,978 that would be time-based. 146 146 00:05:08,978 --> 00:05:10,920 We also could do this based on location, 147 147 00:05:10,920 --> 00:05:12,263 this is called location-based. 148 148 00:05:12,263 --> 00:05:14,847 Now, with location-based, we're going to evaluate the location 149 149 00:05:14,847 --> 00:05:17,914 of the endpoint requesting access using geolocation 150 150 00:05:17,914 --> 00:05:21,600 of its IP, it's GPS, or other mechanisms. 151 151 00:05:21,600 --> 00:05:22,652 For example, if I know 152 152 00:05:22,652 --> 00:05:25,143 that one of my employees always logs in from Florida 153 153 00:05:25,143 --> 00:05:27,210 but now all of a sudden their login credentials 154 154 00:05:27,210 --> 00:05:29,174 are being logged in from Italy, 155 155 00:05:29,174 --> 00:05:30,840 that would be something that will be flagged 156 156 00:05:30,840 --> 00:05:32,952 and we might put them into remediation until we figure out 157 157 00:05:32,952 --> 00:05:34,980 if they're really the right person. 158 158 00:05:34,980 --> 00:05:36,120 Maybe that person's on vacation 159 159 00:05:36,120 --> 00:05:37,950 and they are accessing from Italy, 160 160 00:05:37,950 --> 00:05:39,630 or maybe somebody's hacked their credentials 161 161 00:05:39,630 --> 00:05:41,580 and they're tryna log in as them. 162 162 00:05:41,580 --> 00:05:42,900 Both of those would be things that we could catch 163 163 00:05:42,900 --> 00:05:44,608 using location-based access. 164 164 00:05:44,608 --> 00:05:46,380 Then we have role-based. 165 165 00:05:46,380 --> 00:05:47,247 Role-based is a NAC method 166 166 00:05:47,247 --> 00:05:49,644 that reevaluates a device's authorization 167 167 00:05:49,644 --> 00:05:51,690 when it's being used to do something. 168 168 00:05:51,690 --> 00:05:53,970 This is also known as adaptive NAC. 169 169 00:05:53,970 --> 00:05:56,287 For example, if your device tries to join a subnet 170 170 00:05:56,287 --> 00:05:57,924 that's used for server management 171 171 00:05:57,924 --> 00:06:00,960 and it's on a user account and a user laptop, 172 172 00:06:00,960 --> 00:06:02,070 it's going to be rejected, 173 173 00:06:02,070 --> 00:06:03,733 but if I tried to connect a server to that domain, 174 174 00:06:03,733 --> 00:06:05,095 it would allow that to happen 175 175 00:06:05,095 --> 00:06:06,961 because that is an authorized function. 176 176 00:06:06,961 --> 00:06:09,030 And so that's the idea here with adaptive NAC, 177 177 00:06:09,030 --> 00:06:10,200 we look at the role of something 178 178 00:06:10,200 --> 00:06:11,100 and figure out if it's something 179 179 00:06:11,100 --> 00:06:12,420 that it should be allowed to do. 180 180 00:06:12,420 --> 00:06:13,900 And then the last one is a rule-based. 181 181 00:06:13,900 --> 00:06:16,899 Now, rule-based is a complex admission policy 182 182 00:06:16,899 --> 00:06:18,705 that might enforce a series of rules 183 183 00:06:18,705 --> 00:06:20,040 and we basically write these 184 184 00:06:20,040 --> 00:06:21,449 with a bunch of logical statements. 185 185 00:06:21,449 --> 00:06:23,390 If this, then this... 186 186 00:06:23,390 --> 00:06:25,110 If this and this... 187 187 00:06:25,110 --> 00:06:26,065 If this or this... 188 188 00:06:26,065 --> 00:06:30,450 So for instance, if Jason and instructor, 189 189 00:06:30,450 --> 00:06:32,014 let him in this access, 190 190 00:06:32,014 --> 00:06:35,550 if Jason and student, deny him this access, 191 191 00:06:35,550 --> 00:06:36,823 that's the idea of a rule-based. 192 192 00:06:36,823 --> 00:06:38,820 Now, that's obviously a very simple example 193 193 00:06:38,820 --> 00:06:40,110 but you get the idea. 194 194 00:06:40,110 --> 00:06:41,621 The idea here is we want to make a policy 195 195 00:06:41,621 --> 00:06:42,730 based on a series of rules 196 196 00:06:42,730 --> 00:06:45,393 and then allow or deny people based on those things.