WEBVTT

1
00:00.000 --> 00:01.730 align:middle line:84%


2
00:01.730 --> 00:03.490 align:middle line:90%
In this video, you and
I could take a look

3
00:03.490 --> 00:06.730 align:middle line:90%
at the big picture of TrustSec
and a few of the components

4
00:06.730 --> 00:09.543 align:middle line:90%
in the magic and logic
that makes it work.

5
00:09.543 --> 00:10.960 align:middle line:90%
Let's start off
with this diagram.

6
00:10.960 --> 00:12.610 align:middle line:84%
Let's imagine the device here.

7
00:12.610 --> 00:15.610 align:middle line:90%
If I say a user at that
device is going to connect

8
00:15.610 --> 00:19.510 align:middle line:90%
to the switch-- now, if we are
using MAC authentication bypass

9
00:19.510 --> 00:23.255 align:middle line:90%
or, better yet, using 802.1x, we
can identify who that device is

10
00:23.255 --> 00:25.630 align:middle line:90%
or who that user is behind
that device that's connecting.

11
00:25.630 --> 00:27.232 align:middle line:90%
And then coordinating
with ISE, we

12
00:27.232 --> 00:28.690 align:middle line:90%
can go ahead and
know who they are.

13
00:28.690 --> 00:31.700 align:middle line:90%
Now, in addition to just
knowing who they are,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.690 --> 00:31.700 align:middle line:90%
Now, in addition to just
knowing who they are,

14
00:31.700 --> 00:33.550 align:middle line:90%
we can also use
or leverage what's

15
00:33.550 --> 00:36.190 align:middle line:90%
known in TrustSec
as a security group.

16
00:36.190 --> 00:39.130 align:middle line:90%
Think of a security group
just like a logical group.

17
00:39.130 --> 00:41.350 align:middle line:90%
And that group can have
members of that group,

18
00:41.350 --> 00:43.130 align:middle line:90%
or they can be
assigned to that group.

19
00:43.130 --> 00:47.560 align:middle line:90%
And let's imagine that Bob,
who is a member of ISE ops,

20
00:47.560 --> 00:48.678 align:middle line:84%
has been authenticated.

21
00:48.678 --> 00:50.470 align:middle line:90%
And as part of that
authentication and part

22
00:50.470 --> 00:52.450 align:middle line:90%
of the authorization
policy, we've

23
00:52.450 --> 00:55.840 align:middle line:90%
assigned Bob to this security
group called ISE-Ops.

24
00:55.840 --> 00:58.990 align:middle line:90%
Now, each security
group has a SGT number.

25
00:58.990 --> 01:02.500 align:middle line:90%
An SGT stands for Security Group
tag, or in some environments,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.990 --> 01:02.500 align:middle line:90%
An SGT stands for Security Group
tag, or in some environments,

26
01:02.500 --> 01:04.379 align:middle line:90%
it stands for
Scalable Group Tag.

27
01:04.379 --> 01:06.920 align:middle line:90%
But it's simply a number that's
associated with a security

28
01:06.920 --> 01:07.420 align:middle line:84%
group.

29
01:07.420 --> 01:10.540 align:middle line:90%
So ISE-Ops, in this
example on this chalkboard,

30
01:10.540 --> 01:12.760 align:middle line:84%
has a security group tag of 19.

31
01:12.760 --> 01:15.070 align:middle line:90%
ISE-Admins-- and let's
imagine that Luis,

32
01:15.070 --> 01:17.067 align:middle line:90%
when he logs on
somewhere, is going

33
01:17.067 --> 01:19.150 align:middle line:90%
to be assigned these
security group of ISE-Admins.

34
01:19.150 --> 01:21.250 align:middle line:90%
And that has a
group number of 18.

35
01:21.250 --> 01:23.060 align:middle line:90%
And there's also another
group right here.

36
01:23.060 --> 01:25.817 align:middle line:90%
Let's have a little Raspberry
Pi, which in lab environment

37
01:25.817 --> 01:28.150 align:middle line:90%
is going to play the part of
a little internet-of-things

38
01:28.150 --> 01:28.480 align:middle line:84%
device.

39
01:28.480 --> 01:29.958 align:middle line:90%
And let's imagine
when it connects,

40
01:29.958 --> 01:31.750 align:middle line:90%
we're going to associate
it with a security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.958 --> 01:31.750 align:middle line:90%
we're going to associate
it with a security

41
01:31.750 --> 01:37.270 align:middle line:90%
group of PCB-PCs, which has
a security group tag of 20.

