Cisco Identity Services Engine Unlocking Profiling and TrustSec power

Yeah, good morning, good afternoon, everyone. So yeah, let's start the session and.00:00Go ahead, yeah. We have a full agenda today and we will leave some time for Q and A at the end, but we welcome and encourage all your questions during the sessions via Q and A panel where our panelists will be answering you.00:20Meet the team. So I'm because I have as a presenter with Mechang, then we have our panelist Gray and Suresh. We all are customer success specialist in security.00:37And this is our agenda for today. We will cover the profiling, the basic profiling and what's been added new after ICE on, on ice three.two onwards.00:56Then we are gonna cover the trust sec part. This is called and SGT overview, traditional versus group based segmentation, how the sgts are classified, propagated and enforced some design considerations and.01:10The configuration workflow, and we will wind up with with a short demo on profiling as well as trust sec. Yeah, so the features and the capability of ICE, which we are covering today, which is the group based policy segmentation, context sharing and.01:26Asset visibility profiling, they fall under ICE advantage license. Cisco ICE advantage enhances network security with the granular segmentation dynamic policy enforcement and seamless integration for improved visibility and control.01:46So let us kick off by looking at what profiling is. So this is a short overview of profiling which you all might already know.02:01That profiling is a nice feature that that's used for detection and classification. We have the active ice probes which collects like e.g. netflow DSCP DNS, HTTP, so on and so forth. Then we have device sensors, which works based on CDP.02:16The LLDP DSCP.02:36And the anyconnect. The ICE utilizes profiling probes to collect information or attributes about endpoints that are connecting to the network. Now, once all the attributes are collected, ICE will classify the endpoint and categorize it into profiler policy as shown in the example here.02:38After the device is placed on a profile of policy, we can then specify its level of access on the network in the authorization policy. E.g., the endpoint policy, if Cisco IP phone then put it in the voice VLAN.02:58Profiling must be enabled on the ICE psns and network devices must be configured to send profiling information to ICE. So this, this was just an ICE overview which you already know. Now.03:14As you can see in this slide here on the left, the left most column is I Cisco provider, is what was there up until three.two and the next four columns are now included.03:30In ICE version three.two and above until version three.five. Now Cisco provided profiling includes the built in profiling policies available on ICE and relying on the traditional profiling probes available with ICE along with the device sensor configured on the nat. Now.03:45These will be best for standard network endpoints such as workstation, IP phones, printers etc. Now if you talk about Wi Fi edge analytics, this is a newer profiling method available natively on wlcs and currently only available for three vendors, Apple, Intel and Samsung endpoints connected.04:03Via wireless.04:23Those endpoints will essentially self profile when they connect wirelessly and share attributes to identify exactly what they are. And those profiles will be available directly on the cat 9800 wlcs and the wlcs can share the attributes to ICE via radius accounting just like the.04:25ICE can then use the attributes directly in the authorization. You need to enable radius profiling and HTTP DSCP TLB caching on WLC policy profile. AI proposed labels plus.04:47MFC Cloud profiler uses a combination of new built in AI analytics feature on ICE three.three, where the AI analytics cloud agent will provide MFC proposals or recommendation on how certain groups of endpoints should be profiled based on analyzed data.05:03With the main goal to help reduce any remaining unknown endpoints and easily group endpoints together along with the new MFC cloud profiler feature on ICE three.five. We will discuss this in the later slide.05:21Now in the MFC cloud profiler feature which is there on ICE three.five, the endpoint attributes gathered by ICE are sent to the cloud and then dynamically placed into MFC labels, right? Admin created refers to any custom attributes, custom profiling policies manually created.05:37And leveraging ICE integration with CMDB databases via PX Grid direct and then leveraging this data via custom attributes. Now integration refers to relying on PX Grid integration for additional profiling data.05:55Either with the medigate, order armies for AI ML plus DPI profiling or with the catalyst center via AI endpoint analytics. Now this will be best for IoT endpoints where devices don't normally send a lot of interesting network data and will commonly be profiled as unknown.06:12Now as of ICE three.five DPI profiling does not natively exist with ICE. Next, let us switch gears to learn an important aspect of profiling which also includes configuration on network devices known as device sensor.06:31Now device sensor is a feature where switch or the WLC will proactively collect endpoint attributes locally based on CDP, LLDP DSCP, and HTTP, and then send those attributes to ICE within the radius accounting packets. We recommend this method as it greatly increases the scale.06:53Availability and performance of profiling since it place places the collection agent as close as possible to the endpoint.07:11And the attributes are proactively sent to the correct ice PSN which removes the need for ICE to reactively reach out for the data. Also, with device sensor, it doesn't require packet redirection like DSCP helper.07:19And any span session for profiling. In a wired environment, device sensor collects information from the Mac OUI and protocols such as CDP LLDP and DSCP to identify device. To collect CDP and LLDP information, these proto.07:35Call must be enabled on the switch.07:55For DSCP the DSCP snooping feature must be enabled, then you can use filters to define which specific attributes and options will be sent to ICE. To send this sensor data to ICE, the access device must have radius accounting enabled. The sample filter shown for CDP LLDP and DSCP provide reason.07:57Level selection for most use cases.08:17To understand which attributes are available, use the show commands for CDP and LLDP to view which TLVs the endpoints present and determine if any specific attribute will assist in profiling the endpoint. Device sensor can also be deployed initially without filters to see which attributes are being.08:20You can use these to build custom filter list if required.08:40In wireless environment, the device sensor configuration is a lot simpler on WLC. You can enable the device sensor per WLAN. Initially only a hostname and class ID were supported, but the AROS seven.three introduces gathering user agent via HTTP.08:47So here under the WLAN you have to enable DSCP and HTTP profiling under radius client. Device sensor is the recommended option to acquire the user agent attribute