Advanced Network Security Troubleshooting and Solutions v22.411 (ANSTS)

Welcome to this week's class (ANSTS)



Please be sure you have downloaded the learner guide and lab guide as per instructions you received from an email you would have received from HPE last week.  Check your email history, spam folder etc... for keyword "OnSecure" if you cannot find the email.

    • the Podx Spreadsheet (ask me in class for your password)

    Lab Notes

Tips on how to google our site for documentation

    • googling for AOS-Switch-related topics
      • site:hpe.com 16.09 -inurl:pdf -inurl:cx "dhcp-snooping"
    • googling for AOS-CX-related topics
      • site:arubanetworks.com -inurl:pdf inurl:AOS-CX inurl:10\.11 "dhcp-snooping"
    • search option notes:
      • site:x only searched that domain
      • -inurl:x don't report links with this text in the URL
      • inurl:x only report on links with text
        • (ideal for finding specific version documentation)

Helpful Links

    • about Aruba training and this course

    • where to find more information
    • where to find online documentation

    • AOS-CX specific links

      • AP Datasheets

        • GW Datasheets


                Day 1 - Lecture Modules & Labs 

                M01: Introduction to the Scenario 

                M02: Harden Devices

                  • error in slide 11
                    • says:
                      • you should also add loop guard to prevent loops from occurring regardless of spanning tree settings
                    • issue: that is a description of loop-protect, not loop guard  
                    • should say: 
                      • you should also add loop-protect to prevent loops from occurring regardless of spanning tree settings
                    • references: 

                Lab 0 - Lab Topology, Credentials, and General Instructions

                    • begins on pdf page 11 (page 1 on bottom of page)
                      • page 5
                        • when you login to arubatraininglab.computerdata.com be sure that the login page is fully loaded before you press submit
                      • page 6
                        • where it asks to use MPuTTy to connect to your switches, it will likely be prevented access due to the control-plane ACL not permitting SSH, you will address this issue in the LAB 2 errata, so you can safely ignore this issue for now 
                      • page 8:
                        • be sure to click "SSO" before you try to login to Central

                Lab 2 - Ensure That the Customer’s Network Complies with Local Policies

                    • 2.1: Check that the Mobility Infrastructure Complies with Security Policies
                      • on page 13 (1.1.3.f)
                        • it says
                          • "tableID": "XX"
                        • but should say
                          • "tableID": "y" (replace y with your table number, remove any leading zeros)
                    • 2.2: Check the Aruba CX Switch
                      • on page 22 (2.2.1.h)
                        • it says
                          • Double - click switch to connect to the switch
                        • however
                          • the switch control-plane acl is likely blocking access
                          • you can confirm this with
                            • show access-list hitcounts control-plane vrf default
                          • add the following to fix this
                            • conf t
                            • access-list ip control-plane
                            • 60 permit tcp 10.254.1.0/24 any eq 22
                            • exit
                            • write mem

                M03: Deploy Certificates on Aruba Solutions

                    • web: regex.com
                      • examine the meaning of
                          • switch[0-9]{1,4}
                          • mc\.acnsxtest\.com 
                      • extra exercise
                        • expression: aps[124]{0,1}.example.com
                        • text block:
                          • aps.example.com
                          • aps1.example.com
                          • a.example.com
                          • ap.example.com
                          • aps2.example.com
                          • aps3.example.com
                          • aps4.example.com

                Lab 3 - Managing Aruba Certificates and Using Them to Enhance Security

                    • 3.1: Identify Certificate Issues and Install Certificates on CPPM
                      • issue: 
                        • you get "Error processing request..." on lab 3 task 1 step 2, where you are attempting to install your clusters HTTPS cert on CPPM2
                      • solution:
                        • this may happen if you try to install the HTTPS cert from the CPPM2 web console, although this should work, try installing it instead from CPPM1
                    • 3.2: Install Certificates on MCs
                    • 3.3: Establish RadSec between the MCs and CPPM
                    • 3.4: Use RadSec for Mobility Manager Authentication
                    • 3.5: Configure ClearPass to Issue Certificates with EST
                    • 3.6: Configure the AOS-CX Switch to Obtain a Certificate with EST
                    • 3.7: Establish RadSec between the AOS-CX Switch and CPPM
                    • 3.8: Use RadSec for AOS-CX Manager Authentication 