42
01:37.270 --> 01:39.220 align:middle line:90%
Now what happens next
is pretty amazing.

43
01:39.220 --> 01:41.110 align:middle line:90%
When those packets from
those individuals who

44
01:41.110 --> 01:42.527 align:middle line:90%
are part of those
security groups,

45
01:42.527 --> 01:44.200 align:middle line:90%
as they are being
sent into the network,

46
01:44.200 --> 01:46.367 align:middle line:90%
not only does the system
know who they are, but it's

47
01:46.367 --> 01:49.360 align:middle line:90%
going to include those SGTs,
those tags for the groups

48
01:49.360 --> 01:49.967 align:middle line:84%
they're in.

49
01:49.967 --> 01:51.550 align:middle line:90%
And those are included
in a little CMD

50
01:51.550 --> 01:55.710 align:middle line:90%
field in the frame of the
packets, so packet by packet.

51
01:55.710 --> 01:57.520 align:middle line:90%
Packets from people
in one group are going

52
01:57.520 --> 01:58.870 align:middle line:84%
to have the tag for that group.

53
01:58.870 --> 02:00.640 align:middle line:90%
Packets from devices
in a different group
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:58.870 --> 02:00.640 align:middle line:90%
Packets from devices
in a different group

54
02:00.640 --> 02:02.440 align:middle line:90%
are going to have a
different tag number.

55
02:02.440 --> 02:06.130 align:middle line:90%
Now, the question might
be, well Keith, so what?

56
02:06.130 --> 02:08.229 align:middle line:90%
If we're just implementing
this little tag in each

57
02:08.229 --> 02:10.570 align:middle line:90%
of the frames from Bob
or Luis or that PC,

58
02:10.570 --> 02:12.070 align:middle line:84%
how is that going to help us?

59
02:12.070 --> 02:13.180 align:middle line:84%
Check this out.

60
02:13.180 --> 02:16.180 align:middle line:90%
What we can do is we can specify
what we want the rules to be

61
02:16.180 --> 02:17.950 align:middle line:84%
between these logical groups.

62
02:17.950 --> 02:22.030 align:middle line:90%
We could say, between ISE-Admins
going over to ISE-Ops,

63
02:22.030 --> 02:23.590 align:middle line:90%
we want to permit
these protocols

64
02:23.590 --> 02:25.120 align:middle line:84%
or deny these protocols.

65
02:25.120 --> 02:29.860 align:middle line:90%
Or from ISE-Admins going to the
PCB-PCs group, we want a permit

66
02:29.860 --> 02:31.120 align:middle line:84%
or allow different protocols.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.860 --> 02:31.120 align:middle line:84%
or allow different protocols.

67
02:31.120 --> 02:32.110 align:middle line:84%
And check this out.

68
02:32.110 --> 02:33.190 align:middle line:84%
We can even say this.

69
02:33.190 --> 02:36.550 align:middle line:90%
We can say, we want certain
protocols or certain ports

70
02:36.550 --> 02:40.510 align:middle line:90%
allowed network wise between
devices in the same group.

71
02:40.510 --> 02:41.990 align:middle line:84%
I mean, this is amazing.

72
02:41.990 --> 02:43.900 align:middle line:90%
So let's imagine
it's Luis up here.

73
02:43.900 --> 02:45.940 align:middle line:84%
So Luis has been authenticated.

74
02:45.940 --> 02:48.550 align:middle line:84%
Luis is a member of ISE-Admins.

75
02:48.550 --> 02:50.593 align:middle line:90%
He has this little
security group tag of 18.

76
02:50.593 --> 02:52.760 align:middle line:90%
And as his packets are
flowing through the network--

77
02:52.760 --> 02:54.220 align:middle line:90%
let's imagine he's
down here, and he's

78
02:54.220 --> 02:55.360 align:middle line:84%
trying to get to devices.

79
02:55.360 --> 02:56.277 align:middle line:84%
Maybe it's the server.

80
02:56.277 --> 02:58.840 align:middle line:90%
In fact, maybe it's
this a PC or device

81
02:58.840 --> 03:02.022 align:middle line:90%
that is a member of
this group PCB-PCs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:58.840 --> 03:02.022 align:middle line:90%
that is a member of
this group PCB-PCs.

82
03:02.022 --> 03:02.980 align:middle line:84%
Well, here's the magic.

83
03:02.980 --> 03:08.900 align:middle line:90%
This device-- let's imagine
this is port 22 on this switch.

84
03:08.900 --> 03:09.820 align:middle line:84%
And here's the magic.

