WEBVTT

1
00:00.000 --> 00:01.632 align:middle line:84%


2
00:01.632 --> 00:03.590 align:middle line:90%
One of the really cool
features about TrustSec,

3
00:03.590 --> 00:06.410 align:middle line:90%
among others, is that it's
embedded that security group

4
00:06.410 --> 00:08.210 align:middle line:84%
tag inside the frame.

5
00:08.210 --> 00:10.700 align:middle line:90%
And if you have Cisco
gear, it's wonderful,

6
00:10.700 --> 00:14.044 align:middle line:90%
because Cisco gear can carry
that frame and forward it.

7
00:14.044 --> 00:16.280 align:middle line:90%
However, in many
environments we're

8
00:16.280 --> 00:20.060 align:middle line:90%
not going to have a 100% Cisco
environment of all switches

9
00:20.060 --> 00:21.370 align:middle line:84%
and devices in the path.

10
00:21.370 --> 00:24.980 align:middle line:90%
And in that case, if you have a
device that's non-Cisco between

11
00:24.980 --> 00:27.540 align:middle line:90%
point A and Z, it
may not be able to--

12
00:27.540 --> 00:29.540 align:middle line:90%
in fact, it won't be able
to propagate correctly

13
00:29.540 --> 00:31.730 align:middle line:90%
that tag in the CMD
field, because it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.540 --> 00:31.730 align:middle line:90%
that tag in the CMD
field, because it

14
00:31.730 --> 00:33.330 align:middle line:84%
won't understand what it is.

15
00:33.330 --> 00:35.450 align:middle line:90%
So to solve that
problem, we have a method

16
00:35.450 --> 00:36.920 align:middle line:84%
of advertising the tags.

17
00:36.920 --> 00:38.810 align:middle line:90%
That way you can
have a packet that

18
00:38.810 --> 00:40.700 align:middle line:90%
was brought in the
network over here, being

19
00:40.700 --> 00:43.700 align:middle line:90%
routed and forwarded
over non-Cisco devices.

20
00:43.700 --> 00:45.320 align:middle line:90%
But at the very end
where it's going

21
00:45.320 --> 00:47.812 align:middle line:90%
to be sent or egress
out and forwarded

22
00:47.812 --> 00:49.520 align:middle line:90%
to the final destination,
we can actually

23
00:49.520 --> 00:52.670 align:middle line:90%
ship over with a protocol
over the network,

24
00:52.670 --> 00:55.070 align:middle line:90%
like a control protocol,
to tell that network access

25
00:55.070 --> 00:57.570 align:middle line:90%
device at the end,
hey, oh by the way,

26
00:57.570 --> 00:59.690 align:middle line:90%
here are the tags involved
for these devices.

27
00:59.690 --> 01:03.020 align:middle line:90%
So that end device, that network
access device like a switch,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.690 --> 01:03.020 align:middle line:90%
So that end device, that network
access device like a switch,

28
01:03.020 --> 01:05.720 align:middle line:90%
can still enforce policy,
even though we weren't

29
01:05.720 --> 01:09.470 align:middle line:90%
able to carry all that security
group tag information in each

30
01:09.470 --> 01:11.730 align:middle line:90%
of the frames for
the entire duration.

31
01:11.730 --> 01:15.170 align:middle line:90%
Now that is done with a
protocol called SXP, which

32
01:15.170 --> 01:17.190 align:middle line:84%
is the focus of this video.

33
01:17.190 --> 01:19.550 align:middle line:90%
So here's a visual
representation of the problem,

34
01:19.550 --> 01:21.380 align:middle line:90%
and then we'll walk
through the solution

35
01:21.380 --> 01:27.080 align:middle line:90%
with SXP, which is the
SGT Exchange Protocol.

36
01:27.080 --> 01:30.050 align:middle line:90%
Think of it like a routing
protocol or the security group
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:27.080 --> 01:30.050 align:middle line:90%
Think of it like a routing
protocol or the security group

37
01:30.050 --> 01:32.490 align:middle line:84%
tag information over a network.

38
01:32.490 --> 01:36.260 align:middle line:90%
So if switch A, right here,
is participating in TrustSec,

39
01:36.260 --> 01:39.470 align:middle line:90%
and so is switch Z, but we
have one or more devices

40
01:39.470 --> 01:40.940 align:middle line:90%
in the path here
that know nothing

41
01:40.940 --> 01:42.835 align:middle line:84%
about it, that can't handle it.

42
01:42.835 --> 01:44.960 align:middle line:90%
What we could do is have
the ISE server, as well as

43
01:44.960 --> 01:48.130 align:middle line:84%
other devices, act as an SXP.

