Welcome to this video. Today we will explore how ISC serves as the cornerstone of your network security strategy by providing unparalleled visibility and granular control over every user and device accessing your environment. We will break down how ISC goes beyond traditional triple aaa fun.00:05Functionality to act as a powerful policy engine, enabling a robust zero trust framework that protects your infrastructure from the edge to the data center. Following that, I will thoroughly guide you through the ICE deployment. We'll discuss the different roles and how you can set it up in some ways from a scaling perspective. We'll also explain how ICE 2.8.00:20Licensing works and which use cases fit each license type. Finally, we'll wrap up with a walkthrough of the ice graphical user interface. Cisco ICE is essential for zero trust architecture, giving continuous authentication and monitoring for secure network access.00:40ICE provides visibility and control by identifying classifying, and gathering contextual data about users and devices. It authenticates and authorizes them via network access devices. Granting access based on roles and functions. ICE works smoothly with identity.01:01Services like Active Directory, enabling communication for authorized users while blocking unauthorized access. It also provides highly robust multi factor authentication, which marketedly enhances security by requiring additional steps to thoroughly verify your identity. ICE shares contextual.01:20Data alongside Cisco security products and partners, thereby helping with rapid threat containment by assessing vulnerabilities. In essence, ICE shows the zero trust principle of never trust, always verify serving as the foundation for Cisco's zero trust strategy in the modern workplace. You might know.01:40Know what Cisco ICE is, but do you truly know everything it can do for you today? As network managers and security administrators, we continually seek tools to simplify our work and boost efficiency. Cisco ICE assists by centralizing network access controls and policies.02:00Who or what is connected to the network and supplying user and device information.02:20To maximize ic's value, you should align it with your business goals. Let's examine some practical use cases. For device administration employee takex plus to enforce precise, unambiguous policy control tailored to administrator roles or device groups. In terms of secure access, ensure each connection is protected whether wire.02:25Shared wireless or via VPN by using radius with 802 point X map easy connect or passfit based on the identity of the user or the device. To enable guest access, provide guest entry through web based portals, offering choices such as mobile hotspot access, self registration, and.02:45Sponsored guest portals as needed. Regarding asset visibility, identify and categorize unauthorized devices using probes to create device profiles. Ensure compliance and posture by verifying patches antivirus and related safeguards prior to granting access. Using tools such as anyconnect or integrating with an.03:05MDM solution. Enable context exchange with apps via PSK for automated enforcement. Achieve scalable segmentation by using group tags and ACLs to boost speed and security without VLANs, enabling topology independence. Leverage SDA DNAC to automate your network fabric.03:25And enforce policies with software defined access through Catalyst Center.03:45Your security arsenal.04:19As you might have noticed, ICE is designed to handle a wide and varied range of capabilities. To manage this efficiently, it uses a distributed architecture that enables it to perform a range of different roles, all of which are known as personas. Let's break them down. The policy administration node pan, is your.04:20Control center where you set up and manage all network policies. It's the backbone of your ICE setup, allowing you to configure your policies and enable advanced features with the right licenses for robust operation. Next, the policy services node PSN is your radio server handling authentication requests and.04:40The policy evaluation independently of the PAN. It also manages guest access, profiling, posturing, and chains of authorization while serving as a certificate authority and offering services like endpoint profiling, SGT, TACACS plus, and passive ID.05:00Monitoring and troubleshooting node referred to as M and T collects and stores detailed logs for the PSN to organize this data, enabling you to track user activity and employment related actions, thereby making it easier to diagnose and resolve network security issues. Finally, PSN.05:21Grid enables secure context exchange by sharing security data with various services, integrating ICE seamlessly with other security tools. These personas collaborate to ensure ICE can manage secure networks at scale, supplying robust solutions for your enterprise environment now.05:40Let's talk about ICE deployment details. Think of a deployment as a cluster of one or more Cisco ISE nodes managing all ISE personas. In a standalone deployment, a single node handles everything. This configuration is acceptable for laboratory environments or test.06:03Scenarios yet it is not ideal for live production environments because there is NO backup if the node fails. To improve reliability, a small high availability deployment uses two distinct nodes. One node acts as the primary pane with secondary MNT and PSN services