WEBVTT

1
00:00.000 --> 00:02.690 align:middle line:84%


2
00:02.690 --> 00:05.210 align:middle line:90%
In this video, we're going to
take a look at the creation

3
00:05.210 --> 00:06.110 align:middle line:84%
of security groups.

4
00:06.110 --> 00:08.330 align:middle line:90%
Now, there are some security
groups that exist by default,

5
00:08.330 --> 00:09.830 align:middle line:90%
and certainly we
can leverage those,

6
00:09.830 --> 00:11.540 align:middle line:90%
but I also wanted to
walk you through in

7
00:11.540 --> 00:14.810 align:middle line:90%
the TrustSec workflow how we
can create security groups,

8
00:14.810 --> 00:17.370 align:middle line:90%
and look at the properties
of those groups.

9
00:17.370 --> 00:18.950 align:middle line:84%
And here we go.

10
00:18.950 --> 00:20.570 align:middle line:90%
One of the features
that I've really

11
00:20.570 --> 00:23.240 align:middle line:90%
come to enjoy and
appreciate inside of ISE

12
00:23.240 --> 00:25.310 align:middle line:90%
is the ability to use
their work center.

13
00:25.310 --> 00:27.728 align:middle line:90%
So if you hover over work
centers, they kind of line

14
00:27.728 --> 00:29.270 align:middle line:90%
everything up to
make it pretty easy.

15
00:29.270 --> 00:32.479 align:middle line:90%
So hovering over work centers,
let me go to TrustSec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.270 --> 00:32.479 align:middle line:90%
So hovering over work centers,
let me go to TrustSec.

16
00:32.479 --> 00:33.950 align:middle line:84%
And then we could click there.

17
00:33.950 --> 00:35.768 align:middle line:90%
And then all the subtabs
here are the same

18
00:35.768 --> 00:38.060 align:middle line:90%
that we could just go right
from that work center view.

19
00:38.060 --> 00:41.473 align:middle line:90%
So Overview, Components,
TrustSec Policy, et cetera.

20
00:41.473 --> 00:43.640 align:middle line:90%
And what I want to do is
start here with components,

21
00:43.640 --> 00:46.465 align:middle line:90%
and take a look at
security groups with you.

22
00:46.465 --> 00:47.840 align:middle line:90%
So these are the
security groups.

23
00:47.840 --> 00:50.000 align:middle line:90%
These are all here
by default. We

24
00:50.000 --> 00:51.290 align:middle line:84%
can use them, or not use them.

25
00:51.290 --> 00:52.460 align:middle line:84%
We can create new ones.

26
00:52.460 --> 00:54.350 align:middle line:90%
And I just want to
point out for the SGT

27
00:54.350 --> 00:57.380 align:middle line:90%
here, like for auditors,
it's number nine.

28
00:57.380 --> 01:00.440 align:middle line:90%
And for BYOD, that
group, it's number 15.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:57.380 --> 01:00.440 align:middle line:90%
And for BYOD, that
group, it's number 15.

29
01:00.440 --> 01:01.850 align:middle line:84%
And for contractors, it's five.

30
01:01.850 --> 01:04.879 align:middle line:90%
So basically, there's a
unique number for each group.

31
01:04.879 --> 01:07.670 align:middle line:90%
That way when you put
devices into that group

32
01:07.670 --> 01:09.620 align:middle line:90%
and they start being
identified and putting

33
01:09.620 --> 01:11.510 align:middle line:90%
in frames and packets
into the network,

34
01:11.510 --> 01:12.950 align:middle line:84%
they're going to include--

35
01:12.950 --> 01:15.110 align:middle line:90%
in the CMD field
of those frames,

36
01:15.110 --> 01:17.760 align:middle line:90%
it's going to include that
security group tag number.

37
01:17.760 --> 01:19.505 align:middle line:90%
And that way, the
end device, who's

38
01:19.505 --> 01:21.380 align:middle line:90%
about to deliver the
final packages, can say,

39
01:21.380 --> 01:22.040 align:middle line:84%
you know what?

40
01:22.040 --> 01:23.060 align:middle line:84%
Sorry.

41
01:23.060 --> 01:23.750 align:middle line:84%
I can't do it.

42
01:23.750 --> 01:25.640 align:middle line:90%
You're trying to go from
group 5 to group 10.

43
01:25.640 --> 01:27.880 align:middle line:90%
And that's not being
permitted by the policy.

44
01:27.880 --> 01:29.480 align:middle line:90%
Coming up, we'll
get to that policy.

45
01:29.480 --> 01:31.880 align:middle line:90%
So regarding security groups,
let's go ahead and just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:29.480 --> 01:31.880 align:middle line:90%
So regarding security groups,
let's go ahead and just

46
01:31.880 --> 01:34.700 align:middle line:90%
create three new
security groups.

47
01:34.700 --> 01:37.310 align:middle line:90%
And to do that,
we'll click on Add.

48
01:37.310 --> 01:41.120 align:middle line:84%
And let's call this ISE-Admins.

49
01:41.120 --> 01:42.950 align:middle line:90%
So we could create
groups for any reason.

50
01:42.950 --> 01:44.390 align:middle line:90%
If we wanted to,
like for example,

51
01:44.390 --> 01:47.815 align:middle line:90%
put all our thermostats in our
building into a specific group,

52
01:47.815 --> 01:48.440 align:middle line:84%
we could do it.

