WEBVTT

1
00:00.000 --> 00:01.680 align:middle line:84%


2
00:01.680 --> 00:04.950 align:middle line:90%
For me, the implementation and
verification of a technology,

3
00:04.950 --> 00:07.100 align:middle line:90%
including TrustSec,
is a very fun thing

4
00:07.100 --> 00:09.050 align:middle line:90%
to do, see the fruit
of all our labors

5
00:09.050 --> 00:11.480 align:middle line:90%
as it actually does what
we expected it to do,

6
00:11.480 --> 00:13.820 align:middle line:90%
and if it doesn't, we look
at the radius live logs,

7
00:13.820 --> 00:15.300 align:middle line:84%
and we troubleshoot why not.

8
00:15.300 --> 00:17.650 align:middle line:90%
So let me share with
you the lay of the land.

9
00:17.650 --> 00:19.430 align:middle line:90%
We've got a slightly
different topology

10
00:19.430 --> 00:21.680 align:middle line:90%
with one additional
device, and then, we'll

11
00:21.680 --> 00:25.650 align:middle line:90%
implement our TrustSec policy
and then verify that it works.

12
00:25.650 --> 00:28.280 align:middle line:90%
So here is the slightly
modified topology

13
00:28.280 --> 00:29.510 align:middle line:84%
from our previous videos.

14
00:29.510 --> 00:33.320 align:middle line:90%
I've got this 3750x switch
which supports TrustSec.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.510 --> 00:33.320 align:middle line:90%
I've got this 3750x switch
which supports TrustSec.

15
00:33.320 --> 00:35.330 align:middle line:90%
ISE and it are all
synced up and ready to go

16
00:35.330 --> 00:37.770 align:middle line:90%
based on the configurations
we did in the previous videos.

17
00:37.770 --> 00:41.450 align:middle line:90%
And I've got Bob, who
is connected via Port 1.

18
00:41.450 --> 00:46.550 align:middle line:90%
It's actually 2/0/1 on this
24 port, 48 port-- anyway,

19
00:46.550 --> 00:47.560 align:middle line:84%
It's a lot of ports--

20
00:47.560 --> 00:48.620 align:middle line:84%
3750 switch.

21
00:48.620 --> 00:50.120 align:middle line:90%
And what we'll do
is we'll make sure

22
00:50.120 --> 00:54.770 align:middle line:90%
that Bob ends up in the security
group called Ops or ISE Ops.

23
00:54.770 --> 00:58.130 align:middle line:90%
And then we have Luis
coming in on Port 2.

24
00:58.130 --> 01:01.310 align:middle line:90%
Again, 802.1x authenticated,
and we'll make sure that he is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:58.130 --> 01:01.310 align:middle line:90%
Again, 802.1x authenticated,
and we'll make sure that he is

25
01:01.310 --> 01:04.760 align:middle line:90%
coming in and associated with
a security group called ISE

26
01:04.760 --> 01:05.378 align:middle line:84%
Admins.

27
01:05.378 --> 01:06.920 align:middle line:90%
And then, this PC
right here actually

28
01:06.920 --> 01:09.830 align:middle line:84%
is a little Raspberry Pi device.

29
01:09.830 --> 01:12.770 align:middle line:90%
I have MAB enabled on that
port so it's going to connect.

30
01:12.770 --> 01:15.680 align:middle line:90%
It's going to time out
with 802.1x, go for MAB,

31
01:15.680 --> 01:16.820 align:middle line:84%
go to the identity store.

32
01:16.820 --> 01:18.680 align:middle line:90%
It also is going
to authenticate.

33
01:18.680 --> 01:20.840 align:middle line:90%
And what we can do based
on its authorization,

34
01:20.840 --> 01:25.480 align:middle line:90%
is we can put it into a
secure group called PCB_PCS.

35
01:25.480 --> 01:28.100 align:middle line:90%
And then, once those
devices are in those groups,

36
01:28.100 --> 01:30.230 align:middle line:90%
the policies about who
should be able to connect
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:28.100 --> 01:30.230 align:middle line:90%
the policies about who
should be able to connect

37
01:30.230 --> 01:33.723 align:middle line:90%
to where with what protocols
should be enforced.

38
01:33.723 --> 01:36.140 align:middle line:90%
So to make this work, we need
to associate security groups

39
01:36.140 --> 01:38.540 align:middle line:90%
with those individuals
who are logging in.

