{"id":95330,"date":"2020-09-28T07:42:51","date_gmt":"2020-09-28T05:42:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/cisco-ise-sozdanie-polzovatelej-dobavlenie-ldap-serverov-integracziya-s-ad-chast-2"},"modified":"2020-09-28T07:42:51","modified_gmt":"2020-09-28T05:42:51","slug":"cisco-ise-sozdanie-polzovatelej-dobavlenie-ldap-serverov-integracziya-s-ad-chast-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/cisco-ise-sozdanie-polzovatelej-dobavlenie-ldap-serverov-integracziya-s-ad-chast-2","title":{"rendered":"Cisco ISE: Vytv\u00e1\u0159en\u00ed u\u017eivatel\u016f, p\u0159id\u00e1v\u00e1n\u00ed LDAP server\u016f, integrace s AD. \u010c\u00e1st 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Cisco<\/p>\n

V\u00edtejte ve druh\u00e9m vyd\u00e1n\u00ed cyklu \u010dl\u00e1nk\u016f o Cisco ISE. V prvn\u00edm \u010dl\u00e1nku<\/u><\/a><\/noindex>  byly zd\u016frazn\u011bny v\u00fdhody a rozd\u00edly \u0159e\u0161en\u00ed \u0159\u00edzen\u00ed p\u0159\u00edstupu k s\u00edti (NAC) od standardn\u00edch AAA, jedine\u010dnost Cisco ISE, architektura a proces instalace produktu.<\/p>\n

V tomto \u010dl\u00e1nku se pono\u0159\u00edme do vytv\u00e1\u0159en\u00ed \u00fa\u010dt\u016f, p\u0159id\u00e1n\u00ed LDAP server\u016f a integrace s Microsoft Active Directory, stejn\u011b jako do nuanc\u00ed p\u0159i pr\u00e1ci s PassiveID. P\u0159ed \u010dten\u00edm d\u016frazn\u011b doporu\u010duji sezn\u00e1mit se s prvn\u00ed \u010d\u00e1st\u00ed<\/u><\/a><\/noindex>.<\/p>\n

1. Trocha terminologie<\/h2>\n

Identita u\u017eivatele<\/strong> \u2014 u\u017eivatelsk\u00fd \u00fa\u010det, kter\u00fd obsahuje informace o u\u017eivateli a vytv\u00e1\u0159\u00ed jeho p\u0159ihla\u0161ovac\u00ed \u00fadaje pro p\u0159\u00edstup k s\u00edti. N\u00e1sleduj\u00edc\u00ed parametry se obvykle uv\u00e1d\u011bj\u00ed v User Identity: u\u017eivatelsk\u00e9 jm\u00e9no, e-mailov\u00e1 adresa, heslo, popis \u00fa\u010dtu, skupina u\u017eivatel\u016f a role.<\/p>\n

U\u017eivatelsk\u00e9 skupiny <\/strong>\u2014 skupiny u\u017eivatel\u016f \u2014 jsou souhrnem jednotliv\u00fdch u\u017eivatel\u016f, kte\u0159\u00ed maj\u00ed spole\u010dnou sadu opr\u00e1vn\u011bn\u00ed, kter\u00e1 jim umo\u017e\u0148uj\u00ed p\u0159\u00edstup k ur\u010dit\u00e9 sad\u011b slu\u017eeb a funkc\u00ed Cisco ISE.<\/p>\n

User Identity Groups \u2014 <\/strong>p\u0159edem definovan\u00e9 u\u017eivatelsk\u00e9 skupiny, kter\u00e9 ji\u017e maj\u00ed ur\u010dit\u00e9 informace a role. N\u00e1sleduj\u00edc\u00ed p\u0159edem definovan\u00e9 skupiny existuj\u00ed ve v\u00fdchoz\u00edm nastaven\u00ed, do kter\u00fdch lze p\u0159id\u00e1vat u\u017eivatele a u\u017eivatelsk\u00e9 skupiny: Employee (zam\u011bstnanec), SponsorAllAccount, SponsorGroupAccounts, SponsorOwnAccounts (sponzorsk\u00e9 \u00fa\u010dty pro spr\u00e1vu hostitelsk\u00e9ho port\u00e1lu), Guest (host), ActivatedGuest (aktivovan\u00fd host).<\/p>\n

