WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.610 align:middle line:90%
The next identity-based
authentication

3
00:02.610 --> 00:04.410 align:middle line:90%
and authorization
technology that we're

4
00:04.410 --> 00:07.050 align:middle line:90%
going to be talking
about is Cisco TrustSec,

5
00:07.050 --> 00:09.930 align:middle line:90%
and how it can leverage
security group tags.

6
00:09.930 --> 00:12.960 align:middle line:90%
Look, this technology,
it's not exactly new,

7
00:12.960 --> 00:15.780 align:middle line:90%
but it's rapidly
gaining in popularity,

8
00:15.780 --> 00:18.780 align:middle line:90%
because it's all about
intent-based networking.

9
00:18.780 --> 00:21.840 align:middle line:90%
This is one of the
core and key components

10
00:21.840 --> 00:26.740 align:middle line:90%
that makes the SD-Access fabric
in DNA Center actually work.

11
00:26.740 --> 00:29.930 align:middle line:90%
This is how it implements
the microsegmentation policy.

12
00:29.930 --> 00:32.940 align:middle line:90%
So if you haven't watched the
content on DNA Center yet,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:29.930 --> 00:32.940 align:middle line:90%
So if you haven't watched the
content on DNA Center yet,

13
00:32.940 --> 00:34.980 align:middle line:90%
go back and watch
that skill real quick,

14
00:34.980 --> 00:36.810 align:middle line:90%
because this next
Nugget is going

15
00:36.810 --> 00:38.910 align:middle line:90%
to make a whole lot more
sense once you actually

16
00:38.910 --> 00:40.030 align:middle line:84%
see it in action.

17
00:40.030 --> 00:42.030 align:middle line:90%
But for now what we're
going to be talking about

18
00:42.030 --> 00:44.640 align:middle line:90%
is how we can define
policies based

19
00:44.640 --> 00:48.810 align:middle line:90%
on who a person is rather than
their IP address or their VLAN.

20
00:48.810 --> 00:49.800 align:middle line:84%
Let's get going.

21
00:49.800 --> 00:53.070 align:middle line:90%
Cisco TrustSec is really
flipping the networking world

22
00:53.070 --> 00:53.790 align:middle line:84%
on its head.

23
00:53.790 --> 00:55.740 align:middle line:90%
I mean, it really takes
the traditional way

24
00:55.740 --> 00:58.290 align:middle line:90%
of doing networking, and it
basically just throws it away,

25
00:58.290 --> 01:01.980 align:middle line:90%
and says, we've got a cooler
way of doing things that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.290 --> 01:01.980 align:middle line:90%
and says, we've got a cooler
way of doing things that's

26
01:01.980 --> 01:04.620 align:middle line:90%
going to be based on
who the person is,

27
01:04.620 --> 01:07.890 align:middle line:90%
rather than what their IP
address or their VLAN is.

28
01:07.890 --> 01:12.060 align:middle line:90%
This is how we can control
access from one resource

29
01:12.060 --> 01:16.050 align:middle line:90%
to another based on their
identity, rather than

30
01:16.050 --> 01:17.850 align:middle line:84%
their network configuration.

31
01:17.850 --> 01:19.210 align:middle line:84%
This is so cool.

32
01:19.210 --> 01:21.900 align:middle line:90%
And it's a major,
major component

33
01:21.900 --> 01:23.880 align:middle line:84%
to Cisco's SD-Access product.

34
01:23.880 --> 01:25.890 align:middle line:90%
In fact, it's really
what makes it work.

35
01:25.890 --> 01:29.460 align:middle line:90%
This is what we call the
microsegmentation policy.

36
01:29.460 --> 01:33.240 align:middle line:90%
Let's talk about what Cisco
TrustSec in these security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:29.460 --> 01:33.240 align:middle line:90%
Let's talk about what Cisco
TrustSec in these security

37
01:33.240 --> 01:35.970 align:middle line:90%
group tags really do
at the end of the day.

38
01:35.970 --> 01:37.560 align:middle line:84%
So now here's the scenario.

39
01:37.560 --> 01:41.010 align:middle line:90%
What I want you to imagine
is we have a username,

40
01:41.010 --> 01:42.660 align:middle line:84%
like a guy named Bob.

41
01:42.660 --> 01:44.580 align:middle line:90%
And what Bob wants
to do is he wants

42
01:44.580 --> 01:46.110 align:middle line:90%
to go through their
network, which

43
01:46.110 --> 01:48.480 align:middle line:90%
may contain a
series of switches,

44
01:48.480 --> 01:51.960 align:middle line:90%
or routers, which
go to more switches.

45
01:51.960 --> 01:55.260 align:middle line:90%
And Bob wants to
access a file share.

