Cisco ISE Meets Cisco Catalyst Center

Welcome everyone, and thank you for joining today's expert Insights webinar on ICE Mails Catalyst Center.00:09I'm sorry customer success specialist here at Cisco focused in catalyst center. I'm also joined by our expert panelists, Matthew Webel and Peter Michael Andra, who will answer your questions live. So if you run a network today, you know the pain points, the pain of manual provisioning, the.00:17Matched their secrets and the long night's troubleshooting client access, right?00:37Today we will show you how catalyst centers automation combined with the identity intelligence of ICE changes how you operate your network. So over the next 90 min, we will go deep on how these two platforms work together.00:43To automate and secure your network edge. Our expert insight series is built in such a way that each session builds on the last to help drive your adoption. Today's session is a part of our amplify series and this is the 1st of the four.01:00Our goal today is purely practical. We'll walk through the integration workflow, automate your AAA configuration on your network devices as well as the clients. Manage security group tags and finally, I'll take you through the AI analytics to secure the unknown devices connecting your network.01:19A few quick housekeeping notes. If a question comes up during the session, please post it in the chat panel. You can click on the three dots at the bottom right of your Webex window and click chat and you can post your questions in there, our experts will respond.01:41If we can't get your question live, we'll capture it and then we'll follow up with you. Also, this session is being recorded. The captions are on and the recording and the Q and A will be shared with you afterward. So you don't need to worry about capturing every detail.01:56So with that, let's look at the agenda for today's session. Firstly, we will begin by understanding the need for this integration followed by the prerequisites from the perspective of Atlas Center and ICE.02:16We will then go through the initial integration workflow. As a part of the integration I will also take you through the configuration that is needed to externally authenticate into catalyst center through your eyes using tech X. Next I'll show how catalyst center automates the AAA settings on your.02:30Network devices and the wired clients.02:50And after that, we will go over the config automation, the options that you have there followed by trustsec policy management, and then we'll finish with the AI endpoint analytics and the trust scores that you can get from it. One quick note on the level, this is an intermediate session, so we assume that you.02:52You're familiar with the basics of ICE and AAA.03:12Historically, networking and security have lived in separate worlds. The network team provisioned your switch and the security team manage the radio server. Today the idea is to converge them both together, helping us move from a manual.03:20Box by box configuration to intent based networking. So while catalyst center acts as the single source of truth for your device inventory as well as your aaa configuration, ICE on the other hand provides the granular policy engine.03:36The trust sec and the complex authorization rules. So think of your catalyst center as your network's intent and provisioning engine, right? Whereas your eyes would be the policy and identity engine.03:51The catalyst center pushes the configuration down to the switches, whereas ICE handles the actual authentication and pushes the context backup into catalyst center through PX grid. So we have three main use cases. 1st is the AAA automation where your attacks and radius configurations are provi.04:08Automatically on your device. This also helps automatically register them as network access devices or nads on your ICE instance. Second is the policy matrix. The policy data from the ICE server, so you are able to manage and create access policies.04:28From catalyst center itself. We have a very intuitive and a user friendly matrix that you can use that I'll go through. So you'll also be able to visualize the traffic flows from there. The 3rd use case is the exchange of endpoint data. So catalyst center receives endpoint authentication and posture status from the ICE for.04:47It's client assurance data, whereas the ICE in turn from this integration receives the endpoint analytics attributes from the catalyst center. And all of this exchange happens through the HTTPS REST API and.05:07Yes screen. So let's get into the weeds. We'll start with the two essentials, 1st integrating the catalyst center and the ice servers and second setting up the ice server to log in into catalyst center using.05:22So these are the integration requirements on catalyst center, we recommend that you use a minimum of 2379 or the 23710 recommended release. On ICE, you need to at least run the three.three patch ten or.05:41They recommended 3434 patch five recommended release, right? One important note, always confirm your exact combination on the catalyst center compatibility matrix. We we can post that link in the chat.05:57I suggest that because the supported versions change with each of the maintenance release, so it's always important that you make sure that you're running compatible versions from that matrix. And on the licensing portion, the AI and ML analytics that I'm gonna demo later, they are going to be covered and.06:14For the advantage license.06:34And before we proceed with the integration, here are some of the prerequisites and key things to keep in mind. Certificates are one of the most common areas why this integration would fail. So if you are using a CSN certificate for catalyst center, make sure that the FQDN as well as the IP addresses of all the interface.06:39Are included in the sand fields of your certificate.07:01If you are running a three node cluster, you also need to make sure that the IP addresses of all the interfaces from all the three nodes must be included in the SAN field. And the same applies for ICE