while the other node acts as the secondary pane with the primary mn.06:21NT and PSN services, providing redundancy and enabling load sharing. With a nice distributed deployment, scaling becomes simpler to plan and monitor.06:40Tasks are expressed across the several nodes, which in turn makes overall management easier and more reliable. A medium deployment typically involves two pain nodes sharing MNT duties supported by around six psns, together providing balanced performance and efficient management. And in a large deployment, each node.06:51Uses on a single clearly defined role, pain, mnt, PSN or PSD, thereby maximizing scalable growth and efficiency. This configuration helps your ICE systems scale smoothly and adapt effectively to your evolving business needs. As we explore ISE 4.0, we examine.07:10The new licensing model for ICE three point X and how it directly applies to a variety of real world use cases. Unlike the older two point X version, which required multiple licenses, ISE three point X simplifies this with a single high tier license where premiere covers all features. ICE three point X adopts a.07:30Smart licensing model, which means you must connect to Cisco license Manager in the cloud using a registered smart account. There is also an on premise option, which is called Cisco Smart Software Manager. This new licensing approach simplifies administration and supports deployment strategies helping you scale your isis.07:51Environments for your organization.08:13Feature sets have changed. Base is now called essential plus is now advantage, and Apex is now premiere. These align with these specific use cases. Essential for guest and secure access, Advantage for profiling and BYOD and premier force.08:16Advanced features like threat containment and compliance. Device admin license remain unchanged and are still one per node. However, starting with ICE three point RO patch four, VM licenses have been simplified for three sizes. Small, medium, large to a single.08:35VM license, making management easier. These updates make it more efficient to manage your ICE deployment and licenses, allowing you to focus on improving network security. With all endpoint licensing now term based and device admin feature not requiring a specific tier. Managing licenses is.08:55More straightforward. With that clear and concise overview, we're ready to move on to our demo, where we'll see how the user graphical interface is organized. Let's dive in now. Proceeding with our detailed walkthrough of the Cisco Identity Service engine.09:153.3 graphical user interface. Let us begin with the dashboard. It serves as your command center displaying real time data on sessions, alarms, and performance now. Customized widgets to focus on what matters most for you. Let's move some key icons to the top right, making your workspace feel clearer. You will locate the search icon.09:35Icon right away, find the settings swiftly. The launchpad helps you quickly access your sessions. The help icon provides resources for support, and the notification icons inform you clearly about system alerts. The user profile icon manages your settings and logs you out. And you can also verify here the version and all the files you have installed.09:55Called in your deployment. Let us open the hamburger menu to reveal additional features that are available. We have bookmarks that allow you to quickly save pages and easily return to your favorites. After that, you can view context visibility. It provides broad, actionable insights into everything connected to your network.10:15In real time. You can review insights for every endpoint, the device is linked, user activity, and monitoring network devices and how applications are used. In the operation sessions, you manage network security. You can monitor the logs from radios, create century NAC, and the Tapis plus.10:36The troubleshoot provides tools to resolve issues and the adaptive network control managed policy enforcement dynamically. Finally, reports in system 360 provide system health insights. Transitioning to policy right now.10:55This is where security rules come alive. Organize the rules within comprehensive policy sets. 1st, classify devices by means of profiling. Ensure compliance with posture. Modify client provisioning policies and define the necessary conditions by using policy elements. In administration, configure.11:10System settings and manage resources now. The system handles global configuration settings while network resources take care of the administration of devices, integrate a 3rd party vendor for threat intelligence in threat centric NAC and manage identities within identity management to also configure your ID.11:30Identity service integration. Administrate PSM services, customized portals and device portal management, and update profiler heat in the heat services. So we also have here, at last, this particular section, which is officially titled Work Centers. You can focus on particular use cases and.11:50To gain meaningful insights into how they are configured on the overview page. There is also an option for the use case that includes network access, guest access, trust decks, BYOD, profiler posture, device administration, and passive ID.12:10As you can clearly see in this tab, we have made network security management straightforward with a very user friendly graphical interface. Thank you for joining this walkthrough and overview again.12:25
