WEBVTT

1
00:00.000 --> 00:02.650 align:middle line:84%


2
00:02.650 --> 00:05.560 align:middle line:90%
On the ISE server, in addition
to having security groups

3
00:05.560 --> 00:07.930 align:middle line:90%
and security group ACLs
and having them applied

4
00:07.930 --> 00:09.640 align:middle line:90%
between those
security groups, it's

5
00:09.640 --> 00:12.910 align:middle line:90%
also important to tell ISE
that our network access

6
00:12.910 --> 00:15.400 align:middle line:90%
devices that we're integrating
with and working with

7
00:15.400 --> 00:19.445 align:middle line:90%
should be told about and have
Cisco TrustSec enabled on them.

8
00:19.445 --> 00:21.070 align:middle line:90%
So that's the part
I'd like to walk you

9
00:21.070 --> 00:23.400 align:middle line:84%
through in this video right now.

10
00:23.400 --> 00:25.210 align:middle line:90%
And there's more than
one way to get there,

11
00:25.210 --> 00:28.060 align:middle line:90%
but because we're dealing with
TrustSec, we go to Work Centers

12
00:28.060 --> 00:31.455 align:middle line:90%
and then, we go to
TrustSec and Components,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.060 --> 00:31.455 align:middle line:90%
and then, we go to
TrustSec and Components,

13
00:31.455 --> 00:32.330 align:middle line:84%
that'll get us close.

14
00:32.330 --> 00:32.830 align:middle line:84%
There we go.

15
00:32.830 --> 00:35.218 align:middle line:90%
So under Components, we
have Network Devices,

16
00:35.218 --> 00:37.510 align:middle line:90%
and this is just referring
to our network access device

17
00:37.510 --> 00:39.520 align:middle line:84%
that we've set up previously.

18
00:39.520 --> 00:45.370 align:middle line:90%
Switch1 was the 3560, which
doesn't support TrustSec.

19
00:45.370 --> 00:47.855 align:middle line:90%
However, the 3750x
does, and so if we

20
00:47.855 --> 00:50.230 align:middle line:90%
go into the details for that,
here what we're going to do

21
00:50.230 --> 00:53.080 align:middle line:90%
is enable the additional
functionality of TrustSec

22
00:53.080 --> 00:55.010 align:middle line:84%
on that network access device.

23
00:55.010 --> 00:57.280 align:middle line:84%
So this was put in previously.

24
00:57.280 --> 01:00.130 align:middle line:90%
We have the network device
group, not security device
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:57.280 --> 01:00.130 align:middle line:90%
We have the network device
group, not security device

25
01:00.130 --> 01:02.020 align:middle line:84%
group, that has the site1--

26
01:02.020 --> 01:03.070 align:middle line:84%
it's a switch.

27
01:03.070 --> 01:06.808 align:middle line:90%
We have the radius password that
we configured on that device.

28
01:06.808 --> 01:09.100 align:middle line:90%
And if we scroll down under
Advanced TrustSec Settings,

29
01:09.100 --> 01:10.420 align:middle line:84%
make sure that's checked.

30
01:10.420 --> 01:11.380 align:middle line:84%
You're enabling it.

31
01:11.380 --> 01:13.390 align:middle line:84%
I said I want to use this ID.

32
01:13.390 --> 01:14.950 align:middle line:90%
I put in the
password, the same one

33
01:14.950 --> 01:16.960 align:middle line:90%
we just did on the
network access device

34
01:16.960 --> 01:18.300 align:middle line:84%
in the previous video.

35
01:18.300 --> 01:19.960 align:middle line:90%
I also, this was
the default COA,

36
01:19.960 --> 01:21.430 align:middle line:90%
which is change
of authorization,

37
01:21.430 --> 01:24.490 align:middle line:90%
as a method for the
ISE to communicate

38
01:24.490 --> 01:26.940 align:middle line:90%
updates and new policy
down to the switch.

39
01:26.940 --> 01:29.950 align:middle line:90%
And in the 802.1x videos, we
enabled the network access

40
01:29.950 --> 01:30.670 align:middle line:84%
device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.950 --> 01:30.670 align:middle line:84%
device.

41
01:30.670 --> 01:32.590 align:middle line:84%
It was config to support that.