as well. You need to ensure that the certificate on your admin node, the policy admin node contains the IP address as well as the FQDNS.07:04For credentials, we suggest you create a dedicated ERS admin account on the ICE just for this integration and consider disabling password expiry, so an expired password doesn't break your integration in the future, right?07:26For connectivity, the ICE node running the PX grid must be reachable from catalyst center on its E zero IP address. And the ports that I have listed over here, they must be open for HTTPS ERS and PX grid exchange to happen, right?07:41A common question that we get is when you add ICE, you can point catalyst center only at the primary admin node, right? The catalyst center will then discover the psns and the PX grid nodes automatically, so all that you need to do is add only the primary admin node.08:00Also, if you have an existing brownfield ICE deployment, ensure that your device names in the ICE servers match the host names in your catalyst center inventory. Otherwise the auto sync between the two products might fail. And this is our eight step integration.08:20Integration workflow. Step one through five are the core integration.08:40So catalyst center uses their ERS REST API to push network access devices or nads into ice. And then it uses PX grid to subscribe to live endpoint data. Step six seven and eight, these handle the external authentication.08:44Right, so we strongly recommend that you configure catalyst center to use for external authentication and for switch management, right? Offers you the same login functionality as radius, but that also reduces policy complexity that comes with radius, right? So we always recommend that use techacks.09:00When it comes to external authentication for as well as, you know, for switch management. And that could also potentially improve your eyes performance and it could also help maximize the value of your device admin licenses, which you can then have in abundance.09:19So by using your switches consume a single device admin license preserving your radius licenses strictly for your end users. And that is a real cost optimization. So now for our 1st demo, this is the heart of our integration. I'll follow the workflow that we just saw.09:37Now I'll enable the ERS read write enable PX grid. I'll configure eyes on the catalyst center.09:56And then use ICE to enable external authentication over TACACS, right? And in my setup, ICE is integrated with Active Directory so that Active Directory users can log in into the catalyst center. So let's go ahead and dive in into the demo.10:03So as you can see, I'm on my catalyst center homepage, the 1st thing I would do is click on the menu icon, system and then settings, and then in external services, I would go and click on authentication and.10:27Policy servers and here is where we would be able to add our ice server.10:47Right, we have two different options triple A as well as ice. Today we are going to add ICE to get the extra capabilities, but you could also add the AAA server as well. So you can go ahead and click on ICE, and once you click on that, you will be given the option of entering the.10:52My server details, right? It will ask you for the IP address, the shared secret, the username and password as well as the FQDN of your ICE server.11:12So we'll go into the server to gather those details. I'll go into administration and then deployment. So here are all the deployment nodes that I have, I have just the policy administration node and I can go into the policy administration node and make sure that my PX grid is enabled.11:24So we ensured that the PX grid toggle is enabled here and then I'll go into settings, API settings, and this is where I would enable the ERS read write.11:43API access, right? I will also suggest that you disable the CSRF just for the ERS settings and click on save, then we would go into.12:02Administration system and admin process admin access. Here we would be able to add the users for our catalyst center, right? The credentials that we have to provide within catalyst center for ICE. So we'll create one specifically for catalyst center. So I've named it as cat center and.12:17You've entered the password already and this is what we are going to use in our catalyst center. The next step is to go into deployment copy the IP address of your ICE instance and then paste it into here for the shared secret.12:37We have to go back into ICE and create the shared secret. So for that we'll go into network device, we'll have to add Atlas Center as the network device in ICE. So we provided the name and then the IP address of the ICE server.12:55Of the catalyst center, and then the prefix, make sure that is correct. And then we would enable the radius authentication and the authentication settings.13:13So firstly, we'll enter a shared secret for authentication and then we will do the same for radius and then click submit. Then we'll go into administration deployment going into the pan.13:35Node and we'll also need the FQDN of the server.13:55So we'll enter the shared secret that we configured on ICE, then the username and password, then the FQ.14:00That we copied from the node. Here we have the advanced settings as well where you can you know select the option of connecting to PX grid that is enabled by default, but you can also select the protocol here whether you want to do radius or tacacs. Here in our case, you're also going to use so I've enabled that.14:20And click save. And when you do that, it takes you through a sequence of steps. And firstly what happens is the certificates are exchanged between center and ice server, right? And we need to accept the agreement. And once that is done, it goes through the flow, right? Initiating the connection establish.14:40Publishing the trust and then connecting to the PX grid.15:00Once that is done, you would see the ICE instance displayed over here, the status must be shown as active, and that is the IP address of our.15:05A server, the next step is to enable external authentication