                M04: Implement Certificate-Based Authentication and Access Control

                  Lab 4 - Deploy Certificate-Based Authentication

                      • 4.1: Configure Aruba CPPM Authentication Methods and Authentication Sources
                      • 4.2: Configure the CPPM Policies and Service for Wireless 802.1X Authentication
                      • 4.3: Create a WLAN and Begin Testing Wireless 802.1X Authentication
                        • issue: 
                          • if your AOS8 AP is not advertising any SSID you might have any of the following issues:
                        1. your control-plane ACL is blocking DHCP
                          • bootrom: type "dhcp" to validate
                          • add as a temporary workaround:
                            • 1002 permit udp any any eq 67
                        2. your AP is running InstantOS 8 or 10
                          • login via serial terminal and type: "convert-aos-ap cap 10.1.16.101"
                            • to login first try admin/admin
                            • next, use mfginfo or central's ap details page to find the serial number of your AP (it might be the APs admin password)
                          • if you cannot login by serial console, check if the AP is connected to central, ensure it is not in the default group, then access its console through central
                          • bootrom: type "factory_reset"
                          • if you were specifically on 8.7, you will need to disable CPsec or the converted AP will be denied with certificate validation errors, after your AP connects and updates is code to match 8.10.02 firmware, you can reenable CPsec and it will work
                        • reference
                          • apboot> help
                          • boot    - boot the OS image
                          • clear   - clear the OS image or other information
                          • dhcp    - invoke DHCP client to obtain IP/boot params
                          • factory_reset- reset to factory defaults
                          • help    - print command description/usage
                          • mfginfo - show manufacturing info
                          • osinfo  - show the OS image version(s)
                          • ping    - send ICMP ECHO_REQUEST to network host
                          • printenv- print environment variables
                          • purgeenv- restore default environment variables
                          • reset   - Perform RESET of the CPU
                          • saveenv - save environment variables to persistent storage
                          • setenv  - set environment variables
                          • tftpboot- boot image via network using TFTP protocol
                          • upgrade - upgrade the APBoot or OS image
                          • version - print monitor, compiler and linker version
                      • 4.4: Configure Application and WebCC Rules on an AOS Firewall
                        • issue:
                          • when enabling firewall and DPI on VMC
                            • an extra reboot is likely required
                            • validate that both VMCs have L2-connected cluster state after a reboot
                      • 4.5: Configure AOS Firewall Aliases, Policies, and Roles
                      • 4.6: Send TEAP Usernames to Network Devices

                  Day 2 - Lecture Modules & Labs

                  M05: Enhance Certificate-Based Authentication and Access Control

                  Lab 5.a - Apply Advanced Authentication and Access Controls

                      • 5.a.1: Add Custom Attributes and Filters to a CPPM Authentication Source
                      • 5.a.2: Meet the Customers' Security Requirements
                        • issue:
                          • table L5a-1 on page 218 and table L5a-3 on page 220 of solution guide 1 incorrectly shows rule 4 with an AND operator, note that the text based instructions on page 223 are correct
                        • solution: 
                          • replace the AND with and ANY (OR) operator
                      • 5.a.3: Test Your Solution
                      • 5.a.4: Assign Aruba-User-Roles Dynamically

                  Lab 5.b - Enforce Wired 802.1X

                      • 5.b.1: Configure AOS-CX Port-Access Roles and Policies
                      • 5.b.2: Set Up Wired 802.1X Authentication
                      • 5.b.3: Test Wired 802.1X Authentication
                      • 5.b.4: Implement Dynamic Segmentation on the AOS-CX Switches

                  M06: Implement Best Practices for RADIUS and 802.1X

                  Lab 6 - Implement Authentication Best Practices

                      • 6.1: Implement Other Best Practices for 802.1X Authentication
                      • 6.2: Configure and Test Dynamic Authorization

                  Day 3 - Lecture Modules & Labs

                  M07: Integrate with Cloud Mobility Device Management (MDM)

