WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:01.890 align:middle line:90%
In a very, very
small network, we

3
00:01.890 --> 00:03.630 align:middle line:90%
can put access
control lists in place

4
00:03.630 --> 00:06.910 align:middle line:90%
for filtering to control the
traffic between, for example,

5
00:06.910 --> 00:08.760 align:middle line:84%
sales and engineering.

6
00:08.760 --> 00:11.670 align:middle line:90%
However, in a larger network
with people roaming around,

7
00:11.670 --> 00:12.730 align:middle line:84%
we need something better.

8
00:12.730 --> 00:15.483 align:middle line:90%
And that something better
is called TrustSec.

9
00:15.483 --> 00:20.320 align:middle line:84%
[MUSIC PLAYING]

10
00:20.320 --> 00:22.030 align:middle line:90%
And let's take a look
at the components.

11
00:22.030 --> 00:23.850 align:middle line:90%
Now here's the concept
behind TrustSec.

12
00:23.850 --> 00:26.280 align:middle line:90%
What we're going to do is
instead of saying this IP

13
00:26.280 --> 00:27.945 align:middle line:90%
address or this
range of IP addresses

14
00:27.945 --> 00:29.820 align:middle line:90%
can be permitted here
or there, what we'll do

15
00:29.820 --> 00:32.229 align:middle line:90%
is we'll categorize our
devices on the network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.820 --> 00:32.229 align:middle line:90%
is we'll categorize our
devices on the network.

16
00:32.229 --> 00:34.300 align:middle line:90%
So here, I have a
whole bunch of groups.

17
00:34.300 --> 00:37.020 align:middle line:90%
I've got something for
BYOD, bring your own device,

18
00:37.020 --> 00:39.750 align:middle line:90%
one called computers, domain
services, employees, guests,

19
00:39.750 --> 00:40.500 align:middle line:84%
et cetera.

20
00:40.500 --> 00:42.915 align:middle line:90%
And then there's an
SGT, a security group

21
00:42.915 --> 00:44.790 align:middle line:90%
tag that's going to be
associated with those.

22
00:44.790 --> 00:46.165 align:middle line:90%
And then once
we've done this, we

23
00:46.165 --> 00:48.270 align:middle line:90%
can create access control
lists to permit or deny

24
00:48.270 --> 00:50.100 align:middle line:90%
certain types of
traffic and we can

25
00:50.100 --> 00:53.100 align:middle line:90%
specify what we want to
allow between various groups,

26
00:53.100 --> 00:55.283 align:middle line:90%
regardless of where
they are on the network.

27
00:55.283 --> 00:56.700 align:middle line:90%
This is how we can
specify what we

28
00:56.700 --> 00:59.310 align:middle line:90%
want to have happen between
two different objects

29
00:59.310 --> 00:59.950 align:middle line:84%
in our network.

30
00:59.950 --> 01:01.117 align:middle line:84%
So always follow the matrix.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
00:59.950 --> 01:01.117 align:middle line:84%
So always follow the matrix.

31
01:01.117 --> 01:02.650 align:middle line:84%
[LAUGHS] Follow the matrix.

32
01:02.650 --> 01:07.080 align:middle line:90%
So for example, BYOD and ISE,
if we go to that intersection,

33
01:07.080 --> 01:09.660 align:middle line:90%
it's permitting some
traffic, some SSH traffic.

34
01:09.660 --> 01:12.390 align:middle line:90%
If we go to domain
services and guests,

35
01:12.390 --> 01:13.790 align:middle line:84%
we have a deny in that column.

36
01:13.790 --> 01:15.832 align:middle line:90%
And the way this is
implemented in a network that

37
01:15.832 --> 01:18.510 align:middle line:90%
supports TrustSec is that the
forwarding devices are looking

38
01:18.510 --> 01:19.425 align:middle line:84%
at those tags.

39
01:19.425 --> 01:20.800 align:middle line:90%
And they can
implement the policy

40
01:20.800 --> 01:22.120 align:middle line:84%
regardless of where it is.

41
01:22.120 --> 01:24.480 align:middle line:90%
So in this example, if we
a guest computer that's

42
01:24.480 --> 01:27.660 align:middle line:90%
trying to access domain
services, it's a big no.

43
01:27.660 --> 01:29.220 align:middle line:90%
And this can be
enforced regardless

44
01:29.220 --> 01:32.520 align:middle line:90%
of where that client came in
or what domain services they're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:29.220 --> 01:32.520 align:middle line:90%
of where that client came in
or what domain services they're

45
01:32.520 --> 01:34.470 align:middle line:84%
trying to access or reach.

46
01:34.470 --> 01:36.810 align:middle line:90%
Now one of the considerations
from a design perspective

47
01:36.810 --> 01:38.700 align:middle line:90%
is that if we want
TrustSec to work,

48
01:38.700 --> 01:41.880 align:middle line:90%
we need TrustSec compliant
or capable devices that

49
01:41.880 --> 01:44.820 align:middle line:90%
can look at those tags based on
the frames that are going back

50
01:44.820 --> 01:47.010 align:middle line:90%
and forth in our network,
and then either permit

51
01:47.010 --> 01:48.870 align:middle line:84%
or deny based on those tags.