44
01:48.130 --> 01:51.850 align:middle line:90%
That's an SGT exchange
protocol speaker.

45
01:51.850 --> 01:54.320 align:middle line:90%
Now think of a
speaker as somebody

46
01:54.320 --> 01:57.620 align:middle line:90%
who is willing to share the
mapping information regarding

47
01:57.620 --> 02:01.430 align:middle line:90%
devices, and IP addresses,
and their associated group tag
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:57.620 --> 02:01.430 align:middle line:90%
devices, and IP addresses,
and their associated group tag

48
02:01.430 --> 02:02.460 align:middle line:84%
information.

49
02:02.460 --> 02:05.600 align:middle line:90%
The one option would be
have the ISE be a speaker,

50
02:05.600 --> 02:09.449 align:middle line:90%
and have it go ahead and
have switch A be a listener,

51
02:09.449 --> 02:11.750 align:middle line:84%
and have switch B be a listener.

52
02:11.750 --> 02:14.540 align:middle line:90%
And that way they could get
all the group tag information.

53
02:14.540 --> 02:17.120 align:middle line:90%
This would be above and beyond
the relationship they already

54
02:17.120 --> 02:18.230 align:middle line:84%
have with the ISE server.

55
02:18.230 --> 02:21.570 align:middle line:90%
This would be the ability to
additionally learn information

56
02:21.570 --> 02:22.820 align:middle line:84%
about the security group tags.

57
02:22.820 --> 02:26.150 align:middle line:90%
That way if a packet is coming
in here from device Z, which

58
02:26.150 --> 02:27.730 align:middle line:90%
is in a different
security group,

59
02:27.730 --> 02:30.860 align:middle line:90%
if that tag isn't here it
can still get the mapping,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:27.730 --> 02:30.860 align:middle line:90%
if that tag isn't here it
can still get the mapping,

60
02:30.860 --> 02:33.170 align:middle line:90%
because it's using
SXP and learning

61
02:33.170 --> 02:34.980 align:middle line:84%
that information from ISE.

62
02:34.980 --> 02:36.860 align:middle line:90%
So that way we're
alleviating the problem

63
02:36.860 --> 02:38.750 align:middle line:90%
of this intermediate
network having

64
02:38.750 --> 02:40.875 align:middle line:84%
to support the CMD field.

65
02:40.875 --> 02:43.250 align:middle line:90%
So there's components we need
to implement at the switch.

66
02:43.250 --> 02:45.083 align:middle line:90%
There's also components
we need to implement

67
02:45.083 --> 02:47.240 align:middle line:84%
at the server, regarding SXP.

68
02:47.240 --> 02:49.350 align:middle line:90%
Let me show you both
of those right now.

69
02:49.350 --> 02:51.480 align:middle line:90%
So here is the syntax
in configuration mode.

70
02:51.480 --> 02:57.620 align:middle line:90%
We'd say cts for Cisco TrustSec,
sxp as the SGT exchange

71
02:57.620 --> 02:58.880 align:middle line:84%
protocol, enable.

72
02:58.880 --> 03:00.990 align:middle line:90%
We'd specify a
password, and then we'd
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:58.880 --> 03:00.990 align:middle line:90%
We'd specify a
password, and then we'd

73
03:00.990 --> 03:03.080 align:middle line:90%
tell it who to go ahead
and buddy up with.

74
03:03.080 --> 03:06.170 align:middle line:90%
Think of this like
two BGP speakers

75
03:06.170 --> 03:07.730 align:middle line:90%
that can communicate
over a network

76
03:07.730 --> 03:08.967 align:middle line:84%
to share routing information.

77
03:08.967 --> 03:11.300 align:middle line:90%
However, in this case, we're
learning security group tag

78
03:11.300 --> 03:12.420 align:middle line:84%
information.

79
03:12.420 --> 03:15.650 align:middle line:90%
So this cts sxp connection
peer is pointing

80
03:15.650 --> 03:18.230 align:middle line:84%
to the IP address of a speaker.

81
03:18.230 --> 03:20.330 align:middle line:90%
In this case, I'm just
pointing to the ISE server.

82
03:20.330 --> 03:22.400 align:middle line:90%
We specify a password
default, which

83
03:22.400 --> 03:25.100 align:middle line:90%
is referring to this
default password right here.

84
03:25.100 --> 03:27.770 align:middle line:90%
And then we specify what
the peer is going to be.

85
03:27.770 --> 03:28.700 align:middle line:84%
And that's it.

86
03:28.700 --> 03:31.890 align:middle line:90%
So this configuration is
already present on the switch.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:28.700 --> 03:31.890 align:middle line:90%
So this configuration is
already present on the switch.