                  Lab 7.a - Enable Users to Register Devices in Microsoft Intune

                      • 7.a.1: Enable Secure Provisioning for New Wireless Devices
                      • 7.a.2: Test Wireless Provisioning
                      • 7.a.3: Enable and Test Provisioning for Wired Clients
                      • 7.a.4: Integrate Aruba ClearPass Onboard and Microsoft Intune
                      • 7.a.5: Test Intune Enrollment and Certificate Deployment

                  Lab 7.b - Configure Intune Integration

                      • 7.b.1: Integrate ClearPass with Intune
                      • 7.b.2: Use Intune Attributes as Criteria to Control Wireless Clients’ Access
                      • 7.b.3: Test the Solution
                      • 7.b.4: Use Intune Attributes for Wired Clients
                      • 7.b.5: Test the Solution

                  M08: Implement Compliance-Based Controls

                  Lab 8 - Use Aruba Solutions to Help Enforce Compliance

                      • 8.1: Enforce Intune Compliance-Based Policies
                      • 8.2: Ensure Timely Restoration for Newly Compliant Clients
                      • 8.3: Automate Triggers of a Resync (Optional)
                      • 8.4: Validate the Solution

                  M09: Implement Device-Based Authentication and Access Control

                  Lab 9 - Enforce Authentication for Non-802.1X Capable Devices

                      • 9.1: Enable Profiling
                      • 9.2: Configure a MAC-Auth Service on CPPM
                      • 9.3: Configure MAC-Auth on AOS-CX Switches
                      • 9.4: Import Endpoints
                      • 9.5: Validate the Solution
                        • on page 463.3.a
                          • it says
                            • a. On the BYOD client, open the Network Connections shortcut
                          • issue: 
                            • the missing lab 7.1 task 4, step 4 has you install BYOD EAP-TLS certificates
                            • this cert is required for this authentication to work
                          • solution: option 1 or 2 will work
                            1. user your Domain client instead (it has domain certs)
                            2. ask me how to find the missing 7.1.4.4 lab steps where you will enrole your client with Intune
                        • on page 467.k
                          • it says
                            • auth-status 19 client
                          • user port 20 instead, if you did enroll your BYOD client with Intune (in lab 7.1.4.4)
                            • auth-status 20 client

                  M10: Use Custom Network Address Extension (NAE) Scripts and Agents

                  Lab 10 - Use Custom Network Analytics Engine (NAE) Agents

                      • 10.1: View a Custom NAE Script
                        • on page 470.d
                          • it says
                              • id = 1/1/20
                            • issue
                              • be sure this port is in "no shutdown" state
                      • 10.2: Install the Custom Script

                  Day 4 - Lecture Modules & Labs

                    M11: Secure an AOS 10 Architecture

                    Lab 11 - Implement Security Features in Aruba Central

                        • 11.1:Transition to the Central Configuration
                          • 11.1.1 BGW ZTP issue:
                            • for BGW setup to succeed smoothly
                            • CX: conf
                            • CX: int 1/1/16/1/1/23
                            • CX:     shut
                            • this is to ensure the BGW will be easy to static-activate
                          • on page 480.3 says:
                            • Access your branch gateway (BGW) 1 console port.
                            • if you don't see a menu of provisioning options
                              • login to the console and write erase all, to ensure stable lab results, you must static provision both BGWs, instructions are in the lab 11 appendix
                            • the BGW login credential may be one of the following:
                              • admin/(usual password)
                              • branchsupport/(bgw mac address recorded in central)
                            • after you static-activate, no-shut 1/1/16,1/1/23
                            • if they ZTP provisioned, you will likely have to
                              • shut their ports, wait for them to go offline
                              • delete their records in Central
                              • login using branchsupport, write erase all
                              • static-activate them, no shut their ports
                          • 11.1.12 Creating your "creds.txt" file
                            • be sure there are no blank lines or blank spaces at the ends of lines or you are likely to get script errors
                        • 11.2: Configure Certificates
                        • 11.3: Validate Your Gateway Config and Assign Them a New System IP
                        • 11.4: Set up a Cluster that Supports Dynamic CoAs
                          • on page 517.3 says:
                            • "show ubt state" will now show the registered state
                            • if you have a registering state
                              • reboot your GWs
                            • you will see related errors from the following"
                            • CX: debug ubt all, show debug buffer
                            • GW: show tunneled-node-mgr trace-buf count 10
                        • 11.5: Configure Firewall and IDS/IPS Settings
                        • 11.6: Ensure Visibility into Client Traffic and Behavior
                        • 11.7: Start Traffic Generation

