Department: STIC

Reference:

Applied License in Sciences and Technologies

of Information and Communications

Final year project:

Implementation of a NAC solution

Made by: Anouar ABDALLAH

Class: STIC L3 SR-A

Supervised by: Mr. Marouene BOUBAKRI

M. Hichem HARHIRA

Host company: Next Step IT

Academic Year: 2014-2015

 Acknowledgements

My sincere thanks go to my two supervisors, Mr. Marouene

BOUBAKRI teacher at ISET'Com and Mr. Hichem HARHIRA technical director of
NEXT STEP IT, for their availability, support, and valuable advice all the way.
length of this project.

May the members of the jury find here my deep thanks for the honor
that they made me assist in this defense.

I would also like to express my gratitude to all the engineers,

technicians and workers within the company for their pedagogy and assistance during
this internship as well as to all the staff.
« The one who takes a path in which he
seeks to acquire knowledge, Allah gives him.
it facilitates a way to paradise thanks
» to her

Abou Hourayrah
 Resume
This report is part of our final year project carried out within
the company Next Step IT, consisting of the implementation of an access control solution to
network. This solution consists of several components that operate in a way
contiguous, will allow filtering access to the network by authenticating any host requesting access and
to perform, on the authenticated host, a set of tests to check its 'health' status and the
bring into compliance with the security strategy being followed.

These objectives will be achieved through the implementation of a security platform provided by
the world leader, Cisco Systems, and integrated with a directory service (Microsoft Active
Directory) in order to ensure authentication, as well as a switch and a network controller
wireless local serving to connect users to wired and wireless networks respectively.

Abstract
This report is part of our graduation project realized within Next Step IT company,
consisting in the implementation of a network access control solution. This solution is composed
of several components, operating adjacently, allow to filter network access by authenticating any
host requesting access and to perform a series of tests in this authenticated host to check its health
status and whether it conforms with the followed security strategy.

This will be accomplished by implementing a security platform provided by the world

leader, Cisco Systems, and integrated with a directory service (Microsoft Active Directory) to
ensure authentication together with a switch and a Wireless LAN controller for connecting users
to the wired and wireless networks, respectively.
 Summary

General Introduction...........................................................................................................1

Chapitre 1 : Présentation du projet .......................................................................................2

1.1. Introduction
1.2. Presentation of the host company .......................................................................................3
1.2.1. Key figures....................................................................................................................3
1.2.2. The services offered..............................................................................................................3
1.3. Need for a NAC solution .......................................................................................................5
1.4. Contribution.................................................................................................................................5
1.5. Forecasting Project Planning .......................................................................................6
1.6. Project Management.........................................................................................................................6
1.7. Conclusion

Chapter 2: State of the Art........................................................................................................7

2.1. Introduction
2.2. The NAC solution..........................................................................................................................8
2.2.1. Operating principle ..............................................................................................8
2.2.2. Architecture
2.2.3. Comparative study of available solutions ...............................................................10
2.3. The Cisco ISE platform.........................................................................................................14
2.3.1. Definition ...........................................................................................................................14
2.3.2. Comparison between ACS and ISE
2.3.3. Operation
2.3.4. Licences
2.4. Conclusion

Chapitre 3 : Réalisation.......................................................................................................20
3.1. Introduction
3.2. Network Architecture............................................................................................................21
3.3. Installation and integration of Cisco ISE and Active Directory...............................................23
3.3.1. Installation of the domain controller (Active Directory)..........................................23
3.3.2. Installation and integration of two Cisco ISE platforms.......................................23
3.3.3. Joining the two platforms to the Active Directory controller...............................28
3.4. Configuration of the ISE
3.4.1. Authentication.................................................................................................................29
3.4.2. Posture & Client Provisioning.........................................................................................32
 3.4.3. Authorization........................................................................................................................37
3.5. Switch Configuration
3.5.1. Global Configuration .......................................................................................................39
3.5.2. Interface Configuration..............................................................................................41
3.6. WLC Configuration.............................................................................................................43
3.7. Conclusion .................................................................................................................................. 4

Chapter 4: Testing and Validation.............................................................................................49

4.1. Introduction
4.2. Wired network...............................................................................................................................50
4.3. Wireless network ............................................................................................................................
4.4. Conclusion

Conclusion and perspectives........................................................................................................59

References........................................................................................................................... 61
Glossaire..............................................................................................................................62
 List of figures

Figure 1: Company logo.....................................................................................................................3

Figure 2: Forecast Planning
Figure 3: Global architecture of a NAC solution................................................................................9
Figure 4: Architecture of a Microsoft NAP solution
Figure 5: Architecture of the Juniper UAC solution
Figure 6: Deployment of an access control solution based on ISE .........................................15
Figure 7: EAP Datagram.
Figure 8: Encapsulation of EAP messages
Figure 9: Summary of the server characteristics.................................................................21
Figure 10: Network Architecture............................................................................................................22
Figure 11: Adding DNS and Active Directory roles............................................................................23
Figure 12: Downloading the .iso image to the datastore
Figure 13: Network configuration parameters during installation...................................................25
Figure 14: Adding Active Directory Certificate Services ..............................................................25
Figure 15: Microsoft Active Directory certificate service WEB interface..............................26
Figure 16: Importing the certification authority certificate into the ISE platform.................26
Figure 17: Certificate generation by the AD certificate service.................................................26
Figure 18: Details of the generated certificate for the second node ..........................................................27
Figure 19: Registration of the secondary node
Figure 20: Adding machines to the DNS server.................................................................28
Figure 21: Joining ISE platforms to Active Directory .................................28
Figure 22: Adding platforms to the list of machines ..................................................................28
Figure 23: Adding an Active Directory user group to the ISE .................................29
Figure 24: Authentication Rules.........................................................................................................30
Figure 25: Definition of the sequence 'Use_AD_then_local'..............................................................30
Figure 26: Composite condition (example: MAB)...............................................................31
Figure 27: Authentication success when the MAC address is not found.............................31
Figure 28: RADIUS attributes of DOT1X authentication on the wired network.............................32
Figure 29: Client Provisioning Rules................................................................................................33
Figure 30: Examples of the list of NAC agents ...................................................................................33
Figure 31: List of antivirus vendors................................................................................................34
Figure 32: Fields to fill in for an antivirus condition
Figure 33: Choice of McAfee products in the antivirus condition..................................................35
Figure 34: Adding the remediation file
Figure 35: Definition of the requirement rule
Figure 36: Displaying a message with the NAC agent.................................................................36
Figure 37: Posture Rule
Figure 38: Regular Reevaluation.............................................................................................................36
Figure 39: CWA Authorization Profile......................................................................................................37
Figure 40: Authorization Rules................................................................................................................38
Figure 41: Cisco Catalyst 3650 .................................................................................................................38
Figure 42: Global commands entered at the Switch..............................................................40
Figure 43: Activation of CoA at the Switch level...
Figure 44: Activation of HTTP and HTTPS ............................................................................................40
Figure 45: Redirection ACL ..................................................................................................................41
Figure 46: Authentication methods diagram......................................................................42
Figure 47: Interface Configuration....................................................................................................43
Figure 48: Cisco 2500 Series Wireless Controller
Figure 49: Cisco Aironet 1041N
Figure 50: Access point detection at the WLC
Figure 51: Diffusion of two SSIDs .........................................................................................................44
Figure 52: Activation of MAC filtering............................................................45
Figure 53: Adding the RADIUS server to the WLC
Figure 54: Adding authentication and authorization servers ......................................................46
Figure 55: Activation of CoA
Figure 56: DHCP Configuration..............................................................................................................47
Figure 57: Security policy of the second WLAN 'PFE-NSIT2'................................................47
Figure 58: Redirection ACL
Figure 59: Adding and starting the DOT1X service
Figure 60: Activation of DOT1X on the Ethernet card...........................................................51
Figure 61: Authentication window
Figure 62: Redirection to the Client Provisioning page..................................................................52
Figure 63: Message obtained on the NAC Agent..............................................................52
Figure 64: Authentication events observed at the switch................................................53
Figure 65: Details of authentication on the GigabitEthernet1/0/23 interface................................53
Figure 66: Detection of SSIDs...............................................................................................................54
Figure 67: 802.1X Authentication for the SSID "PFE-NSIT2"....................................................54
Figure 68: Restricted access for a user of the wireless network................................................................54
Figure 69: Guest portal .............................................................................................................................55
Figure 70: Registration via the mobile version of the captive portal
Figure 71: Responsible portal interface............................................................................................56
Figure 72: Creation of a Guest account with a duration of eight hours ..................................................56
Figure 73: Posture validation with a temporary agent.................................................................57
Figure 74: Full network access.........................................................................................................57
Figure 75: Log of the ISE platform......................................................................................................58
Figure 76: Session details.................................................................................................................58
 List of tables

Table 1: Comparison ACS vs ISE

Table 2: The services of the ISE and the corresponding licenses.......................................................19
Table 3: Redirect ACL entries ..........................................................................................41
 General introduction

Network security has become an essential topic nowadays to ensure the

availability and effectiveness of resources on the network. The specification of network access is
became very important for the protection of resources against attempts at internal intrusions
or external ones, which develop new techniques day by day, or also accesses,
to high important data and very confidential information, by non-members
qualified. That is why every user or machine wanting to access the network must be
identified and undergo some compatibility tests with the network (domain integration, existence
of a well-defined antivirus on the machine that wants to authenticate itself, etc.); it will then be directed
according to its identity and the access rights that will be assigned to it towards the resources and the sub
networks to which he will have access.