42
01:32.590 --> 01:34.570 align:middle line:90%
I also supplied the
username and password

43
01:34.570 --> 01:37.000 align:middle line:90%
where ISE could log in
to this network access

44
01:37.000 --> 01:41.510 align:middle line:90%
device, this 3750 switch, if it
needs to update any group tag

45
01:41.510 --> 01:42.010 align:middle line:84%
mappings.

46
01:42.010 --> 01:45.070 align:middle line:90%
For example, if there's a
group that had the tag of 17,

47
01:45.070 --> 01:47.660 align:middle line:90%
and now it's 28, that
needs to be communicated.

48
01:47.660 --> 01:50.060 align:middle line:90%
So I supplied that
information as well.

49
01:50.060 --> 01:52.990 align:middle line:90%
I also set up the PAC, the
Protected Access Credentials,

50
01:52.990 --> 01:55.690 align:middle line:90%
by clicking on
generate PAC, and then

51
01:55.690 --> 01:58.360 align:middle line:90%
I specified the encryption key,
and that's the same encryption

52
01:58.360 --> 02:02.225 align:middle line:90%
key that I specified over on the
network access device as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.360 --> 02:02.225 align:middle line:90%
key that I specified over on the
network access device as well.

53
02:02.225 --> 02:03.850 align:middle line:90%
So that's already in
place and working.

54
02:03.850 --> 02:05.120 align:middle line:84%
We verified that.

55
02:05.120 --> 02:07.120 align:middle line:90%
And also, one of the other
things we can do here

56
02:07.120 --> 02:09.037 align:middle line:90%
is we can click on this
Test Connection, which

57
02:09.037 --> 02:10.539 align:middle line:90%
is kind of handy,
and it'll come up

58
02:10.539 --> 02:12.040 align:middle line:90%
with a little
checkbox saying, Yep,

59
02:12.040 --> 02:13.248 align:middle line:84%
I can connect to that device.

60
02:13.248 --> 02:14.210 align:middle line:84%
It's good.

61
02:14.210 --> 02:16.510 align:middle line:84%
So that work is already done.

62
02:16.510 --> 02:19.630 align:middle line:90%
So now, this switch acting
as a network access device

63
02:19.630 --> 02:23.860 align:middle line:90%
is also capable of understanding
and cooperating and enforcing

64
02:23.860 --> 02:26.920 align:middle line:90%
policy based on TrustSec
and our TrustSec policies

65
02:26.920 --> 02:29.240 align:middle line:90%
that we looked at in
the previous video.

66
02:29.240 --> 02:31.270 align:middle line:90%
So now that we have
security groups,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.240 --> 02:31.270 align:middle line:90%
So now that we have
security groups,

67
02:31.270 --> 02:34.600 align:middle line:90%
we have security group ACLs,
we have a TrustSec policy,

68
02:34.600 --> 02:37.510 align:middle line:90%
and we've also configured
the network access device

69
02:37.510 --> 02:40.490 align:middle line:90%
to support TrustSec,
what's next?

70
02:40.490 --> 02:44.020 align:middle line:90%
Next is to actually put
some devices or entities

71
02:44.020 --> 02:46.060 align:middle line:90%
in those security
groups, make sure they

72
02:46.060 --> 02:48.700 align:middle line:90%
have those groups assigned
with the appropriate tags,

73
02:48.700 --> 02:52.210 align:middle line:90%
and that way we can actually
test to verify whether or not,

74
02:52.210 --> 02:55.690 align:middle line:90%
based on security group tags,
the network access device has

75
02:55.690 --> 02:58.330 align:middle line:90%
the ability to permit
or deny traffic

76
02:58.330 --> 03:00.058 align:middle line:84%
based on our TrustSec policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:58.330 --> 03:00.058 align:middle line:84%
based on our TrustSec policy.

77
03:00.058 --> 03:01.600 align:middle line:90%
And that's exactly
what you and I get

78
03:01.600 --> 03:03.245 align:middle line:84%
to do in the very next video.

79
03:03.245 --> 03:04.870 align:middle line:90%
So I'll see you there
in just a moment.

80
03:04.870 --> 03:07.450 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

81
03:07.450 --> 03:10.890 align:middle line:90%
and I'd like to thank
you for viewing.