46
01:55.260 --> 01:57.600 align:middle line:90%
And while this diagram
is pretty simplistic--

47
01:57.600 --> 01:59.720 align:middle line:90%
we've got two switches
and a router here--

48
01:59.720 --> 02:02.580 align:middle line:90%
imagine this is actually
a gigantic enterprise
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.720 --> 02:02.580 align:middle line:90%
imagine this is actually
a gigantic enterprise

49
02:02.580 --> 02:05.880 align:middle line:90%
campus with thousands
upon thousands of devices,

50
02:05.880 --> 02:07.980 align:middle line:90%
and hundreds of
thousands of users

51
02:07.980 --> 02:09.930 align:middle line:90%
who may be bringing
their own devices,

52
02:09.930 --> 02:11.280 align:middle line:84%
and so on, and so on, and so on.

53
02:11.280 --> 02:13.260 align:middle line:90%
This is where it gets
really complicated

54
02:13.260 --> 02:17.070 align:middle line:90%
to extend security
from one endpoint all

55
02:17.070 --> 02:18.420 align:middle line:84%
the way to the other.

56
02:18.420 --> 02:20.310 align:middle line:84%
There's going to be VLAN ACLs.

57
02:20.310 --> 02:22.308 align:middle line:84%
And there's going to be IP ACLs.

58
02:22.308 --> 02:23.850 align:middle line:90%
And then there's
going to be routing,

59
02:23.850 --> 02:27.670 align:middle line:90%
and security permissions, and
NTFS, and blah, blah, blah.

60
02:27.670 --> 02:28.920 align:middle line:84%
You get the idea.

61
02:28.920 --> 02:31.170 align:middle line:90%
Trying to stretch
Bob's permission
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:28.920 --> 02:31.170 align:middle line:90%
Trying to stretch
Bob's permission

62
02:31.170 --> 02:34.590 align:middle line:90%
all the way across a campus
can get out of hand fast.

63
02:34.590 --> 02:38.160 align:middle line:90%
And that's the problem that
Cisco TrustSec tries to solve.

64
02:38.160 --> 02:41.310 align:middle line:90%
You see, when Bob plugs his
computer, maybe his laptop

65
02:41.310 --> 02:43.860 align:middle line:90%
that he brought from
home, into the network,

66
02:43.860 --> 02:46.890 align:middle line:90%
the network can perform
authentication services

67
02:46.890 --> 02:50.550 align:middle line:90%
like we've seen using
something like Cisco's ISE.

68
02:50.550 --> 02:54.520 align:middle line:90%
But this is where Cisco
TrustSec shakes things up a bit.

69
02:54.520 --> 02:58.770 align:middle line:90%
It uses something called
security group tags.

70
02:58.770 --> 03:01.830 align:middle line:90%
And it tags all
of Bob's traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:58.770 --> 03:01.830 align:middle line:90%
And it tags all
of Bob's traffic.

71
03:01.830 --> 03:04.140 align:middle line:90%
Specifically this
switch right here,

72
03:04.140 --> 03:06.090 align:middle line:90%
the entrance point
into the network,

73
03:06.090 --> 03:08.190 align:middle line:84%
tags all of Bob's traffic.

74
03:08.190 --> 03:10.410 align:middle line:90%
What kind of tag,
you might be asking.

75
03:10.410 --> 03:12.810 align:middle line:90%
Literally, on the
layer 2 frame, it

76
03:12.810 --> 03:15.810 align:middle line:90%
could be just a simple
tag as something like a 4

77
03:15.810 --> 03:18.720 align:middle line:90%
that says Bob belongs
to group number 4.

78
03:18.720 --> 03:22.230 align:middle line:90%
On the flip side of the network,
we'll have the server here.

79
03:22.230 --> 03:24.150 align:middle line:90%
Maybe the server
gets authenticated

80
03:24.150 --> 03:27.630 align:middle line:90%
with MAC authentication
bypass all the way to ISE.

81
03:27.630 --> 03:31.230 align:middle line:90%
And it will receive a
security group tag of 5.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:27.630 --> 03:31.230 align:middle line:90%
And it will receive a
security group tag of 5.

82
03:31.230 --> 03:34.860 align:middle line:90%
At this point, we, the network
administrators, the ISE

83
03:34.860 --> 03:38.670 align:middle line:90%
administrators, can
say users in this group

84
03:38.670 --> 03:42.300 align:middle line:90%
are permitted to access
resources in this group.

85
03:42.300 --> 03:44.970 align:middle line:90%
We don't have to
worry about VLANs,

86
03:44.970 --> 03:46.170 align:middle line:84%
and routing, and all that.

87
03:46.170 --> 03:48.240 align:middle line:90%
I mean, there has to
be IP connectivity,

88
03:48.240 --> 03:52.290 align:middle line:90%
but we don't have to enforce
any sort of security policy

89
03:52.290 --> 03:55.620 align:middle line:90%
on any of the devices along
the path at this point.

90
03:55.620 --> 03:59.670 align:middle line:90%
When Bob sends his traffic
in to access the file server,

91
03:59.670 --> 04:04.200 align:middle line:90%
this switch will see, ah, wait,
I'm a TrustSec-enabled device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:59.670 --> 04:04.200 align:middle line:90%
this switch will see, ah, wait,
I'm a TrustSec-enabled device.