This project represents the implementation of a security and network compliance solution.
which will address aspects of lack of security. This is reflected in the establishment of a mechanism
automatic authentication, when plugging in the network cable or in case of use of the
wireless network. This applies to a permanent user; whereas for a user
temporary (visitor), authentication takes place via the web portal. Once authenticated, the client
(workstation) will undergo some tests to ensure its compliance with
predefined security strategy. After conducting these tests and if the client shows any
vulnerabilities that require the installation or update of a component, it will have access
restricted providing him with the necessary updates to establish the appropriate remedies and achieve
thus a compliant and healthy state.

Also, this report describes the implementation of this solution. In its first
chapter, it will address the general framework of the project. The second chapter titled 'State of the Art' is
dedicated to the theoretical concepts related to our solution. The third chapter will detail the
installation steps and the necessary configurations of the various elements making up the solution.
In the fourth and final chapter, we will conclude with the exercise of the necessary tests aiming to
to protect ourselves from a potential malfunction.
 CHAPTER 1 :
PRESENTATION OF
PROJECT
Chapter 1 Project presentation

1.1. Introduction
In this chapter, we present the general context of the project. Also, we
Let's first present the host company and the need to deploy a NAC solution.
as well as our contribution related to the needs of the company, and we conclude with the quote from the
forecast planning and the work methodology that we will need to follow.

1.2. Presentation of the host company

In this section, we will try to present the company within which
The internship took place, recalling its key figures and the services it offers.

1.2.1. Chiffres clés

Next Step IT is a limited liability company, founded in the year 2012.

based in Tunis, Mutuelleville and employing around forty people.

Next Step IT found itself on a start-up trajectory achieving a few hundred

thousands of dinars in 2012, three million dinars in 2013 and double in 2014.

Its logo is as follows:

Figure 1: Company logo

1.2.2. The services offered

They mainly summarize into audit, study and advisory, integration, assistance.
technique and support and maintenance.
Audit

Next Step IT offers the service of auditing information systems infrastructures.

The audit services aim to establish an overview of the infrastructures.
existing computer systems in order to assess needs and highlight all aspects
necessary to optimize the environment and organization. Thus, Next Step IT supports
3 | Page
Chapter 1 Project presentation

does it consult its clients to make a strategic choice about the evolution of its information system and this
knowingly.

Study and advice

The success of a solution depends on the care taken in its design. Next Step IT studies
tailor-made solutions, adapting to the context and needs of businesses. It supports
its clients in this process:
Collection of needs
Analysis of the existing and site visits
Definition of technical specifications, features, performance, etc.
Identification of constraints, budget, and deadlines
Demonstration, setup of the model and support for testing
Assistance in drafting specifications

Integration

Next Step IT is a specialist in integrating network, system infrastructure solutions.

sécurité et communications. Elle dédie une équipe composée d’un chef de projet, d’un ingénieur
commercial and engineers and technicians for the duration of the project. The entire project team of Next
Step IT is certified by partner manufacturers. It is made up of technicians and
certified engineers who are continuously trained on its solutions and on various technologies
that pertain to his profession. All his integration projects go through a preparation phase and
planning, a design phase, an implementation and migration phase, and finally a
transfer of skills and startup assistance.

Technical assistance
Next Step IT associates the technical skill of its team with IT tools.
necessary to provide the appropriate and high value-added technical assistance to its clients.
The professionalism and expertise of Next Step IT guarantee its clients:
Reactivity: the teams intervene directly where desired, according to the
customer constraints:
Efficiency: the technicians find the most appropriate solution in the best
deadlines
Transparency: its interventions are subject to reports and transfer of authority.
Know-how: the client's problem is handled by a qualified team,
experienced and certified

4 | Page
Chapter 1 Project presentation

Support and maintenance

The effectiveness of the support center that assists the client in the maintenance of their
network solutions guarantee the rapid resolution of incidents and the control of developments of the
solution. This efficiency results from the speed of processing the request and the
competence of the interveners handling the request

1.3. Need for a NAC solution

Every computer network, especially a corporate network, should remain healthy.

Each administrator is supposed to authenticate, authorize, evaluate, and correct the equipment.
wired, wireless, and remote, before granting their users access to the network.
Also, the manager must recognize the users, their devices, and their roles on the
network. This first step occurs at the authentication phase, before that
potential malicious code could damage the system.
In a second step, network security requires verifying compliance with
machines with security policies. These policies depend on the type of user, the type
equipment or operating system. In case of non-compliance, reactions may occur
result: blockage, isolation, and repair.
The deployment of a NAC (Network Admission Control or Network Access)
Control) will allow the administrator to benefit from all of these functions in one way
more efficient and more effective.

1.4. Contribution

The management and administration of a NAC solution are carried out in a centralized manner.
The core of any similar solution is the decision point or platform in which they are
define the security policies to be applied towards the client.
Cisco Systems, the global leader in network solutions, has a range of products
serving to implement the NAC solution. Its new policy aims to adopt the platform
ISE (or Identity Services Engine). However, the information available on its implementation
and its configuration is limited since it is recent.
The realization of this project is therefore an opportunity to experiment with this platform.
forms and may be an opportunity to address potential technical obstacles that may
to be encountered during the deployment; moreover, the same solutions will be deployed in the future,
by Next Step IT, with its clients.

5 | Page
Chapter 1 Project presentation

1.5. Project forecasting planning

The following Gantt chart reproduces the projected planning defined for
the implementation of the NAC solution and the writing of the associated report.

February Mars April May June

Research and
documentation
Preparation of
the environment
Drafting of
report
Realization of a
test scenario
Preparation
from the solution

Figure 2: Forecast Planning

1.6. Project Management

During the discussion with the company representative, it turned out that the services were
realize, which are integrated into the NAC solution, depend on the available features
in the ISE platform and the needs of Next Step IT clients. Therefore, our implementation of
the place may undergo numerous modifications depending on progress.
Par ailleurs, nous avons opté pour une gestion de projet Agile, méthode plutôt adoptée
in software developments and more specifically the SCRUM method. Its main
the characteristics are:
Transparency: a common language must allow any observer to obtain
quickly a good understanding of the project.
Inspection: at regular intervals, Scrum suggests taking stock of the different
modifications made, in order to detect any undesirable variation.
The adaptation: if a drift is observed during the inspection, the process will then have to
to be adapted.

1.7. Conclusion
In the above, we addressed the general context of our project and more
precisely the production environment and the management that follows. As well as the accuracy of
Project objectives through a forecast planning allowed us to ensure the smooth
conduct and ensure compliance with deadlines.
6 | Page
CHAPTER 2:
STATE OF THE ART
Chapter 2 State of the art

2.1. Introduction
Notre projet consistant à implémenter une solution NAC à base de la plate-forme Cisco
Thus, this chapter will be an opportunity to highlight the details of this solution and
particularly the ISE platform in order to better understand the implementation part that will be
dealt with later.

2.2. The NAC solution

In this section, it is useful, on the one hand, to recall the principle of operation of the
solution NAC and its overall architecture, and on the other hand, to study certain available solutions.

2.2.1. Operating Principle

Network access control (or NAC) is a term that encompasses various technologies.
developed to control/restrict access to the network by endpoint systems based on
of their "health status." The basic idea is that dangerous or vulnerable endpoint systems
("in poor health") should not communicate on the company's network insofar as
where they could introduce a security risk to critical processes and services. A
The NAC solution will prevent an unhealthy endpoint from accessing the system normally.
network until the health of this system is ensured.
The health assessment of a device connected to the network is also called "evaluation".
the end system. End systems can notably include PCs,
printers, IP phones, traditional IP security cameras, etc. This assessment
must allow to discover the acceptable level of vulnerability or threat of a system
at the end. Elements such as the level of security patch, the presence of solutions
antivirus/malicious code removal, updates for antivirus/malicious code signatures,
running applications and open ports can all be scanned in order to
determine the overall health status of the end system.
After executing the evaluation and authorization process of the end system, if
it turns out that the latter does not comply with the network security policies, we can grant him
restricted access or to put it in network quarantine. The application process of
quarantine policies involve very network communication policies
granular, that is to say based on flows and not a simple assignment to a VLAN. Indeed,
group all "unhealthy" end systems within the same VLAN of
quarantine means letting them infect each other with new vulnerabilities. The

8 | Page
Chapter 2 State of the art

network policies describe how incoming traffic on switch ports must

to be processed at the filtering and tagging level.
As part of an NAC solution, remediation involves resolving a problem.
in compliance with certain predefined policies. This remediation process allows for
The user placed in quarantine needs to regain their compliance. It is important that they
be involved in the remediation process to optimize the performance of processes
profession. (Enterasys Secure Networks, 2007)

2.2.2. Architecture

The implementation of a NAC solution requires the existence of a set of

components. The diagram below shows all of these elements and the flow of
communication exchanged :

Figure 3: Global architecture of a NAC solution

•Devices trying to access the network or 'Agents' (A): includes the

mobile laptops or those that connect only rarely, guest users
or visitors as well as regular network users trying to access the network
of the company.
•Network access control peripheral (B): from the perspective of the
requesting device, the network access device operates as
network device of "first hop" that initiates the Posture Validation process and the
authentication process.
Posture Validation Server (network access decision point) (C): server in
dedicated background, also known as "Posture Validation Server", which evaluates the references.