40
01:38.540 --> 01:41.480 align:middle line:90%
So I think before we
assign those, -3 do this.

41
01:41.480 --> 01:45.050 align:middle line:90%
Let's go to the switch, and here
on the switch on those three

42
01:45.050 --> 01:48.750 align:middle line:90%
ports, I'm going to
bounce all three of them.

43
01:48.750 --> 01:56.120 align:middle line:90%
So that interface range, going
to give it 2/0/1-3, Do a shut.

44
01:56.120 --> 01:57.333 align:middle line:84%
Then, I'll do a no shut.

45
01:57.333 --> 01:59.750 align:middle line:90%
And I suppose I don't have
terminal monitor on because I'm

46
01:59.750 --> 02:01.270 align:middle line:84%
not getting messages.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
01:59.750 --> 02:01.270 align:middle line:84%
not getting messages.

47
02:01.270 --> 02:02.140 align:middle line:84%
That's OK.

48
02:02.140 --> 02:04.833 align:middle line:90%
So if we go to
Operations and Live Logs,

49
02:04.833 --> 02:06.500 align:middle line:90%
we can actually see
the details of that.

50
02:06.500 --> 02:08.979 align:middle line:90%
So there is Bob,
current session.

51
02:08.979 --> 02:14.990 align:middle line:90%
There is Luis, current session,
and I'm not seeing the client,

52
02:14.990 --> 02:18.610 align:middle line:90%
the Raspberry Pi, but that's
because, if we go back to this

53
02:18.610 --> 02:24.130 align:middle line:90%
guy, the terminal monitor,
that's because it should fail

54
02:24.130 --> 02:27.850 align:middle line:90%
the 802.1x, and then after a
period of time, it'll try MAB,

55
02:27.850 --> 02:30.290 align:middle line:84%
and then, it'll authenticate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:27.850 --> 02:30.290 align:middle line:84%
and then, it'll authenticate.

56
02:30.290 --> 02:32.790 align:middle line:84%
And SXP is another video.

57
02:32.790 --> 02:34.550 align:middle line:90%
So we'll save that
for another video.

58
02:34.550 --> 02:36.980 align:middle line:90%
It's another way of
communicating the security

59
02:36.980 --> 02:40.100 align:middle line:90%
group tag mappings to
switches over networks

60
02:40.100 --> 02:43.545 align:middle line:90%
that don't completely support
end-to-end Cisco's TrustSec.

61
02:43.545 --> 02:45.170 align:middle line:90%
All right, I guess
I must've missed it.

62
02:45.170 --> 02:47.220 align:middle line:84%
Let me click on Refresh.

63
02:47.220 --> 02:48.570 align:middle line:84%
There it is right there, OK.

64
02:48.570 --> 02:51.840 align:middle line:90%
So we've got three sessions,
one from Bob, one from Luis,

65
02:51.840 --> 02:54.290 align:middle line:90%
and one from this
guy that-- let's

66
02:54.290 --> 02:55.540 align:middle line:84%
just check him out real quick.

67
02:55.540 --> 02:58.290 align:middle line:90%
That's my Raspberry Pi,
and it authenticated

68
02:58.290 --> 03:01.003 align:middle line:90%
on our authentication, MAB,
MAB authorization rule.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:58.290 --> 03:01.003 align:middle line:90%
on our authentication, MAB,
MAB authorization rule.

69
03:01.003 --> 03:02.670 align:middle line:90%
Fantastic, I just
wanted to make sure we

70
03:02.670 --> 03:05.292 align:middle line:90%
had something to work with when
we start modifying our policy.

71
03:05.292 --> 03:06.750 align:middle line:90%
So we're going to
modify our policy

72
03:06.750 --> 03:08.820 align:middle line:90%
by going to Policy,
Policy Sets-- now,

73
03:08.820 --> 03:11.320 align:middle line:90%
this is different,
very different

74
03:11.320 --> 03:12.810 align:middle line:84%
than the TrustSec policy.

75
03:12.810 --> 03:16.620 align:middle line:90%
So under Work Centers,
TrustSec, and TrustSec Policy,

76
03:16.620 --> 03:20.175 align:middle line:90%
this is our matrix regarding
which security groups can

77
03:20.175 --> 03:22.080 align:middle line:90%
talk to which security
groups and what access

78
03:22.080 --> 03:24.090 align:middle line:84%
control lists are applied there.

