WEBVTT

1
00:00.000 --> 00:01.410 align:middle line:84%


2
00:01.410 --> 00:04.770 align:middle line:90%
In this video, we get to marry
two things, a security group

3
00:04.770 --> 00:08.310 align:middle line:90%
and a security group ACL that's
going to eventually enforce

4
00:08.310 --> 00:10.770 align:middle line:84%
our policy with TrustSEC.

5
00:10.770 --> 00:11.880 align:middle line:84%
Let's begin.

6
00:11.880 --> 00:15.000 align:middle line:90%
Someone once told me it's wise
to have a plan before we just

7
00:15.000 --> 00:16.410 align:middle line:84%
start implementing policy.

8
00:16.410 --> 00:18.510 align:middle line:84%
So I totally agree with that.

9
00:18.510 --> 00:21.120 align:middle line:90%
Let's make a short plan,
and then we'll implement it.

10
00:21.120 --> 00:24.090 align:middle line:90%
So we have three security
groups that we created.

11
00:24.090 --> 00:27.570 align:middle line:90%
We have two security group
ACLs that we can apply,

12
00:27.570 --> 00:28.760 align:middle line:84%
and let's do this.

13
00:28.760 --> 00:36.150 align:middle line:90%
Let's specify that for traffic
between ISE ops going over
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.760 --> 00:36.150 align:middle line:90%
Let's specify that for traffic
between ISE ops going over

14
00:36.150 --> 00:38.250 align:middle line:84%
to PCB-PC--

15
00:38.250 --> 00:40.780 align:middle line:90%
to that group-- from
this group to that group.

16
00:40.780 --> 00:46.910 align:middle line:84%
Let's go ahead and deny telnet.

17
00:46.910 --> 00:51.200 align:middle line:90%
And let's also do that from
ISE Admins over here as well.

18
00:51.200 --> 00:53.290 align:middle line:84%
We'll deny telnet.

19
00:53.290 --> 00:55.180 align:middle line:84%
Now, that's the logical policy.

20
00:55.180 --> 00:57.310 align:middle line:90%
Now, the way we would
apply that is we

21
00:57.310 --> 00:59.950 align:middle line:90%
would go into ISE in our
TrustSec policies, which we'll

22
00:59.950 --> 01:02.470 align:middle line:90%
do here in a moment, and we'll
simply say, all right, here's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:59.950 --> 01:02.470 align:middle line:90%
do here in a moment, and we'll
simply say, all right, here's

23
01:02.470 --> 01:04.060 align:middle line:90%
the new policy I'd
like to create--

24
01:04.060 --> 01:06.250 align:middle line:90%
traffic from the
security group called

25
01:06.250 --> 01:10.290 align:middle line:90%
ISE Admins going over to the
security group called PCB-PC.

26
01:10.290 --> 01:12.460 align:middle line:90%
In retrospect, I would've
called it something easier

27
01:12.460 --> 01:13.600 align:middle line:84%
to pronounce.

28
01:13.600 --> 01:16.552 align:middle line:90%
But we can specify that for
traffic from here and to there

29
01:16.552 --> 01:18.010 align:middle line:90%
and from here to
there that we want

30
01:18.010 --> 01:22.960 align:middle line:90%
to apply the security group ACL,
the one that's denying telnet.

31
01:22.960 --> 01:26.500 align:middle line:90%
We could also very
easily deny other traffic

32
01:26.500 --> 01:29.890 align:middle line:90%
that we wanted to jump simply by
creating the security loop ACL

33
01:29.890 --> 01:30.793 align:middle line:84%
and applying it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:29.890 --> 01:30.793 align:middle line:84%
and applying it.

34
01:30.793 --> 01:31.710 align:middle line:84%
We could also do this.

35
01:31.710 --> 01:35.920 align:middle line:90%
What if we had two devices that
we wanted in the same group--

36
01:35.920 --> 01:37.810 align:middle line:90%
Just imagine we had
two devices that

37
01:37.810 --> 01:40.780 align:middle line:90%
were both a part of this
security group, PCB-PC.

38
01:40.780 --> 01:43.930 align:middle line:90%
We could create and
apply a security group

39
01:43.930 --> 01:46.577 align:middle line:90%
ACL that applies to those
devices within that group.

40
01:46.577 --> 01:48.160 align:middle line:90%
So if we wanted to
say, you know what?