9 | Page
Chapter 2 State of the art

Authentication posture (status of devices that require access) based on

compliance rules.
Enterprise servers (D): critical zone of the network and the NAC solution
protects from unhealthy, infected, or vulnerable devices.
Quarantine VLAN (E): a virtual protected network area in which the
devices can be secured and patched, re-analyzed, then they gain access
Complete to the corporate network, or kept with restricted access to resources.
of a network such as the Internet. (LANDESK, 2013)

2.2.3. Comparative study of the available solutions

Several NAC solutions are available. They can be classified under two
main categories: commercial and free.
The business solutions

Many solutions exist on the market. The following three manufacturers are the
dominants: Cisco, Microsoft, and Juniper. The CISCO solution is discussed in more detail given
which is used in the execution of this project, while the other two will be mentioned
briefly.

Solution Cisco
The Cisco range can be defined by the following characteristics:
Integration of authentication with single sign-on

Cisco NAC acts as an authentication proxy for most forms

authentication, as it natively integrates Kerberos, LDAP (Lightweight Directory
Access Protocol), RADIUS, Active Directory and many other solutions as well. In order to
minimize the inconvenience for end users, Cisco NAC supports single sign-on
for VPN clients, wireless clients, and Active Directory Windows domains. The control
Role-based access allows the administrator to manage multiple user profiles with
different permission levels.

Vulnerability assessment

Cisco NAC supports the analysis of all Windows operating systems, Mac OS,
Linux machines and network equipment other than PCs (game consoles, PDAs,
printers, IP phones, etc.). It performs a network analysis and can, if necessary, use
custom analysis tools. Cisco NAC can check any application identified by
its registry keys, the services executed or the system files.

10 | Page
Chapter 2 State of the art

Quarantine

Cisco NAC can place non-compliant machines in quarantine to prevent the

propagation of infections while providing access to remediation resources.
quarantine can be implemented on a small subnet (type /30) or on a VLAN of
quarantine.

Automated security policy updates

The automatic updates of security policies provided by Cisco as part of

the standard software maintenance service allows for obtaining predefined policies for
the most common network access criteria, including the policies that check for updates
critics of the operating system such as antivirus signatures and anti-spyware.
main products of the market. This function reduces management costs for the administrator
network that can allow the Cisco NAC server to ensure the continuous update of
security policies.

Centralized management

The Cisco NAC web management console allows the administrator to define the types
of analysis required for each role as well as the necessary remediation tools.
"repairs". The same management console can manage several servers.

Remediation and repair

Quarantine features give devices access to servers of

remediation that can provide them with patches and operating system updates,
virus definition files or endpoint security solutions such as
Cisco Security Agent. The administrator can enable automatic remediations through
the Cisco NAC Agent option, initiate the automatic launch of Windows updates or
provide a list of web pages containing remediation instructions. (Cisco Systems, 2006)

Solution Microsoft

Network Access Protection (NAP) is a set of system components

exploitation included in Windows Server 2008, 2012 and Windows Vista systems; this
the ensemble serves as a platform to ensure that client computers in a
Private networks meet the requirements set by the administrator regarding system integrity.
NAP strategies define the configuration and update state of the operating system.
and critical software of a client computer.

11 | Page
Chapter 2 State of the art

The deployments of NAP technology require servers equipped with Windows Server.
2008 ou 2012. De plus, cela suppose que des ordinateurs clients, exécutant Windows XP,
Windows Vista, Windows 7 or Windows 8, should be available.
The central server responsible for the integrity determination analysis for the technology
NAP is a computer equipped with Windows Server 2008 or 2012 and an NPS (Network Policy Server).
Policy Server). NPS is the Windows implementation of the RADIUS (Remote Authentication Dial-In User Service) server and proxy.

Authentication Dial-In User Service). The NPS replaces the Internet authentication service.
(IAS or Internet Authentication Service) in the Windows Server 2003 operating system.
Access devices and NAP servers perform the function of RADIUS clients
for an NPS RADIUS server. NPS performs an authentication and authorization attempt
of a network connection and, depending on integrity control strategies, determines the
compliance of computer integrity and how to restrict network access of a
non-compliant computer. (Microsoft, 2008)

Figure 4: Architecture of a Microsoft NAP solution

Juniper Solution

The Juniper or Unified Access Control (UAC) solution is based on standards of

the industry, including 802.1X, RADIUS, IPsec, and TNC's IF-MAP, which enable
the integration of the UAC solution with any third-party security and network equipment.
It combines user identity, device security status and the
information on network location to create an access control strategy,

12 | Page
Chapter 2 État de l'art

unique for each user (who does what and when?). The solution can be activated in layer 2
using the 802.1X protocol, or at layer 3 through an overlay network deployment. UAC
2.0 can also be implemented in a mixed mode that uses the 802.1X protocol for
monitor admissions on the network and layer 3 to control access to resources.
The UAC solution includes Junos Pulse, Junos Pulse Access Control Service, the
Junos Pulse MAG Series gateways, the unified access control equipment IC Series, as well
that points of implementation of Unified Access Control (UAC) including all the
switches or 802.1X access points compliant with the IF-MAP protocol of the architecture
Trusted Network Connect (TNC).
Among these devices are, for example, the EX Series switches, the points
access for WLA Series local network and SRX Series gateways. (Juniper Networks, 2011)

The following figure presents an example of architecture for a UAC solution:

Figure 5: Architecture of the Juniper UAC solution

Free solutions

Several open-source solutions exist. The most widespread are FreeNAC and PacketFence.

FreeNAC

The FreeNAC solution performs authentication through two modes:

• VMPS mode: the machines on the network are identified by their MAC address.
users are not authenticated in this mode.
• Mode 802.1x: devices on the network can be authenticated by certificate and
Windows domain users by their account.

13 | Page
Chapter 2 State of the art

The assignment of a VLAN is based on a machine's MAC address. In VMPS mode,

l'authentification et l'attribution ont lieu en une seule étape. En mode 802.1x, l'authentification
of users (in the Windows domain), or that of machines (by certificate), takes place in
first, and only afterwards is the MAC address used for VLAN assignment.
(FreeNAC)

PacketFence

PacketFence is a network compliance solution (NAC, Network Access Control)

completely free, supported, and recognized. It provides an impressive list of
features such as:
The recording of network components through a powerful captive portal
The automatic blocking, if desired, of unwanted devices such as products
Apple and Sony, wireless terminals and others
The halt of the spread of worms and viruses
The prevention of attacks on servers or various components of the network
The verification of the compliance of the devices present on the network (installed software,
specific configurations, etc.)
The simple and efficient management of guests connecting to the network
User authentication referencing the 802.1X standard
Level-2 isolation of problematic components
The integration of Snort intrusion detectors and Nessus vulnerabilities (Marcotte,
2013)

2.3. The Cisco ISE platform

In the following, we will define the Cisco ISE platform, compare it with its
predecessor ACS and emphasize the main standards it refers to for
function and we end up mentioning the required licenses to benefit from its services.

2.3.1. Definition

Identity Services Engine (ISE) is the latest generation of control platforms.

access offered by Cisco that allows companies to enforce their security policies
during access, to strengthen the security of their infrastructures and to streamline their operations
of services.
The unique architecture of Cisco ISE allows businesses to collect information
regarding users and devices, in real time from the network. The administrator

14 | Page
Chapter 2 State of the art

can then use this information to make proactive governance decisions in

linking identity to various elements of the network, including switches, network controllers
wireless local (WLC) and virtual private network (VPN) gateways.
The following diagram shows an example of the deployment of the ISE within the network:

Figure 6: Deployment of an access control solution based on ISE

The ISE platform can be considered as an access control system.

consolidated, based on rules and integrating a superset of features available in the
existing platforms. Among its characteristics, we can mention:

Provides support for discovery, profiling, placement-based

rules and monitoring of endpoint devices on the network.
Combine authentication, authorization, traceability (AAA: authentication,
authorization, accounting), posture assessment and profiling into a single application.
Supports the scalability needed to accommodate a number of scenarios
deployment, from the small office to large enterprise environments.