when supported by the network device. If your infrastructure does not have support for device sensor, HTTP profiling, then you.09:05Use URL redirection for client provisioning and web auth use cases.09:25URL redirection may already be a basic requirement for the enabled ICE services but in some cases you may want to force URL redirection in order to capture the user agent. Then we have Wi Fi edge analytics.09:29Now this is a newer device sensor profiling capability introduced on ICE three.three and iOS XE 1710 one on catalyst 9800 wlcs, where the WLC can learn attributes such as model number.09:46And OS version from certain endpoints connected to it. ICE can then use this information for profiling. You can either leverage the Wi Fi edge analytics attribute directly in the authorization policy or create a custom MFC labels with these attributes and use the MFC labels in the policies.10:02Currently the Wi Fi edge analytics, the Wi Fi analytics is only supported for Apple Samsung and Intel processor devices. WLC will share these attributes to ICE via radius accounting packets, so ensure that the radius accounting is enabled on the WLC and.10:21That is profiling TLB caching for HTTP and DSCP traffic are enabled on the WLC policy profile. Now this section goes over the enforcement aspect of profiling. Multi factor classifi.10:39Application also known as MFC. ICE three.three introduced multi factor classification profiling labels which assigns profile endpoints into four separate category instead of just one individual profile policy.10:59This gives you more endpoint data than before and more flexibility on how you want to create and organize your authorization policies, whether it's based on the manufacturer endpoint type, the specific model or the OS running on the endpoint.11:15Additionally, for the enhancements that have been added to ice such as AI proposed rules through AI analytics or MFC cloud profiler rules. We'll assign endpoint profiles to the MFC labels. Therefore, it's.11:31Recommended now in deployments that utilize profiling methods beyond the standard profiling probes to utilize MFC labels rather than profiling policies or logical profiles in their authorization policies. However, all three options are available to.11:46Used to support previous policies in place. Now starting in ICE three.5a new flow is available to create user defined profiling policy with custom flows through simple if and or org conditions.12:03Similarly to other policies on ICE, where we use these operators without the need to define certainty factors. All endpoints attributes that ICE has learned can be used as conditions for your custom policies.12:22And then you can map these custom profile policies directly to MFC labels. You also have the ability to map authority to sources of endpoint attributes that ICE has learned through MDM integration or CMDB integration or custom attributes learned via PX grid integrations such as AI.12:38And analytics directly to MFC labels.12:58Previously, you had to either create or import custom profile policies using these authority to sources and then leverage the endpoint policies in the authorization policies. But now you can easily map these attributes to MFC labels and reference the MFC labels in the authorization policy instead.13:01Simplifying the process. The new MFC cloud profiler feature available in ICE three.five can dynamically classify and map endpoints into MFC level as well. Next, this is cloud MFC profiler. This was introduced in ICE three.five.13:19It enables ICE to share observed endpoint attribute with the cloud for analysis.13:39This process enhances the overall efficacy of the MFC classification process by assigning MFC labels to endpoint that do not have a custom MFC profiling rule or the MFC direct mapping rule applied. Now prior to ICE three.five, ICE would either try to map endpoint attribu.13:45Tools it learned from MFC labels without the support of the cloud.14:04The default behavior or you could leverage the AI proposed MFC labels through AI analytics. But this only provided suggestions. It didn't dynamically place endpoint into MFC label after AI ML cloud analysis. So enabling the cloud MFC profiler triggers the ref reclassification of new and existing.14:08Active endpoints and disabling the cloud MFC profiler immediately stops the reclass classification process. Previously learned attributes are still written and can be used so it doesn't mean that the other attributes which are learned previously will be gone.14:29And the last point to remember is when configuring the cloud MFC profiler you must be authorized to access to Cisco authorization portal and you may need to register your devices for MFA if it's your 1st attempt accessing the Cisco login portal. Now starting in ICE three.five.14:46We introduced a new method to manage all your MFC labeled profiling policies that were custom created.15:05Directly mapped either manually or by cloud and the AI proposed MFC labels that were user accepted. Similar to how other policies function on ICE, the MFC profiling policies are processed from top down approach based on the order and the 1st match.15:12And they can be arranged in any order. If you have an endpoint that may match on multiple MFC profiling policies ensure that the most specific MFC profiling policy or the MFC profiling policy you wish to use in authorization is listed above the other.15:30With the new flow, you can choose which policies you want to enable or disable, which will help tremendously when testing in monitor mode or before enforcing any sort of segmentation or authorization. The new flow will also inform you of how many endpoints have matched a specific MFC labeled profiling policies and you can easily.15:46The filter to search through your policies too.16:06And lastly, you also can import MFC label profiling policies to ICE in JSON format. Now MFC label rule prioritization. Now again this is available in ICE three.five.16:08Sorry to interrupt. Can you dismiss the reminder pop up on the bottom right corner? Yep, sure, sure. Thank you, thank you please continue. Yeah, so.16:28MFC level labels have the following order of alterable priority of how they are generated with the 1st rule having the highest prior priority. If an MFC label is provided by a higher priority rule, the label is not overwritten by the lower priority rule.16:42Consider a scenario where a system rule provides an endpoint's hardware manufacturer label. If an AIML rule exists for the same endpoint containing all four labels, the hardware manufacturer value from the system rule is retained, only the other three labels are taken from the AI ML rule.16:59If the MFC cloud profiler is not configured and there are NO custom or manual direct rule defined, then system rules will take priority like how it did prior to ICE three.five.17:18AIML rule proposal with AI analytics. So the new built in AI analytics feature introduced in ICE three.three is where the AI analytics cloud agent will provide MFC proposals recommendation on how certain groups of endpoints should be profiled based on the analyzed data.17:35With the main goal to help reduce any remaining unknown endpoints and easily group common endpoints together. 