41
01:48.160 --> 01:51.100 align:middle line:90%
Within the group,
no peer to peer

42
01:51.100 --> 01:52.960 align:middle line:90%
file transfer protocols
in those ports,

43
01:52.960 --> 01:54.610 align:middle line:90%
and so forth, and
we could block them,

44
01:54.610 --> 01:59.230 align:middle line:90%
or we could say, deny telnet
from anybody in PCB-PC,

45
01:59.230 --> 02:01.060 align:middle line:90%
that group going
to that same group.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:59.230 --> 02:01.060 align:middle line:90%
that group going
to that same group.

46
02:01.060 --> 02:03.580 align:middle line:90%
Let's go to the ICE
interface, and let's do it.

47
02:03.580 --> 02:05.118 align:middle line:90%
And to get to the
TrustSec policies,

48
02:05.118 --> 02:07.660 align:middle line:90%
we'd simply go to Work Centers--
this is probably the easiest

49
02:07.660 --> 02:08.410 align:middle line:84%
way to get there--

50
02:08.410 --> 02:10.169 align:middle line:90%
Work Centers, and
then, under TrustSec,

51
02:10.169 --> 02:12.110 align:middle line:90%
let's go down to
TrustSec Policy.

52
02:12.110 --> 02:13.690 align:middle line:84%
Boom, we're there.

53
02:13.690 --> 02:16.600 align:middle line:90%
So here under Work Centers,
TrustSec, and TrustSec policy,

54
02:16.600 --> 02:18.940 align:middle line:90%
and then I have
selected Matrix, which

55
02:18.940 --> 02:21.010 align:middle line:90%
is going to show us
all the relationships

56
02:21.010 --> 02:23.230 align:middle line:90%
between every group
and every other group.

57
02:23.230 --> 02:25.150 align:middle line:90%
So over here on the
left is the source,

58
02:25.150 --> 02:27.430 align:middle line:90%
or where we're sourcing
traffic from, and over

59
02:27.430 --> 02:30.320 align:middle line:90%
here on the right, on the top
rather, is the destination.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:27.430 --> 02:30.320 align:middle line:90%
here on the right, on the top
rather, is the destination.

60
02:30.320 --> 02:31.930 align:middle line:90%
Now, there is a lot
of content here.

61
02:31.930 --> 02:32.650 align:middle line:84%
It's like, wow.

62
02:32.650 --> 02:35.025 align:middle line:90%
If you've got hundreds of
groups, how do you sort it out?

63
02:35.025 --> 02:37.440 align:middle line:90%
Well, one way of sorting
out is to click on View--

64
02:37.440 --> 02:39.523 align:middle line:90%
let me make sure my face
isn't in the way, great--

65
02:39.523 --> 02:42.070 align:middle line:90%
View, and we could say Condensed
without Security Group ACL

66
02:42.070 --> 02:45.498 align:middle line:90%
Names or Condensed with Security
Group ACL Names, one of these.

67
02:45.498 --> 02:47.290 align:middle line:90%
I'll just go ahead and
say with, and that's

68
02:47.290 --> 02:50.380 align:middle line:90%
going to show us only
the relationships where

69
02:50.380 --> 02:52.930 align:middle line:90%
there's a policy and access
control lists supplied.

70
02:52.930 --> 02:54.700 align:middle line:90%
And it's saying, you
know what, Keith?

71
02:54.700 --> 02:56.020 align:middle line:84%
That's what it calls me.

72
02:56.020 --> 02:58.810 align:middle line:90%
You've got no policies
whatsoever yet

73
02:58.810 --> 03:01.060 align:middle line:90%
so I can't show you just
the ones with policies
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:58.810 --> 03:01.060 align:middle line:90%
so I can't show you just
the ones with policies

74
03:01.060 --> 03:02.320 align:middle line:84%
because they don't exist.

75
03:02.320 --> 03:03.820 align:middle line:90%
So it's going to
show us everything.

76
03:03.820 --> 03:06.810 align:middle line:90%
So if we want to make a new
policy about an access control

77
03:06.810 --> 03:08.560 align:middle line:90%
list, a security
group access control,

78
03:08.560 --> 03:11.320 align:middle line:90%
between two of these security
groups, here's what we do.

79
03:11.320 --> 03:15.010 align:middle line:90%
The easiest way is you could
find the spot and click here.

80
03:15.010 --> 03:19.060 align:middle line:90%
That's between BYOD and
Development whatever

81
03:19.060 --> 03:22.450 align:middle line:90%
or whatever, and you
could put in the policy

82
03:22.450 --> 03:25.810 align:middle line:90%
right there, or much
better, check this out.

