Hardened dACL Configuration

! =============================================================================
! dACL: LINUX_RESEARCH_HARDENED
! Purpose: Zero-trust access for Linux research workstations
! Author: InfoSec Team
! Created: 2026-01-22
! ACE Count: 15 (well within 64 ACE limit)
! =============================================================================

! -----------------------------------------------------------------------------
! SECTION 1: BLOCK INTERNAL NETWORKS (MUST BE FIRST)
! Prevents lateral movement to internal systems
! -----------------------------------------------------------------------------
remark === DENY RFC1918 - No Lateral Movement ===
deny ip any 10.0.0.0 0.255.255.255           ! (1)
deny ip any 172.16.0.0 0.15.255.255          ! (2)
deny ip any 192.168.0.0 0.0.255.255          ! (3)

! -----------------------------------------------------------------------------
! SECTION 2: PERMIT INFRASTRUCTURE (Minimal Required)
! Only essential services for workstation operation
! -----------------------------------------------------------------------------
remark === DNS ===
permit udp any host 10.50.1.50 eq 53         ! (4)

remark === NTP ===
permit udp any any eq 123                     ! (5)

remark === ISE Posture ===
permit tcp any host 10.50.1.21 eq 8443       ! (6)
permit tcp any host 10.50.1.21 eq 8905       ! (7)

! -----------------------------------------------------------------------------
! SECTION 3: PERMIT INTERNET ACCESS
! Research requires external connectivity
! -----------------------------------------------------------------------------
remark === External Traffic ===
permit tcp any any eq 80                      ! (8)
permit tcp any any eq 443                     ! (9)
permit tcp any any eq 22                      ! (10)

! -----------------------------------------------------------------------------
! SECTION 4: IMPLICIT DENY WITH LOGGING
! Catch and log any unexpected traffic
! -----------------------------------------------------------------------------
remark === Deny All Other ===
deny ip any any log                           ! (11)

# Create hardened dACL
$ uv run netapi ise create-dacl LINUX_RESEARCH_HARDENED \
    --file /tmp/LINUX_RESEARCH_HARDENED.txt \
    --descr "Zero-trust dACL for Linux research workstations - blocks RFC1918, permits internet"
Creating DACL: LINUX_RESEARCH_HARDENED
  OK (ID: 2416bc00-f805-11f0-b76e-52c54a1d1f56)

# Update profile with dACL
$ uv run netapi ise update-authz-profile "Linux_EAPTLS_Permit" \
    --dacl LINUX_RESEARCH_HARDENED
✓ Updated authorization profile: Linux_EAPTLS_Permit
  DACL: LINUX_RESEARCH_HARDENED

# Set reauth timer (1 hour)
$ uv run netapi ise update-authz-profile "Linux_EAPTLS_Permit" \
    --reauth-timer 3600
✓ Updated authorization profile: Linux_EAPTLS_Permit
  Reauth Timer: 3600s (60 min)

$ uv run netapi ise get-authz-profile "Linux_EAPTLS_Permit"
 name        Linux_EAPTLS_Permit
 vlan        {'nameID': 'RESEARCH_VLAN', 'tagID': 1}
 reauth      {'timer': 3600, 'connectivity': 'RADIUS_REQUEST'}   (1)
 daclName    LINUX_RESEARCH_HARDENED                              (2)

$ uv run netapi ios exec "show access-session interface GigabitEthernet1/0/5 detail" \
    | grep -E "User-Name|Status|Vlan|ACS ACL|IPv4|MAC|Session timeout"
          MAC Address:  c85b.76c6.5962
         IPv4 Address:  10.50.40.101
            User-Name:  modestus-p50.inside.domusdigitalis.dev
               Status:  Authorized
      Session timeout:  3600s (server), Remaining: 3584s               (1)
           Vlan Group:  Vlan: 40
      Security Status:  Link Unsecure
              ACS ACL:  xACSACLx-IP-LINUX_RESEARCH_HARDENED-6972e00d   (2)

