文本文稿培训sda poc

1、SDA POC Training 3SDA ValidationXiaosheng Yu | Hui ChenGC EN TeamWired Host 802.1x Settings23132456控制面板 管理工具 服务Wired AutoConfig 服务，默认未运行，启动该服务，并设置为自动4选择接入SDA的网卡，右键属性，选择身份验证选项卡选择网络身份验证方法默认为PEAP，不修改，选择设置取消“通过验证证书来验证服务器的身份”选择身份验证方法默认为EAP-MSCHAP v2，不修改，选择配置确认自动使用windows登录名和密码未勾选12345675选择接入SDA的网卡，右键属性，选

2、择身份验证选项卡选择其他设置，勾选“指定身份验证模式”选择“用户身份验证”选择替换凭据，输入用户名和密码 （配置在ISE上）12345Validation Case - Wired67Case1有线主机均接入lab_employee VN，获取统一网段ip，并获取不同的SGTsIntmEdge-2Edge-1CP/BorderFusionShared-Service GWInternet Edge RouterInternetDNA-CISEFabric WLCDHCP/DNS/NTPvipdeveloperfinance8Case1有线主机均接入lab_employee VN，获取统一网段i

3、p，并获取不同的SGTsUSERUSER-GROUPSGTVLAN-Name(IP Pool Name)developerlab_developerlab_developer10_2_102_0-lab_employeeviplab_viplab_vipfinancelab_financelab_finance9Case1有线主机均接入lab_employee VN，获取统一网段ip，并获取不同的SGTsEdge-C9300-1#show authentication sessions interface gigabitEthernet 1/0/2 details Interface: Gig

4、abitEthernet1/0/2 IIF-ID: 0 x1A77358B MAC Address: 0050.5683.aa67 IPv6 Address: fe80:b545:dd3c:52d2:9f3d IPv4 Address: User-Name: lab7 Device-type: Microsoft-Workstation Status: Authorized Domain: DATA Oper host mode: multi-auth Oper control dir: in Session timeout: N/A Common Session ID: 0201020A00

5、000859D2C7EE5C Acct Session ID: 0 x0000000e Handle: 0 x6100001b Current Policy: POLICY_Gi1/0/2Local Policies: Idle timeout: 65536 secServer Policies: Vlan Group: Vlan: 1028 Security Policy: None Security Status: Link Unsecured SGT Value: 22Method status list: Method State dot1x Authc SuccessEdge-C93

6、00-1#show authentication sessions interface gigabitEthernet 1/0/3 details Interface: GigabitEthernet1/0/3 IIF-ID: 0 x18647DA0 MAC Address: 0050.5683.6d1c IPv6 Address: fe80:9590:b5a2:82f2:97f9 IPv4 Address: User-Name: lab1 Device-type: Microsoft-Workstation Status: Authorized Domain: DATA Oper host

7、mode: multi-auth Oper control dir: in Session timeout: N/A Common Session ID: 0201020A0000085AD2C7EE88 Acct Session ID: 0 x0000000f Handle: 0 xac00001c Current Policy: POLICY_Gi1/0/3Local Policies: Idle timeout: 65536 secServer Policies: Vlan Group: Vlan: 1028 Security Policy: None Security Status:

8、Link Unsecured SGT Value: 20Method status list: Method State dot1x Authc Success10Case1有线主机均接入lab_employee VN，获取统一网段ip，并获取不同的SGTsEdge-C9300-2#sh authentication sessions interface gigabitEthernet 1/0/2 details Interface: GigabitEthernet1/0/2 IIF-ID: 0 x1223E2B5 MAC Address: 0050.5683.d080 IPv6 Addres

9、s: fe80:6835:bf7f:4237:7c47 IPv4 Address: User-Name: lab5 Device-type: Microsoft-Workstation Status: Authorized Domain: DATA Oper host mode: multi-auth Oper control dir: in Session timeout: N/A Common Session ID: 0A01020A00000010D2C698BB Acct Session ID: 0 x00000003 Handle: 0 xd8000006 Current Polic

10、y: POLICY_Gi1/0/2Local Policies: Idle timeout: 65536 secServer Policies: Vlan Group: Vlan: 1028 Security Policy: None Security Status: Link Unsecured SGT Value: 21Method status list: Method State dot1x Authc Success11Case2vip可以访问developer和finance，developer和finance互相不能访问POLICY Policy Administration G

11、roup-Based Access Control (Fabric) Add Policy编辑Policy的Name和Description，拖拽源SGT和目的SGT，关联默认的permit contract12Case2vip可以访问developer和finance，developer和finance互相不能访问POLICY Policy Administration Group-Based Access Control (Fabric) Add Policy编辑Policy的Name和Description，拖拽源SGT和目的SGT，关联默认的deny contract13Case2vip可以访问developer和finance，developer和finance互相不能访问vip 可以访问developer和financefinance不能访问developer developer不能访问finance14Case3vip可以访问developer和finance的ftp-server，不可以访问其它服务POLICY Contracts Access Contract Add Contract新建的Contract中，Implicit Action 设为Deny，Rows中新建两条PERMIT策略，匹配ftp和ftp-da