Bridging Networks: Unlocking the Power of ISE and SNA Integration

Oh good morning, everyone. Thank you for joining today's webinar. So today's topic is bridging networks unlocking the power of eyes and as an integrate.00:00Patient.00:20I will start to introduce you today's presenters and panelists. Today we have Harry to present the topic and on the panel me and Gree will addressing the questions in the chat. All of us are part of the Cisco customer success specialist team for security products. We are working with customers like you to make sure that you get.00:21Like maximum value of the of your investment in Cisco products. To ask a question at any time, you can click apps in the bottom right corner of your screen and open Slido. In the Q and A tab, you can just click type your questions and and enter your questions. Please use.00:41Q and A rather than the chat panel so we can keep track of everyone's questions and make sure that we don't miss any. We will answer your questions as we go and if we don't get your yours during the session, we will follow up by email afterwards. All right, so I will now hand it over to our presenter, Henry.01:01Yeah, alright thanks Mandy. Let me share my screen as well. Sure.01:21Yeah, hello everyone. This is Henry from Cisco CSS team. Thanks for joining today's session. Yeah, the topic today will be bridging networks mainly about allowing the power of ISE and SNA integration.01:41We will start by talking about why it is so important to get all your security tools talking to each other. Then we will dive into how Cisco ISE fits into zero trust security. After that we will look at how building.02:01And sharing context is a real game changer for your team and we will run things about by talk about how to spot threats faster so you can shut them down before they become a headache.02:19Alright, we have been trying to gain as much visibility as much we can over the many years of networking. Over this time several evolution of networking best practice have caused us to revise the tools.02:37We need to maintain and protect our infrastructures.02:57We now have to contain with micro applications or cloud network or during and after the users are now more remote especially after the 19 period.03:02So your network application and users are NO longer just on prem, and we have little to visibility or control into networks about where our users are connecting from and how can we fix such problem?03:18Yeah SNA integration with ISE will help a lot.03:37The step one, preparing Cisco ISE and SNA. Firstly, let's have a look at benefits of ISE capabilities for zero trust workplace. ISE can provide zero trust in a.03:43Network with an established trust.04:02Yeah, what do we mean by zero trust and the established trust? Zero trust means many things to different vendors with only partial solutions. Established trust means I have completely established and.04:06Guaranteed the identity of every single device in my environment and can validate its presence. Zero trust means that every single connection or user or device must be validated to ensure identity.04:26Before being allowed to access our resources.04:46And there are four functions that must be met for true zero trust. Number one, established trust. You cannot secure what you don't know, and in that case, NO policy can be made. ISE can.04:51And provide full visibility into who and what and context information and et cetera. And number two.05:11Enforce chart based access. Yeah, authentication authenticate all the users and the endpoint and can profile and posture them to provide visibility into who and what they are. And in ISEBB.05:21Use ACL and SGT to do that.05:41And number three, constantly be verify trust. ISE use this data to verify and the access the trust level and act accordingly after the initial access was guaranteed.05:44And number four, respond to change in trust, ISE leverage the security product and the service integrations and can automatically respond to the change in trust.06:02Yeah, it does this by investigating the response to potential incident with increased in investigation into any suspected change in just levels. Yeah threat comes from.06:18You know, comes from anywhere and can now move lately so just discuring the edge of your infrastructure with firewall is NO longer enough to protect your environment. It is very important to know definitely how to automate.06:37With the containment of the infected endpoint and revoke access of them so that we are able to stop lateral movement of this rep.06:57Yeah, think of the Cisco ISE as a gatekeeper of your entire network. The main goal here is to make sure that before any device or person get the access, they have been properly checked and verified. Here is how the.07:11The process.07:31Hello. Yeah, 1st of all the the who? You have got all kinds of device like laptops, cameras or phones they are all trying to connect. Yeah, they go through different doors like.1X or or web authentication.07:32Or introduce themselves to the