through our Atlas center. So right now we just have an internal user, the default user that comes with deploying Atlas center, right? And it has the super admin role.15:23Then we'll go into the role based access control and here we'll have all the user groups listed. So the super admin network admin and the observer role are present by default, but what I've created here is a custom user role called assurance only that would only provide access to the assurance features, right? And we're gonna use this.15:41User group to test our external authentication. As you can see, I've only permitted this user group to have assurance related features.16:01And then we'll also create another user for external authentication on super admin role as well, right? Just to make sure you are able to see both of them in the demo. And then we have the external authentication. This is.16:17Something that is important, right? Here is where we enable the AAA attribute and we also use the AAA attribute over here to paste that into the ICE configuration, right? And we also need to make sure that the enable external user toggle the the radio button is enabled.16:33So now we'll go into the eyes, going to administration and then external identity sources. Here, as you can see, I have my eyes mapped with my active directory already, right? And I have a couple of groups that are already picked from my active directory.16:57So I have the user groups for assurance only as well as super admin as well as the users for both assurance and super admin, right? As you can see, this is how it looks like in my active directory.17:14And then we'll go into work centers and then we'll create a shell profile.17:34So we'll go into profile and click on add so this one will be for our super admin users. And here is where we will use the attributes from.17:44Access center, right? We'll copy the attribute attributes from here for which is the Cisco AV pair. So we need to make sure that we use the one specifically for TACACS since we are doing this case.18:02And then the value would be the name of your user group, right? Here in this case it would be your super admin role.18:17Okay, so we are gonna replicate the same.18:39For our assurance only users as well. So we'll create a shell profile for that and we'll go through the same set of steps so since we've duplicated the role, we'll just replace.18:43The super admin with the assurance only user group name and save, and we have the shell profiles created and the next step is to create our device admin policy set.19:02Right to map it with the active directory. So here we'll use the attributes for our network access, right?19:211st we'll get provide the IP address of our catalyst center and then we'll map it to the authentication policy.19:39And the authorization policy from our active directory. So we'll select the active directory store.19:54So as you can see, we are selecting the super admin's active directory.20:23Profile for this one, the shell profile here, and we're gonna duplicate one for assurance only as well.20:29Oh Once that is done, we'll click on save, that will save the policy set.20:49And we should be able to test the user. But before that we also need to enable as I said we need to go into external authentication enable the external user, and we need to define the AAA attribute to be the TACACS.20:59Attribute, right? So the AAA server fields are automatically populated, but I need to enter the shared secret that I've configured in ICE. We click on advanced settings here we are able to select attacks.21:16Since we are using our case, and then we enable the external user so once we do that, we will be able to test out the.21:37Logins, be it for both the assurance only user as well as.21:56The super admin user, right? So here I've create opened an incognito tab and I'm going to log in as one of the user from my active directory. As you can see, I'm able to successfully log in and if I go into my profile.22:01I can see that I'm mapped to the super admin role. And similarly, we can test the same for our assurance only user and as you can see.22:20The role here for the assurance user is set to.22:40The role in catalyst center right the assurance only catalyst center and we are only provided access to the assurance features so.22:43Two best practices to remember, you need to ensure that the PX grid is enabled on at least one ICE node, and once the external authentication is done, the local users cannot log in unless they are the super admin users, right? So those are some of the things to remember.23:02And now that we're integrated, we need to tell our switches to talk to ICE. By default catalyst center uses an intent based model that is tied to your site hierarchy. So when you assign a device to a site, it inherits the aaa settings you have designed.23:21For that site. And generally when you're pursuing automation, your day zero, day one, and telemetry are bound to the site hierarchy. And that is why it is important to build your site hierarchy that is created at the start of your deployment.23:37This is the critical slide, Atlas center, as I said, gives you two ways to push aaa. One is through site hierarchy or even you can use the day and templates, and these two are mutually exclusive, right? So we suggest you do not mix them on the same device or you could cause configuration conflicts, right?23:56And the site hierarchy is always the recommended path for standard rapid deployments because it can push your AAA settings, all your network wide settings on multiple devices at once, right? And your configuration remains consistent throughout your network, right?24:14And in cases where you need advanced configuration, you can all always opt for the IBNS two.zero through your day end templates. So the rule of thumb is that you must choose either site hierarchy or the day and templates for your AAA provisioning. Since they cannot be simultaneously used together, right?24:31And the best part of this configuration or this integration is since we have enabled the ERS read write on