Daily Worklog: 2026-02-15

remark ### ACTIVE DIRECTORY AUTHENTICATION ###
permit tcp any host {ad-dc-ip} eq 88      # Kerberos
permit udp any host {ad-dc-ip} eq 88
permit tcp any host {ad-dc-ip} eq 389     # LDAP
permit tcp any host {ad-dc-ip} eq 636     # LDAPS
permit tcp any host {ad-dc-ip} eq 3268    # Global Catalog
permit tcp any host {ad-dc-ip} eq 3269    # GC SSL
permit udp any host {ad-dc-ip} eq 53      # DNS
permit tcp any host {ad-dc-ip} eq 53

remark ### SSH MANAGEMENT ###
permit tcp any host {admin-workstation} eq 22

remark ### INFRASTRUCTURE ###
permit udp any host {dns-server} eq 53
permit udp any host {ntp-server} eq 123
permit icmp any any

remark ### BLOCK RFC1918 LATERAL MOVEMENT ###
deny ip any 10.0.0.0 0.255.255.255 log
deny ip any 172.16.0.0 0.15.255.255 log
deny ip any 192.168.0.0 0.0.255.255 log

remark ### PERMIT INTERNET ###
permit ip any any

# Check certificate auth in ISE
netapi ise dc query "
SELECT
    USERNAME,
    AUTHENTICATION_PROTOCOL,
    AUTHORIZATION_PROFILES,
    FRAMED_IP_ADDRESS,
    TIMESTAMP_TIMEZONE
FROM RADIUS_AUTHENTICATIONS
WHERE USERNAME LIKE '%xianming%' OR USERNAME LIKE '%research%'
ORDER BY TIMESTAMP_TIMEZONE DESC
FETCH FIRST 5 ROWS ONLY
"

# Verify EAP-TLS (not MAB/Lookup)
netapi ise mnt session <MAC>

                    ┌─────────────────┐
                    │   9800-CL-WLC   │
                    │   (Primary)     │
                    └────────┬────────┘
                             │ RADIUS
              ┌──────────────┼──────────────┐
              │              │              │
              ▼              ▼              ▼
       ┌──────────┐   ┌──────────┐   ┌──────────┐
       │  ISE-01  │   │  ISE-02  │   │ iPSK-Mgr │
       │ (Primary)│   │(Secondary│   │ (ODBC)   │
       └──────────┘   └──────────┘   └──────────┘
                             │
                    ┌────────┴────────┐
                    │   PostgreSQL    │
                    │  (iPSK Store)   │
                    └─────────────────┘

Current (IoT VLAN):
  Research Workstations ──┬── IoT Devices ──┬── Printers
                          │                 │
                    [Same L2 broadcast domain]
                    [ARP/mDNS/LLMNR shared]

Proposed (Dedicated Research VLAN):
  Research VLAN 40        IoT VLAN 50        Printer VLAN 60
  ┌─────────────┐         ┌──────────┐       ┌──────────┐
  │ Researchers │         │ IoT/BYOD │       │ Printers │
  └──────┬──────┘         └────┬─────┘       └────┬─────┘
         │                     │                  │
         └─────────────────────┼──────────────────┘
                               │
                        [L3 Router/Firewall]
                        [ACLs control inter-VLAN]
                        [dACLs per-user enforcement]

netapi ise add-ad-groups DOMUS_DC01 "GRP-*"

netapi ise add-authz-rule "Domus-Wired 802.1X" \
  "Linux_Computer_AD_Auth" \
  "Linux_EAPTLS_Admins" \
  --and "Network Access:EapAuthentication:EAP-TLS" \
  --and "DOMUS_DC01:ExternalGroups:contains:inside.domusdigitalis.dev/Groups/Security/GRP-Computers-Linux-Admin" \
  --rank 0

{
  "rule": {
    "name": "Linux_Computer_AD_Auth",
    "rank": 0,
    "state": "enabled",
    "condition": {
      "conditionType": "ConditionAndBlock",
      "isNegate": false,
      "children": [
        {
          "conditionType": "ConditionAttributes",
          "dictionaryName": "Network Access",
          "attributeName": "EapAuthentication",
          "operator": "equals",
          "attributeValue": "EAP-TLS"
        },
        {
          "conditionType": "ConditionAttributes",
          "dictionaryName": "DOMUS_DC01",
          "attributeName": "ExternalGroups",
          "operator": "contains",
          "attributeValue": "inside.domusdigitalis.dev/Groups/Security/GRP-Computers-Linux-Admin"
        }
      ]
    }
  },
  "profile": ["Linux_EAPTLS_Admins"]
}

netapi ise dc session "98:BB:1E:1F:A7:13"

Policy Set:    Domus-Wired 802.1X
AuthZ Profile: Linux_EAPTLS_Admins
Auth Method:   dot1x
NAD Port:      GigabitEthernet1/0/1
Session ID:    0A32010A0000077C27167DCD

netapi ios exec "show access-session interface gi1/0/1 de"

User-Name:      modestus-razer.inside.domusdigitalis.dev
Status:         Authorized
Vlan Group:     Vlan: 10
ACS ACL:        xACSACLx-IP-LINUX_EAPTLS_PERMIT_ALL-69680320
Method:         dot1x (Authc Success)