1st, all endpoint data, whether it's profiled or unknown gets forwarded by ICE to the AI ML cloud engine for analysis. Then the cloud engine will group the endpoint into cluster of groups.17:52Based on similar attribute data. Lastly, users can assign MFC labels based on the AI proposal to endpoint profile as unknown or to easily group together similar endpoint into MFC labels that can be used later on in an authorization policy.18:12In order to enable AI analytics for AI MFC proposal, you must be on the advantage licensing. PS grid must be enabled and ICE must have the connectivity to the cloud engine@API.PRD dot kairos.cisco labs.com or HTTPS.18:31Custom attributes and PX grid direct. So with ICE, you also can create custom user attributes and custom endpoints attribute if there's a specific attribute you want to differentiate from your user endpoint in an authorization that's not available in ICE by default.18:52However, for the longest time you could only create and manage custom attributes manually on the GUI or through REST APIs, but you do have an option of custom attributes. Now PX Grid direct for CMDB custom attributes.19:10So you may have some endpoints in your environment that just need to be statically managed on a way or the other despite all dynamic options available. Previously, managing static endpoints on ICE required you to either upload the endpoints manually on ICE via GUI or use API to add the endpoints to ice.19:26And then place them into endpoint identity groups as we showed earlier.19:45However many organizations have database with all this endpoint data already that ICE could not utilize or perhaps there were unique attributes already in place to identify specific devices, specific users, groups, or IPSK for wireless, IoT devices that you wanted to leverage on ICE for your policy.19:50Segmentation strategy. Starting with ICE three.two, you can now integrate ICE directly with CMDB external database such as the ServiceNow, which will use REST APIs to gather JSON data from the CMDB for endpoint attributes.20:10The data collected by ICE is based on custom attributes that you specify in PX Grid direct configuration. And then this data is stored in the ICE database. You can then either use the custom attributes directly in the authorization policy or you or use the custom attributes to create custom MFC labels or custom.20:28Some profiling policies to use later in the authorization policies.20:47PX Grid direct runs on the primary pan and a max of ten connector with 500000 endpoints per connector are supported. We recommend limiting the attributes that ICE receives via PX Grid direct to 15 to 20 attributes for best performance.20:51You have the option to schedule full or partial synchronization of data between ICE and your CMDB and starting in three.four, ICE three.four, you can also perform on demand data synchronization. Starting in ICE three.four patch one.21:08You can issue dynamic change of authorization from ICE for any changed attributes that ICE received from CMDB. Similar to how ICE can issue dynamic CoAs if it learns of any profiling changes for endpoint. So let's move on to creating the authorization.21:24Policies.21:44Here we have three ways to create authorization policies for profiling. In this sample authorization policy, any profiled windows Ten workstation will match on the top rule which contains the Windows Ten workstation endpoint policy. The Cisco IP phones will match on the IP phones logical profile, the apple.21:46Apply devices will match on the Apple I devices endpoint identity group.22:06The 1st two methods are the approved and the recommended, whereas the last one using the endpoint identity group is not recommended. Please note for the last method that the alternative and the preferred method would be to assign the Apple I device profiles to the logical profile to avoid any potential conflict with pre existing identity group as.22:10Okay.22:31Profiling for devices may need to be done in two steps. If a device is only partially profiled at 1st, then two rules will need to be created where the more generic rule is placed at on the bottom as the device will not hit this specific rule, and consequently this should be.22:36Called by the generic rule.22:53Then ICE receives more information about the device that will trigger a change of authorization where the device will re authenticate, and with the new information that ICE has about the device, it will hit the more specific rule on the top. E.g., a Cisco IP phone will commonly be profiled 1st as a Cisco device before a Cisco IP phone.22:56Once ICE receives all proper attributes to properly identify the device as a Cisco IP phone, a change of authorization is issued to the endpoint to reauthorize and then it will hit the Cisco IP phone rule on the top. This is where the associated COA type and the global COA setting for reauth on the profiling policy come.23:15Mentioned to play to adjust the proper level of access.23:35The new method. So creating authorization policy for profiling using MFC labels. This is the new method. Here you will navigate to policy policy set default authorization policy in Cisco eyes. Use the four MFC prefix attribute as a condition in your authorization rule.23:40Cisco is MFC profiler uses four specific endpoint attributes for enhanced visibility and authorization policy creation. The MFC endpoint type, example workstation printer, the MFC hardware manufacturer, the Rocks corporation, Google.23:58And the MFC hardware model e.g. the 3250 etc. And the operating system, the MFC operating system Windows or like smart oS or Mac OS. Prefer using operators like start.24:14Starts with or contains rather than strict equality to accommodate future changes in attribute value. E.g., use Cisco instead of Cisco system incorporation. Use Intel instead of Intel corporation. Now place your policy sets with the MFC attributes.24:30Sorry for this. Yeah, the MFC profiling is enabled by default from Cisco ICE release three.three onwards. You must have advantage license to view and use MFC attributes. MFC profiling policy rely on connectivity between the.24:50The PAN and the PSN. Rule prioritization in MFC profiling favors custom and direct mapping rules followed by system and AIML rules. Now, let's start.25:05With an overview of trust sec, the idea behind it and what is the basic building block of trust sec that is a scalable group tag, we call it as SGT. We will check the business intent of implementing sgts and the benefits of having group based policies.25:22So here is a short overview of what is trustsec and what are sgts. So trustsec uses tags to represent logical group privilege. Now this tag, the cisco trustsec is an architecture that simplifies the provisioning and the management of secure access to the network services and applications.25:43Okay. This particular tag is called as a scaler security group tag or scalable group tag SGT is a 16 bit value which is used in the access policies. The sgts provide consistent policy and access independent of network technology.26:03From Cisco ice release three.five, when