network.07:52And the verification to make sure that device are who they say they are, yeah, ISE chat with your other systems. Yeah, it can verify identity against the things like micro soft agent or active.07:56Directory or other identity providers.08:16Yeah, think of this as a background, check system that provides source of truth for identities, and then the decision, Yeah once ISE knows who is asking to connect, it make two big decisions.08:191st one is authentication. Yeah, it figures out the best way to verify them using either active method yeah where the user or device provide who they are directly or passive method.08:38Yeah, where ISE just watch the traffic to recognize the device. And 2nd thing is authorization. Yeah, this is where it set the rules for what they can actually do. It might put a user into a specific.08:54Assign a SGT group or point them towards a specific webpage and etc.09:14Yeah, after the authentication and authorization, yeah, think of this slide as the team intelligence phase of the operation. Now that Cisco ISE knows who is on network.09:24Yeah, it is time to make sure the rest of your security tubes are just as informed. Here is the simple breakdown, you're building the the visibility. ISE act like a.09:40Intelligence hub. Yeah, it collects data from all over the place like your directory service, vulnerability scanners and device managers to build a complete picture.09:56It is not just the thing a device. Yeah, it's gathering the context, yeah, who is the user, is the device healthy? Is the unknown of vulnerabilities?10:13Where are they and etc. And it makes the summary, ISE take all those raw details into a clear and usable summary. It packages this information into a context that tells the rest of your security infrastructure.10:28Structure exactly what is happening in real time.10:48And share with the team. Yeah, this is the exchange part. ISE use protocol like screen, APIs and syslog to push this context out to your other tools like your firewalls, analytics platforms or.10:52Or even 3rd party security apps.11:12Alright, the next step is enable and configure Pixedgrid in ISE. Yeah, now that we have talked about why and what, and let's look at how. Think of Pixedgrid as the universal language.11:17Or or or like a translator, yeah. It let Cisco ISE talk to all your other security tools. It turns your security set up into a collaboration team rather than a bunch of product work.11:35Working in separately.11:54Yeah, here is four step breakdown of how that partnership works. Number one, yeah. Sharing the knowledge, ISE gave your partner tools a head up like hey, here is who is on the network and he.11:56There is what kind of the device they are using.12:16And number two, yeah, it's a two way street. Your partners and the information back to ISC, helping it make even better, more informed the security decisions based on the whole picture.12:19And number three, taking action. This is the rapid response part. Yeah, if a partner two detect a threat, it can reach out and tell ISE this device is acting suspect.12:36Go ahead and reserve it. And ISE then can take that action immediately. And number four, ISE act as a central hub. It connected different partner tools so they can share the data with each other through ISE. Yeah, even.12:53They are not directly leaked.13:13So in short, it's about making sure your entire security stack is acting like one big and a coordinated team. Everyone knows what is going on and everyone knows how to react when something goes wrong.13:16Right, next step is integrate flow collector with ISE. So, we have talked about building context and sharing it across the team. Now let's look at at the most important part of what happened when.13:36The scenes actually go wrong. This is where a rapid threat continment comes into play. The problem is you have got users like Jim or Harry or Edis all working on the network.13:56Everything is fine until something happen. Yeah, let's say a piece of movie is detected on Jim's laptop by Cisco secure endpoint. Yeah, formerly named as aM4 endpoint.14:15And because we have that integration we talked about earlier, Cisco ISE gets an immediate alert. It doesn't just see a generic error. It gets the full picture.14:31Who it is, it is Jim and what device he's on and where he is and exactly how bad this red is. Yeah, look at the table at the bottom, yeah, INC has automatically flagged Jim's session as having a paint.14:46False thread here.15:06Yeah, you don't have to go to digging through like four or five different dashboards to find out why a laptop is acting up. It's right there in front of you. And now you can have that visibility. You can take actions immediately.15:08You can hate the change authorization button to quarantine Jim's device and kick him off the network. You are not just reacting of threat.15:27You are containing them before they have a chance to spread to Harry or Alice or the rest of the company. So this is a big benefit with that integration. And next step.15:42Configure