User Role \u2014 <\/strong>u\u017eivatelsk\u00e1 role \u2014 je soubor opr\u00e1vn\u011bn\u00ed, kter\u00fd ur\u010duje, jak\u00e9 \u00fakoly m\u016f\u017ee u\u017eivatel vykon\u00e1vat a k jak\u00fdm slu\u017eb\u00e1m m\u016f\u017ee m\u00edt p\u0159\u00edstup. \u010casto je u\u017eivatelsk\u00e1 role spojena se skupinou u\u017eivatel\u016f.<\/p>\n

Krom\u011b toho m\u00e1 ka\u017ed\u00fd u\u017eivatel a skupina u\u017eivatel\u016f dal\u0161\u00ed atributy, kter\u00e9 umo\u017e\u0148uj\u00ed vy\u010dlenit a p\u0159esn\u011bji ur\u010dit dan\u00e9ho u\u017eivatele (u\u017eivatelskou skupinu). Dal\u0161\u00ed informace v n\u00e1vodu<\/u><\/a><\/noindex>.<\/p>\n

2. Vytv\u00e1\u0159en\u00ed m\u00edstn\u00edch u\u017eivatel\u016f<\/h2>\n

1) V Cisco ISE je mo\u017en\u00e9 vytvo\u0159it m\u00edstn\u00ed u\u017eivatele a pou\u017e\u00edvat je v p\u0159\u00edstupov\u00e9 politice nebo dokonce jim p\u0159id\u011blit roli administrace produktu. Vyberte Administration \u2192 Identity Management \u2192 Identities \u2192 Users \u2192 Add.<\/em><\/p>\n

\"CiscoObr\u00e1zek 1. P\u0159id\u00e1n\u00ed m\u00edstn\u00edho u\u017eivatele do Cisco ISE<\/p>\n

2) V zobrazen\u00e9m okn\u011b vytvo\u0159te m\u00edstn\u00edho u\u017eivatele, p\u0159id\u011blte mu heslo a dal\u0161\u00ed srozumiteln\u00e9 parametry.<\/p>\n

\"CiscoObr\u00e1zek 2. Vytvo\u0159en\u00ed m\u00edstn\u00edho u\u017eivatele v Cisco ISE<\/p>\n

3) U\u017eivatel\u00e9 mohou b\u00fdt tak\u00e9 importov\u00e1ni. Na stejn\u00e9 z\u00e1lo\u017ece Administration \u2192 Identity Management \u2192 Identities \u2192 Users <\/em>vyberte mo\u017enost Importovat <\/em>a nahrajte csv nebo txt soubor s u\u017eivateli. Abychom z\u00edskali \u0161ablonu, zvolte Generate a Template<\/em>, pot\u00e9 jej vypl\u0148te informacemi o u\u017eivatel\u00edch ve vhodn\u00e9m form\u00e1tu.<\/p>\n

\"CiscoObr\u00e1zek 3. Import u\u017eivatel\u016f do Cisco ISE<\/p>\n

3. P\u0159id\u00e1n\u00ed LDAP server\u016f<\/h2>\n

P\u0159ipom\u00edn\u00e1m, \u017ee LDAP \u2014 popul\u00e1rn\u00ed aplika\u010dn\u00ed protokol, kter\u00fd umo\u017e\u0148uje z\u00edsk\u00e1vat informace, prov\u00e1d\u011bt autentizaci, vyhled\u00e1vat \u00fa\u010dty v adres\u00e1\u0159\u00edch LDAP server\u016f, funguje na portu 389 nebo 636 (SSL). P\u0159\u00edklady LDAP server\u016f zahrnuj\u00ed Active Directory, Sun Directory, Novell eDirectory a OpenLDAP. Ka\u017ed\u00fd z\u00e1znam v adres\u00e1\u0159i LDAP je definov\u00e1n DN (Distinguished Name) a pro formaci politiky p\u0159\u00edstupu je nutn\u00e9 prov\u00e9st vyhled\u00e1v\u00e1n\u00ed (retrieval) u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f, u\u017eivatelsk\u00fdch skupin a atribut\u016f.<\/p>\n