2.3.2. Comparison between ACS and ISE

The ACS or Secure Access Control System is the predecessor of the ISE. The following table
presents a comparison between the two:
Cisco ACS Cisco ISE
Support du protocole d'authentification
Yes Non
TACACS+ and its services
Authorization and authentication of
Yes Yes
machines and users
Integrated profiling No Yes
Integrated "Guest" services No Yes
Security Group Access (SGA) Yes Yes

Table 1: Comparison ACS vs ISE

15 | Page
Chapter 2 State of the art

2.3.3. Operation

During the authentication phase and to communicate with the client or their machine, the
The ISE platform calls upon a set of standards and protocols. These are mainly:
802.1X, EAP and RADIUS.

802.1X

802.1X is a standard that defines an authentication mechanism for access to

network. 802.1X can be compared to the PPP protocol, widely spread and necessary for a
Internet access using a modem. The PPP protocol relies on an embedded mechanism,
responsible for authentication and for which two sub-protocols were offered as options: PAP
and CHAP. Schematically, we could write:
Internet Access = modem + PPP + (PAP or CHAP) + TCP/IP.
In case 802.1X is used on equipment such as the switch,
The user connecting their computer to the network (wired or wireless) is required to authenticate first.
to start any activity. At the end of the authentication process and in case of success, the client
receives a network profile (TCP/IP and VLAN) as well as a set of security rules.5
The 802.1X standard involves three entities:
The client or "supplicant" which is typically a PC
The authenticator (Switch, WLC)
The authentication server or "authentication server" which is a RADIUS server.
802.1x is based on EAP (Extensible Authentication Protocol) which provides a means
to transport an authentication protocol. (Vincent REMAZEILLES, 2009)

EAP (Extensible Authentication Protocol)

The need for compatibility with diverse authentication infrastructures and the
the necessity of having shared secrets in multiple environments has led to the
genesis of the EAP protocol, capable of transporting authentication methods
regardless of their particularities.
The EAP protocol provides a simple framework for transporting protocols
authentication. A message consists of a 5-byte header and optional data,
as illustrated in the figure that follows.

16 | Page
Chapter 2 State of the art

Figure 7: EAP Datagram

The EAP protocol is extensible since any authentication mechanism can be

encapsulated within EAP messages. At the higher level are the methods
authentication, such as TLS, MSChap, SIM, etc. The EAP frame itself is encapsulated
in a transport frame. This encapsulation can be done either in an EAP over frame
Radius, that is to say in a RADIUS frame, either in an EAPoL frame (EAP over LAN) which
is used in local networks, particularly in wireless local area networks of the Wi-Fi type.
(Pujolle, 2008)

RADIUS (Remote Authentication Dial-In User Server)

Whatever the choice of the authentication mechanism between the access point and the server
For authentication, EAP packets are usually routed using the RADIUS protocol.
RADIUS has long been the AAA (Authentication, Authorization, Accounting) protocol.
the most widely adopted. Used by ISPs to authenticate users, it is mainly
designed to transport authentication, authorization, and billing data between
Distributed NAS (Network Access Server) that wish to authenticate their users and a server
shared authentication.
RADIUS uses a client-server architecture that relies on the UDP protocol.
NAS, which act as clients, are responsible for the transfer of information sent by
the user to the RADIUS servers. The latter support the reception of
authentication requests, user authentication, and responses containing all
the necessary configuration information for NAS. RADIUS servers can
also act as a proxy for other RADIUS servers.
If a mobile device needs to access the network using RADIUS to
authentication, he must present authentication credentials (username,
password, etc.). The latter sends them to the RADIUS server by sending an ACCESS-
REQUEST. The NAS and RADIUS proxies cannot interpret these authentication credits.
because they are encrypted between the user and the destination RADIUS server. Upon receipt
17 | Page
Chapter 2 State of the art

From this request, the RADIUS server checks the NAS identifier and then the authentication credits.
of the user in an LDAP (Lightweight Directory Access Protocol) database or
other.
The authorization data exchanged between the client (the NAS) and the RADIUS server is
always accompanied by a shared secret. This secret is used to verify authenticity and
the integrity of each packet between the NAS and the server. (Pujolle, 2008)

802.1X - EAP - RADIUS

EAP messages carry the authentication exchanges between the client and the server.
authentication. The Switch only relays them, however, on either side of the Switch, the
EAP messages are not transmitted in the same way. Between the client and the Switch, EAP is
directly in the payload of the Ethernet frames. Between the Switch and the RADIUS server,
EAP is transported in RADIUS messages. The following figure explains the two.
encapsulations :

Figure 8: Encapsulation of EAP messages

2.3.4. Licences

The licensing strategy adopted by Cisco aims to minimize the number of licenses to
order by combining the different services. Currently, four ISE license packages
CISCO are available: Base, Advanced, Plus, and Wireless. The evaluation license is included.
in the ISE platform, offering all services for a duration of three months. The license for
the commander remains valid for one, three or five years. The table below shows the different
services and the corresponding licenses.

18 | Page
Chapter 2 State of the art

Cisco ISE Services Licenses

RADIUS services including dot1x and MAB Base - Wireless
Web Authentication Base - Wireless
MACsec Base - Wireless
Guest Portal & Sponsor Services Base - Wireless
Posture Advanced - Wireless
Security Group Access Plus - Advanced - Wireless
Endpoint protection services Plus - Advanced - Wireless
Mobile Device Management (MDM) Advanced - Wireless
Device registration via portal Plus - Advanced - Wireless
Profiling Plus - Advanced - Wireless
Profiler feed service Plus - Advanced - Wireless
External RESTful services Base - Wireless

Table 2: The services of the ISE and the corresponding licenses

2.4. Conclusion

In this present chapter, we have tried to highlight the principle of

operation of any NAC solution, its overall architecture as well as the different
available solutions; however, we focused on a particular solution
proposed by Cisco Systems, namely the ISE platform.

The establishment of this platform and the definition of security policies depend
de l'architecture et de la nature du réseau à protéger, tels que type d’ utilisateurs, équipements
deployed and existing subnets.

19 | Page
CHAPITRE 3 :
ACCOMPLISHMENT
Chapter 3 Achievement

3.1. Introduction
After completing the theoretical concepts, we move on to the implementation of our
solution, which represents our main task. In this chapter, we will
we will focus on the different configurations required to ensure access control of the
wired and wireless network users. This essentially amounts to configuring the platform.
ISE, the switch as well as the wireless network controller or the WLC.

3.2. Network Architecture

In order to implement our solution, we need, on one hand, two pieces of equipment and
on the other hand, of four virtual machines.

The required equipment is:

A switch
An access point

The required virtual machines will be used to install:

A domain controller
Two Cisco ISE platforms
A wireless local area network controller (WLC)

The installation of the virtual machines took place on the company's server, which is
equipped with the following features:

Figure 9: Summary of the server characteristics

21 | Page
Chapter 3 Realization

Their deployment takes place within the company's existing network. Therefore, the
address selection is linked to the available addressing plan; the addresses to be used must
belonging to the network [Link] and having the mask [Link].

The figure below explains the architecture followed.

Figure 10: Network architecture

22 | Page
Chapter 3 Realization

3.3. Installation and integration of Cisco ISE and Active Directory

Before starting the configuration of the three main elements of our solution, we
we should go through the preparation of the area where the solution will be deployed. This consists of
essentially to:
Install the domain controller.
Install and integrate two ISE platforms.
Join the two platforms to the controller.
3.3.1. Installation of the domain controller (Active Directory)

Active Directory is a directory service, or domain controller, that allows for

referencing and organizing objects such as user accounts or permissions and
with the help of domain groups. Information can thus be centralized in a
reference directory to facilitate network administration.
The domain represents the basic unit tasked with grouping objects that share a
same namespace. Therefore, our domain relies on a DNS system.
The DNS server and the Active Directory controller are two roles to add to Windows.
Server.

Figure 11: Adding DNS and Active Directory roles

The domain name we have chosen is: [Link] (abbreviation of the name of
the company: Next Step IT

3.3.2. Installation and integration of two Cisco ISE platforms

The installation of the ISE took place on one of the company's servers.
VMware ESXi hypervisor. We access it using VMware vSphere Client.

23 | Page
Chapter 3 Achievement

First of all, we need to download the .iso image from the database.
the server's datastore.