a SGT is assigned to an active endpoint, the license consumption of that endpoint is updated to an advantage license. A network admin can leverage attributes such as user role, location or device type to define group assignment.26:21Right, and the SGT is understood by the devices and used to enforce the traffic by Cisco switches, routers and firewalls. Then we have the Cisco is defined in three different phases. We have classification, propagation and enforcement, and these we will be discussing each phase in the upcoming slides.26:40So, what we do is represent the things on our network based on the security group tags which are based on roles and context. Then we create a policy based on these groups rather than the IP address they have.27:03There could be 2000 employees and hundred contractors, assuming all employees require the same security policy, we will group them as an employee group with a tag named SGT employee. Once the groups are defined, then security policies can be designed between these groups and not per IP.27:21People and things can be mobile from one location to another connecting wirelessly wired VPN. It doesn't matter as their group classification follows them wherever they go within the network. Now that we know what sgts are.27:40Let us discuss why we need sgts in detail and the benefits of using the term. Now traditional segmentation may look simple when there are a handful of VLANs, but.27:57The number of policy keep increasing with each edition of new VLAN as the network grows. However, as we know, IP, ACLs are local attributes. They're not adaptive so they create a management headache when designing security policies in today's highly mobile workplace.28:12Design needs to be replicated for floors, building, offices, and other facilities. Traditional segmentation could have VLAN assignment control network access at layer three edge or by isolating that VLAN into a segmented virtual network. Additionally, there is an access control list assignment which can be a local ACL or a.28:32Download, downloaded ACL. These ACLs are applied at the switch port ingress or at the virtual port. In the case of wireless LAN controller, now.28:51This paves the way for higher cost of operation and complexity. If even if there is a minor change, imagine going through thousand lines of ACLM making that change at each side within your organization. Now trust sec trustsec deals with.29:09Changes without having to change the topology or VLANs and achieve segmentation easily. Let us see what else we can do with trustsec. With trustsec, we completely get rid of having to change topologies when our organization changes or branches are added. It avoids having to keep track of thousands of VLANs. It achieves my.29:26Micro and micro segmentation with a simple entity, a tag.29:46Everything on the network gets attacked as soon as it is a part of the network and is centrally controlled by ICE. Alright, so let us check on how we can implement sgts and where to start when considering to design a trust sec based app.29:50Architecture.30:10Right. Deciding which assets to protect is the key 1st step because knowing the asset helps to determine the classification method and how, where to classify. Next, you need to determine the classification method. If an endpoint or a user will be authenticating to ICE, then the SGT can be dynamically.30:14Signed through authorization. However, for any endpoint that will not be authenticating to ice, but still needs to be tagged or protected, then this will require manual classification. Typically through static IP SGT mapping, VLAN SGD mapping or subnet SGT mapping.30:34You can also map layer two port to SGT mapping or static VM port profile to SGT mapping. So there are so many ways you can manually map it. Afterwards, you will need to determine the policy enforcement points based on the assets you are trying to protect.30:52If your goal is to just protect user to data center access control, then your enforcement will be close to the data center destination or done through ACI. If your goal is user to user access distribution, then the enforcement will need to be done on the access switches.31:09If your goal is to protect other services on the back end of the network, you can also enforce with the firewall. Lastly, how will SDT be communicated? And in other words propagated throughout the network. You will most likely use variety of methods to propagate the tags throughout the network.31:27Network device SGT, what is network device SGT? When assigning scalable groups, thought also needs to be given to network device to network device and network device to network service communication, right? There are ways where there are protocols.31:50Which leverages device to device communication. Therefore, ICE needs to assign an SGT to the network device themselves. By default SGT two, we call it the SEC devices used for this. Now best way to assign this tag to the network devices through ICE via network device authorization table.32:07And here is the path you can go to works center policy network device authorization, and you can assign the devices there. So this is the screenshot where you will assign the trust sec devices security group.32:24We have three core components for group based policy to work. 1st, we have classification. This is the way we bucketize the things on our network, then we enforce the policies based on those groups. And then we need to propagate the classification across our network in something that we call propagation.32:45Let us dig deep into classification phase to start with.33:05Now classification means assigning an SGT to an IP address. How the classification is assigned in the network depends on the type of classification and use case being deployed. The way we classify is using two methods, the static classification and the dynamic classification. So dynamic classification happens as the user gets authenticated by eyes.33:11This is comparable to how a user gets a downloadable ACL.33:30Or a dynamic VLAN. In a similar way we can assign an SGD. Users such as employee guests contactors can be dynamically classified utilizing services from ICE as shown on the left of the figure. If a supplicant is available on the client, then eight or two.1X can be utilized and if NO suppli.33:35Second is available then Mac authentication bypass map or passive ID easy connect can be used. Guests typically use an ICE web portal to register and access the network web auth. With all these methods, ICE can dynamically assign the users into the appropriate groups.33:55Static classification methods are statically mapping the group to an IP address range or IP address, more fit for internal network infrastructure devices. Continuing our journey with 2nd phase, now.34:12Moving on to understand how sharing of group information takes place and how ICE plays a role in that process. Now Cisco sec has two methods to propagate SDD throughout the network, the data plane propagation and the control plane propagation.34:28These methods are used to forward tag traffic throughout the network. In line tagging, as its name suggests, is the ability to apply