V Cisco ISE je mo\u017en\u00e9 nastavit p\u0159\u00edstup k mnoha LDAP server\u016fm, \u010d\u00edm\u017e se zav\u00e1d\u00ed redundance. V p\u0159\u00edpad\u011b, \u017ee prim\u00e1rn\u00ed (primary) LDAP server nen\u00ed dostupn\u00fd, zkus\u00ed ISE kontaktovat sekund\u00e1rn\u00ed (secondary) a tak d\u00e1le. Dal\u0161\u00ed mo\u017enost\u00ed, pokud jsou k dispozici 2 PAN, je nastavit pro prim\u00e1rn\u00ed PAN prioritn\u00ed jeden LDAP a pro sekund\u00e1rn\u00ed PAN \u2014 jin\u00fd LDAP.<\/p>\n

ISE podporuje 2 typy vyhled\u00e1v\u00e1n\u00ed (lookup) p\u0159i pr\u00e1ci s LDAP servery: User Lookup a MAC Address Lookup. User Lookup umo\u017e\u0148uje vyhled\u00e1v\u00e1n\u00ed u\u017eivatele v datab\u00e1zi LDAP a z\u00edsk\u00e1n\u00ed n\u00e1sleduj\u00edc\u00edch informac\u00ed bez autentizace: u\u017eivatel\u00e9 a jejich atributy, skupiny u\u017eivatel\u016f. MAC Address Lookup tak\u00e9 umo\u017e\u0148uje, bez autentizace, vyhled\u00e1vat podle MAC adresy v adres\u00e1\u0159\u00edch LDAP a z\u00edsk\u00e1vat informace o za\u0159\u00edzen\u00ed, skupin\u011b za\u0159\u00edzen\u00ed podle MAC adres a dal\u0161\u00ed specifick\u00e9 atributy.<\/p>\n

Jako p\u0159\u00edklad integrace p\u0159id\u00e1me Active Directory do Cisco ISE jako LDAP server.<\/p>\n

1) P\u0159ejd\u011bte na z\u00e1lo\u017eku Administration \u2192 Identity Management \u2192 External Identity Sources \u2192 LDAP \u2192 Add.<\/em> <\/p>\n

\"CiscoObr\u00e1zek 4. P\u0159id\u00e1n\u00ed LDAP serveru<\/p>\n

2) V panelu Obecn\u00e9 <\/em>zadejte n\u00e1zev LDAP serveru a sch\u00e9ma (v na\u0161em p\u0159\u00edpad\u011b Active Directory). <\/p>\n

\"CiscoObr\u00e1zek 5. P\u0159id\u00e1n\u00ed LDAP serveru se sch\u00e9matem Active Directory<\/p>\n

3) Pot\u00e9 p\u0159ejd\u011bte na Connection <\/em>z\u00e1lo\u017eku a zadejte Hostname\/IP address <\/em>AD servery, port (389 \u2014 LDAP, 636 \u2014 SSL LDAP), p\u0159ihla\u0161ovac\u00ed \u00fadaje dom\u00e9nov\u00e9ho administr\u00e1tora (Admin DN \u2014 pln\u00fd DN), ostatn\u00ed parametry lze ponechat jako v\u00fdchoz\u00ed.<\/p>\n

Pozn\u00e1mka<\/strong><\/em>: pou\u017eijte \u00fadaje dom\u00e9nov\u00e9ho administr\u00e1tora, aby se p\u0159ede\u0161lo mo\u017en\u00fdm probl\u00e9m\u016fm.<\/p>\n

\"CiscoObr\u00e1zek 6. Vstupn\u00ed data LDAP serveru<\/p>\n

4) Na z\u00e1lo\u017ece Organizace adres\u00e1\u0159e <\/em>je nutn\u00e9 uv\u00e9st oblast katalog\u016f pomoc\u00ed DN, odkud se maj\u00ed na\u010d\u00edst u\u017eivatel\u00e9 a skupiny u\u017eivatel\u016f.<\/p>\n