Figure 12: Downloading the .iso image to the datastore

The ISE platform requires a virtual machine with at least the following specifications
following:
4 GB of RAM
200 GB disk memory
4 processors (CPUs)
Two network cards (2 NIC)

Upon the first startup of the machine, certain data was entered for
start the installation, among which we can mention:
ise-cisco2: name of the machine which will be added later to the DNS and
Active Directory
[Link] : private IP address of the machine
[Link] : subnet mask
[Link] : default gateway
[Link]: domain name that we have chosen
[Link]: IP address of the NTP (Network Time Protocol) server allowing for
synchronize the platform clock. An NTP server has been installed on Windows
Server and on which the ISE points.

24 | Page
Chapter 3 Achievement

Figure 13: Network configuration parameters during installation

The machine containing the ISE platform is called a "node". It can operate according to
two modes:
Standalone: deployment of a single platform providing various services
Primary-secondary: distributed deployment, allowing for the separation of services and the
failover between the two nodes.

To ensure high availability, we have opted for the implementation of two

ISE platforms. Their integration requires mutual authentication based on the
certificates: each one has its own certificate, which must be generated by the authority of
certification (Certificate Authority). In our case, the authority is represented by the controller of
domain. The generation of the certificate is provided by the Active Directory certificate service.

Figure 14: Adding Active Directory Certificate Services

This service is accessible via a WEB interface at the following address:

[Link] [Link] represents the Windows server address.
The following screenshot shows the web interface of the service.

25 | Page
Chapter 3 Realization

Figure 15: WEB interface of the Microsoft Active Directory certificate service

The addition of the certification authority certificate is done manually. We have it.
downloaded from the Web interface and attached to the platforms to ensure recognition
of the two certificates.

Figure 16: Importing the certification authority certificate into the ISE platform

The next step is to generate the certificate requests 'Certificate Request' to

starting from the ISE in order to process them at the level of the Active Directory certificates service. The file of
The request is then opened with a text editor and its content is pasted into the service.
appropriate. The certificate template to choose is 'Web Server'.

Figure 17: Certificate generation by the AD certificates service

26 | Page
Chapter 3 Realization

Figure 18: Details of the certificate generated for the second node

After adding each certificate to the corresponding platform, we are at

even to integrate them. The registration of the secondary platform at the primary level
requires the specification of its FQDN ([Link]) and authentication data
the administrator. It should be noted that the integration of the two platforms requires compliance
clock (NTP).

Figure 19: Secondary node registration

The node can provide one or more of the following services:

Administration: allows you to manipulate system configurations related to
features such as authentication and authorization.
Monitoring provides logging services and troubleshooting tools.
advanced troubleshooting
Policy Service: provides access to the network, validation of
posture, guest access, client provisioning, and profiling services.

In a deployment ensuring high availability, the primary administrative node is the

only active node, on which all changes are made. The secondary node is in state
in 'standby' mode and continuously receives the configuration from the main node.

27 | Page
Chapter 3 Realization

Consequently, it always has a complete copy of the configuration. In case the node
the primary has become out of service, the manager must connect to the node's interface
secondary and promote it to be able to configure the rules.

3.3.3. Joining the two platforms to the Active Directory controller

The integration of the controller with the ISE platform will be useful during the phase
authentication. Indeed, authentication can be carried out from an external source and
this is based on user accounts and their respective groups.
The platform must be recognized by the controller as a machine.
Its FQDN ([Link]) must also be resolved. This leads us to add a host to the
DNS server level, otherwise an alert will be displayed on the platform.

Figure 20: Adding machines to the DNS server

The join request requires the entry of the administrator account details.
domain or those of an account having permissions to add machines and access the list of
groups and users.

Figure 21: Joining ISE platforms to Active Directory

Once the connection is successful, and by consulting the list of existing machines on the
controller, we can see that the machine on which Cisco ISE is installed is
automatically added.

Figure 22: Adding platforms to the list of machines

28 | Page
Chapter 3 Realization

After joining Active Directory, we need to import the groups

allowing to authenticate domain users and serving to assign the authorization profile
suitable for each user. To display the groups we need, you must type their
names, otherwise you need to type '*' to list existing groups. The following figure shows
the importation of the group 'Domain Users'.

Figure 23: Adding an Active Directory user group to the ISE

3.4. Configuration of the ISE

The configuration of the ISE mainly consists of setting up the policies.
of authentication, 'Client Provisioning' and posture and authorization.
3.4.1. Authentication

The authentication policies to be defined at the ISE level serve to identify the
different users or machines requesting access to the network and doing so based on a
set of protocols such as Password Authentication Protocol (PAP), Challenge-Handshake
Authentication Protocol (CHAP), Extensible Authentication Protocol (EAP) and Protected
Extensible Authentication Protocol (PEAP). When adding the rule, we need to choose the
protocols allowed for such an authentication method and the source of identities
Store).
The sources that can be used are as follows:
Internal users
Guest users (user group defined on the platform)
Internal terminals
Active Directory
LDAP databases
RADIUS Token Server

29 | Page
Chapter 3 Achievement

Three authentication methods are supported by the ISE:

802.1X (discussed in the previous chapter)
MAC Authentication Bypass (MAB): certain devices, such as the printer
network and IP phone do not support 802.1X authentication. In this case,
it can be carried out by referring to the MAC address
Web authentication via a captive portal

The authentication rules that were defined were limited to the first two.
methods. The first rule verifies the existence of the MAC addresses of the devices.
in the internal list. This rule will also be useful for the third method, which is postponed to
the authorization phase. The second rule serves to authenticate user accounts, first
place from the Active Directory controller, then from the internal list. On failure
authentication for a domain user, the second rule provides the ability to test
with a local user. This will allow us to better locate the failure; it could be
an integration error with Active Directory or an authentication error
referring to the field.

Figure 24: Authentication Rules

In order to allow more than one authentication source for a single rule, it was necessary to
add an identity source sequence or "Identity Source Sequence" to verify
the identities by consulting the sources in order. The following figure shows the defined sequence:

Figure 25: Definition of the sequence 'Use_AD_then_local'

30 | Page
Chapter 3 Realization

It is possible to define rules with simple or compound conditions. A

A simple condition is based on an operand, an operator such as 'equal to' and 'not equal to'.
as well as a value. These conditions can be defined at the library level and called
directly at the time of defining the rule for better organization. A condition
composed brings together two simple conditions or more with an OR or AND operator. The figure
The following shows the gathering of two existing conditions in the library with a
OR operator for the rule 'MAB'.

Figure 26: Composite condition (example: MAB)

Once authentication is successful, the session moves on to the authorization phase.

The options offered by the ISE allow for verification of compliance with authorization policies.
even in case of authentication failure. These options are essential for functioning
web authentication. MAB authentication will be considered successful even if the address
The MAC of the machine is not found. This is achievable by changing the action to 'Continue' for
the option "If user not found", as shown in the following figure.

Figure 27: Authentication success when the MAC address is not found

The definition of the rules rests on the attributes of the RADIUS protocol. The attributes
constitute the most important principle of the Radius protocol, both in its initial version
that for its extensions. The attribute fields are the foundation of the protocol. Therefore, the
a good understanding of their meaning and role is essential to get the best out of them
radius party. Each attribute has an appropriate number, to which a name is associated. It
There are a large number of attributes in the Radius protocol, but few of them are useful.

31 | Page
Chapter 3 Realization

in the case that concerns us here:

User-Name :cet attribut est envoyé par le NAS et contient l’identifiant qui va servir de
entry point into the authentication server database
User-Password: this is the password associated with User-Name, transmitted by the NAS.
the authentication server validates this password based on the value stored in
its database
NAS-Port: this is the port number of the NAS to which the workstation is connected
work. This attribute is transmitted by the NAS. Its use will allow to authenticate a
workstation provided it is connected via this port number. In the case of a
switch, it is the physical port to which the workstation is connected.
Service-Type :indique le type de service demandé ou le type de service à fournir. Pour
a use with the 802.1X standard, only the Framed, Authenticate Only values
and Call check makes sense.
For example, the predefined condition 'Wired_802.1X' assigns the following values
to the Service-Type and NAS-Port attributes:

Figure 28: RADIUS attributes of DOT1X authentication on the wired network

3.4.2. Posture & Client Provisioning

The posture services provided by Cisco ISE allow for the verification of availability of the
latest updates on the client's machine or the existence of certain applications
such as antivirus and anti-spyware. To assess the machine, the client must have one
of these two Agents:
Cisco NAC Web Agent: a temporary agent that clients install during login and
which disappears once the login session is finished. It is recommended for users
having access for a specific period.
Cisco NAC Agent: a persistent agent that, once installed, remains on a machine
Windows or Mac to allow evaluation during the next connections. It is
generally used with domain users.

32 | Page
Chapter 3 Achievement

Moreover, these agents can facilitate the remediation of machines by displaying a

message explaining the procedure and providing files to download and install. The platform-
ISE form allows redirecting clients to a page for downloading agents.
for those who do not have it thanks to an option to configure at the profile level
of authorization. This service is called 'Client Provisioning'. The figure that follows outlines the rules
From "Client Provisioning" defined: the first provides the temporary agent "Web Agent" to guests.
"Guests", while the second provides the persistent agent to other users who are
mainly the members of the domain. It should be noted that the order of the rules is crucial
to ensure a good assignment. For example, by reversing the order, all users
they will download the persistent agent and the second rule will never be applied.