                    M12: Investigate Threats and Vulnerabilities

                    Lab 12.a - Investigate Threats

                        • 12.a.1: Detect, Document, and Investigate a Threat

                    Lab 12.b - Identify Vulnerabilities

                        • 12.b.1: Identify Vulnerabilities
                        • 12.b.2: Mitigate Threats
                        • 12.b.3: Validate Your Solutions

                    M13: Aruba Cloud Authentication

                      Day 5 - Lecture Modules & Labs

                      M14: Mock Exam

                      Lab 14 - Mock Exam (all day)

                          • Introduction to the Scenario for Tasks 1-12
                            • note: 
                              • it takes up to 15 minutes for the lab reset script to complete
                              • your AOS8 AP may still be managed by Central, if so:
                                • disable cpsec on all your MCs until after your AP is up running 8.10.0.2 firmware
                                •  connect to its console through central and run the following command:
                                  • convert-aos-ap cap 10.1.16.101
                              • be sure to provision your gateways with static-activate
                              • when you are installing certificates, if you see they are already installed, use the existing certificates
                            • are all of your APs on AOS8 MCs?
                              • if you need to convert an AOS8 MC AP to central, from the MC console you can use the following command:
                                • ap redeploy controller-less ?
                            • for the week of may 6, 2024
                                • cppm password = admin/Aruba123!
                          • Introduction to the Scenario for Tasks 13-19
                          • Appendix: Central Setup for the Mock Exam

                      Task 8

                          • on page 702
                            • is says
                              • Permitted access to DNS services from training-ad.acnsxtest.com and no other server
                            • issue
                              • the correct domain name is: traininglab-ad.acnsxtest.com

                                  preperation for Task 13

                            • on page 771
                              • you will need to run the mockexam_central script, goto page 832
                              • the script will fail, to fix:
                                • copy the folder "supporting" from \tools\Central\ and paste it to \tools\Mock Exam\ 

                        Appendix

                        Acronyms or Key terms

                          • ESP: Encapsulating Security Payload
                          • SA: Security Association
                            • a relationship between two or more entities that describes how the entities will use security services to communicate securely
                          • SPI: Security Parameter Index
                            • identification tag added to the header while using IPsec for tunneling the IP traffic. 
                            • This tag helps the kernel discern between two traffic streams where different encryption rules and algorithms may be in use
                          • nonce:
                            • random / semi-random number generated for cryptographic communication 
                            • mechanism helps to protect against replay attacks
                            • the term stands for "number used once"

                        Lab Access Errata

                          • if you get this error message in the lab, click "home", "+" beside your pod/table, find the actual device you were using in the list, double click it.



















                              Neal Vadekar, ACEX, ACSX, ACMX, ACDX, ACCP, ACNSP, ADCNS

                              Comments

                              Post a Comment

                              Popular posts from this blog

                              Arubanetworks Webgate - Copy and Paste instructions

                              Copy/Paste Text from local to remote  Copy/Paste from local to remote  You need to copy the text between local and remote devices as follows: Copy the text from your local machine as usual Press Ctrl+Alt+Shift to get the menu (don't do this on the network diagram, only on telnet / RDP sessions) Paste the text in the box that shows on the menu (this copies the text to the remote server) Press Ctrl+Alt+Shift to close the menu (or do this after the next step) Right click on the device to paste in telnet or paste normally in the remote RDP session Copy/Paste from remote to local To copy to your local machine from the remote switch reverse this: Select the text like you would with Putty Press Ctrl+Alt+Shift to get the menu (don't do this on the network diagram, only on telnet / RDP sessions) Copy text from box on menu Press Ctrl+Alt+Shift to close the menu (or do this after the next step) Paste as usual on your local PC Copy/Paste an Archive of Files from remote to local Make a zip
                              Read more