SNA to use identity context. We all talk about how ISE handle identity and how to contain threat. Now let's talk about the smart segmentation. Yeah, this is basically.16:00Say how you take your network security to next level by combining who is on the network with what they are actually doing.16:19Yeah, think of it like this. The problem is normally, networking can only care about IP address, but IP addresses a change and they do not tell you anything about the person or device.16:29Eyes behind them.16:50It is hard to build a security policy when you are just looking at a string of numbers. So, the tag is is job. Cisco ISE assigns a security group tag or we called it SGT to every user or device.16:51Yeah, it is like giving them a digital name.17:11Tag that they say oh I am an employee, I am a contractor or I am a skill server and et cetera. And the traffic watcher is sna's job. SNA is constantly watching the traffic flow on your network.17:16Normally it would just see traffic moving from one IP to another. But because we have linked it to ISE, SNA can now read those tags as well. So why this matter?17:36Yeah, it is about the the metrics Instead of staring at a confusing network loads, you can get a clean policy metrics. You can see exactly which groups are talking to each other.17:51If you see a green square, it is allowed, a red square means it is blocked. E.g., yeah, a contractor is trying to reach a sensitive data center server and decide if that should be allowed or not.18:07And then flow analyze. When you dig into the traffic, you do not have to check down IP address anymore. The log shows you the actual rule and you can see a specific user group is talking a specific server group.18:27So the big benefit is it makes your network identity aware. You can set policies based on the rules rather than cables or ports. And.18:46For this scenario, yeah, I will show you a very classic scenario in the demo environment later as well. Alright, the next step define and use group based on policy and alert.19:01Alright, we have talked about in ISE we use the SGT group to make the segmentation and in ISE, yeah, we have another segmentation way as well. Yeah, think of this like a organizing a building.19:20To keep your network secure. You need to know who is in the building and who is outside. Yeah, this slide is all about this simple, yeah. Logical division we call host groups.19:37It basically contains two main backs inside health. There are asset living within your walls, yeah, your employee, your printers, your web servers or or your internet security tools like your.19:53Antivarious server and et cetera. Since these are belong to you that you have a higher level of trust and the more control over what they can do and outside host.20:12These are the living beyond your network walls, things like the public cloud service, your external partners or untrusted internet as et cetera.20:28Because these are outside of your direct control, you naturally want to cheat them with more caution and control access rules. And why we do this? It's about making your work easier.20:44Yeah, instead of trying to write this security rules for thousands of individual devices, you can write rules for the whole group. Yeah, e.g., you can set a rule that say only inside device can talk to our internal printers.21:02Yeah, it is much faster and less risk to mistakes and makes your security policy a lot easier to read and manage. It is just a smart way to simplify a complex network so you can spend less time managing individual.21:22Your IP addresses and more time, make sure your inside remains safe from the outside.21:42The next step, yeah. Enable the automated response. Yeah, think of this like having a really smart virtual assistance of your security team. When something specific when something suspect.21:53Happen? Yeah, you don't want to be the one manually typing out emails or digging through the logs to figure out who to contact. You want the system just to handle it.22:13And here is how it automate those features instead of you manually checking the dashboard, the system can automatically ping your team when and there is an issue. It can send an email or fire off an SNM.22:28For the network monitoring tools or or even send a direct message to a Webex room, yeah, where your team is already hangout.22:49If the system, sports something like mobile, yeah, it can automatically send that data over to your forensic tools as well. Yeah, in this way, the investigation starts immediately.23:00And the data is already prepaid for the export to look at. And this is the most powerful part. If the system confirmed this is a thread, it can talk to ISE to automatically change.23:16Change the network rules.23:36E.g., by putting an effected laptop into a quarantine rely so it cannot spread the bug to the rest of their company. Yeah, the logo line at the bottom are showing like ISC service.23:38Now and your same tools is the key. It is showing that your security gear isn't just talking to itself. It is