87
03:31.890 --> 03:34.370 align:middle line:90%
In fact, just to confirm
that, let me copy that.

88
03:34.370 --> 03:38.450 align:middle line:90%
Right-click, copy, and let's
go to the switch and apply it.

89
03:38.450 --> 03:41.530 align:middle line:90%
And that's actually what those
messages were right there,

90
03:41.530 --> 03:44.970 align:middle line:90%
our SXP messages regarding
the updates and so forth.

91
03:44.970 --> 03:46.600 align:middle line:90%
So we'll go ahead
and do a config t,

92
03:46.600 --> 03:48.560 align:middle line:84%
and we'll paste that in.

93
03:48.560 --> 03:50.472 align:middle line:90%
And it didn't like
config t from config t.

94
03:50.472 --> 03:51.180 align:middle line:84%
But there you go.

95
03:51.180 --> 03:52.470 align:middle line:84%
There's the config.

96
03:52.470 --> 03:56.373 align:middle line:90%
We did just show cts, and
we did a security-groups,

97
03:56.373 --> 04:02.850 align:middle line:90%
and show cts role-based
sgt-map for all.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:56.373 --> 04:02.850 align:middle line:90%
and show cts role-based
sgt-map for all.

98
04:02.850 --> 04:06.683 align:middle line:90%
We'll do the show
authentication, sessions.

99
04:06.683 --> 04:08.100 align:middle line:90%
And then we could
go even further,

100
04:08.100 --> 04:10.100 align:middle line:90%
if we wanted to take this
one, for example, take

101
04:10.100 --> 04:10.970 align:middle line:84%
its MAC address.

102
04:10.970 --> 04:13.380 align:middle line:90%
Hit the up arrow
key, type in mac.

103
04:13.380 --> 04:17.430 align:middle line:90%
And then put in the MAC
address, paste that in, and then

104
04:17.430 --> 04:19.380 align:middle line:84%
the word details.

105
04:19.380 --> 04:21.360 align:middle line:90%
That's going to show
us all the details

106
04:21.360 --> 04:24.870 align:middle line:90%
for that specific session, which
is authenticated, including

107
04:24.870 --> 04:27.450 align:middle line:90%
the STG tag, the
vLAN assignment,

108
04:27.450 --> 04:29.030 align:middle line:90%
and also up here
it says it's luis.

109
04:29.030 --> 04:30.090 align:middle line:84%
There's the IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:29.030 --> 04:30.090 align:middle line:84%
There's the IP address.

110
04:30.090 --> 04:31.620 align:middle line:84%
There's his MAC address.

111
04:31.620 --> 04:33.283 align:middle line:90%
And there's the port
he's coming in on.

112
04:33.283 --> 04:34.950 align:middle line:90%
And all of this
information, by the way,

113
04:34.950 --> 04:36.940 align:middle line:90%
would also be in
the log as well.

114
04:36.940 --> 04:39.390 align:middle line:90%
So regarding SXP, we'd have
to do this work on the client.

115
04:39.390 --> 04:41.730 align:middle line:90%
But we'd also want to make
sure we enable this feature

116
04:41.730 --> 04:43.170 align:middle line:84%
on the ISE server itself.

117
04:43.170 --> 04:45.010 align:middle line:84%
Let's do that now.

118
04:45.010 --> 04:49.370 align:middle line:90%
So back on ISE, we'd go to
work centers, and in TrustSec.

119
04:49.370 --> 04:52.630 align:middle line:90%
There's an option right
here for SXP right there.

120
04:52.630 --> 04:54.720 align:middle line:84%
So we'll click on SXP.

121
04:54.720 --> 04:58.620 align:middle line:90%
And what I did was I added
switch 2 as an SXP listener.

122
04:58.620 --> 05:02.133 align:middle line:90%
So if we just edit this
switch and go the details,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:58.620 --> 05:02.133 align:middle line:90%
So if we just edit this
switch and go the details,

123
05:02.133 --> 05:03.300 align:middle line:84%
it will show us the details.

124
05:03.300 --> 05:06.080 align:middle line:90%
So I just put in switch
2, its IP address,

125
05:06.080 --> 05:07.580 align:middle line:84%
said that it was a listener.

126
05:07.580 --> 05:09.930 align:middle line:90%
And then I also specified,
when I configured it,

127
05:09.930 --> 05:11.450 align:middle line:84%
I specified a password.

128
05:11.450 --> 05:13.200 align:middle line:90%
And if we want to look
at all the mappings

129
05:13.200 --> 05:14.658 align:middle line:90%
that are currently
in place that it

130
05:14.658 --> 05:18.417 align:middle line:90%
would be advertising via SXP,
we can go to all SXP mappings.