52
01:48.870 --> 01:51.690 align:middle line:90%
Because that's how TrustSec
is implemented, by the tags

53
01:51.690 --> 01:53.550 align:middle line:90%
and then the forwarding
devices in the path

54
01:53.550 --> 01:56.070 align:middle line:90%
either forwarding or
blocking that traffic based

55
01:56.070 --> 01:57.630 align:middle line:84%
on those security group tags.

56
01:57.630 --> 01:59.200 align:middle line:90%
Another aspect to
security design

57
01:59.200 --> 02:00.450 align:middle line:84%
is we can encrypt our traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
01:59.200 --> 02:00.450 align:middle line:84%
is we can encrypt our traffic.

58
02:00.450 --> 02:03.360 align:middle line:90%
Now I'm not referring to
like a VPN end to end tunnel.

59
02:03.360 --> 02:05.490 align:middle line:90%
I'm referring to
encrypting the traffic

60
02:05.490 --> 02:09.539 align:middle line:90%
as it's going from the computer,
the node, into the switch.

61
02:09.539 --> 02:11.910 align:middle line:90%
And to do that, we can use
something called MACSec,

62
02:11.910 --> 02:15.450 align:middle line:90%
M-A-C-S-E-C. And it's
encrypting the actual traffic.

63
02:15.450 --> 02:18.215 align:middle line:90%
So if we're using SGT,
security group tags,

64
02:18.215 --> 02:20.340 align:middle line:90%
that tagging information
along with everything else

65
02:20.340 --> 02:21.180 align:middle line:84%
can be encrypted.

66
02:21.180 --> 02:22.860 align:middle line:90%
So what happens is
the traffic, if it's

67
02:22.860 --> 02:25.770 align:middle line:90%
going from a node to a switch,
that's called a downlink

68
02:25.770 --> 02:26.442 align:middle line:84%
MACSec.

69
02:26.442 --> 02:27.900 align:middle line:90%
If it's going
between two switches,

70
02:27.900 --> 02:29.547 align:middle line:84%
it's called uplink MACSec.

71
02:29.547 --> 02:31.380 align:middle line:90%
And the key here is
that they'll encrypt it,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:29.547 --> 02:31.380 align:middle line:90%
And the key here is
that they'll encrypt it,

72
02:31.380 --> 02:33.548 align:middle line:90%
they'll ship it across,
the frame across.

73
02:33.548 --> 02:35.340 align:middle line:90%
The other switch will
decrypt it because it

74
02:35.340 --> 02:37.230 align:middle line:90%
needs to read the
security group tags.

75
02:37.230 --> 02:39.000 align:middle line:90%
It can analyze
those, make decisions

76
02:39.000 --> 02:40.470 align:middle line:90%
on forwarding or
dropping, and then

77
02:40.470 --> 02:42.900 align:middle line:90%
it forwards it out if the
decision was to forward,

78
02:42.900 --> 02:45.660 align:middle line:90%
it can then go ahead and encrypt
it once again using MACSec.

79
02:45.660 --> 02:47.910 align:middle line:90%
So in this video, I want to
impress upon your mind two

80
02:47.910 --> 02:48.760 align:middle line:84%
basic concepts.

81
02:48.760 --> 02:51.897 align:middle line:90%
One is TrustSec, which is the
ability to create that matrix

82
02:51.897 --> 02:53.730 align:middle line:90%
and identify what you
want to permit or deny

83
02:53.730 --> 02:56.310 align:middle line:90%
with the permissions based on
the objects and their security

84
02:56.310 --> 02:56.850 align:middle line:84%
group tags.

85
02:56.850 --> 02:58.433 align:middle line:90%
And that's implemented
by the network.

86
02:58.433 --> 03:02.550 align:middle line:90%
So we don't have to do a fixed
ACL on an interface anymore.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
02:58.433 --> 03:02.550 align:middle line:90%
So we don't have to do a fixed
ACL on an interface anymore.

87
03:02.550 --> 03:05.880 align:middle line:90%
We can let a TrustSec capable
network enforce that for us.

88
03:05.880 --> 03:09.270 align:middle line:90%
And then to hide the
content of those SGTs,

89
03:09.270 --> 03:11.580 align:middle line:90%
those tags, and
the data being sent

90
03:11.580 --> 03:13.100 align:middle line:90%
between devices
and the switches,

91
03:13.100 --> 03:14.767 align:middle line:90%
and between switches
and other switches,

92
03:14.767 --> 03:16.740 align:middle line:90%
we can use MACsec,
which does link

93
03:16.740 --> 03:18.802 align:middle line:90%
by link encryption
of that traffic.

94
03:18.802 --> 03:20.760 align:middle line:90%
So thanks for joining me
in this set of videos.

95
03:20.760 --> 03:21.968 align:middle line:84%
I'll see you in the next one.

96
03:21.968 --> 03:24.210 align:middle line:90%
Meanwhile, I hope this has
been informative for you

97
03:24.210 --> 03:27.350 align:middle line:90%
and I'd like to thank
you for viewing.