Figure 29: Client Provisioning Rules

In order to choose the appropriate agent, we had to download it directly onto the
platform and this from the Cisco site. Therefore, the domain name [Link] must be
resolved from the ISE. The following list presents multiple versions of the two types of agents
NAC, temporary and persistent.

Figure 30: Examples of the NAC agents list

After providing the agents for posture assessment to clients, we need to

proceed to the phase of defining posture rules. A rule is written as:
Second conditional or exigency
Also, a requirement can be broken down as follows:
Second condition then remediation action

33 | Page
Chapter 3 Realization

In a requirement rule, a simple condition can be:

a file: check the existence of a file, the date of the file as well as its version
a registry: to ensure the existence of a registry key or the value of the key
an application: check if an application is running
a service: check if a service is running

We can also form a composite condition based on simple conditions or

composed. In addition, integrated composed conditions with the ISE exist: Antivirus and
Antispywares. When adding an antivirus condition and after choosing the system
From the exploitation, the list of vendors is displayed:

Figure 31: List of antivirus vendors

For such a condition, Cisco ISE provides the ability to examine the machine for
check the existence of antivirus or even the availability of a recent version. This is achievable.
by analyzing the version definition file by the NAC Agents. Consequently, the
Versions recognized by the ISE must be continuously updated.

Figure 32: Fields to fill in for an antivirus condition

34 | Page
Chapter 3 Realization

As the company Next Step IT is a reseller of Mcafee products, we have opted

for the use of this seller in the definition of the rule. Any user requesting access to
the network must have a version of the Mcafee antivirus.

Figure 33: Choice of Mcafee products in antivirus condition

After defining the antivirus condition, we need to choose the remediation action.
Is it possible to allow access to specific IP addresses used for downloading and updating?
day the antivirus such as the official McAfee site and this during the declaration of the access list
(ACL), or to offer the executable file directly. In our case, we imported the
installation file of the antivirus on the platform so that it can be downloaded directly.

Figure 34: Adding the remediation file

As the antivirus condition and remediation action have been added, it is possible
to define the rule of requirement or "requirement". This rule will be useful during the definition of the
posture rule.

35 | Page
Chapter 3 Realization

Figure 35: Definition of the requirement rule

With the remediation file, we have the ability to display a message explaining
the procedure and the cause of non-conformity. In our case, the following message will be displayed:

Figure 36: Displaying a message with the NAC agent

The defined posture rule requires the deployment of McAfee antivirus for all
Windows environment users by making use of the one that has just been declared and
named "Mcafee".

Figure 37: Posture rule

After gaining access, a client can uninstall their antivirus or in another way,
divert the set rule. This forces us to periodically recheck the machine. In our
We have applied a regular one-hour reassessment as described in the figure.
next.

Figure 38: Regular reassessment

36 | Page
Chapter 3 Completion

3.4.3. Authorization

The authorization policies to be defined implement the policies.

of authentication and posture; these policies are declared as being conditions. On the
Based on these conditions, the user will have the appropriate authorization. To summarize, a rule
Authorization is written:
Conditions (attributes or user groups) then permissions (profile
of authorization).

In our case, we need authentication and posture attributes as well as

des groupes d'utilisateurs. Afin de vérifier l'état de la machine par rapport à la règle de posture,
we use the attribute 'PostureStatus'. This attribute can have three values:
Unknown: no data has been obtained to evaluate the machine; the NAC agent is
not available
Noncompliant: the machine does not comply with one or more rules.
Compliant: the machine is in accordance with the rules

In order to verify the identity of the domain user, we use the attribute
ExternalGroups
Users registered on the captive portal are directly assigned to a group.
of the user named "Guest", which can be exploited when adding the rule.
Before adding a rule, we need to create the associated authorization profile. In a
such as assignment to a VLAN,
Redirection to a URL (web authentication portal, client provisioning portal, URL
external, etc.), based on an access control list, and even the application of an ACL on the port
the switch.
As an example, we created the CWA authorization profile to redirect
users to the captive portal by referring to the access list defined at the WLC level and
Switch and which we will explore later.

Figure 39: CWA authorization profile

37 | Page
Chapter 3 Achievement

After completing the creation of the profiles, we can define the rules. These rules
allow access to authenticated users in the domain or via the Web portal and having
machines conforming to posture rules. A domain user without the agent
NAC or non-compliant with posture policies is redirected to the Client page.
Provisioning. Otherwise, the user is redirected to the web portal which includes a validation phase.
of posture.

Figure 40: Authorization Rules

3.5. Switch Configuration

In this section, we will focus on the configuration of the Switch which represents
the authenticator for wired network users. Indeed, the switch will play the role
between the RADIUS server (ISE) and the client.

Throughout the implementation of our solution, we worked with three

different models, namely the Cisco Catalyst 3560, the Cisco Catalyst 3650 and the Cisco Catalyst
2960 and this according to the availability of one or the other, in other words, according to the different needs
employees of the company.

Figure 41: Cisco Catalyst 3650

To access the Switch, we can connect directly using a cable.

console or remotely via SSH. The SSH service is disabled by default at the
switch.
38 | Page
Chapter 3 Achievement

To activate it, we use the following commands:

crypto key generate RSA: generate the encryption key
line vty 0 4: allow four simultaneous remote access sessions
transport input ssh: enable the SSH service instead of Telnet
username <nom d'utilisateur> password <mot de passe> :spécifier les données
authentication

It should be recalled that ports existing on a switch can operate according to

different modes. In the two sections that follow, we will discuss, first of all,
global configuration applying to the entire Switch and secondly, we proceed to the
interface configuration.

3.5.1. Global Configuration

The commandaaa new-model allows you to enable authentication functions,

of authorization and accounting of the Switch. The following commands define the services
the RADIUS server that will be responsible for authenticating users and assigning them profiles
of authorization based on access lists or VLANs and to keep track of their activity:

aaa authentication dot1x default group radius

aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius

The following command we need is dot1x system-auth-control used to

enable 802.1x for the entire Switch. After enabling AAA and dot1x, it is necessary to
declare the address of the RADIUS server providing the requested services as well as a key
authentication. This declaration is made using the command radius-server host
[Link] key nextstep where [Link] and nextstep represent respectively the IP address
from Cisco ISE and the authentication key between the switch and the server, which is
mentioned when adding the Switch to the list of network devices in the ISE.

The application order of ACLs at the port level, assigning interfaces to

VLANs or even redirection to URLs issued from Cisco ISE to the Switch, involve a
set of advanced attributes of the RADIUS protocol named VSA (Vendor Specific Attribute).
These attributes are exchanged during the assignment of authorization profiles. In order to benefit from
For these features, it is essential to apply the commands radius-server vsa send
accountingetradius-server vsa send authentication. The following figure represents the
different commands mentioned above, specifying that the declaration command of the

39 | Page
Chapter 3 Realization

The server was entered twice, the first including the address of the primary node while the second
includes the address of the secondary node.

Figure 42: Global commands entered at the Switch

A user attempting to access the network may initially have restricted access.
for reasons of non-compliance and this before having a broader access. This translates to
the assignment of multiple permission profiles for the same session. In order to support the
authorization profile change requests from the ISE, the CoA (Change of
Authorization must be enabled on the Switch using the command aaa server radius
dynamic-author. Also, the address of the server sending the requests must be specified by typing the
clientcommand <server ip-address> server-key <server-key string>.

Figure 43: Activation of CoA at the Switch level

When defining authorization profiles, it is possible to redirect users

to the captive portal web page to authenticate or to the download page of
NAC agents. In this case, the Switch will intercept the HTTP stream and respond to the GET command.
of HTTP with the specified URL, recalling that these URLs are sent from the ISE to the Switch via
the VSA attributes. To ensure this redirection function, it is essential to activate the
HTTP and HTTPS services via the commands ip http server and ip http secure-server.

Figure 44: Activation of HTTP and HTTPS

40 | Page
Chapter 3 Achievement

To determine which traffic to redirect, Cisco ISE refers to an access list declared at the
Switch; any flow with the reaction "permit" must be redirected. It should be noted that all
Traffic to redirect other than HTTP and HTTPS will be rejected. The following table outlines the different
rules declared under the access list:

ACL Entries Description

deny udp any eq bootpc any eq bootps Reject all DHCP traffic
deny udp any any eq domain Refuse all DNS traffic
deny udp any host [Link] eq 8905 Reject all traffic on port 8905 designated for
deny tcp any host [Link] eq 8905 the communication Nac Agent - ISE
Reject all traffic on port 8905 dedicated to
deny tcp any host [Link] eq 8443
CWA and CPP portals
deny tcp any host [Link] eq 8909 Reject all traffic on port 8905 dedicated to
deny udp any host [Link] eq 8909 client provisioning
allow ip any any Allow any other traffic

Table 3: Redirect ACL Entries

This figure brings together the different entries of the redirection ACL.