92
04:04.200 --> 04:06.480 align:middle line:90%
I work with the Cisco
TrustSec protocol.

93
04:06.480 --> 04:09.870 align:middle line:90%
And after authenticating
Bob using ISE,

94
04:09.870 --> 04:14.100 align:middle line:90%
I have to tag all of Bob's
frames with a tag of 4.

95
04:14.100 --> 04:17.190 align:middle line:90%
So as it makes its way through
the network all the way

96
04:17.190 --> 04:22.410 align:middle line:90%
to the endpoint here, before
Bob's traffic exits the switch,

97
04:22.410 --> 04:27.330 align:middle line:90%
this switch has to
check can 4 access 5.

98
04:27.330 --> 04:29.970 align:middle line:90%
So it checks in with
the policy server here.

99
04:29.970 --> 04:32.040 align:middle line:90%
And if the answer is
yes, guess what happens.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:29.970 --> 04:32.040 align:middle line:90%
And if the answer is
yes, guess what happens.

100
04:32.040 --> 04:34.800 align:middle line:90%
Bob's traffic makes it
out towards the server,

101
04:34.800 --> 04:37.020 align:middle line:90%
and the server sends
the reply traffic

102
04:37.020 --> 04:38.550 align:middle line:84%
all the way back down to Bob.

103
04:38.550 --> 04:41.490 align:middle line:90%
So you've got to think about
how this really comes into play.

104
04:41.490 --> 04:43.710 align:middle line:84%
Within ISE, we have users.

105
04:43.710 --> 04:46.020 align:middle line:90%
We either manually
create these users,

106
04:46.020 --> 04:49.020 align:middle line:90%
or maybe we import them
from Active Directory.

107
04:49.020 --> 04:53.170 align:middle line:90%
And then each of these users
we can classify into groups.

108
04:53.170 --> 04:54.930 align:middle line:84%
We may have an IT group.

109
04:54.930 --> 04:56.910 align:middle line:84%
We may have an HR group.

110
04:56.910 --> 04:59.070 align:middle line:90%
We may have an
engineering group.

111
04:59.070 --> 05:01.890 align:middle line:90%
We may have a third-party
consultants group.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:59.070 --> 05:01.890 align:middle line:90%
We may have a third-party
consultants group.

112
05:01.890 --> 05:04.210 align:middle line:90%
And then on the opposite
end of the network,

113
05:04.210 --> 05:06.510 align:middle line:84%
we may have groups of devices.

114
05:06.510 --> 05:09.060 align:middle line:84%
We may have IT servers.

115
05:09.060 --> 05:11.130 align:middle line:84%
We may have HR servers.

116
05:11.130 --> 05:12.940 align:middle line:84%
We may have printers.

117
05:12.940 --> 05:15.760 align:middle line:84%
We may have IoT devices.

118
05:15.760 --> 05:19.800 align:middle line:90%
So using security group
tags in Cisco TrustSec,

119
05:19.800 --> 05:24.400 align:middle line:90%
we now only focus on the
people and the devices,

120
05:24.400 --> 05:27.930 align:middle line:90%
rather than the network
itself and this greatly

121
05:27.930 --> 05:31.860 align:middle line:90%
simplifies how we can
implement policy and intent
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:27.930 --> 05:31.860 align:middle line:90%
simplifies how we can
implement policy and intent

122
05:31.860 --> 05:34.980 align:middle line:90%
in a large security
based enterprise.

123
05:34.980 --> 05:37.380 align:middle line:90%
Heck, it makes it easy
in small enterprises,

124
05:37.380 --> 05:40.740 align:middle line:90%
because, again, we're just
focusing on user administration

125
05:40.740 --> 05:41.550 align:middle line:84%
at this point.

126
05:41.550 --> 05:43.800 align:middle line:90%
Never forget the
fact that the network

127
05:43.800 --> 05:47.790 align:middle line:90%
isn't the only IT infrastructure
in the entire enterprise.

128
05:47.790 --> 05:50.400 align:middle line:90%
You've also got servers,
probably Windows servers.

129
05:50.400 --> 05:53.250 align:middle line:90%
You've also got Active
Directory, and file servers,

130
05:53.250 --> 05:54.940 align:middle line:84%
and NTFS permissions.

131
05:54.940 --> 05:58.830 align:middle line:90%
So if you can leverage already
existing identity stores

132
05:58.830 --> 06:01.380 align:middle line:90%
to enforce network
access policies,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
05:58.830 --> 06:01.380 align:middle line:90%
to enforce network
access policies,

133
06:01.380 --> 06:04.020 align:middle line:90%
think about how much
easier this makes your job.

134
06:04.020 --> 06:07.740 align:middle line:90%
That's the point of Cisco
TrustSec and the security group

135
06:07.740 --> 06:08.312 align:middle line:84%
tags.

136
06:08.312 --> 06:10.020 align:middle line:90%
I hope this has been
informative for you.

137
06:10.020 --> 06:12.710 align:middle line:90%
And I'd like to thank
you for viewing.