\"CiscoObr\u00e1zek 7. Ur\u010den\u00ed katalog\u016f, ze kter\u00fdch budou st\u00e1hnuty skupiny u\u017eivatel\u016f<\/p>\n

5) P\u0159ejd\u011bte do okna Skupiny \u2192 P\u0159idat \u2192 Vybrat skupiny z adres\u00e1\u0159e <\/em>pro volbu na\u010dten\u00ed skupin z LDAP serveru. <\/p>\n

\"CiscoObr\u00e1zek 8. P\u0159id\u00e1n\u00ed skupin z LDAP serveru<\/p>\n

6) V zobrazen\u00e9m okn\u011b stiskn\u011bte Na\u010d\u00edst skupiny. <\/em>Pokud se skupiny na\u010detly, znamen\u00e1 to, \u017ee p\u0159edchoz\u00ed kroky byly \u00fasp\u011b\u0161n\u011b dokon\u010deny. Jinak zkuste jin\u00e9ho administr\u00e1tora a zkontrolujte dostupnost ISE s LDAP serverem p\u0159es LDAP protokol.<\/p>\n

\"CiscoObr\u00e1zek 9. Seznam sta\u017een\u00fdch skupin u\u017eivatel\u016f<\/p>\n

7) Na z\u00e1lo\u017ece Atributy <\/em>m\u016f\u017eete voliteln\u011b uv\u00e9st, kter\u00e9 atributy z LDAP serveru maj\u00ed b\u00fdt na\u010dteny, a v okn\u011b Pokro\u010dil\u00e9 nastaven\u00ed <\/em>aktivovat mo\u017enost Povolit zm\u011bnu hesla<\/em>, kter\u00e1 donut\u00ed u\u017eivatele zm\u011bnit heslo, pokud vypr\u0161elo nebo bylo resetov\u00e1no. V ka\u017ed\u00e9m p\u0159\u00edpad\u011b klikn\u011bte na Odeslat <\/em>pro pokra\u010dov\u00e1n\u00ed.<\/p>\n

8) LDAP server se objevil na p\u0159\u00edslu\u0161n\u00e9 z\u00e1lo\u017ece a m\u016f\u017ee b\u00fdt d\u00e1le pou\u017e\u00edv\u00e1n pro vytv\u00e1\u0159en\u00ed politiky p\u0159\u00edstupu.<\/p>\n

\"CiscoObr\u00e1zek 10. Seznam p\u0159idan\u00fdch LDAP server\u016f<\/p>\n

4. Integrace s Active Directory<\/h2>\n

1) P\u0159id\u00e1n\u00edm serveru Microsoft Active Directory jako LDAP serveru jsme obdr\u017eeli u\u017eivatele, skupiny u\u017eivatel\u016f, ale ne logy. D\u00e1le doporu\u010duji nastavit plnou integraci AD s Cisco ISE. P\u0159ejd\u011bte na z\u00e1lo\u017eku Spr\u00e1va \u2192 Identita a spr\u00e1va \u2192 Extern\u00ed zdroje identity \u2192 Active Directory \u2192 P\u0159idat. <\/em><\/p>\n

Pozn\u00e1mka: <\/strong><\/em>Pro \u00fasp\u011b\u0161nou integraci s AD mus\u00ed b\u00fdt ISE v dom\u00e9n\u011b a m\u00edt plnou konektivitu s DNS, NTP a AD servery, jinak to nebude fungovat.<\/p>\n

\"CiscoObr\u00e1zek 11. P\u0159id\u00e1n\u00ed serveru Active Directory<\/p>\n

2) V zobrazen\u00e9m okn\u011b zadejte \u00fadaje administr\u00e1tora dom\u00e9ny a za\u0161krtn\u011bte pol\u00ed\u010dko Ulo\u017eit p\u0159ihla\u0161ovac\u00ed \u00fadaje. <\/em>D\u00e1le m\u016f\u017eete uv\u00e9st OU (Organiza\u010dn\u00ed jednotku), pokud se ISE nach\u00e1z\u00ed v n\u011bjak\u00e9 konkr\u00e9tn\u00ed OU. Budete tak\u00e9 muset vybrat uzly Cisco ISE, kter\u00e9 chcete spojit s dom\u00e9nou.<\/p>\n