53
01:48.440 --> 01:50.570 align:middle line:90%
If we wanted to put
all our web servers

54
01:50.570 --> 01:53.300 align:middle line:90%
in a certain group, or DNS
servers in a certain group,

55
01:53.300 --> 01:53.900 align:middle line:84%
we could.

56
01:53.900 --> 01:57.200 align:middle line:90%
And that way we can control
access between groups, and also

57
01:57.200 --> 01:59.390 align:middle line:90%
within the group based
on the access control

58
01:59.390 --> 02:01.880 align:middle line:90%
list for those groups
that will implement.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
01:59.390 --> 02:01.880 align:middle line:90%
list for those groups
that will implement.

59
02:01.880 --> 02:03.950 align:middle line:90%
So I'm going to make
one for ISE-Admins.

60
02:03.950 --> 02:06.590 align:middle line:90%
And then we can either
manually assign this,

61
02:06.590 --> 02:09.410 align:middle line:90%
or we can dynamically
assign the security group

62
02:09.410 --> 02:12.140 align:middle line:90%
based on the authorization
policies that we set up.

63
02:12.140 --> 02:14.360 align:middle line:90%
So we'll create an
ISE-Admins group.

64
02:14.360 --> 02:16.520 align:middle line:84%
And that's it.

65
02:16.520 --> 02:18.650 align:middle line:84%
I'll go ahead and click on Save.

66
02:18.650 --> 02:19.940 align:middle line:84%
And so there's ISE-Admins.

67
02:19.940 --> 02:21.830 align:middle line:90%
Let's make one more
security group.

68
02:21.830 --> 02:24.830 align:middle line:84%
And we'll call it ISE-Ops.

69
02:24.830 --> 02:27.080 align:middle line:90%
Any list down here, it's
going to automatically assign

70
02:27.080 --> 02:28.100 align:middle line:84%
that 17 for us.

71
02:28.100 --> 02:29.600 align:middle line:84%
It's just picking the numbers.

72
02:29.600 --> 02:31.400 align:middle line:84%
And we'll click on Submit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:29.600 --> 02:31.400 align:middle line:84%
And we'll click on Submit.

73
02:31.400 --> 02:33.270 align:middle line:84%
And let's create one more.

74
02:33.270 --> 02:36.080 align:middle line:84%
And let's create one for PCB.

75
02:36.080 --> 02:38.110 align:middle line:84%
And I'm just going to throw my--

76
02:38.110 --> 02:39.700 align:middle line:84%
not my Kali Linux box.

77
02:39.700 --> 02:40.570 align:middle line:84%
Where's my mind?

78
02:40.570 --> 02:43.053 align:middle line:90%
I'm going to throw my
Raspberry Pi into that group.

79
02:43.053 --> 02:44.970 align:middle line:90%
And I'm going to connect
it to our lab network

80
02:44.970 --> 02:48.480 align:middle line:90%
so I can have a third device
to play with and verify from.

81
02:48.480 --> 02:52.250 align:middle line:90%
It's going to get 18 as
the security group tag.

82
02:52.250 --> 02:53.510 align:middle line:84%
So boom.

83
02:53.510 --> 02:56.330 align:middle line:90%
We now have three
new security groups--

84
02:56.330 --> 03:00.632 align:middle line:84%
ISE-Admins, ISE-Ops, PCB_PCs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
02:56.330 --> 03:00.632 align:middle line:84%
ISE-Admins, ISE-Ops, PCB_PCs.

85
03:00.632 --> 03:02.840 align:middle line:90%
So what we have so far are
just some security groups.

86
03:02.840 --> 03:06.130 align:middle line:90%
Now here's what a security
group does for a living.

87
03:06.130 --> 03:09.500 align:middle line:90%
It's just stands there unless
you make it part of the policy.

88
03:09.500 --> 03:11.510 align:middle line:84%
So here's the overall plan.

89
03:11.510 --> 03:14.160 align:middle line:90%
And I'll step you through the
individual steps as we proceed.

90
03:14.160 --> 03:16.820 align:middle line:90%
We are going to
create some rules.

91
03:16.820 --> 03:19.310 align:middle line:90%
They call them
security group ACLs,

92
03:19.310 --> 03:21.950 align:middle line:90%
also sometimes called
scaleable group ACLs.

93
03:21.950 --> 03:23.660 align:middle line:90%
But in either case,
these are simply

94
03:23.660 --> 03:26.450 align:middle line:90%
rules about what we
want to allow either

95
03:26.450 --> 03:29.210 align:middle line:90%
between group A and
group B, or what we

96
03:29.210 --> 03:30.930 align:middle line:84%
want to allow within a group.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:29.210 --> 03:30.930 align:middle line:84%
want to allow within a group.

97
03:30.930 --> 03:32.930 align:middle line:90%
So that's what we get to
do in the next video is

98
03:32.930 --> 03:34.990 align:middle line:90%
we will create
some security group

99
03:34.990 --> 03:38.210 align:middle line:90%
ACLs that then in
the subsequent video

100
03:38.210 --> 03:40.550 align:middle line:90%
we can apply as
part of our policy.

101
03:40.550 --> 03:43.520 align:middle line:90%
We can control the access
between groups or within groups

102
03:43.520 --> 03:46.280 align:middle line:90%
based on what network
protocols we want to allow

103
03:46.280 --> 03:48.408 align:middle line:84%
between or within those groups.

104
03:48.408 --> 03:49.700 align:middle line:84%
I'll see you in the next video.

105
03:49.700 --> 03:52.190 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

106
03:52.190 --> 03:55.470 align:middle line:90%
And I'd like to thank
you for viewing.