83
03:25.810 --> 03:28.030 align:middle line:90%
Just click on Add,
and then from here,

84
03:28.030 --> 03:29.910 align:middle line:90%
just use the
dropdown, the source.

85
03:29.910 --> 03:34.540 align:middle line:90%
Let's imagine the
source is ISE Admins,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:29.910 --> 03:34.540 align:middle line:90%
Let's imagine the
source is ISE Admins,

86
03:34.540 --> 03:39.235 align:middle line:90%
and the destination security
group is going to be PCB group.

87
03:39.235 --> 03:41.860 align:middle line:90%
So that would represent traffic
sourced from the security group

88
03:41.860 --> 03:44.260 align:middle line:90%
ISE Admins going
to the PCB group.

89
03:44.260 --> 03:48.100 align:middle line:90%
And then, we get to specify
our downloadable ACLs, which

90
03:48.100 --> 03:50.990 align:middle line:90%
in my environment, I only have
two, the two we just created.

91
03:50.990 --> 03:52.930 align:middle line:90%
Let's say, well, we
talked about no telnet.

92
03:52.930 --> 03:53.560 align:middle line:84%
Let's do it.

93
03:53.560 --> 03:58.753 align:middle line:90%
So no telnet allowed, and
then, I'm looking for my--

94
03:58.753 --> 04:00.420 align:middle line:90%
there-- I'm looking
for my Apply button,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:58.753 --> 04:00.420 align:middle line:90%
there-- I'm looking
for my Apply button,

95
04:00.420 --> 04:02.220 align:middle line:90%
and it scrolled
down on me so I need

96
04:02.220 --> 04:06.670 align:middle line:90%
to make the screen just
a little bit smaller.

97
04:06.670 --> 04:07.550 align:middle line:84%
There we go.

98
04:07.550 --> 04:10.750 align:middle line:90%
So we can go ahead and see
it, and then click on Save.

99
04:10.750 --> 04:12.160 align:middle line:84%
And now, that's applied.

100
04:12.160 --> 04:15.250 align:middle line:90%
Now, with that applied, what
I could do is click on View,

101
04:15.250 --> 04:18.595 align:middle line:90%
and then, go to Condensed
with Security Group ACL Names,

102
04:18.595 --> 04:21.220 align:middle line:90%
and that's just going to show me
just the security groups where

103
04:21.220 --> 04:23.440 align:middle line:90%
there's a relationship,
and that's

104
04:23.440 --> 04:24.977 align:middle line:84%
between these two groups.

105
04:24.977 --> 04:27.310 align:middle line:90%
And I will make this a little
smaller, so we can see it.

106
04:27.310 --> 04:29.530 align:middle line:90%
Over here we have ISE
Admins as the source

107
04:29.530 --> 04:32.500 align:middle line:90%
going to the PCB group
using the access control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
04:29.530 --> 04:32.500 align:middle line:90%
going to the PCB group
using the access control

108
04:32.500 --> 04:34.300 align:middle line:84%
list of no telnet.

109
04:34.300 --> 04:35.260 align:middle line:84%
Ta-dah.

110
04:35.260 --> 04:37.420 align:middle line:90%
Now let's add another
one because we talked

111
04:37.420 --> 04:38.560 align:middle line:84%
about more than just one.

112
04:38.560 --> 04:40.250 align:middle line:84%
Let's go ahead and click on Add.

113
04:40.250 --> 04:44.220 align:middle line:90%
And let's also limit telnet
from the ISE Ops as well.

114
04:44.220 --> 04:46.670 align:middle line:90%
So I clicked on
New for new policy.

115
04:46.670 --> 04:48.980 align:middle line:90%
The source is going
to be ISE Ops,

116
04:48.980 --> 04:51.340 align:middle line:90%
and I'll make this
bigger in just a second.

117
04:51.340 --> 04:54.820 align:middle line:90%
And the destination is going to
be the same PCB group, great,

118
04:54.820 --> 04:57.610 align:middle line:90%
and the rule, once again,
is going to be no telnet,

119
04:57.610 --> 04:59.140 align:middle line:84%
and click on Save.

120
04:59.140 --> 05:01.910 align:middle line:90%
Wonderful, and now I'll
make it a little bit bigger.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:59.140 --> 05:01.910 align:middle line:90%
Wonderful, and now I'll
make it a little bit bigger.

