Secure Network Access, Visibility, and Enforcement Flashcards
Allows you to enable authentication across the wired infrastructure, without affecting wired users or devices. It can be thought of as an audit mode. With the help of logging data for validation, administrators use the monitor mode to help ensure that all devices are authenticating correctly, either with 802.1X or MAB. If a device is misconfigured or is missing an 802.1X supplicant, access will be allowed and logged. However, if authentication succeeds, authorization (for example, Dynamic VLAN, Downloadable access control list (DACL)) can still be applied.
Monitor Mode
It allows selective transition from an open (nonfiltering) preauthorization method to selective preauthorization. This function is provided by static port ACLs (Pre-ACL as shown in the previous figure) that allow necessary services such as Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) while blocking all other network access. Users connected to controlled ports will receive additional access (based on policy) after successful authentication, based on DACL that will override the static ACL on the port.
Low Impact Mode
It provides the highest level of controls by configuring the closed preauthorization port control. No traffic will be permitted on a port except EAPOL before authentication and authorization.
Closed Mode
What are some forms of 802.X fallback methods?
MAB, Guest VLAN, Authentication Fail VLAN, CWA (Cisco Web Authentication) with ISE
True or False: A switch can use any Layer 2 packet including CDP, STP, DTP, and LLDP to learn a source MAC address during MAB.
False
True or False: Cisco ISE MAB authentication policy is by default configured in such a way that MAB will always succeed for the unknown MAC addresses.
True
What are the 4 802.1X host modes on a port?
Single, Multiple, Multiple Domain Authentication, Multiple Authentication
True or False: In multiple host mode, every client on the port must be authorized.
False, only the first client must authenticate, then all subsequent clients are authorized.
In MDA mode, how many MAC addresses can be learned in each domain and how many domains are there?
2 domains data/voice and 1 MAC per domain
In multi-authentication mode, what determines the group VLAN assignment?
The first host to connect.
How does critical authentication and low impact mode interact?
Low-impact mode does not work well with the inaccessible authentication bypass feature. When a RADIUS server (ISE) is not reachable, a port is put into critical state and critical VLAN is applied. The problem is that preauthentication ACL is still applied to the port in critical state, therefore limiting traffic going through the port into the critical VLAN.
Timeout = (max-reauth-req +1) * tx-period, using the default Cisco values, what is the default amount of time an endpoint without a supplicant to get access via MAB, or the Guest VLAN.
90 seconds. 30 seconds tx-period and 2 max-reauth-req
What does IP device tracking functionality do on a switch?
he purpose of IP device tracking is for the switch to obtain and maintain a list of devices that are connected to the switch via an IP address.
What global AAA settings need to be configured before you can use 802.1X?
These settings include enabling AAA new-model and configure AAA lists for 802.1X.
What global RADIUS setting need to be configured before you can use 802.1X?
Individual RADIUS servers, RADIUS server group, RADIUS attributes, RADIUS CoA
What is the purpose of the following command: authentication port-control auto
Enables port-based authentication and causes the port to begin in the unauthorized state, allowing only EAPOL frames to be sent and received through the port
What would happen without this command: authentication periodic
The host would be indefinitely autheticated
On the WLC, enabling Cisco ISE Default settings sets these parameters:
RADIUS CoA,
applies AuthC details to the accounting server,
Sets the Layer 2 security of a WLAN to WPA+WPA2.
Sets authentication key management (AKM) method to 802.1X.
Enables MAC filtering if the Layer 2 security of a WLAN is set to None.
What is the purpose of AAA override on the WLC?
This setting enables you to apply dynamic VLAN, Quality of Service (QoS), and ACLs to individual clients based on the returned RADIUS attributes from the AAA server, such as Cisco ISE.
Cisco ISE configuration for 802.1X consists of the following overall tasks:
Configure Cisco ISE digital certificates. Digital certificates on Cisco ISE are used for different purposes, for example for sever-side and client-side EAP authentication.
Configure identity sources, that are used to verify clients identity. This include configuration of local user and device accounts, and integrations with external identity sources, such as Microsoft Active Directory, or general Lightweight Directory Access Protocol (LDAP) server. Configure network devices, which act as RADIUS clients. The settings include device name, IP address, and RADIUS settings. Review authentication policy. Generally, no changes are needed in Cisco ISE default authentication policy. Configure authorization policy. Authorization policy on Cisco ISE usually needs to be customized based on your requirements.
For Cisco ISE what is the most common use case for using internal identity source in the context of 802.1X
to maintain a database of MAC addresses for MAB, or to maintain a database of guest accounts for web authentication.
Password is a mandatory parameter of an internal Cisco ISE user, which protocols don’t work with this?
EAP-TLS or Protected Extensible Authentication Protocol-Transport Layer Security (PEAP-TLS), do not use password-based authentication. The internal database does not work with these protocols.
What is the only mandatory setting for a user group?
a name
To deploy MAB using the internal Cisco ISE endpoints database, you must identify and add endpoint MAC addresses. How can you add them?
You can add endpoints manually, or by importing them from a file or an LDAP database.