SGT to the layer two ethernet frame while it is sent across the wire to the upstream host.34:43The upstream host will evaluate the policy based on the SGD or continue forwarding it upstream. This allows the technology to scale virtually endlessly and it remains completely independent of any layer three protocol. Architecturally speaking, it does not matter whether the traffic is IPV four or IP.34:59The tag remains completely independent as it is in the layer two Ethernet frame.35:19For those platforms that do not support the native SGT capabilities, SXP advertises IP to SGT mapping. SXP is a TCP based peering protocol. SXP is able to propagate SGT across network devices that do not have hardware support for Cisco trustsec.35:25In most production deployment, our customers uses a combination of all these method to seamlessly transport the sgts while evaluating group based policy along the path. Now SGT inline tagging, now this is a wireshark capture as you can see under Cisco metadata.35:43We have a value of SGT three. Here is the packet capture and how it looks when a CMD is inserted. The SGT is a single label indicating the privilege of the source within the entire network.36:02Now each security group in Cisco trustsec domain is assigned a unique 16 bit tag. Okay, this SGT is a 16 bit tag. The tag is then propagated between the network hops allowing any intermediary devices to enforce policies based on the identity tag.36:17The max number of sgts supported on ICE is 10000. Now, the scalable group tag exchange protocol is what we call as SXP for the device that do not support inline tagging, we have SXP protocol.36:36Call.36:56SXP can build a TCP connection between the devices, device to device or device to ICE in order to share the IPSGD bindings, right? It's a peering protocol, one device acts as a speaker and the other device acts as a listener. The SXP speaker is responsible for sending the IP.36:57Binding and the listener is responsible for collecting these bindings.37:17Now PX Grid for trust sec. Now ice PX grid is an open scalable and IETF standard driven data sharing and threat control system. It allows multiple security products to work together and share context information for the benefit of all. Ice PX grid.37:26Can send SGT and group membership information to Cisco platforms such as firepower, threat defense, the WSS, the web application security appliance and stealthwatch as well as the 3rd party platforms which subscribe to the service. Both SXP and serve the same function that is to share the bindings either static.37:45Configured from the eyes or dynamically assigned by the eyes within the authorization policies.38:05A binding that comes from are shared to SXP and the same from SXP into PX grid. Now in most production deployment, our customer will use a combination of all these methods to seamlessly transport the SGT while evaluating group based.38:10Policies along the path.38:30In this example, we can see a full network example with the variety of propagation options coming into play. For the LAN, all the switches support inline tagging, so that's in use. To propagate the SGT across the van, the routers on the edges can communicate the tags either through a GRE tunnel, IPsec.38:32DMVPN or get VPN. Additionally, SXP can be used to propagate the tags across the van, between the switches involved.38:51Ice can propagate the tags to other networking components such as the switch or firewall through the SXP or PX grid depending on the product and what's supported. Lastly, if SDA fabric is in place with DNA center, then SGT propagation is all done via VXLAN instead.39:01Finally let's look at the enforcement phase, right? The enforcement occurs at the 1st platform in the traffic path which has all these four things, source binding, the destination binding, platform and VLAN has enforcement enabled and the policy.39:19It is downloaded from the eyes, either default or specific.39:39Now, this picture in this scenario, we want to enforce traffic from user to service in the backend such as scanner printer. Every switch along the path is configured for inline tagging as well as enforcement on both the layer two and the layer three interface. In this case, the enforcement will be done on the egress on the last switch.39:44Which is closest to the scanner Since it will have both the source binding and the destination binding. This switch will be the one to download the policy that is the SGACL as defined on the matrix from ICE. In this, what if the last switch had propagated the scanners as.40:03To a different switch along the path via SXP.40:23In this case, the enforcement will now be done on the egress on the middle switch since it learned the source binding through the inline tagging and the destination binding through SXP. Understand how to configure SGT component, network devices, SXP and role assignment policy in ICE.40:26And realize the value in segmentation simplification. Now here are the key deployment steps. The 1st one is to configure the network device, you configure the radius settings and the advanced set setting. 2nd is.40:45Create the sgts and the sgacls.41:05The 3rd one is define the egress policy metrics and static mapping, right? You can create this on the eyes and the last step would be to configure the radius policies, apply and radius authorization policy. Now considering the time, I'm not going to go into detailed configuration step, but please.41:10Please contact us for any detailed configuration step following all these ice SGT workflow including all the devices, switches firewalls or ICE.41:30Now I'll hand over to my colleague here for a quick demo on these. So over to you. Thanks because let me just quickly share.41:41The demo, right. Hi, everyone, this security specialist from customer success team. For the coming 30 min who stayed on the call, I will walk you through a demo video of ICE profiling and.41:56Trust set. So, starting off with eyes, profiling topic because just mentioned, we need to make sure the profiling feature is enabled. In the standalone mode it's enabled by default. Distributed deployment, you may have it in enabled per PSN node.42:16And setting up things like the MFC classification, AI endpoint analytic, the new profiling, the recommendation from admin guy is basically to have every single probe turned on to bring in as much.42:35Data is possible to give you the best profiling information. But we realize that it's not realistic in some environment if you're not running netflow DXCP or you cannot get for device sensor where things like nmap, not allowed or you.42:53Don't have SNMP set up.43:13So this is our deployment by deployment, but best practice is to have this probe turned on in the use case regard to get richer filing data possible. And moving down.43:16Into the global setting or profiling.43:35Endpoint attribute filter has been recommended to be turned on for a very long time just because traditionally, we had a lot of attributes coming that were not really usable by ICE to profile device. But with the new cloud based MFC profiling this is more possible, so few.43:40Future state recommendation is to have this turn