79
03:24.090 --> 03:25.770 align:middle line:90%
This policy here
is the policy sets

80
03:25.770 --> 03:27.450 align:middle line:90%
regarding the initial
authentication

81
03:27.450 --> 03:29.890 align:middle line:90%
and what's supported,
and if it's matched,

82
03:29.890 --> 03:32.490 align:middle line:90%
then we go into the individual
rules for authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:29.890 --> 03:32.490 align:middle line:90%
then we go into the individual
rules for authentication

83
03:32.490 --> 03:33.940 align:middle line:84%
and authorization.

84
03:33.940 --> 03:36.630 align:middle line:90%
So based on the log we just
looked at, it did hit all three

85
03:36.630 --> 03:39.840 align:middle line:90%
of those, hit our site,
switch, policy set,

86
03:39.840 --> 03:42.030 align:middle line:90%
which matched devices
going from Site1

87
03:42.030 --> 03:43.950 align:middle line:90%
and coming in from a
switch, fair enough.

88
03:43.950 --> 03:46.680 align:middle line:90%
We'll expand that, and
that shows our details

89
03:46.680 --> 03:48.270 align:middle line:84%
for that policy set.

90
03:48.270 --> 03:50.280 align:middle line:90%
So we have the
authentication effect.

91
03:50.280 --> 03:52.330 align:middle line:90%
I know that all three
authenticated from the logs

92
03:52.330 --> 03:55.020 align:middle line:90%
so I'm going to go
right to Authorization,

93
03:55.020 --> 03:56.970 align:middle line:90%
and that's where we'll
make our changes.

94
03:56.970 --> 03:58.920 align:middle line:90%
So down here under
Authorization,

95
03:58.920 --> 04:00.780 align:middle line:90%
let's just verify these
three authorisation
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:58.920 --> 04:00.780 align:middle line:90%
let's just verify these
three authorisation

96
04:00.780 --> 04:03.600 align:middle line:90%
profile we're set
to, ISE Operations,

97
04:03.600 --> 04:08.370 align:middle line:90%
ISE Admins, and PCB-PC
Authorization Profile.

98
04:08.370 --> 04:12.200 align:middle line:90%
To verify that, we'll go to
Operations and Live Logs.

99
04:12.200 --> 04:15.380 align:middle line:84%
And let's check on Bob first.

100
04:15.380 --> 04:19.250 align:middle line:90%
And if we scroll down,
ISE Operations, fantastic.

101
04:19.250 --> 04:24.320 align:middle line:90%
And if we go back, and
then we go to Luis,

102
04:24.320 --> 04:26.000 align:middle line:84%
that is ISE Admins, great.

103
04:26.000 --> 04:30.638 align:middle line:90%
And we'll go back to this one
that did MAB, and this is PCB,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
04:26.000 --> 04:30.638 align:middle line:90%
And we'll go back to this one
that did MAB, and this is PCB,

104
04:30.638 --> 04:33.180 align:middle line:90%
and sure enough, they got the
correct authorization profiles.

105
04:33.180 --> 04:35.900 align:middle line:90%
I just wanted to make sure that
they were matching and getting

106
04:35.900 --> 04:39.710 align:middle line:90%
the properties and policies
that we expected them to.

107
04:39.710 --> 04:42.590 align:middle line:90%
All right, so back to
Policy and Policy Sets.

108
04:42.590 --> 04:44.180 align:middle line:90%
We're going to take
this policy set

109
04:44.180 --> 04:46.430 align:middle line:90%
and go down to
Authorization, and we just

110
04:46.430 --> 04:48.890 align:middle line:90%
confirmed that they're matching
based on the authorization

111
04:48.890 --> 04:50.480 align:middle line:90%
profiles that they
were assigned,

112
04:50.480 --> 04:52.640 align:middle line:84%
and to assign a security group--

113
04:52.640 --> 04:53.750 align:middle line:84%
hold on to your hats--

114
04:53.750 --> 04:58.250 align:middle line:90%
here's how you can do it
dynamically is if it's ISE Ops,

115
04:58.250 --> 05:00.860 align:middle line:90%
and they are a member
of group ISE Operations,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:58.250 --> 05:00.860 align:middle line:90%
and they are a member
of group ISE Operations,

116
05:00.860 --> 05:02.940 align:middle line:90%
they're going to get this
authorization profile,

117
05:02.940 --> 05:06.740 align:middle line:90%
and if we use this option, we
can assign a security group

118
05:06.740 --> 05:07.790 align:middle line:84%
as well.