plugging directly into the platforms. Your IT team uses everything.23:58Okay whether it is opening a ticket in ServiceNow or sending an alert in your same platform, the goal is to make sure your response is fully automated.24:18You get to spend your time on the high level movement where the system takes cares of the immediate work of keeping the network safe. Alright, think of this page.24:32As a central dashboard that gives you the total control over any device on the network. Here is what is happening about the context. Yeah, you have got the host summary that act like a digital ID.24:49Card for a device. It pulls in all the important details, who is the user, what kind of device it is, where are they and when were they last active?25:09Having all of these in one spot saves you from having to, look between different screens and understand what you are looking at, right? And you can see the pixedgrid link.25:23Yeah, that's the magic breach that connect the dashboard to your other security tools. Yeah, it, if a medication tool like an antivirus or an intrusion detection system is bought about.25:41It helps to this dashboards through the bridge.26:02You can see the quarantine button, yeah, this is the core of this slide. If the system flags find a device as an infected one, yeah, you or an automated policy yeah can hit this.26:06Quarantine button.26:26Instantly, Cisco ISE tells the network to escalate that specific device so it cannot spread the threat to anyone else. And once the issue is cleaned up, you can hitting the.26:28Button, yeah, bring the device back into the fold. And in simple term, this slide shows you do not need to be a networking visit to handle a security emergency by gathering all the context in one place and.26:47Giving you a simple powerful way to isolate threats.27:07And it keeps your network safe without, menu headache. Alright, here is some reference links as well. I will share.27:11Those into chat. Hold on a second, please. Alright, let me send into the chat panel here.27:30Okay, then let's move into our demo environment as well. And 1st of all, I prepared a video that shows how to integrate with SNA and ISC.27:501st of all, it is all about the certificate part and let's have a look. All right, when we start the integration, yeah, in SNA we move to application configurations and find the general.28:07And here, there is a chest store part and the 1st of all we need to add our yeah root CA from ISE into our SNA chat store and move to administration under system there is a certificate menu.28:24And move to certificate authority, send out our group CA in CA certificate menu, right? We can click that and export and export the certificate into our local.28:44And then we move back to SNM manager and add this root CA, name it and choose a file that we download before and open.29:03And add the certificate and click the apply settings, apply change and for several minutes, the status will become from pending to up again. Let's.29:21Yeah, we can wait for several minutes and make sure.29:55Sure the status is changing from pending to up again and then do another movement because if the status is not changing to up.29:59We if we do any other configuration, that will not work. All right, make sure the status comes to up again and then yeah go to the appliance configuration page and we need to add.30:14A CSR code. Alright here we need to generate a CSR code and for for the key lens, it should be the same with our certificate template in ISE.30:31Right, choose the same key lens and generate the CSR code. Alright, and download this CSR file.30:47All right. And move back to ISE. We need to put this CSR code into ISE. In this case, the ISE plays a role of the CA server, right?31:06Go to the client management and under the certificate we need to click we want to generate a single certificate with CSR code. And then we open the CSR file.31:22And copy the code. Yeah copy the code and pass it into ISC, right? And choose a format PKCS five format and generate a.31:40Password. Here we can create, create a certificate. This is a client certificate. All right, make sure it is downloaded.32:00And move back to our SNA, yeah, we need to add the client identity, name it and choose five. Yeah, this is a zip file we need to unzip it.32:18Yeah extract out, extract out and we get the client certificate and choose file, upload the certificate, open.32:36And the bundle password must be same with the password we generate in ISC or double check it and add the client identity and apply settings.32:52Alright, and then, yeah, it will apply change again it will change the appliance status from pending to up again.33:10Also it takes several times and make sure all of the appliance status changed to up again, ok? And after that, from the SNA page, we can check it.33:26Under the configure, there will be Cisco ISE under the integration menu. We need to check this status comes to connected, make sure this is connected and it means.33:45Are from there.34:05Integration from ISE and SNA comes to alright? And then what we can, what benefit we can earn from this integration. All right? I will show you some of the scenarios. All right? 