Zero Trust Access Control: Nile RADIUS & Agentless Fingerprinting

Transcript:

This demonstration shows how Nile forces zero trust access across both wired and wireless networks within the zero trust fabric. In our example, two different device types are onboarded in this environment. A corporate employee device authenticates using.1x with certificate based authentication and posture validation through Microsoft in tune. Next, an IoT device is onboarded using agentless fingerprinting.

Both devices are automatically classified and placed into the appropriate security segment using Nile's identity-centric policy model.

In this environment, we've configured a corporate SSID that supports multiple identity based segments. For example, employees and contractors can connect to the same SSID, but their access is determined dynamically through policy.

Let's look at the radius policy that's used to onboard employee devices.

Here the administrator defines a policy chain that evaluates multiple identity and posture attributes.

Once EAP-TLS authentication is successfully validated by Nile’s native cloud radius service, the system checks a few additional conditions.

First, the device must be compliant with the MDM platform. in this case Microsoft in tune. Second, the user must belong to the employee group synchronized from the identity provider using SCIM and third the connection must originate from the corporate SSID.

All of these checks are combined using an and condition. When every condition is met, the device is automatically placed in the employee segment.

Now let's look at the device. Here we can see shift's corporate laptop which is connected to the corporate SSID because the authentication posture checks passed successfully. The device has been mapped to the invoice segment.

If you look at the authentication logs, you can see all the attributes that were used during the authorization decision.

These include the in tune compliance state, the SCIM group membership and the certificate-based EAP-TLS authentication.

These identity and posture signals allow Nile to enforce access decisions dynamically and consistently within the Nile access service. Access policies apply not only to user devices but also to IoT and IP based OT endpoints. Many of these devices cannot run agents or perform certificate authentication. So Nile uses agentless fingerprinting to identify and classify them. To demonstrate this, we'd onboard an IoT device, in this case, an IP connected speaker. Instead of relying on DHCP or radius attributes for device identification like clear pass or Cisco ISE, Nile performs multiffactor device fingerprinting using multiple telemetry sources including DHCP radius, DNS, MDNS, multicast, user agent data, and traffic behavior patterns. These signals allow Nile to classify devices at a much more granular level.

Let's create a fingerprint rule for our speaker and map it to the IoT segment.

As seen, a fingerprint rule has been created and our device up here has been approved and mapped to the IoT segment.

Nile does device validation checks. As seen here, our speaker failed validation and is now mapped to the system defined quarantine group.

The policy for all groups can be configured from our global policy set.

As seen here, our quarantine devices cannot communicate with the internet.

However, if the speaker had pass validation, it would be able to communicate with the PA controller as seen here. To summarize, employee devices whether wired or wireless authenticate using certificatebased.1x with posture validation. On the other hand, IoT devices are onboarded through continuous agentless fingerprinting.

Both device types are automatically classified and placed into identity based segments, enabling consistent zero trust enforcement across the entire network.

Thank you for watching.