Figure 45: Redirect ACL

3.5.2. Interface Configuration

Once the global configuration is completed, we proceed with the configuration of

the interface for implementing the defined authentication policies
previously and this at the level of Cisco ISE.

The switch offers the ability to define more than one authentication method on
the same port. However, the order of verification should be mentioned. In our case, we
we use both methods, MAB and Dot1x. Web authentication is included with
MAB authentication.

41 | Page
Chapter 3 Realization

The following diagram summarizes the authentication methods used:

Figure 46: Diagram of authentication methods

We start by assigning the interface to VLAN 340 used for the local network of
the company and run it in Access mode as long as a PC is directly
connected.
In order to enable 802.1X authentication on the port and prohibit all traffic except for that from
EAPOL protocol (Extensible Authentication Protocol over LAN), we use the command
dot1x port-control auto. By combining this command with the command dot1x pae
Authenticator, the Switch should initiate authentication as soon as the cable is plugged in, otherwise
it, as soon as the interface changes its state from "down" to "up".
To enable MAC Authentication Bypass (MAB), it is enough to
Type the command just like that.
At this moment, both authentication methods are activated and we still have to
favor dot1x over MAB. This can be achieved using the authentication command.
order dot1x mab.

42 | Page
Chapter 3 Realization

The following figure compiles the various commands applied to the interface:

Figure 47: Interface configuration

3.6. WLC Configuration

A second category of users can access the network: they are the users of
Wireless network. Their machines must be connected to the access point, which can operate
according to two modes:

Lightweight: in a centralized architecture, the access point

operates in light mode; the wireless local area network controller or Wireless LAN Controller
(WLC) to which it is connected manages the configuration and controls the transactions.
Autonomous mode: each access point is configured separately and controls its own
traffic.

A Cisco WLC can be deployed as a device or on a virtual machine.

(virtual WLC). In this project, the controller was installed on a machine; a file having
.OVA extension, and downloaded from the official site, has been imported to the server of
the company. The following figure represents a WLC Hardware:

Figure 48: Cisco 2500 Series Wireless Controller

43 | Page
Chapter 3 Achievement

The access point model used is Cisco Aironet 1041N. It has been plugged into a socket.
RJ45 to communicate with the controller installed on the server.

Figure 49: Cisco Aironet 1041N

After assigning it an IP address and specifying the WLC address, the access point is
automatically detected at the controller level via the CAPWAP protocol.

Figure 50: Detection of the access point at the WLC

Users attempting to benefit from wireless access fall into two categories,
temporary users (or visitors) and persistent users belonging to the domain.
This translates to the broadcasting of two different SSIDs; each WLAN has its own
security policies.

Figure 51: Diffusion of two SSIDs

The first SSID broadcasted "PFE-NSIT" is dedicated to visitors, on which we must

activate MAC address filtering equivalent to MAB authentication. Although the machine does not
if not known by the ISE, it will be considered authenticated with the option 'If user not
found

44 | Page
Chapter 3 Realization

Figure 52: MAC filtering activation

Authentication with the platform required the addition of the server.

RADIUS authentication included in the platform at the WLC. The following figure shows the
different fields available and that must be configured when adding.

Figure 53: Adding the RADIUS server to the WLC

The activation of 'Support for RFC 3576', as indicated in the previous figure, is
similar to the commandaaa server radius dynamic-authentication entered at the Switch level. Indeed,
this option allows for the acceptance of Change of Authorization (CoA) requests. Also, we
let's specify the shared secret key between the ISE and the WLC.

Once the authentication server was added, it needed to be included in the configuration of
this WLAN under the 'AAA Servers' tab; by default, authentication is performed locally. The
the same configuration was applied to the accounting server to have traceability of
the user, as mentioned in the following screenshot.

45 | Page
Chapter 3 Achievement

Figure 54: Adding authentication and authorization servers

Also, and to allow dynamic assignment of authorization profiles (CoA), we

We should check the box 'Allow AAA Override' and change the value of NAC State to Radius NAC.

Figure 55: Activation of CoA

The allocation of private IP addresses to machines is done automatically using the

DHCP server declared. The range of addresses is already defined at the 'Cyberoam' firewall level.
of the company, it is enough to mention its address at the WLC as we can observe on
the figure that follows.

46 | Page
Chapter 3 Realization

Figure 56: DHCP Configuration

The same configuration should be applied to the second WLAN except that the policy of
security that should be changed to WPA2-802.1X instead of Mac Filtering. Unlike the
switch, only one authentication method can be enabled on the same WLAN.

Figure 57: Security policy of the second WLAN 'PFE-NSIT2'

After completing the setup of the two WLANs, and like the access list
declared at the Switch level, we need to add an ACL to specify the type of
traffic to be redirected, specifying that the entries must be declared in reverse to the Switch;

47 | Page
Chapter 3 Achievement

a 'permit' rule is replaced by 'deny' and vice versa. We did not resort to
Add a rule for DHCP traffic as long as it is allowed by default.

Figure 58: Redirection ACL

[Link]
Throughout this third chapter, we have tried to address the configurations
necessary elements making up our solution and doing so by alternating between the quote
principles of operation and those of the applied configurations, while illustrating with the
explanatory figures.

Although the solution is configured and implemented, a testing phase is essential.

in order to validate the behavior of the different components with respect to the machines attempting

to access the network.

48 | Page
 CHAPTER 4 :
TEST AND VALIDATION
Chapter 4 Testing and validation

4.1. Introduction
Once the solution is implemented, we proceed to the testing phase in order to
ensure the proper functioning of the equipment and the configuration. The verification consists of
try to connect to wired and wireless networks with different scenarios and this in
variant the authentication method and involving machines with states of
diverse health.

4.2. Wired Network

The first test to conduct will allow us to ensure the proper conduct of
domain authentication and posture validation for a wired network user.
By default on a Windows system, 802.1X authentication is disabled on the cards.
Ethernet network. Therefore, we need to add and start the "Configuration" service.
cable network automation
Ethernet interfaces.
After launching '[Link]' and clicking on the corresponding service, the following window
appears to start the service.

Figure 59: Adding and starting the DOT1X service

50 | Page
Chapter 4 Testing and validation

The next step is to enable 802.1X authentication on the Ethernet interface.

default authentication method (PEAP) has been retained as long as it is supported by the
ISE platform.

Figure 60: Activation of DOT1X on the Ethernet card

As soon as the cable is connected to the Ethernet interface, a window appears asking to
enter the username and password to authenticate at the domain level
the moment that the data from the existing session are not automatically used.

Figure 61: Authentication Window

After entering the user account data and trying to access the page
[Link] , we found ourselves redirected to the 'Client Provisioning' page
providing the persistent NAC Agent.

51 | Page
Chapter 4 Testing and validation

Figure 62: Redirection to the Client Provisioning page

By clicking on the button 'Click to install the agent', the Agent will be downloaded
is launched. When executing it, we receive a message indicating the non-compliance of our
machine with the security policy and providing temporary access to download the
remediation file as long as the Mcafee antivirus is not available on our machine. The
The figure below shows a capture of the message received at the agent level.

Figure 63: Message obtained on the NAC Agent

The second test we are conducting involves checking MAB authentication. For the
to do this, we disable 802.1X authentication on the interface so that authentication by
the MAC address should be used automatically.

52 | Page
Chapter 4 Testing and validation

At the level of the Switch, we can observe the progress of the authentication:

Figure 64: Authentication events observed at the switch

To ensure the proper assignment of the authorization profile, we may have

use the switch and run the command show authentication session interface
GigabitEthernet1/0/23 detail. The results displayed in the Server Policies section confirm
downloading the redirect URL from the ISE and using the appropriate ACL for
to know which traffic should be redirected.

Figure 65: Authentication details on the GigabitEthernet1/0/23 interface

4.3. Wireless network

We begin by checking the broadcast of the two SSIDs (PFE-NSIT and PFE-
NSIT2) and this by consulting the list of available wireless networks from our PC.

53 | Page
Chapter 4 Testing and validation

Figure 66: Detection of SSIDs

While attempting to connect to PFE-NSIT2 and after enabling authentication

802.1X, two fields appear asking for the username and password input
as illustrated in the following figure.

Figure 67: DOT1X Authentication for the SSID 'PFE-NSIT2'

After entering the details, we are directed to the CCP (Client) page.
Provisioning Portal) to download the NAC agent. Once installed, this Agent informs us that
Our access to the network is restricted due to non-compliance as shown in the figure.
et nous suggère la réparation de la machine pour avoir un accès complet.