1st of all, let's.34:07Let's say I have a endpoint and I need to connect it into our environment through our VPN. All right, let's connect it.34:27Except. All right, this is connected and from ISC we can check the session. Okay.34:49Alright under the operation lab logs, let's have a look at ok I will go to endpoint directly, yeah.35:17Yeah. VPN. Yeah, this VPN user one is the username that we just used in the workstation and here is some endpoint information as well. And after that.35:35Here is the IP address. We can check this IP in SNA as well, and let's see, have a look at what is happening here. All right, under this.35:56I address. There is some information actually is from the ISE. All right, here we can see the host name, the Mac address, and here also the user and session information as well. Yeah, here we can see.36:11The Mac address, the Mac vendor, the device type is workstation and user information as well.36:31This information are actually from the from the ISC. All right? So in this page we can directly see, ok, about this IP address, who is.36:40Logging on and use what, what device, right? And the the host name information as well. All right, all these informations are can check directly from the SNA. If there is NO ISE integrated, the user and session information can.36:55Not be checked.37:15Alright, and then here will show up an ISE ANC policy as well. Yeah, this is something that we can do about the device. Let's say alright, for for this.37:17The workstation, ok, a thread is happening and we need to do something about it.37:37And we can edit and use this is server to give it and quarantine policy to make sure this device is quarantined because it is.37:43Affected, right? And let's say alright you have successfully your change. And for our environment because this ASA VPN version is too low, so it is not supported to COA.38:03It is not about change of authorization, so let's do it manually. Let's disconnect the VPN and reconnect it again. So make sure in your environment your device.38:22Is the support for the COA for the change of authorization and can do it automatically. Let's connect it again. Alright.38:38Put into our password. Okay, here we can see this is showing as a login field. The reason is we have quarantined it and let's move back to ISE to check. Okay.38:54The log. Alright, here you can see there is an ANC quarantine authorization policy has been set so it cannot connect to our environment. And let's have a look at why it can.39:13Worked like this. The reason is about the policy set. Yeah, here we can see under the this policy set.39:29Yeah, after the it yeah goes through the authentication, it will check the authorization policy. Here, we have set the ANC quarantine.39:49Here, so if any device or any user, yeah, hit the ANC policy, yeah, it just give it a deny access profile.40:05So we give it the ANC policy from the SNA and it trigger the COA in ISC and it will find out the matching.40:20Authorization policy here, so make it quarantine. Oh, and also these policies are separated here under the operation, there is an adaptive network control and under that there is a policy list.40:37We can see what policy there is. Alright, when we click the add button, you name it and under the action there are four actions that we can choose. And normally we use the quarantine or strack down.40:56To make sure that the device or the user is out of our environment.41:16Alright, and then after our investigation or after the the the issue fixed, we can also unquarantine it as well, yeah, e.g..41:22We can check that there's NO ANC policy, and we can try to reconnect the VPN.41:40Alright, it is connected again and let's move back to the ISC session as well. Yeah, it will change. Alright, it will change the authorization policy from the quarantine to employ employee to the normal one, right? So it is a very.42:02Classic.42:21Scenario that ok in I after the integration, we can find out some user information about this specific IP and then if we find out any threat in the device we can quarantine it and after the fix, I'll be.42:23Can move it give it back the right.42:42Place. All right? This is one scenario and another one is if we are using the right here if you we are using the chest deck.42:46Oh Policy said, ok, let's see here ok.43:05If we are use our as well yeah we can integrate this information as well. All right here. Here is all our security groups.43:25And this is all created by ISE side, right? And we want to see what the related traffic it is. And these are also can check in.43:40SNA as well after the integration. All right? Let's move to ok under the configure, let's go to the.43:58This is under the report and go to the report builder.44:18Here we can create a new report and here there is a chat sec analyze. E.g., let's say last seven days and run report. Yeah, all of these chat