\"CiscoObr\u00e1zek 12. Zadejte p\u0159ihla\u0161ovac\u00ed \u00fadaje<\/p>\n

3) P\u0159ed p\u0159id\u00e1n\u00edm dom\u00e9nov\u00fdch \u0159adi\u010d\u016f se ujist\u011bte, \u017ee na PSN na z\u00e1lo\u017ece Spr\u00e1va \u2192 Syst\u00e9m \u2192 Nasazen\u00ed<\/em> je aktivov\u00e1na mo\u017enost Pasivn\u00ed identitn\u00ed slu\u017eba<\/em>. PassiveID <\/strong>\u2014 mo\u017enost, kter\u00e1 umo\u017e\u0148uje transformovat User na IP a naopak. PassiveID z\u00edsk\u00e1v\u00e1 informace z AD prost\u0159ednictv\u00edm WMI, speci\u00e1ln\u00edch AD agent\u016f nebo SPAN portu na p\u0159ep\u00edna\u010di (ne nejlep\u0161\u00ed volba).<\/p>\n

Pozn\u00e1mka: <\/strong><\/em>pro kontrolu stavu Passive ID zadejte v konzoli ISE show application status ise | include PassiveID.<\/strong><\/p>\n

\"CiscoObr\u00e1zek 13. Aktivace mo\u017enosti PassiveID <\/p>\n

4) P\u0159ejd\u011bte na kartu Administration \u2192 Identity Management \u2192 External Identity Sources \u2192 Active Directory \u2192 PassiveID <\/em>a zvolte mo\u017enost Add DCs<\/em>. N\u00e1sledn\u011b vyberte za\u0161krt\u00e1vac\u00edmi pol\u00ed\u010dky pot\u0159ebn\u00e9 dom\u00e9nov\u00e9 kontrol\u00e9ry a stiskn\u011bte OK.<\/em><\/p>\n

\"CiscoObr\u00e1zek 14. P\u0159id\u00e1n\u00ed dom\u00e9nov\u00fdch kontrol\u00e9r\u016f<\/p>\n

5) Vyberte p\u0159idan\u00e9 DC a stiskn\u011bte tla\u010d\u00edtko Edit. <\/em>Uve\u010fte FQDN <\/em>va\u0161eho DC, dom\u00e9nov\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no a heslo, stejn\u011b jako mo\u017enost spojen\u00ed WMI <\/em>nebo Agent<\/em>. Vyberte WMI a stiskn\u011bte OK.<\/em><\/p>\n

\"CiscoObr\u00e1zek 15. Vlo\u017een\u00ed \u00fadaj\u016f kontrol\u00e9ru dom\u00e9ny<\/p>\n

6) Pokud WMI nen\u00ed preferovan\u00fdm zp\u016fsobem spojen\u00ed s Active Directory, m\u016f\u017eete pou\u017e\u00edt agenty ISE. Agentn\u00ed zp\u016fsob spo\u010d\u00edv\u00e1 v tom, \u017ee m\u016f\u017eete na servery nainstalovat speci\u00e1ln\u00ed agenty, kte\u0159\u00ed budou zas\u00edlat p\u0159ihla\u0161ovac\u00ed ud\u00e1losti. Existuj\u00ed 2 varianty instalace: automatick\u00e1 a ru\u010dn\u00ed. Pro automatickou instalaci agenta na stejn\u00e9 kart\u011b PassiveID <\/em>vyberte polo\u017eku Add Agent \u2192 Deploy New Agent<\/em> (DC mus\u00ed m\u00edt p\u0159\u00edstup k internetu). Pot\u00e9 vypl\u0148te povinn\u00e9 \u00fadaje (n\u00e1zev agenta, FQDN serveru, u\u017eivatelsk\u00e9 jm\u00e9no\/heslo dom\u00e9nov\u00e9ho spr\u00e1vce) a stiskn\u011bte OK.<\/em><\/p>\n