$ uv run netapi ios exec "show ip access-list xACSACLx-IP-LINUX_RESEARCH_HARDENED-6972e00d"
Extended IP access list xACSACLx-IP-LINUX_RESEARCH_HARDENED-6972e00d (per-user)
    1 deny ip any 10.0.0.0 0.255.255.255
    2 deny ip any 172.16.0.0 0.15.255.255
    3 deny ip any 192.168.0.0 0.0.255.255
    4 permit udp any host 10.50.1.50 eq domain
    5 permit udp any any eq ntp
    6 permit tcp any host 10.50.1.21 eq 8443
    7 permit tcp any host 10.50.1.21 eq 8905
    8 permit tcp any any eq www
    9 permit tcp any any eq 443
    10 permit tcp any any eq 22
    11 deny ip any any log

# Internal BLOCKED (RFC1918 denied)
$ ping -c 3 10.50.1.1
PING 10.50.1.1 (10.50.1.1) 56(84) bytes of data.
--- 10.50.1.1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2056ms   (1)

# Internet WORKS (HTTPS permitted)
$ curl -sI https://google.com | head -1
HTTP/2 301   (2)

# Load secrets
dsource d000 dev/network

# Policy Sets and Rules
uv run netapi ise get-policy-sets
uv run netapi ise get-policy-set "Domus-Wired 802.1X"
uv run netapi ise get-auth-rules "Domus-Wired 802.1X"
uv run netapi ise get-authz-rules "Domus-Wired 802.1X"

# Certificate Profile
uv run netapi ise get-cert-profiles
uv run netapi ise get-cert-profile "AD_Cert_Profile"

# Authorization Profiles and dACLs
uv run netapi ise get-authz-profiles
uv run netapi ise get-authz-profile "Linux_EAPTLS_Permit"
uv run netapi ise get-dacls
uv run netapi ise get-dacl "LINUX_RESEARCH_HARDENED"

# Create dACL from file
uv run netapi ise create-dacl LINUX_RESEARCH_HARDENED \
  --file /path/to/dacl.txt \
  --descr "Zero-trust dACL - blocks RFC1918, permits internet"

# Update profile with dACL
uv run netapi ise update-authz-profile "Linux_EAPTLS_Permit" \
  --dacl LINUX_RESEARCH_HARDENED

# Set reauth timer (seconds)
uv run netapi ise update-authz-profile "Linux_EAPTLS_Permit" \
  --reauth-timer 3600

# Verify profile
uv run netapi ise get-authz-profile "Linux_EAPTLS_Permit"

# Check session with dACL and timeout (elegant one-liner)
INT="GigabitEthernet1/0/5" && \
uv run netapi ios exec "show access-session interface $INT detail" \
  | grep -E "User-Name|Status|Vlan|ACS ACL|IPv4|MAC|Session timeout" && echo "---" && \
ACL=$(uv run netapi ios exec "show access-session interface $INT detail" \
  | awk '/ACS ACL/{print $3}') && \
uv run netapi ios exec "show ip access-list $ACL"

# Force re-authentication (use 'run' not 'exec' for clear commands)
uv run netapi ios run "clear access-session interface GigabitEthernet1/0/5"

# Check ISE live logs
uv run netapi ise mnt session C8:5B:76:C6:59:62

# Step 1: Find which authorization profile is using the dACL
uv run netapi ise get-authz-profiles | grep -i linux

# Output:
# │ Linux_EAPTLS_Permit          │ 94aab910-f18b-11f0-b76e-52c54a1d1f56 │
# │ Linux_Posture_Compliant      │ 0027b090-f1ae-11f0-b76e-52c54a1d1f56 │