off for the work properly. The additional attributes that we are learning from the integration like you the attributes and the profile of water resistance QR all enabled to give you more profiling data.43:59And to better profile your devices. And then at the high level together the MFC and the AI enabled and working, this checkbox needs to be enabled and over to.44:19Get the actual profiler under work center down in their settings.44:39Getting Cisco AI analytic. Enable is coming here. So check the box to turn it on, make sure you have the correct cloud service enabled, downloading these configuration files just in case one day you.44:46You need to rebuild your ICE reconfigure and then you can just upload the configured file again.45:06And then click and check our basic cloud connectivity. So from there, once we have it running, it takes couples updates for all the data to be popped up to the cloud and be analyzed to bring back proposed profiling rule.45:14So once we had time to do that, looking at the help menu here gives you a little bit more information on how often these things happen, how long it takes to provide the AI machine learning cloud profile and proposal. Once they start coming in move over here, you will get the options to either.45:35Accept or deny using the matter.45:55For the MFC device, once ICE has learned enough information to apply MFC tags, if we look at the endpoint classification which is listed here also lists in context with ability endpoint, we've got a few more columns.46:02So there were a few device in the lab that ICE has learned MFC endpoint type MFC hardware manufacturer, and the hardware model, it didn't bring in any, you know, operating system information yet. Or that would be important when we move over to the policy in a.46:19Bit, just to show these are now usable within the endpoint addictionaries for creating rules and enforcing policy.46:39The other piece we just mentioned that we can do quick dive into is our pace Grid direct connector to a CMDB. So, if you have something like ServiceNow or a custom CMDB database, we can do a direct connection from ICE to that cmdb.46:51To pull down some JSON file attributes that includes anything that's stored in there.47:11This is basically just pull from the particular CMDB and the JSON file presented by that. You can have the baseline local authentication on device in three.43.fives asked a few more authentication method, but just always good to test the connection there.47:17We'll put down the JSON and split out the key value pairs and then you have options here within the CMDB config or the PX grid direct integration to include any of these attributes we sent in JSON file in additionary.47:38Which then usable within policy. For certain value here like I've got some for compliant, we can move over and if enabled up here the COA and how we want it to perform.47:57For this case, if device originally come in as either non compliant or compliant equals false or compliance is true and then change in the next thing. We can enable a COA here to have ISC automatically change the authorization for the endpoint.48:14Actually a different policy just based on whatever you have configured.48:33Which you can choose as many, as few of these include a dictionary as you like. Enable COA for attribute you wanna check, save it, then everything usable within policy. And we jump over to the trust set.48:37Site before we go into the policy to do a few high level checks there. So starting off with components, this is where we going to define our security group packs. Out of the box, ISC has about less than 20 building SGT, but you can come in and add.48:58And once you've identified the device in your environment or users, groups, VLAN et cetera, then you wish you to tag and add these in dynamically. So just come in and add one, apply whatever name you wanted, apply security group tag. Once defined here.49:17Then useable in the policy. For devices that are not going to be dynamically tagged weird ICE authorization, we can come here to ICE to to map the IPSGT statically, figure it out.49:35Like, you know, our update servers that are not authenticating through ICE test server or development server that just manually tagging those based on IP to SGT.49:55Which are then be shared out either through SXP or PX grid, through integration with other device. We also have the ability to create a SGACL that will push down from ICE downloadable.50:08In.50:28In the trust set environment data. The when device applies this as part of the policy or manually applied on switch or other network device, simplify syntast here, in this case we're just, you know, denying ICMP and permitting everything else.50:30And that can be applied when we move over to the actual set policy, so once we've identified our SGTN, which things we would like to tag, we can come in, find the intersection point and define the traffic enforcement based on source and destination in two way matrix.50:54So if we defined it here for auditor to contractor.51:14We've also, need to come down to contractor for the reverse traffic to auditor. Anything that's showing up here at screen basically just using the default permit IP policy, anything that's red using the default denied policy, and anything that's blue is applying what.51:20One of the SGACL that were custom created, which is everything.51:40As you move forward with enforcement and once you finalize your network design traffic is recommended to change this default policy, which is everything here in the background and light green.51:46Which just before permit IP ideally over to deny policy at the very end, right? So we've got everything classified, we know what we want to happen, we know what we, we don't want to happen in the network and anything unknown.52:01We'll just go straight up to nine and we jump from the policy set. Once we have our, you know, policy.52:20We have certain things defined over in the ice. We will come back just our standard policy set using the this top one, you know, some tests, network devices sending authentication to eyes. Authentication doesn't really matter, not really changed there, but move down into.52:36To this authorization policy.52:56And the top one, we're just looking at our CMDB for non compliance, so anything that's been passed in that JSON file, has a value of compliant equals false.53:00We can just come in and edit the policy and our CMDB or whatever with name that PX grid, direct integration showed up here and then attributes that were set for use in dictionary become available here. We can always change this operator.53:17It's more recommended to use something like contains or start with just in case the value change over time. But in my case it's pretty simple. The logic is, so either true or false, right? So basically any device comes in with member of CMDB database, then I see learn about.53:37And let's quickly jump over to the direct tab. So the eyes have learned five specific devices we are JSON file that we pull from the CMDB. Clicking on it, we can take a look at the learn. In this case, this one is true.53:59And we see the user information, MAC address, inventory