119
05:07.790 --> 05:11.720 align:middle line:90%
So we can just say we want to
assign ISE Ops to the security

120
05:11.720 --> 05:13.730 align:middle line:84%
group called ISE Ops--

121
05:13.730 --> 05:15.600 align:middle line:84%
we named it very similar.

122
05:15.600 --> 05:17.330 align:middle line:90%
And then, for ISE
Admins, we want

123
05:17.330 --> 05:21.230 align:middle line:90%
to assign them to the
security group of ISE Admins.

124
05:21.230 --> 05:22.880 align:middle line:90%
And then for the
MAB authorization

125
05:22.880 --> 05:24.915 align:middle line:90%
rule and our little
Raspberry Pi,

126
05:24.915 --> 05:27.290 align:middle line:90%
we want to go ahead and assign
that to our security group

127
05:27.290 --> 05:31.010 align:middle line:84%
called this, the PCB-PCs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:27.290 --> 05:31.010 align:middle line:84%
called this, the PCB-PCs.

128
05:31.010 --> 05:33.050 align:middle line:84%
And click on Save.

129
05:33.050 --> 05:35.270 align:middle line:84%
So that says it's saved.

130
05:35.270 --> 05:37.340 align:middle line:90%
And what you'd also
want to pay attention to

131
05:37.340 --> 05:39.920 align:middle line:84%
is this notification right here.

132
05:39.920 --> 05:42.673 align:middle line:90%
If there needs to be a push
where the network access

133
05:42.673 --> 05:44.090 align:middle line:90%
device says there's
been a change,

134
05:44.090 --> 05:45.673 align:middle line:90%
and they need to
get it, there is

135
05:45.673 --> 05:47.090 align:middle line:90%
an option that
often shows up here

136
05:47.090 --> 05:48.725 align:middle line:84%
that says go ahead and push.

137
05:48.725 --> 05:50.930 align:middle line:90%
So you can click on
Push and push it out.

138
05:50.930 --> 05:52.730 align:middle line:90%
In the lab environment,
I would recommend

139
05:52.730 --> 05:54.590 align:middle line:84%
doing something like this.

140
05:54.590 --> 05:55.340 align:middle line:84%
That's our client.

141
05:55.340 --> 05:56.680 align:middle line:84%
Let me go back to our switch.

142
05:56.680 --> 06:01.550 align:middle line:90%
So on the switch, we could
use this command, tts refresh,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:56.680 --> 06:01.550 align:middle line:90%
So on the switch, we could
use this command, tts refresh,

143
06:01.550 --> 06:05.660 align:middle line:90%
and then we could refresh
the environmental data,

144
06:05.660 --> 06:06.830 align:middle line:84%
and take a look at that.

145
06:06.830 --> 06:08.850 align:middle line:90%
See if there's any
error messages there.

146
06:08.850 --> 06:12.790 align:middle line:90%
And then, we could also
refresh policy as well.

147
06:12.790 --> 06:15.150 align:middle line:90%
All right, let me scoot
you over here a little bit.

148
06:15.150 --> 06:16.150 align:middle line:90%
So let's take a look
at some commands

149
06:16.150 --> 06:17.525 align:middle line:90%
that we could use
right here that

150
06:17.525 --> 06:18.860 align:middle line:84%
could be very, very helpful.

151
06:18.860 --> 06:22.000 align:middle line:90%
One of the commands
we show, cts,

152
06:22.000 --> 06:25.020 align:middle line:90%
and we could do security
groups, and that would show us

153
06:25.020 --> 06:26.060 align:middle line:84%
our security groups.

154
06:26.060 --> 06:28.580 align:middle line:90%
OK, great, so there's our
three security groups,

155
06:28.580 --> 06:31.670 align:middle line:90%
and it's showing us the actual
security group tag numbers that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
06:28.580 --> 06:31.670 align:middle line:90%
and it's showing us the actual
security group tag numbers that

156
06:31.670 --> 06:32.930 align:middle line:84%
are assigned to those.

157
06:32.930 --> 06:36.470 align:middle line:90%
We could also do a
show authentication,

158
06:36.470 --> 06:38.608 align:middle line:84%
and we'll type in sessions.

159
06:38.608 --> 06:41.150 align:middle line:90%
And it's showing us that we have
three authenticated sessions

160
06:41.150 --> 06:41.790 align:middle line:84%
right here.