Figure 68: Restricted access to a wireless network user

54 | Page
Chapter 4 Test and validation

A guest, not belonging to the domain, is invited to connect to PFE-NSIT. From

when he connects, he is redirected to the captive portal on his browser.

Figure 69: Guest portal

As we see in the previous figure, a registration link is available. The

the password for the "Guest" account is generated randomly while its username is
generate from the first name and last name. Also, a mobile version of the guest portal is provided:

Figure 70: Registration via the mobile version of the captive portal

We can also disable the automatic registration of members on the portal and
we limit ourselves to the creation of accounts via the responsible portal or 'Sponsor', which is
accessible at the following link:[Link] on

55 | Page
Chapter 4 Testing and validation

this portal was accessed with a user account created at the platform level and equipped with
privileges of a 'sponsor'.

Figure 71: Responsible portal interface

When creating the account, we must choose the lifespan of the account.
affecting one of the existing profiles on the platform. In the following example, the account will be active
durant une période de huit heures.

Figure 72: Creation of a Guest account lasting eight hours

After entering the username and password on the guest portal, we

we are redirected to the Client Provisioning page. The temporary agent starts to check the
machine posture as long as we use a Guest account. This agent is launched under
a browser window. Once the analysis is completed, it indicates non-compliance with
the posture policy.

56 | Page
Chapter 4 Test and validation

Figure 73: Posture validation with a temporary agent

We tested again after installing Mcafee antivirus. The NAC agent

we were given broader access to the network, as mentioned in the figure below.

Figure 74: Full access to the network

By consulting the log of the ISE platform, we can observe the following evolution:
Success of MAB authentication
Success of guest portal authentication
3) Machine posture validation
Success of the dynamic authorization or CoA (change of the authorization profile of
CWA to Permit Access

57 | Page
Chapter 4 Testing and validation

Figure 75: Log of the ISE platform

Other details are also available in the Cisco ISE log, such as the
VSA attributes exchanged with the WLC specifying the ACL and the redirection URL, as well as
the Called-Station-ID attribute mentioning the MAC address of the access point and the associated SSID.

Figure 76: Session details

4.4. Conclusion

This part of the report was dedicated to testing the solution with different scenarios in order to
to prove its proper functioning and effectiveness by trying to connect a machine
on the network, or by referring to the services available within the components, such as the
logging system of the Cisco ISE platform.

58 | Page
 Conclusion and perspectives

As part of this project carried out within the company Next Step IT, and starting from a
souci de sécurité et d’un besoin de protection des ressources critiques et vitales d'une manière
permanent, we have implemented a wired network access control solution
and wireless. The solution is even more necessary when we know that, in certain establishments,
The number of users who frequently use the network is very high.

The solution adopted during the implementation of the project is based on proprietary products.
Cisco: the access point, the switch, the wireless LAN controller (WLC) as well as
the ISE platform representing the latest generation of access control platforms
proposed by Cisco, noting that the company Next Step IT specializes in integration of
network infrastructure solutions primarily based on Cisco equipment.

Once deployed, the solution allowed for real-time response to any attempt to
network connection by reference to predefined security policies at the platform level
forme Cisco ISE. En effet et en premier lieu, l'utilisateur est appelé à s'authentifier en présentant
his user account and the associated password in case he belongs to the domain, otherwise and if he
This is a guest user, they authenticate through a web portal by signing up.
temporarily or he gets an account created by the manager which also allows access
temporary. The step following the verification of the user's legitimacy is that of validation
of the state of the machines; each must have the McAfee antivirus. Otherwise,
The user benefits from a grace period, during which a remediation file is provided to them.
offer in order to gain access.

Like the antivirus test, other scans offered by the platform will be able to
to be carried out, such as checking the status of the operating system update and
the existence of certain security applications in order to further ensure safety
of the network.
 Of course, different attack techniques exist; they tend to find by
all means the password, which allows intruders to impersonate one of
users to access the network. In order to confront them, we can resort to a
strong authentication, concatenating at least two authentication factors, such as the
digital certificates and one-time passwords (OTPs); this is achievable by integrating
the Cisco ISE platform with external identity sources.
 References

Cisco Systems Description of the Cisco NAC range [Online]. - 2006. - February 4, 2015.

Enterasys Secure Networks Network Access Control (Network Access Control) [Online]. -
2007 - March 2, 2015.

FreeNAC Control access network En line]. - 20 Mars 2015.

[Link]

Juniper NetworksUnified Access Control [En ligne]. - Novembre 2011. - 15 Mars 2015.

LANDESK Help Center Understanding Basic NAC Components Help Center

LANDESK [Online] // LANDESK Help Center website. - 2013. - March 12, 2015.
[Link]
[Link].

Marcotte LudovicPacketFence 4.1: a BYOD/NAC solution in the big leagues

[line] // Linuxfr. - December 17, 2013. - March 22, 2015. - [Link]
a-byod-nac-solution-in-the-big-leagues.

Microsoft Network Access Protection (NAP) [Online] // Microsoft. - January 2008. - March 12
2015. - [Link]

Pujolle GuyLes réseaux [Livre]. - [s.l.] : Eyrolles, 2008. - p. 880.

Vincent REMAZEILLES La sécurité des réseaux avec Cisco [Livre]. - [s.l.] : Editions ENI,
2009. - p. 40.

61 | Page
 Glossary

802.1X: a standard that allows control of access to network equipment

AAA (Authentication, Authorization, Accounting): AAA corresponds to a protocol that performs three
fonctions : l'authentification, l'autorisation, et la traçabilité

ACL (Access Control List): ACLs are primarily used for packet filtering on interfaces.
physiques

CHAP (Challenge Handshake Authentication Protocol): authentication protocol for PPP

challenge base, which makes it much safer than its previous PAP.

The CA (Certificate Authority) has the mission, after verifying the identity of the certificate applicant,
to sign, issue, and maintain certificates

CPP (Client Provisioning Portal): a portal belonging to the ISE platform that allows for the provisioning of
NAC Agents

CWA (Central Web Authentication): web portal that allows users to register and
to authenticate. It can also include posture validation (CPP).

DHCP (Dynamic Host Configuration Protocol): allows, from a server, to download the
network configuration for a computer (IP address, TCP/IP settings, etc.)

DNS (Domain Name System): a name service based on servers that allows for conversion
a name in an IP address

EAP (Extensible Authentication Protocol): a network communication protocol embedding

multiple authentication methods that can be used on point-to-point links, wired networks
and wireless networks

FQDN (Fully Qualified Domain Name) is a domain name that reveals the absolute position of a
node in the DNS hierarchy indicating all top-level domains up to the root

LDAP (Lightweight Directory Access Protocol) is originally a protocol that allows

the querying and modification of directory services. However, it has evolved to represent a
standards for directory systems.

MAB (Mac Authentication Bypass): level 2 authentication based on MAC addresses and
provided by Cisco

MAC (Medium Access Control): software layer that is responsible for structuring information bits.
in formats adapted to the physical medium and to manage the physical addresses of network cards (Addresses
MAC)

62 | Page
 Glossary

MS-CHAP: enhanced version of the CHAP protocol proposed by Microsoft

NAS (Network Access Server): RADIUS client acting as an intermediary between the end user and the
server

NTP (Network Time Protocol): a protocol that allows synchronizing the clock of a machine to a
clock reference

PAP (Password Authentication Protocol): authentication protocol for PPP. The data is
transmits in clear text over the network, which makes it consequently insecure.

PEAP (Protected Extensible Authentication Protocol): derived from the EAP protocol, providing a
more secure transmission channel (TLS tunnel).

PPP (Point-to-Point Protocol): link layer protocol used on telephone serial lines
or specialized

RADIUS (Remote Authentication Dial-In User Server): client-server protocol allowing

centralize authentication data

RSA (Rivest Shamir and Adelman): public and secret key encryption algorithm carrying the
name of its designers.

TACACS+: latest version of the TACACS protocol (AAA protocol provided by Cisco)

TCP/IP (Transport Network Protocol/Internetwork Protocol): data transport protocol

in packet form, universally used on LAN and WAN networks

TLS: a protocol that ensures confidentiality between communicating applications and their users.
Internet.

UDP (User Datagram Protocol): equivalent to TCP but in a connectionless mode, without the mechanisms
flow control, error recovery and other options

VLAN (Virtual Local Area Network): this mechanism allows the creation of multiple virtual networks within
of the same physical network and allocate specific configurations for each virtual network created

VMware ESXi: hypervisor developed by VMware that allows the deployment of virtual machines.

VPN (Virtual Private Network): technique that simulates a private network within a public network for the purpose
to offer more security

VSA (Vendor Specific Attributes): RADIUS is extensible; many hardware vendors and
RADIUS software implements its own variants using VSA attributes.

WLC (Wireless LAN Controller): allows you to manage the wireless local area network by controlling the access points
access, managing interferences, ensuring handover, etc.

63 | Page