# Check ISE allowed protocols for TEAP
curl -ks -u 'domus_ers_admin:PASSWORD' -H 'Accept: application/json' \
  'https://10.50.1.20:9060/ers/config/allowedprotocols/92613980-8c01-11e6-996c-525400b48521' | jq '.AllowedProtocols.teap'

# Create TEAP authentication rule (wired)
curl -ks -u 'domus_ers_admin:PASSWORD' \
  -H 'Content-Type: application/json' -H 'Accept: application/json' \
  -X POST -d @/tmp/teap-auth-rule.json \
  'https://10.50.1.20/api/v1/policy/network-access/policy-set/2c2e6b05-a29c-46a4-a0ee-7fcea4853e47/authentication'

# Create TEAP authorization rule with EAP chaining
curl -ks -u 'domus_ers_admin:PASSWORD' \
  -H 'Content-Type: application/json' -H 'Accept: application/json' \
  -X POST -d @/tmp/teap-chain-both.json \
  'https://10.50.1.20/api/v1/policy/network-access/policy-set/2c2e6b05-a29c-46a4-a0ee-7fcea4853e47/authorization'

# Update rule to change DenyAccess → Domus_Secure_Profile
curl -ks -u 'domus_ers_admin:PASSWORD' \
  -H 'Content-Type: application/json' -H 'Accept: application/json' \
  -X PUT -d @/tmp/teap-update.json \
  'https://10.50.1.20/api/v1/policy/network-access/policy-set/POLICY_ID/authorization/RULE_ID'

# Verify TEAP rules
curl -ks -u 'domus_ers_admin:PASSWORD' -H 'Accept: application/json' \
  'https://10.50.1.20/api/v1/policy/network-access/policy-set/2c2e6b05-a29c-46a4-a0ee-7fcea4853e47/authorization' | \
  jq '.response[] | select(.rule.name | test("TEAP")) | {name: .rule.name, profile: .profile[0]}'

{
  "rule": {
    "default": false,
    "name": "TEAP_Wired_Auth",
    "rank": 1,
    "state": "enabled",
    "condition": {
      "conditionType": "ConditionAttributes",
      "isNegate": false,
      "dictionaryName": "Network Access",
      "attributeName": "EapTunnel",
      "operator": "equals",
      "attributeValue": "TEAP"
    }
  },
  "identitySourceName": "Windows_Cert_Profile",
  "ifAuthFail": "REJECT",
  "ifUserNotFound": "REJECT",
  "ifProcessFail": "DROP"
}

{
  "rule": {
    "default": false,
    "name": "TEAP_Machine_User_Success",
    "rank": 0,
    "state": "enabled",
    "condition": {
      "conditionType": "ConditionAndBlock",
      "isNegate": false,
      "children": [
        {
          "conditionType": "ConditionAttributes",
          "isNegate": false,
          "dictionaryName": "Network Access",
          "attributeName": "EapTunnel",
          "operator": "equals",
          "attributeValue": "TEAP"
        },
        {
          "conditionType": "ConditionAttributes",
          "isNegate": false,
          "dictionaryName": "Network Access",
          "attributeName": "EapChainingResult",
          "operator": "equals",
          "attributeValue": "User and machine both succeeded"
        }
      ]
    }
  },
  "profile": ["Domus_Secure_Profile"]
}

groupDirectorySubtree: cn=groups,cn=accounts,...  ← user groups only

groupDirectorySubtree: cn=hostgroups,cn=accounts,...  ← host groups

ssh ipa-01 "ipa hostgroup-find"

1 hostgroup matched: ipaservers

CN=modestus-razer.inside.domusdigitalis.dev, OU=Domus-Admins, O=Domus-Infrastructure

netapi ise add-authz-rule "$POLICY_SET" \
  "Domus_Infra_Admins" \
  "$AUTHZ_EAPTLS" \
  --and "Network Access:EapAuthentication:EAP-TLS" \
  --and "Certificate:Subject Organizational Unit:contains:Domus-Admins" \
  --and "Certificate:Subject Organization:contains:Domus-Infrastructure" \
  --rank 0

# Delete BYOD auth rule that was catching all EAP-TLS
netapi ise delete-auth-rule "Domus-Secure 802.1X" "BYOD_Certificate_Auth"

netapi ise add-authz-rule "Domus-Secure 802.1X" \
  "Linux_Cert_Domus_Infra" \
  "Linux_EAPTLS_Admins" \
  --and "Network Access:EapAuthentication:EAP-TLS" \
  --and "CERTIFICATE:Subject - Organization:equals:Domus-Infrastructure" \
  --rank 0

netapi ise add-auth-rule "Domus-Secure 802.1X" "Linux_EAP_TLS_Auth" "Test_Linux_CertAuth" --rank 0

# Delete rule with wired profile
echo "y" | netapi ise delete-authz-rule "Domus-Secure 802.1X" "Linux_Cert_Domus_Infra"

# Recreate with wireless-compatible profile (no dACL)
netapi ise add-authz-rule "Domus-Secure 802.1X" \
  "Linux_Cert_Domus_Infra" \
  "Domus_Secure_Profile" \
  --and "Network Access:EapAuthentication:EAP-TLS" \
  --and "CERTIFICATE:Subject - Organization:equals:Domus-Infrastructure" \
  --rank 0