161
06:41.790 --> 06:44.630 align:middle line:90%
And then, we can see that one
was done with MAB and that two

162
06:44.630 --> 06:46.250 align:middle line:84%
were done with .1x.

163
06:46.250 --> 06:49.980 align:middle line:90%
Another great command is
show cts role-based and then

164
06:49.980 --> 06:52.490 align:middle line:90%
sgt-map, and it's
going to show us--

165
06:52.490 --> 06:54.490 align:middle line:90%
if I put in the rest of
the commands-- and let's

166
06:54.490 --> 06:56.090 align:middle line:84%
go ahead and do it for all.

167
06:56.090 --> 06:57.740 align:middle line:90%
It's going to show
us the mappings.

168
06:57.740 --> 06:59.800 align:middle line:84%
And this, oh my gosh.

169
06:59.800 --> 07:02.120 align:middle line:90%
That security group, that's
the default security group
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
06:59.800 --> 07:02.120 align:middle line:90%
That security group, that's
the default security group

170
07:02.120 --> 07:06.320 align:middle line:90%
tag for the switch itself
and not the clients.

171
07:06.320 --> 07:08.408 align:middle line:90%
Let me bounce the
interfaces, and then we

172
07:08.408 --> 07:10.200 align:middle line:90%
should see some different
information here.

173
07:10.200 --> 07:17.750 align:middle line:90%
So interface range, gigabit
2/0/1 through then put 3,

174
07:17.750 --> 07:19.850 align:middle line:84%
and then, we'll do a shutdown.

175
07:19.850 --> 07:22.977 align:middle line:90%
And give that a moment,
and then, no shut.

176
07:22.977 --> 07:25.060 align:middle line:90%
All right, and then give
that a moment to come up.

177
07:25.060 --> 07:28.200 align:middle line:90%
So we should have three
because we have our policies

178
07:28.200 --> 07:31.530 align:middle line:90%
in place on the ISE server, and
these ports are now coming up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

178
07:28.200 --> 07:31.530 align:middle line:90%
in place on the ISE server, and
these ports are now coming up.

179
07:31.530 --> 07:33.760 align:middle line:90%
That should trigger
a reauthentication,

180
07:33.760 --> 07:35.402 align:middle line:90%
which the security
group tags for each

181
07:35.402 --> 07:37.110 align:middle line:90%
of those respective
groups should show up

182
07:37.110 --> 07:38.740 align:middle line:84%
on those devices.

183
07:38.740 --> 07:42.630 align:middle line:90%
So if we do a show cts
role-based sgt-map all

184
07:42.630 --> 07:46.460 align:middle line:90%
and press Enter, oh
and look at this.

185
07:46.460 --> 07:50.590 align:middle line:84%
No tcp destination equals 23.

186
07:50.590 --> 07:52.033 align:middle line:84%
I must have a typo in my ACL.

187
07:52.033 --> 07:53.450 align:middle line:90%
That's what that
says right there.

188
07:53.450 --> 07:54.980 align:middle line:90%
It says, Keith,
you're syntax is all

189
07:54.980 --> 07:57.590 align:middle line:84%
messed up with the no telnet.

190
07:57.590 --> 07:58.560 align:middle line:84%
Let's go fix that.

191
07:58.560 --> 07:59.975 align:middle line:84%
Let's go fix that right now.

192
07:59.975 --> 08:01.760 align:middle line:90%
So going back to
ISE, we'll click on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
07:59.975 --> 08:01.760 align:middle line:90%
So going back to
ISE, we'll click on

193
08:01.760 --> 08:05.930 align:middle line:90%
Work Centers and TrustSec
and TrustSec Components,

194
08:05.930 --> 08:08.050 align:middle line:84%
and let me clean up my ACL.

195
08:08.050 --> 08:09.650 align:middle line:84%
Oh no, look at that.

196
08:09.650 --> 08:10.730 align:middle line:84%
I said no.

197
08:10.730 --> 08:11.870 align:middle line:84%
Oh, my gosh.

198
08:11.870 --> 08:14.520 align:middle line:90%
That's one of the things
I said, no, don't do it.

199
08:14.520 --> 08:16.243 align:middle line:90%
That should probably
be a deny, and I

200
08:16.243 --> 08:17.660 align:middle line:90%
would hope that
in the future they

201
08:17.660 --> 08:22.160 align:middle line:90%
have a check access list syntax
deny tcp destination equals

202
08:22.160 --> 08:23.657 align:middle line:84%
23, not no.