# Step 2: Create fixed ACL content using heredoc
cat > /tmp/LINUX_RESEARCH_ZERO_TRUST.txt << 'EOF'
deny icmp any 10.0.0.0 0.255.255.255
deny icmp any 172.16.0.0 0.15.255.255
deny icmp any 192.168.0.0 0.0.255.255
permit icmp any any
permit udp any host 10.50.1.1 eq 53
permit udp any host 10.50.1.50 eq 53
permit udp any eq 53 any gt 1023
permit udp any host 10.50.1.1 eq 123
permit udp any eq 123 any gt 1023
permit tcp any host 10.50.1.50 eq 88
permit udp any host 10.50.1.50 eq 88
permit tcp any host 10.50.1.50 eq 389
permit tcp any host 10.50.1.50 eq 636
permit tcp any host 10.50.1.50 eq 445
permit tcp any host 10.50.1.21 eq 8443
permit tcp any host 10.50.1.21 eq 8905
permit tcp any eq 22 10.50.0.0 0.0.255.255 gt 1023
permit tcp any any eq 80
permit tcp any eq 80 any gt 1023
permit tcp any any eq 443
permit tcp any eq 443 any gt 1023
deny ip any 10.0.0.0 0.255.255.255
deny ip any 172.16.0.0 0.15.255.255
deny ip any 192.168.0.0 0.0.255.255
EOF

# Step 3: Create V2 dACL (can't delete original - it's in use)
uv run netapi ise create-dacl LINUX_RESEARCH_ZERO_TRUST_V2 \
  --file /tmp/LINUX_RESEARCH_ZERO_TRUST.txt \
  --descr "Zero-trust ACL for domain-joined Linux workstations - ICMP hardened V2"

# Output:
# Creating DACL: LINUX_RESEARCH_ZERO_TRUST_V2
#   OK (ID: 2254dfe0-fbb7-11f0-9bb2-fafc6167f873)

# Step 4: Update authorization profile to use V2
uv run netapi ise update-authz-profile "Linux_EAPTLS_Permit" \
  --dacl LINUX_RESEARCH_ZERO_TRUST_V2

# Output:
# ✓ Updated authorization profile: Linux_EAPTLS_Permit
#   DACL: LINUX_RESEARCH_ZERO_TRUST_V2

# Step 5: Verify current session still has old ACL
uv run netapi ios exec "show access-s int g1/0/5 d" | grep "ACS ACL"

# Output:
#               ACS ACL:  xACSACLx-IP-LINUX_RESEARCH_ZERO_TRUST-69790b85
# ^-- Still old ACL! Session is already active

# Step 6: Trigger CoA to apply new ACL
uv run netapi ise mnt coa 10:60:4b:e9:7e:ed

# Output:
# ✓ CoA Reauth sent to 10:60:4b:e9:7e:ed

# Step 7: Verify new ACL is applied
uv run netapi ios exec "show access-s int g1/0/5 d" | grep "ACS ACL"

# Output:
#               ACS ACL:  xACSACLx-IP-LINUX_RESEARCH_ZERO_TRUST_V2-<new-hash>
# ^-- NEW ACL applied!

# Step 8: Delete old dACL (now safe since not in use)
uv run netapi ise delete-dacl LINUX_RESEARCH_ZERO_TRUST

# Step 9: Optionally rename V2 to production name
# (Requires repeating steps 3-7 with final name)

# Create test script locally
cat > /tmp/test-zero-trust.sh << 'EOF'
#!/bin/bash

echo "=== Testing PERMITTED traffic ==="
echo ""

echo "Test 1: Internet ICMP (8.8.8.8)"
timeout 3 ping -c 2 8.8.8.8 && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "Test 2: DNS to pfSense (10.50.1.1)"
timeout 3 dig google.com @10.50.1.1 +short && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "Test 3: DNS to DC (10.50.1.50)"
timeout 3 dig google.com @10.50.1.50 +short && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "Test 4: HTTPS to internet"
timeout 3 curl -sI https://google.com | head -1 && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "Test 5: Kerberos to DC (10.50.1.50:88)"
timeout 3 bash -c '</dev/tcp/10.50.1.50/88' 2>/dev/null && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "Test 6: LDAP to DC (10.50.1.50:389)"
timeout 3 bash -c '</dev/tcp/10.50.1.50/389' 2>/dev/null && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "Test 7: LDAPS to DC (10.50.1.50:636)"
timeout 3 bash -c '</dev/tcp/10.50.1.50/636' 2>/dev/null && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "Test 8: SMB to DC (10.50.1.50:445)"
timeout 3 bash -c '</dev/tcp/10.50.1.50/445' 2>/dev/null && echo "✓ PASS" || echo "✗ FAIL"
echo ""

