WEBVTT

1
00:00.000 --> 00:01.280 align:middle line:84%


2
00:01.280 --> 00:04.130 align:middle line:90%
As we're building towards a
working functional TrustSec

3
00:04.130 --> 00:06.380 align:middle line:90%
environment, we need to
have security groups.

4
00:06.380 --> 00:08.540 align:middle line:90%
We created three of
those in the last video.

5
00:08.540 --> 00:11.330 align:middle line:90%
Now we're going to create
security ACLs, which

6
00:11.330 --> 00:12.800 align:middle line:84%
specify what is allowed.

7
00:12.800 --> 00:14.630 align:middle line:90%
And then in the
next video, we'll

8
00:14.630 --> 00:17.360 align:middle line:90%
take a look at applying
that policy as part

9
00:17.360 --> 00:18.780 align:middle line:84%
of our ISE configuration.

10
00:18.780 --> 00:21.410 align:middle line:90%
So for now, this step is let's
take a look at where we would

11
00:21.410 --> 00:25.570 align:middle line:90%
go in the interface, and how
to create an ISE security group

12
00:25.570 --> 00:26.690 align:middle line:84%
ACL.

13
00:26.690 --> 00:28.430 align:middle line:84%
And it goes something like this.

14
00:28.430 --> 00:31.820 align:middle line:90%
What we're going to do is under
Work Centers, and TrustSec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.430 --> 00:31.820 align:middle line:90%
What we're going to do is under
Work Centers, and TrustSec.

15
00:31.820 --> 00:34.160 align:middle line:90%
And if we go to
Components, that'll

16
00:34.160 --> 00:35.510 align:middle line:84%
get us to the right place.

17
00:35.510 --> 00:37.090 align:middle line:90%
And then under
components, here we

18
00:37.090 --> 00:38.840 align:middle line:90%
have the option for
security groups, which

19
00:38.840 --> 00:40.160 align:middle line:84%
we did in the previous video.

20
00:40.160 --> 00:44.210 align:middle line:90%
And then two down from that,
we have security group ACL.

21
00:44.210 --> 00:47.810 align:middle line:90%
Now, based on the flavor and
when you get to the ISE system,

22
00:47.810 --> 00:50.930 align:middle line:90%
there may or may not
be some defaults.

23
00:50.930 --> 00:52.700 align:middle line:90%
I think in prior
versions there were some,

24
00:52.700 --> 00:53.900 align:middle line:84%
but I'm not seeing any.

25
00:53.900 --> 00:54.800 align:middle line:84%
But no problem.

26
00:54.800 --> 00:58.070 align:middle line:90%
What we're going to do is we are
going to create some security

27
00:58.070 --> 01:01.760 align:middle line:90%
group ACLs so that we can
then apply traffic that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.070 --> 01:01.760 align:middle line:90%
group ACLs so that we can
then apply traffic that's

28
01:01.760 --> 01:03.800 align:middle line:90%
trying to go between
security groups based

29
01:03.800 --> 01:06.590 align:middle line:90%
on those tag numbers, or
within the same security group.

30
01:06.590 --> 01:09.090 align:middle line:90%
But the first thing is we need
to create some security group

31
01:09.090 --> 01:09.680 align:middle line:84%
ACLs.

32
01:09.680 --> 01:12.140 align:middle line:90%
So to did that, we're clicking
here on Security Group ACLs.

33
01:12.140 --> 01:14.210 align:middle line:84%
And we're going to click on Add.

34
01:14.210 --> 01:15.990 align:middle line:90%
Now, before we also
get to this point,

35
01:15.990 --> 01:18.440 align:middle line:90%
we also may want to consider,
what's our intention?

36
01:18.440 --> 01:20.300 align:middle line:90%
For the lab environment,
if you're just

37
01:20.300 --> 01:22.175 align:middle line:90%
starting to practice
and getting used to ISE,

38
01:22.175 --> 01:24.380 align:middle line:90%
I would say the ACLs
should be something

39
01:24.380 --> 01:27.110 align:middle line:90%
that you can verify
and test, and verify

40
01:27.110 --> 01:30.710 align:middle line:90%
that the ACLs that you're
creating and applying actually
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:27.110 --> 01:30.710 align:middle line:90%
that the ACLs that you're
creating and applying actually

41
01:30.710 --> 01:31.417 align:middle line:84%
work.

42
01:31.417 --> 01:33.500 align:middle line:90%
So I'm going to start off
with a couple basic ones

43
01:33.500 --> 01:35.180 align:middle line:90%
that my lab
environment can test,

44
01:35.180 --> 01:37.640 align:middle line:84%
like boom, test and verify.

45
01:37.640 --> 01:41.340 align:middle line:90%
The first one is going
to deny ICMP traffic.

46
01:41.340 --> 01:43.450 align:middle line:84%
I'm going to call it NO_ICMP.

47
01:43.450 --> 01:48.190 align:middle line:90%
And in this security group ACL,
I'm going to say deny ICMP.