203
08:23.657 --> 08:24.740 align:middle line:84%
I'm glad I had logging on.

204
08:24.740 --> 08:28.950 align:middle line:90%
All right, let me save that,
and let me also go up here.

205
08:28.950 --> 08:30.890 align:middle line:90%
And if there's a
push that's needed,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

205
08:28.950 --> 08:30.890 align:middle line:90%
And if there's a
push that's needed,

206
08:30.890 --> 08:32.900 align:middle line:84%
it usually shows up here.

207
08:32.900 --> 08:34.220 align:middle line:84%
Let's give that a moment.

208
08:34.220 --> 08:36.610 align:middle line:84%
Let me go back to this guy.

209
08:36.610 --> 08:37.110 align:middle line:84%
Oh, look.

210
08:37.110 --> 08:41.299 align:middle line:90%
It has a security groups
now, or 11, 12, and 13.

211
08:41.299 --> 08:44.660 align:middle line:90%
However, it does not have
the ACL because it was wrong.

212
08:44.660 --> 08:47.560 align:middle line:90%
So let's do a cts
refresh policy,

213
08:47.560 --> 08:50.240 align:middle line:90%
and I just want to verify
the ACL didn't come in wrong.

214
08:50.240 --> 08:51.140 align:middle line:84%
So let's do this.

215
08:51.140 --> 08:54.050 align:middle line:90%
Config t-- I'm going to bounce
the interfaces one more time.

216
08:54.050 --> 08:58.000 align:middle line:84%


217
08:58.000 --> 09:02.680 align:middle line:90%
And then we'll do a show
cts role-based, sgt-map all,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

217
08:58.000 --> 09:02.680 align:middle line:90%
And then we'll do a show
cts role-based, sgt-map all,

218
09:02.680 --> 09:04.120 align:middle line:84%
and there's 11 and 13.

219
09:04.120 --> 09:06.910 align:middle line:90%
So those are the two that
authenticated via 802.1x,

220
09:06.910 --> 09:13.300 align:middle line:90%
and .12 my little Raspberry
Pi device, and it'll come in.

221
09:13.300 --> 09:14.220 align:middle line:84%
And there it goes.

222
09:14.220 --> 09:18.730 align:middle line:90%
So .1x timed out, and now, if we
do a show command, there it is,

223
09:18.730 --> 09:19.420 align:middle line:84%
18.

224
09:19.420 --> 09:21.837 align:middle line:90%
All right, so the security
group tag for the group it's in

225
09:21.837 --> 09:22.350 align:middle line:84%
is 18.

226
09:22.350 --> 09:26.110 align:middle line:90%
So basically, .11
and .13 should not

227
09:26.110 --> 09:30.340 align:middle line:84%
be able to telnet over to .12.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

227
09:26.110 --> 09:30.340 align:middle line:84%
be able to telnet over to .12.

228
09:30.340 --> 09:32.200 align:middle line:90%
So let's verify that
from the client.

229
09:32.200 --> 09:35.188 align:middle line:90%
In fact, we can also do
a show cts role-based,

230
09:35.188 --> 09:36.730 align:middle line:90%
and then, we
[INAUDIBLE] permissions.

231
09:36.730 --> 09:37.660 align:middle line:84%
Check this out.

232
09:37.660 --> 09:42.220 align:middle line:90%
This is also showing us
that from group 16 to 18

233
09:42.220 --> 09:45.940 align:middle line:90%
that that access list is in
place, and from group 17 to 18,

234
09:45.940 --> 09:47.050 align:middle line:84%
it's in place.

235
09:47.050 --> 09:48.640 align:middle line:84%
So let's test that.

236
09:48.640 --> 09:50.930 align:middle line:84%
That's the no telnet option.

237
09:50.930 --> 09:55.622 align:middle line:90%
Let's go to the PC, and on
this PC, let's do a show--

238
09:55.622 --> 09:57.820 align:middle line:84%
show-- let's do an IP config.

239
09:57.820 --> 10:01.520 align:middle line:90%
All right, so one of our
addresses here is 10.80.0.11,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

239
09:57.820 --> 10:01.520 align:middle line:90%
All right, so one of our
addresses here is 10.80.0.11,

240
10:01.520 --> 10:06.010 align:middle line:90%
and if we try to
ping 10.80.0.12,

241
10:06.010 --> 10:09.200 align:middle line:90%
which is our Raspberry
Pi, that works.

242
10:09.200 --> 10:12.930 align:middle line:90%
And let me just verify that
that really is our Raspberry Pi.