the ICE server and integrated.24:50It with catalyst center. Catalyst center will automatically push all the inventory data over to ICE, right? As we've seen, this eliminates the need for having to manually enter the device information in your ICE server. So these are the AAA settings and how.24:59What they would look like in catalyst center, you would go into the network settings. I'll take you through the demo as well. You can select the particular site where you want AAA to be provisioned.25:19It can be global or site specific, but whatever settings you enter over there, there are inherited to all the underlying sites, buildings and floors. And you can provision the aaa settings individually for the network devices as well as for the clients or the wired endpoints in that site.25:28And as I mentioned earlier, we could recommend that you configure center to manage your network access devices, so they consume a single device admin license and that will help preserve your tiered radius licenses strictly for user and endpoint authentication.25:47So in this specific demo, we are going to discover a few devices and then provision site level settings on your switches through catalyst center. And once that is done, we will also check in ICE that the newly provisioned devices are reflected over there.26:07So as you can see, once we've added the ICE server, it is being shown in an active state in our authentication and policy servers, right? And you can click on the active status as well and it will give you more details on your ICE server, like what is your node, what is your PSN node, what is the PX grid?26:30What is the status of it, right?26:50You'll see all those details in the system three 60 dashboard. Now the next step for us is to run a discovery, right? So even before we push the AAA settings, we need to ensure that we have a couple of devices that are discovered. So I'm gonna discover.26:54From you know custom IP I'm gonna provide a custom IP range and discover a few devices. So I'll go into tools discovery. But even before that, you know, I would like to show you how the settings look like, right? How the aaa settings look like, right? So we go into design and network settings.27:14And here you can see we have two different tabs for network as well as the wired clients, right? And you can select the specific sites on the left. Right now it is selected to the default global, but you can apply site specific settings by selecting that specific site individually.27:33So you see that the PAN node details are populated already as well as the PSN has been synced. In addition to that, you also have the option of entering your NTP DHCP, DNS, all the network details that can be pushed to all the devices within the site.27:53And then if we go into the client and point tab, we have the option of adding our replace servers here, so these are all the options that we get. Similarly, you know, that we have for network devices.28:10So now I'm gonna go discover a few devices, right? So for that I'll go into tools and discovery. Here I already have a scheduled job that is running, you know, for the IP range that I'm targeting, right? So this is the one that I have.28:38I have three reachable devices and I'm just gonna rerun the same discovery job again. Once I do that, I can see that I have my three device devices discovered.28:54Right, so this is my discovery task. You can see that I have discovered the three devices. I can go into my inventory and then check whether the devices are being displayed. Now I can set the view here to inventory and that will help me understand, you know, what is the status of the inventory collection from catalyst center.29:16So since the devices were just discovered, they're still syncing up with catalyst center and once they're completely managed and reachable, then we can go ahead, provision the devices, right? So I'm gonna select the two switches here and then click on actions.29:37Provision and then provision device. So here as I said, you have the option of picking a specific site for the individual devices or you can assign them all to one specific site and the aaa settings that we have on.29:54That's what site will get applied to both these switches. So I'm gonna select the RTP site over here, North Carolina. I'm assigning it to building one, click on next.30:12And then it will show me the summary of all the configuration that is being applied, right? So this is what we were looking at previously in the aaa settings, right? So we've already entered the NTP server, the server details, the DNS et cetera, right?30:30So all those details, they get pushed, all that configuration gets pushed to these switches individually. So when I provision the device I have the option of doing it now later or I can even select the.30:47Option of preview and deploy.31:07And the catalyst center is gonna check whether there are any pending operations on the device. If in that case it will pause you know performing this configuration. So once it's done the prechecks, then I'll go on to the next step, which is.31:11You know, provisioning the configuration, right? So we can see the status for both the devices over here and we can choose to deploy the configuration either now.31:28Or we can pick a scheduled time.31:48So now that we've provisioned the devices, we can check the status of the provisioning from here as well as you can go into the details. But as you can see, they have changed from a not provisioned state into a pending state, right? So the provisioning is in progress.31:53So we've seen that the provisioning is successful and on ICE, we can go ahead into administration or network devices.32:14And here we should see the devices being reflected as you can see, if we go into network devices.32:31It will take a little bit of time to sync the device data from the catalyst center over to ice. We are gonna edit the device role from here as well. I'm gonna set this as the border router as well as the.32:47Other one has access. So as you can see in ICE, we can see that both the network