\"CiscoObr\u00e1zek 16. Automatick\u00e1 instalace ISE agenta<\/p>\n

7) Pro ru\u010dn\u00ed instalaci Cisco ISE agenta je t\u0159eba vybrat polo\u017eku Register Existing Agent<\/em>. Mimochodem, agenta si m\u016f\u017eete st\u00e1hnout na kart\u011b Work Centers \u2192 PassiveID \u2192 Providers \u2192 Agents \u2192 Download Agent.<\/em><\/p>\n

\"CiscoObr\u00e1zek 17. Stahov\u00e1n\u00ed ISE agenta<\/p>\n

D\u016fle\u017eit\u00e9: <\/strong><\/em>PassiveID nezaznamen\u00e1v\u00e1 ud\u00e1losti logoff<\/strong>! Parametr odpov\u011bdn\u00fd za \u010dasov\u00fd limit se naz\u00fdv\u00e1 user session aging time<\/strong> a je podle defaultu 24 hodin. Proto je t\u0159eba bu\u010f se s\u00e1m odhl\u00e1sit na konci pracovn\u00edho dne, nebo napsat n\u011bjak\u00fd skript, kter\u00fd automaticky odhl\u00e1s\u00ed v\u0161echny p\u0159ihl\u00e1\u0161en\u00e9 u\u017eivatele. <\/p>\n

Pro z\u00edsk\u00e1n\u00ed informac\u00ed logoff<\/strong> pou\u017e\u00edvaj\u00ed se \u201eEndpoint probes\u201c \u2014 koncov\u00e9 sondy. V Cisco ISE existuje n\u011bkolik Endpoint probes: RADIUS, SNMP Trap, SNMP Query, DHCP, DNS, HTTP, Netflow, NMAP Scan. RADIUS <\/strong>sonda pomoc\u00ed CoA <\/strong>(Change of Authorization) paket\u016f poskytuje informace o zm\u011bn\u011b opr\u00e1vn\u011bn\u00ed u\u017eivatele (k tomu je pot\u0159eba implementovan\u00fd 802.1X<\/strong>), a spr\u00e1vn\u011b nastaven\u00fd SNMP na p\u0159\u00edstupov\u00fdch switch\u00edch poskytne informace o p\u0159ipojen\u00fdch a odpojen\u00fdch za\u0159\u00edzen\u00edch.<\/p>\n

N\u00ed\u017ee je uveden p\u0159\u00edklad aktu\u00e1ln\u00ed konfigurace Cisco ISE + AD bez 802.1X a RADIUS: u\u017eivatel je p\u0159ihl\u00e1\u0161en na Windows stroji, ani\u017e by se odhl\u00e1sil, a p\u0159ihla\u0161uje se z jin\u00e9ho PC p\u0159es WiFi. V tomto p\u0159\u00edpad\u011b z\u016fstane relace na prvn\u00edm PC aktivn\u00ed, dokud nenastane \u010dasov\u00fd limit nebo nedojde k vynucen\u00e9mu odhl\u00e1\u0161en\u00ed. Pokud maj\u00ed za\u0159\u00edzen\u00ed r\u016fzn\u00e1 pr\u00e1va, posledn\u00ed p\u0159ihl\u00e1\u0161en\u00e9 za\u0159\u00edzen\u00ed bude uplat\u0148ovat sv\u00e1 pr\u00e1va.<\/p>\n

8) D\u00e1le na kart\u011b Administrace \u2192 Spr\u00e1va identity \u2192 Extern\u00ed zdroje identity \u2192 Active Directory \u2192 Skupiny \u2192 P\u0159idat \u2192 Vybrat skupiny z adres\u00e1\u0159e <\/em>m\u016f\u017eete vybrat skupiny z AD, kter\u00e9 chcete importovat do ISE (v na\u0161em p\u0159\u00edpad\u011b to bylo provedeno v bod\u011b 3 \u201eP\u0159id\u00e1n\u00ed LDAP serveru\u201c). Vyberte mo\u017enost Na\u010d\u00edst skupiny \u2192 OK<\/em>. <\/p>\n

