How to Set Up an Identity Policy
This topic provides a high-level overview of setting up an identity policy using any available user identity source: TS Agent, ISE/ISE-PIC, Microsoft Azure AD (SAML), captive portal.
Procedure
| Command or Action | Purpose | |||
|---|---|---|---|---|
Step 1 | Choose your identity source. |
| ||
Step 2 | (Optional.) Create a proxy sequence. | A proxy sequence is one or more managed devices that can be used to communicate with an LDAP, Active Directory, or ISE/ISE-PIC server. It is necessary only if Security Cloud Control cannot communicate with your Active Directory or ISE/ISE-PIC server. (For example, Security Cloud Control might be in a public cloud but Active Directory or ISE/ISE-PIC might be in a private cloud.) Although you can use one managed device as a proxy sequence, we strongly recommend you set up two or more so that, in the event one managed device cannot communicate with Active Directory or ISE/ISE-PIC, another managed device can take over. | ||
Step 3 | (Optional.) Create a realm and directory, one realm for every domain in the forest that contain users you want to use in user control. Also create one directory for every domain controller. Only users and groups that have corresponding management center realms and directories can be used in identity policies.. | Creating a realm, realm directory, and proxy sequence is optional if any of the following are true:
The realm is a trusted user and group store, typically a Microsoft Active Directory repository. The management center downloads users and groups at intervals you specify. You can include or exclude users and groups from being downloaded. See Create an LDAP Realm or an Active Directory Realm and Realm Directory. For details about the options to create a realm, see Realm Fields. A directory is an Active Directory domain controller that organizes information about a computer network's users and network shares. An Active Directory controller provides Directory Services for the realm. Active Directory distributes user and group objects across multiple domain controllers, which are peers that propagate local changes between each other by the use of Directory Services. For more information, see the Active Directory technical specification glossary on MSDN. You can specify more than one directory for a realm, in which case each domain controller is queried in the order listed on the realm's Directory tab page to match user and group credentials for user control.
| ||
Step 4 | Synchronize users and groups from the realm. | To be able to control users and groups, you must synchronize them with the management center. You can synchronize them with users and groups whenever you want or you can configure the system to synchronize them at a specified interval. When you synchronize users and groups, you can specify exceptions; for example, you can exclude the Engineering group from all user control for that realm, or you can exclude the user joe.smith from user controls that apply to the Engineering group. See Synchronize Users and Groups | ||
Step 5 | (Optional.) Create a realm sequence. | A realm sequence is an ordered list of realms that, when used in an identity policy, causes the system to search the realms in the specified order to find users to match the rule. See Create a Realm Sequence. | ||
Step 6 | Create a method to retrieve user and group data (the identity source). | Set up an identity source with its unique configuration to be able to control users and groups using data stored in the realm. Identity sources include TS Agent, captive portal, or Remote VPN. See one of the following: | ||
Step 7 | Create an identity policy. | An identity policy contains one or more identity rules, optionally organized in categories. See Create an Identity Policy.
| ||
Step 8 | Create one or more identity rules. | Identity rules enable you to specify a number of matching criteria, including the type of authentication, network zones, networks or geolocation, realms, realm sequences, and so on. See Create an Identity Rule. | ||
Step 9 | Associate your identity policy with an access control policy. | An access control policy filters and optionally inspects traffic. An identity policy must be associated with an access control policy to have any effect. See Associating Other Policies with Access Control. | ||
Step 10 | Deploy the access control policy to at least one managed device. | To use your policy to control user activity, the policy must be deployed to the managed devices to which clients connect. See Deploy Configuration Changes. | ||
Step 11 | Monitor user activity. | View a list of active sessions collected by user identity sources or a list of user information collected by user identity sources. . An identity policy is not required if all of the following are true:
|