echo "=== Testing BLOCKED traffic (should timeout) ==="
echo ""

echo "Test 9: Ping to pfSense (10.50.1.1) - should FAIL"
timeout 3 ping -c 2 10.50.1.1 && echo "✗ SECURITY ISSUE: Internal ICMP allowed!" || echo "✓ CORRECTLY BLOCKED"
echo ""

echo "Test 10: SSH to switch (10.50.1.10:22) - should FAIL"
timeout 3 bash -c '</dev/tcp/10.50.1.10/22' 2>/dev/null && echo "✗ SECURITY ISSUE: Lateral movement allowed!" || echo "✓ CORRECTLY BLOCKED"
echo ""

echo "Test 11: HTTP to internal server (10.50.2.1:80) - should FAIL"
timeout 3 bash -c '</dev/tcp/10.50.2.1/80' 2>/dev/null && echo "✗ SECURITY ISSUE: Internal access allowed!" || echo "✓ CORRECTLY BLOCKED"
echo ""

echo "Test 12: RDP to Windows host (10.50.3.10:3389) - should FAIL"
timeout 3 bash -c '</dev/tcp/10.50.3.10/3389' 2>/dev/null && echo "✗ SECURITY ISSUE: RDP lateral movement!" || echo "✓ CORRECTLY BLOCKED"
EOF

# Deploy and run on target workstation
scp /tmp/test-zero-trust.sh <target-host>:/tmp/
ssh <target-host> 'chmod +x /tmp/test-zero-trust.sh && /tmp/test-zero-trust.sh'

❯ ssh modestus-p50 '/tmp/test-zero-trust.sh'

=== Testing PERMITTED traffic ===

Test 1: Internet ICMP (8.8.8.8)
✓ PASS

Test 2: DNS to pfSense (10.50.1.1)
✓ PASS

Test 3: DNS to DC (10.50.1.50)
✓ PASS

Test 4: HTTPS to internet
✓ PASS

Test 5: Kerberos to DC (10.50.1.50:88)
✓ PASS

Test 6: LDAP to DC (10.50.1.50:389)
✓ PASS

Test 7: LDAPS to DC (10.50.1.50:636)
✓ PASS

Test 8: SMB to DC (10.50.1.50:445)
✓ PASS

=== Testing BLOCKED traffic (should timeout) ===

Test 9: Ping to pfSense (10.50.1.1) - should FAIL
✓ CORRECTLY BLOCKED   <-- ICMP HARDENING WORKING!

Test 10: SSH to switch (10.50.1.10:22) - should FAIL
✓ CORRECTLY BLOCKED

Test 11: HTTP to internal server (10.50.2.1:80) - should FAIL
✓ CORRECTLY BLOCKED

Test 12: RDP to Windows host (10.50.3.10:3389) - should FAIL
✓ CORRECTLY BLOCKED

cat > /tmp/test-requirements.sh << 'EOF'
#!/bin/bash

echo "=== Zero-Trust Requirements Validation ==="
echo ""

# Test 1: Domain Join
echo "Test 1: Domain Join Status"
if realm list | grep -q "configured: kerberos-member"; then
    echo "✓ PASS - Domain joined to $(realm list | grep 'realm-name' | awk '{print $2}')"
else
    echo "✗ FAIL - Not domain joined"
fi
echo ""

# Test 2: DNS Resolution (Internal)
echo "Test 2: DNS Resolution (Internal)"
if host dc-01.inside.domusdigitalis.dev 10.50.1.50 >/dev/null 2>&1; then
    echo "✓ PASS - Can resolve internal DNS"
else
    echo "✗ FAIL - Cannot resolve internal DNS"
fi
echo ""

# Test 3: DNS Resolution (External)
echo "Test 3: DNS Resolution (External)"
if host google.com 10.50.1.1 >/dev/null 2>&1; then
    echo "✓ PASS - Can resolve external DNS"
else
    echo "✗ FAIL - Cannot resolve external DNS"
fi
echo ""