121
05:01.910 --> 05:04.840 align:middle line:90%
So now this is showing us
the two populated cells

122
05:04.840 --> 05:05.470 align:middle line:84%
that we have.

123
05:05.470 --> 05:09.490 align:middle line:90%
We have from ISE Admins to
the PCBs and also, the ISE Ops

124
05:09.490 --> 05:12.430 align:middle line:90%
to the PCBs, and that's
our security policy

125
05:12.430 --> 05:15.560 align:middle line:90%
with the access control list of
no telnet going to be applied.

126
05:15.560 --> 05:17.540 align:middle line:90%
Now, up here, I have
a message saying, hey,

127
05:17.540 --> 05:21.020 align:middle line:90%
there's a TrustSec configuration
that hasn't been pushed out

128
05:21.020 --> 05:22.000 align:middle line:84%
to network devices.

129
05:22.000 --> 05:24.680 align:middle line:90%
I'll go ahead and click on
Push, and that way the network

130
05:24.680 --> 05:27.260 align:middle line:90%
devices that we have
configured to support TrustSec

131
05:27.260 --> 05:28.457 align:middle line:84%
can get that information.

132
05:28.457 --> 05:30.040 align:middle line:90%
Although, I need to
walk through that,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
05:28.457 --> 05:30.040 align:middle line:90%
Although, I need to
walk through that,

133
05:30.040 --> 05:31.983 align:middle line:90%
too, which will be
in the next video.

134
05:31.983 --> 05:34.150 align:middle line:90%
And if we want to go back
to the view of everything,

135
05:34.150 --> 05:36.280 align:middle line:90%
we can click on
View and then say,

136
05:36.280 --> 05:40.197 align:middle line:90%
Show Full With or Without
The Security Group ACL Names,

137
05:40.197 --> 05:42.280 align:middle line:90%
and if we just want to see
the ones that are ours,

138
05:42.280 --> 05:44.555 align:middle line:90%
we can click on View
and say Condensed,

139
05:44.555 --> 05:46.180 align:middle line:90%
and it's just going
to show us the ones

140
05:46.180 --> 05:48.740 align:middle line:90%
that we've implemented
that have something there.

141
05:48.740 --> 05:51.100 align:middle line:90%
So in this video, we
combined our security groups

142
05:51.100 --> 05:53.730 align:middle line:90%
that we made with our
security group ACLs,

143
05:53.730 --> 05:54.960 align:middle line:84%
and we applied them.

144
05:54.960 --> 05:58.180 align:middle line:90%
And in the example, we
applied the no telnet option

145
05:58.180 --> 06:00.820 align:middle line:90%
between the ISE Admins
and ISE Operators
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
05:58.180 --> 06:00.820 align:middle line:90%
between the ISE Admins
and ISE Operators

146
06:00.820 --> 06:03.650 align:middle line:84%
to the PCB security group.

147
06:03.650 --> 06:06.190 align:middle line:90%
Now, there is yet a
slight other challenge,

148
06:06.190 --> 06:10.570 align:middle line:90%
and that is I haven't really
configured any network access

149
06:10.570 --> 06:13.090 align:middle line:84%
devices to support TrustSec.

150
06:13.090 --> 06:15.430 align:middle line:90%
So what I've done is I've
upgraded a few pieces of gear

151
06:15.430 --> 06:16.120 align:middle line:84%
here in my lab.

152
06:16.120 --> 06:17.537 align:middle line:90%
I'll show you what
those are next.

153
06:17.537 --> 06:19.912 align:middle line:90%
I wanted to make sure we had
gear that supported TrustSec

154
06:19.912 --> 06:20.980 align:middle line:84%
so I could demo it.

155
06:20.980 --> 06:23.282 align:middle line:90%
And what we'll do is I'll
let you know about that gear.

156
06:23.282 --> 06:25.240 align:middle line:90%
I'll walk you through
the configuration updates

157
06:25.240 --> 06:27.190 align:middle line:90%
on the network access
device, and then we

158
06:27.190 --> 06:29.410 align:middle line:90%
can proceed further
into the implementation

159
06:29.410 --> 06:32.140 align:middle line:90%
and verification-- it's really
important-- of TrustSec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:29.410 --> 06:32.140 align:middle line:90%
and verification-- it's really
important-- of TrustSec.

160
06:32.140 --> 06:34.630 align:middle line:90%
So I'll catch you in the
next video in just a moment.

161
06:34.630 --> 06:37.270 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

162
06:37.270 --> 06:40.550 align:middle line:90%
and I'd like to thank
you for viewing.