ID, however that tracks within your specific, you know, CMDB instance and user agent attributes, just anything we want to use here, we could then go back to direct.54:18And set those as usable within the policy.54:38And moving back to the policy, a few other things to call out. Traditional, like our auditor here, we are just using the active directory group. So if a member tries to log in as a member of AD group, we are going to permit access. You might notice all.54:43For the.55:03Policy's listing here, just for basic network access, not doing redirect, they're all permit access, and all I'm doing applying is just applying the security group and allowing the SGT matrix on permit IP deny IP or the custom policy.55:04The, you know, deny ICMP traffic.55:24To take a fact once this actually get applied to the network. And for the auditor log as a member, as a AD group on prem permit access, apply the auditor tag and diving a little bit deeper that we have the MSC information.55:27You know endpoint type equals workstation for contractor user.55:48And then we apply the contractor type. And then probably the most definitive check is in this list is the employee check, right? So we are going, we are going to.55:53Give me a sec. Yep, let me continue. Yep. We're going to an active directory group and one CMDB compliance. MSC profile and both endpoint type are hardware manufacturer.56:12If all those matches we're going to apply the employee tag.56:32And if not, it's likely come down and either catch the deny access or potentially, you know, we remediate the rules if I set those up. The last two referred to previous profiling policy where it come in with the endpoint policy.56:35Policy in this case Microsoft workstation or perhaps a logical profile of an IP phone.56:55But in our case, right, we are just applying an SG here and then letting the network handle that without needing for, downloadable ACL VLAN change, and then additional overhead on your network device.57:02To pop into a actual switch to show some of the quick commands that will give you some information of things happening on the network. In this case I've got two sections that have authenticated with ICE, one.1X1 MAB.57:27And in the detail, we could see the user Alex, right? With an IP ten.thirty.1. 100. She's authorized, she's authenticated successfully over.1X And the only thing we are passing back is SGT value of.57:48Nine.58:08And another section, the map section. Similarly, we've got the MAC address, we authenticated with MAP, we've authorized pass back and SGT value of 18 and issue some other command to check the trust set status and.58:11E.g., the CTS pack, so it it gives you the CTS setup we need to have at least this version of the eyes, the CTS pack. Part list provisioning by the way is coming in the future supported for the supporting network device.58:31And another command we issue just to look at the environment data downloaded from ice. So our local device SGT is that static two that comes out of the box is generally reverse for, we serve for the.58:50Device and then we can see we install CDS information, STD information from particular I I server. This will give a list of NO security groups. So anything that pops up here will show it up at NO.59:10And lastly, we can, you know, issue your command to show the role based permission. Once a specific network device has learned one or more SGT, only the policy from the matrix associated with that SGT will be downloaded.59:27So in this case, the switch knows about SGT nine and 18 because we have two active section connection connecting to this switch and they got this SGT assigned, right? So if traffic comes across this switch.59:48And tagging in I tagging has been successfully across network, anything that arriving here with SGTR four for employee destiny to SGTR nine auditor, we are going to give deny ICMP.01:00:05Similarly, contractor just to auditor, developer to auditor, we are not letting them ping the auditor device, just as a basic example. And then moving down to the SGD of 18, which is to remediate basically the only thing.01:00:23Think we're permitting.01:00:41Is the traffic to and from the update server SGT which was statically assigned on ICE. So that's a quick overview of what's coming down to the switch and how this is a little bit less impactful than.01:00:43Downloading multiple ACLs overloading the T cams and potentially causing issues on your switch. And also much easier to manage because any change we have to do is just one or two clicks on I side and then we'll update appropriately based on.01:01:02Whatever relight happened for.01:01:22Policy. And expanding beyond eyes and how this can be used, right? We will, starting over on the secure network analytics, also formerly known as stealth watch.01:01:26If we've got the Cisco ICE integration, in this case, I've got IC three four connected. Blue.is good, means connected. Red.something is wrong, ICE is presenting a certificate that SNA doesn't trust because the inter.01:01:45An OCA chain was updated, but this is the 1st place to look for the integration. Make sure the 1st that we have the PX grid integration enabled.01:02:04And then over the 1st integration screen that we want SNA to learn from ICE over connection. In this case, we've got the adaptive network control ANC, right? And static SGD classification for the device and aim being dynamically.01:02:24The tag and the section information for those who are being dynamically tagged.01:02:43Once this integration is done, if you're on support version of SNA currently 752 and beyond so 752753 new feature on host group management and ways to leverage security group tags dynamically associated.01:02:49Is through.01:03:09Host group automation. So out of the box we've got inside hosts, outside hosts and traditionally we would have to come in SMA manually update, you know, the IP address range in specific group. But with the 752 new feature, we can now create.01:03:12A house group.01:03:31Automation rule currently limit to just ICE, but future integration are coming as well. So we come to set up a name for it. It tells us, you know, we want ice learn attribute to go. In this case, inside host and then I create a host group parent name.01:03:33ICE I picked my ICE cluster, test the connection just to make sure everything looks good there, and then you can use advanced options on how you want SNA trade IP address, learn from these.01:03:53But once it's set up and enabled, by the way is disabled by default so you can turn it on. This script will automatically run once per day as archive hour or you can come in here to set it run.01:04:07I'll set the run now which will trigger right away to request over PX grid on ICE to sync. In a small environment, in this case, there were only like five or six.01:04:23Active authentication so the thing is quite fast. So if you have hundreds of thousands of endpoint on active section, that might take a bit longer. But once these run successfully we can move back to the host group management.01:04:39Drop into our inside host host group, the ISC host group will be create and then we have a few different types of actually