243
10:12.930 --> 10:15.700 align:middle line:90%
Well, I have a terminal
open with it real quick.

244
10:15.700 --> 10:21.427 align:middle line:90%
Do a IP adder, and sure enough,
it is 12, just verifying.

245
10:21.427 --> 10:23.010 align:middle line:90%
And also, I want to
point out that you

246
10:23.010 --> 10:26.530 align:middle line:90%
want to do some tests before you
throw in the security group ACL

247
10:26.530 --> 10:29.088 align:middle line:90%
because Windows devices,
when you try to ping them,

248
10:29.088 --> 10:29.880 align:middle line:84%
they don't respond.

249
10:29.880 --> 10:32.890 align:middle line:90%
There's a default firewall
on most devices by default.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

249
10:29.880 --> 10:32.890 align:middle line:90%
There's a default firewall
on most devices by default.

250
10:32.890 --> 10:36.640 align:middle line:90%
So if you ping to the Windows
machine and it doesn't respond,

251
10:36.640 --> 10:38.620 align:middle line:90%
it may not be because
of an access list

252
10:38.620 --> 10:40.903 align:middle line:90%
that you have as part
of your TrustSec.

253
10:40.903 --> 10:43.070 align:middle line:90%
It could be just the Windows
machine not responding.

254
10:43.070 --> 10:45.700 align:middle line:90%
So in a lab, test the pings
and the telnet and everything

255
10:45.700 --> 10:46.840 align:middle line:84%
else first.

256
10:46.840 --> 10:50.170 align:middle line:90%
Verify what works before you put
in the security, and that way

257
10:50.170 --> 10:52.060 align:middle line:90%
you can do a before
and after comparison

258
10:52.060 --> 10:54.400 align:middle line:90%
to verify that your
security policy for TrustSec

259
10:54.400 --> 10:55.640 align:middle line:84%
is really working.

260
10:55.640 --> 10:59.180 align:middle line:90%
So here, I can ping
that device no problem,

261
10:59.180 --> 11:01.510 align:middle line:90%
but if I bring up a
terminal emulator,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

261
10:59.180 --> 11:01.510 align:middle line:90%
but if I bring up a
terminal emulator,

262
11:01.510 --> 11:03.490 align:middle line:84%
and I try to use Telnet--

263
11:03.490 --> 11:08.200 align:middle line:90%
so right here, I have a
telnet session to 10.80.0.12,

264
11:08.200 --> 11:09.550 align:middle line:84%
which is its IP address.

265
11:09.550 --> 11:12.670 align:middle line:84%
If I go there, it's timing out.

266
11:12.670 --> 11:14.493 align:middle line:84%
It is not allowing that.

267
11:14.493 --> 11:17.160 align:middle line:90%
So if we go back to the switch--
let me get to the right console

268
11:17.160 --> 11:18.400 align:middle line:84%
here--

269
11:18.400 --> 11:21.390 align:middle line:90%
and we did a show cts
role-based permissions, that

270
11:21.390 --> 11:22.050 align:middle line:84%
hasn't changed.

271
11:22.050 --> 11:25.500 align:middle line:90%
But let's do a cts
role-based, and let's go ahead

272
11:25.500 --> 11:26.710 align:middle line:84%
and do counters.

273
11:26.710 --> 11:27.650 align:middle line:84%
Press Enter.

274
11:27.650 --> 11:28.890 align:middle line:84%
Look at that.

275
11:28.890 --> 11:32.790 align:middle line:90%
This is showing it from
group 16 to group 18.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

275
11:28.890 --> 11:32.790 align:middle line:90%
This is showing it from
group 16 to group 18.

276
11:32.790 --> 11:35.100 align:middle line:90%
It's had denies, and
they were in hardware.

277
11:35.100 --> 11:37.630 align:middle line:90%
So it has very little
impact on the devices.

278
11:37.630 --> 11:40.070 align:middle line:90%
There's been a lot of
permits or other traffic,

279
11:40.070 --> 11:41.850 align:middle line:84%
like see that 16 right there.

280
11:41.850 --> 11:43.950 align:middle line:90%
If we went back to
the Windows client,

281
11:43.950 --> 11:48.800 align:middle line:90%
and we went to the Command
Prompt, and we did ping,

282
11:48.800 --> 11:50.180 align:middle line:84%
and there should be five more.

283
11:50.180 --> 11:51.675 align:middle line:84%
Let's go ahead and refresh it.