sec.44:23Information will show up. E.g., there's a BYOD right and we can click BYOD with contractors. All right, we can see the true traffic movement and we can click the flow search.44:39And here, we can see the real traffic movement through these two specific SGT group. Here we can see the subject ID is 15. This peer is the ID is.44:59Why, so means this is source, this is destination, and this is based on the trust SGT group.45:19Alright, yeah, here shows all of the information yeah from the S this SGT to this SGT. And then there is also SNA host group information as well, so.45:28It makes two types of segmentation that helps you have a.45:47A more clear information that what is going on through these devices through these users. All right? Okay, so there is another scenario as well. Yeah, let's say from the SG.45:53Key there is some policy not this page, let's move to chatset policy. Yeah, here we can see some SGT between some SGT there is that the the.46:12The green, the blue one makes permit and the red one makes deny. So there's some scenario that between some sgts, yeah, there should be should not be any.46:32Connection traffic connection between this SGT, right? E.g., for the BYOD and the building, yeah, there should not be, there should the deny IP.46:50But from the report builder we can actually see there is some traffic as well, which means some device, some users are trying to send some traffic. So this is.47:06Something that the administrator should pay attention to. And for this scenario, I have prepared a specific rules to check on that. Okay, let me show you. Oh, ok, let's say.47:22Under the configure go to the policy management. I have created a specific policy. Let's say, yeah, from the BYOD to PCI server.47:38And this it should not be connected. All right. Here we can see the policy information, you have been any subject host as a user with ID from 15, this is BYOD. Yeah communicate with.47:53Is any peer host as a user with ID of 14?48:13This is PCI server, yeah, and alarm is raised. Yeah, through this, this isn't actually denied in ISE chat stack metrics. All right? And then, yeah, I can yeah change the status as own and save it.48:18And move to the response management here under the action, yeah, I have created an ANC policy here.48:38Alright, I, yeah, set up an ANC quarantined policy and make it enabled, right? The action is NC policy and the rules is I can create a new rules here.48:55Alright, when, let's say, alright, change the type and the yeah choose the policy I created before.49:14And assigned this ANC policy as well. Alright, in this case, which means if any user are trying to any user from the BYOD are trying to connect to PCI server.49:29Because of this policy, yeah, we know in ISC we have already set up the policy that from the BYOD user should not be connect to the PCI server. So if it happens, I have set up an ANC policy.49:49See here. So if any traffic happening.50:09Here, ok by O D to PCI server and save it if.50:13Any traffic happening here, the SNA will automatically quarantine the user and let the traffic to do not let the traffic go through the PCI server and all of these steps will happen.50:29And also we can add some other rules as well, e.g., not only here not only.50:50Pop up the ANC policy and also we can send the email or send his logs, send the webhook and access as well. All right, so make sure the administrator, ok, there is a user from the is connecting our PCS server and SNA has automatically quarantine it.51:07Alright, this is very classic scenario after we integrate the ISE and SNA. Alright, in summary, we can have a look, quick look. Alright, for the.51:26After the integration, we can search for the IP. Alright, after the integration here we can see not only for the IP address.51:44And also we can see some user and sessions as well and if there is some specific.52:03Threat detected, we can use the ANC ISC ANC here manually, alright to quarantine the device. And not only that we can create some specific policies as well and yeah.52:13Connected with the response management, we can let the SNA and ISE do it automatically to quarantine this rec. All right, there here is.52:33The demo that I prepared for today and if you have any questions related, welcome to submit it into QA panel and we will answer that. And for now let's give time back to our host. Mandy, it's your time.52:48Thank you. Thank you, Henry for your presentation on the demo. So we're as Henry introduced, we are now move on to the Q and A time. If you have any questions about this session, please feel free to submit them through Slido.53:11Let's see. Okay, so it looks like we've answered all the questions that have come in today that bring us to the end of our session. Thank you all for taking the time to join us and a special thanks to all our presenters and all the panelists for sharing their insights.53:28And answer our questions. We hope you found the session helpful and looking forward to meeting you in the next one. Have a great day, everyone.53:46