\"CiscoObr\u00e1zek 18 a). Importov\u00e1n\u00ed u\u017eivatelsk\u00fdch skupin z Active Directory<\/p>\n

9) Na kart\u011b Pracovn\u00ed centra \u2192 PassiveID \u2192 P\u0159ehled \u2192 \u0158\u00eddic\u00ed panel<\/em> m\u016f\u017eete sledovat po\u010det aktivn\u00edch relac\u00ed, po\u010det zdroj\u016f dat, agent\u016f a dal\u0161\u00ed.<\/p>\n

\"CiscoObr\u00e1zek 19. Monitorov\u00e1n\u00ed aktivity dom\u00e9nov\u00fdch u\u017eivatel\u016f<\/p>\n

10) Na kart\u011b Aktu\u00e1ln\u00ed relace<\/em> se zobrazuj\u00ed aktu\u00e1ln\u00ed relace. Integrace s AD je nastavena.<\/p>\n

\"CiscoObr\u00e1zek 20. Aktivn\u00ed relace dom\u00e9nov\u00fdch u\u017eivatel\u016f<\/p>\n

5. Z\u00e1v\u011br<\/h2>\n

V tomto \u010dl\u00e1nku byly projedn\u00e1ny t\u00e9mata vytv\u00e1\u0159en\u00ed lok\u00e1ln\u00edch u\u017eivatel\u016f v Cisco ISE, p\u0159id\u00e1n\u00ed LDAP server\u016f a integrace s Microsoft Active Directory. V p\u0159\u00ed\u0161t\u00edm \u010dl\u00e1nku bude pojedn\u00e1no o hostuj\u00edc\u00edm p\u0159\u00edstupu ve form\u011b nadbyte\u010dn\u00e9ho pr\u016fvodce.<\/p>\n

Pokud m\u00e1te jak\u00e9koli dotazy ohledn\u011b t\u00e9to problematiky nebo pot\u0159ebujete pomoc s testov\u00e1n\u00edm produktu, obra\u0165te se na odkazu<\/u><\/a><\/noindex>.<\/p>\n

Sledujte aktualizace na na\u0161ich kan\u00e1lech (Telegram<\/u><\/a><\/noindex>, Facebook<\/u><\/a><\/noindex>, VK<\/u><\/a><\/noindex>, TS Solution Blog<\/u><\/a><\/noindex>, Yandex.Zen<\/u><\/a><\/noindex>).<\/p>\n

Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0446\u0438\u043a\u043b\u0430 \u0441\u0442\u0430\u0442\u0435\u0439, \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u043d\u043e\u043c\u0443 Cisco ISE. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435  \u0431\u044b\u043b\u0438 \u043e\u0441\u0432\u0435\u0449\u0435\u043d\u044b \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u0430 \u0438 \u043e\u0442\u043b\u0438\u0447\u0438\u044f Network Access Control (NAC) \u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043e\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0410\u0410\u0410, \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c Cisco ISE, \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430 \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0443\u0433\u043b\u0443\u0431\u0438\u043c\u0441\u044f \u0432 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044e LDAP \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044e \u0441 Microsoft Active Directory, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u043d\u044e\u0430\u043d\u0441\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95331,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95330","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cisco ISE: Vytv\u00e1\u0159en\u00ed u\u017eivatel\u016f, p\u0159id\u00e1n\u00ed LDAP server\u016f, integrace s AD. \u010c\u00e1st 2 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/cisco-ise-sozdanie-polzovatelej-dobavlenie-ldap-serverov-integracziya-s-ad-chast-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Cisco ISE: \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 LDAP \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0441 AD. \u0427\u0430\u0441\u0442\u044c 2 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/cisco-ise-sozdanie-polzovatelej-dobavlenie-ldap-serverov-integracziya-s-ad-chast-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-28T05:42:51+00:00","article:modified_time":"2020-09-28T05:42:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95330","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:07:33","updated":"2022-09-28 09:57:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=95330"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95330\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/95331"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=95330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=95330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=95330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}