284
11:51.675 --> 11:52.590 align:middle line:84%
Go back here.

285
11:52.590 --> 11:55.350 align:middle line:90%
So back here, the
permitted was 16,

286
11:55.350 --> 11:57.000 align:middle line:90%
and if we look at
the counters, it

287
11:57.000 --> 11:59.850 align:middle line:90%
is now 20, although I
think I did five pings.

288
11:59.850 --> 12:02.400 align:middle line:84%
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

288
11:59.850 --> 12:02.400 align:middle line:84%


289
12:02.400 --> 12:05.280 align:middle line:90%
All right, so in any event,
it is filtering the traffic.

290
12:05.280 --> 12:07.620 align:middle line:90%
This is the telnet activity
that wasn't allowed,

291
12:07.620 --> 12:10.170 align:middle line:90%
and I had a lot of fun in
putting this together and doing

292
12:10.170 --> 12:11.100 align:middle line:84%
a lot of testing.

293
12:11.100 --> 12:12.600 align:middle line:90%
And here's my tips
for you as you

294
12:12.600 --> 12:14.970 align:middle line:90%
do this is test the
protocols before you

295
12:14.970 --> 12:16.440 align:middle line:84%
put in the security group ACLs.

296
12:16.440 --> 12:19.530 align:middle line:90%
Make sure they all work, and
then, as you add them verify,

297
12:19.530 --> 12:22.660 align:middle line:90%
and also, refresh your policy
manually on the switch that way

298
12:22.660 --> 12:24.180 align:middle line:90%
you're not waiting
for ISE to push

299
12:24.180 --> 12:24.960 align:middle line:84%
an update or anything else.

300
12:24.960 --> 12:26.430 align:middle line:90%
You make sure you have
the latest and greatest.

301
12:26.430 --> 12:28.055 align:middle line:90%
Also, in the
authorization policy,

302
12:28.055 --> 12:30.180 align:middle line:90%
you can change the security
group tags nilly willy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

302
12:28.055 --> 12:30.180 align:middle line:90%
you can change the security
group tags nilly willy.

303
12:30.180 --> 12:32.070 align:middle line:90%
So you can change them
all to the same group.

304
12:32.070 --> 12:35.310 align:middle line:90%
And then, you could also apply
an access list, a security

305
12:35.310 --> 12:36.828 align:middle line:84%
group ACL, for the same group.

306
12:36.828 --> 12:37.620 align:middle line:84%
Say, you know what?

307
12:37.620 --> 12:39.660 align:middle line:90%
I want to make new
policy for TrustSec

308
12:39.660 --> 12:43.510 align:middle line:90%
or this type of traffic from
this group to the same group

309
12:43.510 --> 12:44.730 align:middle line:84%
and within the same group.

310
12:44.730 --> 12:46.560 align:middle line:84%
You can limit those protocols.

311
12:46.560 --> 12:49.200 align:middle line:90%
And the beautiful thing
is that if you identify

312
12:49.200 --> 12:52.020 align:middle line:90%
the customer on the way in, and
they get a security group tag,

313
12:52.020 --> 12:54.780 align:middle line:90%
and then, you have all your
devices who are implementing

314
12:54.780 --> 12:57.570 align:middle line:90%
security based on those
tags, the security

315
12:57.570 --> 12:58.650 align:middle line:84%
follows the packet.

316
12:58.650 --> 13:01.380 align:middle line:90%
It is packet-based
microsegmentation.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

316
12:58.650 --> 13:01.380 align:middle line:90%
It is packet-based
microsegmentation.

317
13:01.380 --> 13:05.280 align:middle line:90%
You can control in great
detail from a central location

318
13:05.280 --> 13:07.230 align:middle line:90%
the traffic patterns
that you want to allow

319
13:07.230 --> 13:11.070 align:middle line:90%
and/or deny on your network,
and implement it and enforce it

320
13:11.070 --> 13:11.883 align:middle line:84%
with TrustSec.

321
13:11.883 --> 13:13.800 align:middle line:90%
So thanks for joining
me in this demonstration

322
13:13.800 --> 13:15.740 align:middle line:90%
about implementing and
verifying TrustSec,

323
13:15.740 --> 13:18.060 align:middle line:90%
and I'll see you
in the next video.

324
13:18.060 --> 13:20.460 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

325
13:20.460 --> 13:23.630 align:middle line:90%
and I'd like to thank
you for viewing.