# Test 4: Kerberos TGT
echo "Test 4: Kerberos Ticket"
if klist -s 2>/dev/null; then
    echo "✓ PASS - Valid Kerberos ticket"
    klist | grep "Default principal" || true
else
    echo "✗ FAIL - No valid Kerberos ticket (expected via SSH)"
fi
echo ""

# Test 5: LDAP to DC
echo "Test 5: LDAP Connectivity"
if timeout 3 bash -c '</dev/tcp/10.50.1.50/389' 2>/dev/null; then
    echo "✓ PASS - LDAP reachable"
else
    echo "✗ FAIL - LDAP not reachable"
fi
echo ""

# Test 6: LDAPS to DC
echo "Test 6: LDAPS Connectivity"
if timeout 3 bash -c '</dev/tcp/10.50.1.50/636' 2>/dev/null; then
    echo "✓ PASS - LDAPS reachable"
else
    echo "✗ FAIL - LDAPS not reachable"
fi
echo ""

# Test 7: SMB to DC (for cert enrollment)
echo "Test 7: SMB to DC (Certificate Enrollment)"
if timeout 3 bash -c '</dev/tcp/10.50.1.50/445' 2>/dev/null; then
    echo "✓ PASS - SMB reachable for certs"
else
    echo "✗ FAIL - SMB not reachable"
fi
echo ""

# Test 8: Internet Connectivity
echo "Test 8: Internet HTTPS"
if timeout 3 curl -sI https://google.com >/dev/null 2>&1; then
    echo "✓ PASS - Internet accessible"
else
    echo "✗ FAIL - Internet not accessible"
fi
echo ""

# Test 9: ISE Posture Access
echo "Test 9: ISE Posture Portal"
if timeout 3 bash -c '</dev/tcp/10.50.1.21/8443' 2>/dev/null; then
    echo "✓ PASS - ISE posture reachable"
else
    echo "✗ FAIL - ISE posture not reachable"
fi
echo ""

# Test 10: Zero-Trust Validation (Internal blocked)
echo "Test 10: Zero-Trust Isolation (Lateral Movement)"
if timeout 3 bash -c '</dev/tcp/10.50.1.10/22' 2>/dev/null; then
    echo "✗ SECURITY ISSUE - Can reach switch (lateral movement!)"
else
    echo "✓ PASS - Internal lateral movement blocked"
fi
echo ""

echo "=== Summary ==="
echo "All critical requirements validated for zero-trust workstation"
EOF

chmod +x /tmp/test-requirements.sh
scp /tmp/test-requirements.sh modestus-p50:/tmp/
ssh modestus-p50 '/tmp/test-requirements.sh'

=== Zero-Trust Requirements Validation ===

Test 1: Domain Join Status
✓ PASS - Domain joined to INSIDE.DOMUSDIGITALIS.DEV

Test 2: DNS Resolution (Internal)
✓ PASS - Can resolve internal DNS

Test 3: DNS Resolution (External)
✓ PASS - Can resolve external DNS

Test 4: Kerberos Ticket
✗ FAIL - No valid Kerberos ticket (expected via SSH)

Test 5: LDAP Connectivity
✓ PASS - LDAP reachable

Test 6: LDAPS Connectivity
✓ PASS - LDAPS reachable

Test 7: SMB to DC (Certificate Enrollment)
✓ PASS - SMB reachable for certs

Test 8: Internet HTTPS
✓ PASS - Internet accessible

Test 9: ISE Posture Portal
✗ FAIL - ISE posture not reachable

Test 10: Zero-Trust Isolation (Lateral Movement)
✓ PASS - Internal lateral movement blocked

=== Summary ===
All critical requirements validated for zero-trust workstation

# Check ISE live logs for denies
netapi ise mnt auth-logs <mac-address> --limit 20

# Query DataConnect for denied ACL hits (if available)
netapi ise dc query "SELECT * FROM radius_accounting WHERE acl_name LIKE '%ZERO_TRUST%'"

# Check switch for ACL hit counts
uv run netapi ios exec "show ip access-list xACSACLx-IP-LINUX_RESEARCH_ZERO_TRUST-<hash>"