learned from ICE, right? The endpoint operating system, endpoint profile, the security.01:04:59Group and the active on the network within ice. So probably some unknown devices as well. So.01:05:16There were two devices or in the virtual lab has been assigned here because we're not learning any profiling from them, but I also learned you know all the host groups that have active IP address or at one point had an active IP address assigned it. So in this case, our.01:05:31Auditor, Alex, and.01:05:51That locked in with IB address is automatically added here. It would have a device in the remediate group, the MAP device that needs to be updated maybe with the proper.1X configuration by networking team is populated here and then it's.01:05:54It's all again.01:06:14It's Managed for you automatically without needing to go add or remove the IP address manually. You can then take this as GTT over to things like alert alarm response management to set up the adaptive network control policy or.01:06:15Are there alert or alarm that you'd like to see based on the traffic transitting your network if you're seeing NetFlow for it? So that's just a very handy, you know, integration.01:06:35And we can move to, into the report, right? Let me go back a little bit to show you how the report. Yep, go to the report builder. As you are rolling out your trust set environment, you.01:06:54Can, you know, come in and run couples of different reports on trusted traffic. It's actually happening on your organization, so in this case, anything blue you see is the traffic between those SGT transiting export.01:07:14Exporter being sent to the full collector. Anything red, there's something some traffic from the quantine system to contractor, it's likely raise a red flag and require a little bit extra investigation why traffic is happening and not being.01:07:30Lock somewhere. But this gives you an idea, you know, we've classified our device contractors are talking to unknown, we probably need to pare it down a NO list either by profiling or other method to get them proper SGT. We need to figure out why.01:07:50Contractors are communicating with a developer, but it allows you to come in and get visualization on how could a policy moving forward. The other quick report that comes with trust set.01:08:08Out of the box in SNA is the policy compliance so we can run it for last day, last 30 day last week on ICE cluster using whichever matrix in use and we can even pare it down to a specific.01:08:25SGT if we choose to. So similar to the last slide we throw a little, the red box is have traffic transiting things that maybe it shouldn't because we wanted to be denied with traffic.01:08:44We analyzing the policy still, right? If it is monitor mode, any of the tech down here, just give you an idea of what's actually happening on your network in areas of potential concern. And last quick high level, this is going to be example.01:09:01So similar to the SNA over our integration, auto integration, we can dive into.01:09:24Other integration and then identity source. Yep. And then integrate the ICE here with FMC and then subscribe to whichever topic you like. If like the static tag, you must do the SXP topic and or if you liked.01:09:32Only looking for inline tagging or dynamically tag attribute, you can do the section directory topic for here we just check everything relied on XXP traffic, but once integrated over.01:09:52In our access control policy rather than having complex rule and then having to come in the potentially change policy based on different IP address, rangers or other attribute, we can solely rely on SG detect.01:10:10Becoming in our dynamic attribute, just simplify the policy. So we click open one of the, for now the disabled rule, right? Once we have integrated our access control policy under dynamic attribute, we will learn the ice.01:10:28Security group tag and other dynamic attribute and then we can use this to set up the basic policy saying hey if I have you know coming from the auditor heading to update server which you remember back in the static.01:10:48You know, assign IP to SGT mapping in my eyes. I don't want to allow the ICMP in this case. I'm going to block it so we can enable this rule and just to give a kind of a quick visual on this working in practice.01:11:06Go ahead and start pinging from the device, which is our auditor device over to our update server, which at this point has NO policy over on the FMC side with our FTD. I'll go ahead and enable.01:11:24Rule save with the policy and deploy if a minute or so to update. So why FMC is deploying a policy to FTD, we can take the time to check the ISC lock.01:11:40The lifelong, right? So a few of the active section I have on the network, so Elizabeth is an employee. Alice is an auditor. Charles is a contractor, but as we come in, the policy we looked at previously Charles is matching the contractor rule.01:11:59Elizabeth is matching the MFC and CMDB where we are looking for the MFC attributes CMDB compliance equal true as well as the active directory group. And the MAB device, I didn't name it quite well, it stayed with the authorization.01:12:20Rule one, but this was the, you know, the MAB rule, MAB only. Looking over the security group column.01:12:40You can set, you can customize the column to show in life log, on the by switching the, I mean changing the setting on the top right corner, that gear icon to show the column of security group tag, and you can also go deep into a, to check the.01:12:49Detail of this you know authentication log or section log, right? At the very end you will see the SGT has been assigned to the section, which is the 19. Yep. Now the policy has been.01:13:09Deploy to the FTD, and you can see as as soon as the policy deployed the ping traffic got denied by FTD. And.01:13:26Well, that's the, that's basically if we go to take a look at the unified event on the firewall, we will see what previously allow from the auditor to update server, now it's blocked.01:13:42And in the policy that we set for blocking this traffic, only leverage on the security group tag, right? And yeah, that's the demo I want to show everyone for today, both profiling and trust set.01:14:01How you all learn something new.01:14:21And, back to you because yeah thank you that was really detailed demo. So, yeah, so this concludes our session. We appreciate your time and attendance. Thank you for joining us today.01:14:24We would like, we would also like to thank our presenters and panelists. This was the accelerator advanced feature deep dive scalable group tag and the advanced profiling and trust sec. Next, I see we have.01:14:44Some questions which were already answered and these are some of the additional resources, this slide list where to find some resources related to today's presentation that we think you'll find helpful. We will also share the link in the, in the chat window.01:15:03Yeah and yeah, just a reminder that there is more content available to you on our secure firewall YouTube channel so sorry the Cisco ICE YouTube channel, so please take a look and subscribe to be kept up to date. Yeah, thank you very much guys.01:15:20