Welcome to Cisco's integration cyber capsule. I'm Miguel Martinez, your host for today. On today's agenda, we'll have a brief discussion about Cisco ICE integrations, and we'll also take a quick look.00:05Get a demo of an integration with Splunk. Cisco ICE integrations. ICE is the industry's only complete network access control solution, but it's much more than that. It's a foundation for zero trust.00:20Zero trust helps us enable secure access for users and devices. We want strong security without compromising the user experience. Of course, ICE can only do so much with the features it has. It can protect yes, but in the end, if ICE has more information, it can make smarter decisions.00:37E.g., Cisco Secure Endpoint can provide more information to ICE whenever an endpoint is under attack or has been compromised. That way ICE can take action to keep it off our network, and it will be blocked or it will require remediation before it can get access again.00:58And we have a few different examples here, like Meraki switches and wireless. These three are really important because in the end, those are the network access devices. The integrations between those components and ICE are usually pretty common. Not all of them maybe in use. They could all be in use, of course.01:17But depending on the network architecture, usually only some of them will be used. E.g., with Meraki, we typically have Meraki switches or some Meraki access points instead of, e.g., a wireless LAN controller. So it's going to depend. Of course, it can vary, but those can be related as well.01:37Remember the network access device is critical in every one of the flows for ICE to enforce communications for that specific endpoint. Also, it's important to understand that there are features or integrations that are closely tied together like DNA Center or Catalyst Center, which works together with trust sec. DNA center.01:57Center is going to help with the fabric and with the network access devices, of course, to provide configurations. But trust sec is also one of the main elements that will work together with DNA Center or as I mentioned, now Catalyst Center. Besides those different integrations working together, as I mentioned, where we're going to find some information.02:17It's also important to understand that not all of these integrations work the same way. At this point, all of them are for Cisco devices, but in the end, e.g., firepower Management Center can take advantage of ICE.02:37Instead of ICE only receiving more information, it can also provide information to firepower. Like in this case, the IP mapping, which creates a mapping between the IP address and the username. And with that firepower will be able to enforce our network more effectively. Now, as you may have noticed.02:51Just by this point, we're missing one Cisco product that's actually quite recent. Splunk.03:11The reason Splunk doesn't show up here is because it was only recently acquired by Cisco and that's an important point to highlight. Why? Because even before it became part of Cisco, Splunk was already supported. In fact, you'll be able to find it at the link.03:18In the bottom right corner, listed under the name Splunk. And it's not just Splunk. There are also other vendors like Amazon Services, Microsoft, even Palo Alto among a much longer list. It's important to understand that every integration is going to be different.03:38So you'll want to take a look and review which products are supported, how they're supported, and really take advantage of that eye. In the end remember, we wanna get the most value or as much value as possible out of ICE. And to do that, integrations are going to be a critical part.03:58In the end, if we're using more tools, if we're using different products.04:18ICE will be able to make smarter decisions that will impact not only our network, but also our users. Now before our demo, it's important to review the link I just showed you. This is the content or the webpage that you're going to be redirected to. Now, of course, you're going to find a lot of information here.04:23If you want to check a specific vendor, you can click it in this list or you can just scroll down.04:44You'll see plenty of details about different features and eventually you'll get to the integrate section. In the integrate section, which is the key one for this session, you'll find information about network devices, a threat centric NAC, and also the different vendors. Here you'll find four.04:5140 Net, AirWatch, Amazon Web Services, Apple. Here's checkpoint. Of course, everything related to Cisco and cyberark. You'll also find Fortinet, HP, Microsoft, and you'll see other vendors too, like Newtonix, Okta and Palo alto.05:11So.05:31There's a lot of information you can review here, and I wanted to show you this before we move on to the demo. Now for the demo, let's say that as part of the integration, we need to consider the applications we have to download from Splunk base. The 1st one is Splunk for Cisco Identity Services, which is.05:32Mainly a graphical interface as you can see here in the screenshots and then the Splunk add on, which will allow Splunk to collect information mainly syslog data from ICE. Now, once we've downloaded those two apps, we need to install them. To do that, click on manage here and you'll see a button that says install.05:52App from file. From there select the file, click upload, and it'll be added to the list. Here we have Splunk for Cisco ICE and the Splunk add on for Cisco ICE. Make sure both are enabled.06:12Now that we've finished that part, go to settings and click add data. Here select monitor because we want to collect the UDP sized log data, then choose UDP five warrantine, which is the port, and click next. Here, make sure to.06:25Select select option, and under select source type filter by Cisco.06:45Then choose the Cisco ICE size log we have, leave it as search and reporting, and click next. Keep the index set to the default, then click review. You'll see a summary of the information and you can click submit. Once we've finished this part.06:52We can move on to the splunk side. Now make sure the firewall isn't blocking communication between ICE and Splunk because that could be an issue, but let's move on to the IC section. On ice, we need to take a look at administration system logging.07:12As you can see here, we have the remote logging targets, and we're going to add Splunk. You can click add. I've already added Splunk, but let's review the details. 1st, the name, then the host IP address, the port, which is the same one we selected on Splunk. And of course the maximum.07:31Length. Now, once we have this configuration, we can click save and that will add Splunk as a remote login target. Now, the next part is really important. Even if we've added a remote log target, that doesn't mean it's gonna save.07:51Send the information to Splunk. We need to come here to the log categories and make sure we select Splunk for each category where we want those logs to be sent to Splunk. E.g., as you can see here under identity store diagnostics, I don't have anything selected. If I want that information.08:11Need to be sent to Splunk. I need to come here, choose Splunk, and add it, ok?08:31And we need to repeat that process for every category where we wanna send logs to Splunk. Here, for instance, I've added Splunk under accounting a taught AAA audit because in the end, the main goal is for you to be able to review that information.08:37Now, let's do a quick test. Here under operations, I have the live logs and I'm going to try connecting from an endpoint. So let me just start the Wi Fi connection. Give me a second.08:52Right now I'm entering the passcode.09:13I'm connected. As you can see here, my endpoint is now connected. In this case.09:30It's a mobile phone. What's important is to check and confirm we're sending the information to Splunk.09:36Right now in Eve, I can see the authentication, a pass authentication, and it should show up on the splunk side as well. Let's go back to Splunk here, and now we're going to open the EV application.09:43Here we have the ice summary view for the last 16 min.10:05E.g., we can take a look and see that we already have some information related to radius. We have a configuration change and a successful authentication. Of course, we're seeing all of this because we're making different changes on ICE, and those events are being sent to Splunk. Right now about 10 min have had.10:10That's maybe a bit more. Now we have a lot more information across different timeframes. We're going to see configuration changes, successful authentications, radius.10:30Radius accounting, system management, system stats. We're getting a lot of information. Of course, all this Splunk data is being collected from ICE into Splunk. We can look at the different Splunk messages and review the details.10:40It's going to be helpful because we can also use the tools Splunk provides to gather information. So it's gonna be a really useful tool. E.g., here, very quickly, I can see the username, I can see that it's a successful authentication, the NAS IP address, I can check the proto.10:57Call and even the port here. In the end, it's gonna be a very useful tool, and this is a quick overview of the ISE and Splunk integration. Thank you very much.11:17