85
03:09.820 --> 03:12.970 align:middle line:90%
Switch z right here on this
port, where device C is

86
03:12.970 --> 03:14.600 align:middle line:84%
connected, it knows--

87
03:14.600 --> 03:16.480 align:middle line:90%
and let's imagine
that's port 22.

88
03:16.480 --> 03:19.150 align:middle line:90%
It's going to be aware of these
security groups, the tags,

89
03:19.150 --> 03:20.660 align:middle line:84%
and also the rules.

90
03:20.660 --> 03:23.890 align:middle line:90%
So whatever rules are
in place between 18

91
03:23.890 --> 03:28.300 align:middle line:90%
going to 20, which is the
ISE-Admins going to PCB,

92
03:28.300 --> 03:30.370 align:middle line:90%
this switich is going
to enforce that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:28.300 --> 03:30.370 align:middle line:90%
this switich is going
to enforce that.

93
03:30.370 --> 03:33.850 align:middle line:90%
And so if we denied telnet
the switch where that packet

94
03:33.850 --> 03:36.740 align:middle line:90%
or frame is about to egress
or go out to that device,

95
03:36.740 --> 03:38.932 align:middle line:90%
the security is
implemented right there.

96
03:38.932 --> 03:40.390 align:middle line:90%
Now, if you think
about it, we just

97
03:40.390 --> 03:42.070 align:middle line:90%
took security from a
network perspective

98
03:42.070 --> 03:44.380 align:middle line:90%
to a whole other
level because we

99
03:44.380 --> 03:47.620 align:middle line:90%
don't have to go in and manually
configure access control

100
03:47.620 --> 03:49.720 align:middle line:84%
lists on layer-3 interfaces.

101
03:49.720 --> 03:51.700 align:middle line:90%
In ISE, we can
implement or specify

102
03:51.700 --> 03:54.490 align:middle line:90%
what we want the policy to be,
what the relationship should

103
03:54.490 --> 03:56.410 align:middle line:90%
be between this
group and that group

104
03:56.410 --> 03:57.940 align:middle line:84%
or within a certain group.

105
03:57.940 --> 03:59.950 align:middle line:90%
And then as individuals
or identities

106
03:59.950 --> 04:02.440 align:middle line:90%
are authenticated as
they go into the network,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:59.950 --> 04:02.440 align:middle line:90%
are authenticated as
they go into the network,

107
04:02.440 --> 04:04.303 align:middle line:90%
they're given their
appropriate tag.

108
04:04.303 --> 04:06.970 align:middle line:90%
And then when that traffic tries
to get to its final destination

109
04:06.970 --> 04:09.640 align:middle line:90%
on the egress device,
those security group tags

110
04:09.640 --> 04:11.740 align:middle line:90%
and the rules are
going to be checked.

111
04:11.740 --> 04:14.560 align:middle line:90%
And that way we can implement
a policy one time centrally

112
04:14.560 --> 04:17.165 align:middle line:90%
about who gets access to
what regarding the groups,

113
04:17.165 --> 04:18.790 align:middle line:90%
and then it can be
enforced dynamically

114
04:18.790 --> 04:21.220 align:middle line:90%
for us on all the
network access devices.

115
04:21.220 --> 04:22.900 align:middle line:84%
It's pretty darn cool.

116
04:22.900 --> 04:24.820 align:middle line:90%
Now, what I'd like to
do is walk you through,

117
04:24.820 --> 04:27.320 align:middle line:90%
from soup to dessert,
on getting it done.

118
04:27.320 --> 04:30.370 align:middle line:90%
So in the next video, we'll
take a look at security groups
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:27.320 --> 04:30.370 align:middle line:90%
So in the next video, we'll
take a look at security groups

119
04:30.370 --> 04:33.210 align:middle line:90%
that we're going to leverage
for security rules and so forth.

120
04:33.210 --> 04:34.330 align:middle line:90%
But I wanted to walk
you through where

121
04:34.330 --> 04:35.747 align:middle line:90%
we can find these
security groups,

122
04:35.747 --> 04:37.360 align:middle line:90%
how we can create
them, and set up

123
04:37.360 --> 04:39.508 align:middle line:90%
the properties of
these security groups.

124
04:39.508 --> 04:41.300 align:middle line:90%
And all that's coming
up in the next video.

125
04:41.300 --> 04:42.925 align:middle line:90%
So I'll see you there
in just a moment.

126
04:42.925 --> 04:45.250 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

127
04:45.250 --> 04:48.650 align:middle line:90%
and I'd like to thank
you for viewing.