131
05:18.417 --> 05:19.500 align:middle line:84%
And here are the mappings.

132
05:19.500 --> 05:21.060 align:middle line:90%
It knows about
these three devices,

133
05:21.060 --> 05:23.340 align:middle line:90%
because they're the only
three that are connected,

134
05:23.340 --> 05:26.070 align:middle line:90%
and there's their groups,
there's their actual security

135
05:26.070 --> 05:27.350 align:middle line:84%
group tag numbers.

136
05:27.350 --> 05:30.960 align:middle line:90%
So this is information that
would be advertised via SXP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:27.350 --> 05:30.960 align:middle line:90%
So this is information that
would be advertised via SXP,

137
05:30.960 --> 05:34.350 align:middle line:90%
so that devices could still
learn about associated IP

138
05:34.350 --> 05:36.690 align:middle line:90%
addresses and the
security group tags,

139
05:36.690 --> 05:39.270 align:middle line:90%
even if those frames
came into that switch

140
05:39.270 --> 05:41.430 align:middle line:90%
and didn't have that
tag on it natively,

141
05:41.430 --> 05:43.550 align:middle line:90%
because they are connected
to a non-Cisco network.

142
05:43.550 --> 05:45.300 align:middle line:90%
And there's one other
option I'd like just

143
05:45.300 --> 05:47.467 align:middle line:90%
to talk about for a moment,
and then Knox Hutchinson

144
05:47.467 --> 05:50.880 align:middle line:90%
is going to talk more about it
when dealing with DNA Center,

145
05:50.880 --> 05:52.290 align:middle line:84%
regarding these mappings.

146
05:52.290 --> 05:54.630 align:middle line:90%
And that is if we go
to Administration,

147
05:54.630 --> 05:57.140 align:middle line:90%
and under Administration
under System,

148
05:57.140 --> 06:00.630 align:middle line:90%
and then under Deployment
within System, let's go there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
05:57.140 --> 06:00.630 align:middle line:90%
and then under Deployment
within System, let's go there.

149
06:00.630 --> 06:03.000 align:middle line:90%
And then select
our server, ISE 2.

150
06:03.000 --> 06:05.190 align:middle line:90%
If our device was not
a primary ISE node,

151
06:05.190 --> 06:07.890 align:middle line:90%
we could make it a primary,
by clicking on primary here.

152
06:07.890 --> 06:09.030 align:middle line:84%
It currently is.

153
06:09.030 --> 06:12.830 align:middle line:90%
And if we scroll down a little
bit, here under Policy Service,

154
06:12.830 --> 06:15.450 align:middle line:90%
see where says
enable SXP service?

155
06:15.450 --> 06:17.400 align:middle line:90%
We need that running if
we want this to work.

156
06:17.400 --> 06:20.850 align:middle line:90%
If we want to enable sharing
of information using pxGrid,

157
06:20.850 --> 06:24.120 align:middle line:90%
again Knox will talk more about
that, we'd check that checkbox

158
06:24.120 --> 06:25.280 align:middle line:84%
and then click on Save.

159
06:25.280 --> 06:28.370 align:middle line:90%
So for SXP, we'd definitely
want to have that checkbox.

160
06:28.370 --> 06:31.290 align:middle line:90%
And if you need pxGrid services
to share that information,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

160
06:28.370 --> 06:31.290 align:middle line:90%
And if you need pxGrid services
to share that information,

161
06:31.290 --> 06:33.783 align:middle line:90%
you'd click this on as
well, and click on Save.

162
06:33.783 --> 06:35.950 align:middle line:90%
So in this video, we've
answered the question, well,

163
06:35.950 --> 06:37.980 align:middle line:90%
what if I don't have
Cisco devices everywhere

164
06:37.980 --> 06:40.710 align:middle line:90%
that can support those
tag fields in the frames.

165
06:40.710 --> 06:43.110 align:middle line:90%
And the answer is, we can
still advertise that mapping

166
06:43.110 --> 06:46.260 align:middle line:90%
information over to the devices
at the edges of our network

167
06:46.260 --> 06:50.310 align:middle line:90%
that need it using the
SGT Exchange Protocol.

168
06:50.310 --> 06:52.320 align:middle line:90%
Well thanks for joining
me in this video on SXP,

169
06:52.320 --> 06:53.695 align:middle line:90%
and I'll see you
in the next one.

170
06:53.695 --> 06:56.270 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

171
06:56.270 --> 06:59.560 align:middle line:90%
And I'd like to thank
you for viewing.