48
01:48.190 --> 01:50.720 align:middle line:90%
And the syntax for these
ACLs is a little bit weird,

49
01:50.720 --> 01:53.450 align:middle line:90%
because it's basically
going to implement

50
01:53.450 --> 01:54.730 align:middle line:84%
based on security tags.

51
01:54.730 --> 01:56.480 align:middle line:90%
And then each of the
switches and so forth

52
01:56.480 --> 01:59.128 align:middle line:90%
is tracking with
IP device tracking

53
01:59.128 --> 02:00.920 align:middle line:90%
what the IP address
and layer 2 address is,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.128 --> 02:00.920 align:middle line:90%
what the IP address
and layer 2 address is,

54
02:00.920 --> 02:02.810 align:middle line:90%
and so forth, so they
can enforce the policy.

55
02:02.810 --> 02:05.040 align:middle line:90%
But if we want to deny ICMP,
that's the way to do it.

56
02:05.040 --> 02:08.419 align:middle line:90%
And if we want to permit IP,
that's how we would do it.

57
02:08.419 --> 02:12.500 align:middle line:90%
So basically, this says deny
ICMP as rule number one,

58
02:12.500 --> 02:15.230 align:middle line:84%
and permit IP as rule number 2.

59
02:15.230 --> 02:16.670 align:middle line:84%
So then we'll scroll down.

60
02:16.670 --> 02:18.230 align:middle line:84%
We'll click on Submit.

61
02:18.230 --> 02:20.690 align:middle line:90%
Now, in Downloadable
ACLs, there is actually

62
02:20.690 --> 02:23.300 align:middle line:90%
a Check Syntax button,
which I'm rooting

63
02:23.300 --> 02:26.840 align:middle line:90%
for in the next version
of ISE, because the way

64
02:26.840 --> 02:29.720 align:middle line:90%
to verify that it's not OK
is simply looking at the log

65
02:29.720 --> 02:32.000 align:middle line:90%
and saying, well, yeah,
that downloadable ACL isn't
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:29.720 --> 02:32.000 align:middle line:90%
and saying, well, yeah,
that downloadable ACL isn't

66
02:32.000 --> 02:35.160 align:middle line:90%
being accepted by your switch
or your network access device.

67
02:35.160 --> 02:36.510 align:middle line:84%
So let's make one more.

68
02:36.510 --> 02:37.380 align:middle line:84%
And this time.

69
02:37.380 --> 02:38.390 align:middle line:84%
Let's add no telnet.

70
02:38.390 --> 02:40.980 align:middle line:84%


71
02:40.980 --> 02:48.030 align:middle line:90%
And for no telnet, we'll say
no TCP destination equals--

72
02:48.030 --> 02:50.070 align:middle line:84%
and that would be port 23.

73
02:50.070 --> 02:51.890 align:middle line:84%
And then permit IP.

74
02:51.890 --> 02:54.300 align:middle line:90%
So that's just basically
saying no telnet, nothing

75
02:54.300 --> 02:57.260 align:middle line:90%
going to TCP port 23,
permit everything else.

76
02:57.260 --> 02:58.080 align:middle line:84%
We'll scroll down.

77
02:58.080 --> 03:00.270 align:middle line:84%
Click on Submit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:58.080 --> 03:00.270 align:middle line:84%
Click on Submit.

78
03:00.270 --> 03:02.987 align:middle line:90%
And now we have two
security group ACLs,

79
03:02.987 --> 03:05.070 align:middle line:90%
one that's denying ICMP,
and permitting everything

80
03:05.070 --> 03:07.830 align:middle line:90%
else, and one that's denying
telnet and permitting

81
03:07.830 --> 03:09.510 align:middle line:84%
everything else.

82
03:09.510 --> 03:11.310 align:middle line:90%
One more check in the
checkbox on the way

83
03:11.310 --> 03:12.570 align:middle line:84%
to implementing TrustSec.

84
03:12.570 --> 03:15.510 align:middle line:90%
And that is we have security
groups that we created.

85
03:15.510 --> 03:19.170 align:middle line:90%
We also have some security
group ACLs, which are great,

86
03:19.170 --> 03:21.390 align:middle line:90%
but next, what we
need to do is we

87
03:21.390 --> 03:23.670 align:middle line:90%
need to implement our
policy regarding where

88
03:23.670 --> 03:27.030 align:middle line:90%
we want to apply those, whether
it's between two groups,

89
03:27.030 --> 03:27.845 align:middle line:84%
or within a group.

90
03:27.845 --> 03:29.970 align:middle line:90%
And that's what we're going
to do in the next video

91
03:29.970 --> 03:31.890 align:middle line:90%
by implementing a
TrustSec policy that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:29.970 --> 03:31.890 align:middle line:90%
by implementing a
TrustSec policy that

92
03:31.890 --> 03:36.000 align:middle line:90%
calls upon the security groups
and the security group ACLs.

93
03:36.000 --> 03:38.340 align:middle line:90%
So I'll see you in that
next video in just a moment.

94
03:38.340 --> 03:40.890 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

95
03:40.890 --> 03:44.300 align:middle line:90%
And I'd like to thank
you for viewing.