devices have been discovered, right? And these have been added automatically.33:06Into here. So in essence, we provisioned the site level settings and that propagated all the AAA information on.33:22A broad set of devices with just a few clicks, right? And without manual entry.33:41The network access devices were also auto synced into the ice portal from catalyst center through the ERS API access that we provided initially, right? So catalyst center just applied the configuration and it synchronized that information with ICE. But what if we need to push more complex configurations, right? So let's look at that.33:47Next.34:07So here in this case I'd like to go through a scenario where imagine your ice server is in a monitor or a low impact mode, right? And in that case, ICE will just discover and profile your endpoints or discover what endpoint is on the network and where, right? And using that as a starting point, let us see how templates and can.34:13List center.34:33How they help you quickly deploy your.1X configuration on switches. And for those who prefer day and templates, you can push complex CLI to many devices at once with zero syntax errors, right? So if you prefer performing IBNS two zero con configuration on your ports, you can use.34:34Both the ginger or the velocity template options.34:54Within catalyst center, you're able to reliably push the exact same dots configuration to hundreds of devices concurrently. Quick note, we were previously asked this so on the ginger versus velocity question and which template option to use.34:58There is NO official recommendation on that. It's a personal preference, right? But both of the options are fully supported, so you can either use the ginger or the velocity option when you're creating your templates. And in this demo I'll show you how you can quickly get started with building a.1X CLI template, right? Here in this.35:14This case it's gonna be a 9300 switch, right?35:34Right go into the menu and then click on CLI templates and we'll add a new project so we'll name it.35:39Dot one x, and then we'll add a new template within the project. And as I said, you can select either of the languages here I've selected Jinja and we can also select the device details, right? Which group of devices would you like this template to be deployed?36:00Done.36:19So I'm gonna select 9300 series switches and then you can also assign a tag to this template, right? So if you are able to easily find it later. And here is where the content of your.1X configuration goes in.36:21Right, so this is all my.1x configuration on a port by port basis, right? And I can go ahead and commit and the template is created, right?36:41Once the template is created, we'll create a network profile so that we map the template to a network profile. So in our case it's gonna be a switching profile and we are going to attach the template that we created.37:06In the DN template tab. We'll name the profile and then attach the template. Select the.1X template. As you can see, it shows up over here and then the profile is ready.37:25For a site to be assigned.37:45So here we'll select a specific site in our case spectrum, so we've created the network profile mapped it to the template, and then.37:50We've assigned the site to it. Now that the profile is created, we are then going to go into the template again and push it on our devices. We are gonna provision it on our devices.38:07So since we have selected 9300 switches as our targeted device group, we are shown all the list of switches that we have belonging to that device group, device series. So we can select the devices where we want to provision from here.38:23And then click on next and you can look into the device by device configuration, right? Whether you want to copy the running config to startup config.38:42You can do that specifically on a device by device basis. So we're gonna run the task now, we are gonna provision the template now. And once.38:59It is done, we will see that the templates have been provisioned.39:19And the.one next configuration is pushed onto your devices. So this is how your port would look after you push the template, right? We have the IP device tracking on in this case the we have.39:23Is enabled the flow control and most importantly the.1X is in closed mode. For this example, right? In closed mode if an endpoint cannot authenticate and if it isn't configured for map, so it simply cannot get on the network, which is why he selected this option. So.39:43In short, we secured the port in just a few clicks, and once a user connects, you'll see that endpoint in ICE, the device name, the authentication policy, the authorization profile, and more. And moving on to the next part, which is the.40:01Device access control policy.40:21Beginning 237, we introduced the UI workflows that can also help you push layer two and.1X configuration on a per port basis without any CLI at all, right? So we just have a UI feature that you can a very intuitive user.40:23A feature that you can select, right? You can select all the settings that you want. You don't have to enter any configuration, but this is just an alternative to the velocity template options, right? We have a click driven alternative, you know, you can push the configuration, the access control policies, the authentication policy.40:42Policies directly from catalyst center without creating the template.41:02And in my case, I have the catalyst 9300 switch and the device is already in catalyst center in a reachable and managed state. So I would simply go into layer two configuration, click on authentication, it would present what is the current status of it right now it is disabled.41:07I can enable it by editing it. So once I've enabled the radio button, I can also enter my trusted configuration from here and enter my VLANs that I'd like to enforce.41:25And then apply this configuration on the specific port that I want, right? So I can select that port, look at all the current configuration, I can right right now I select this, the.one next mode I've changed it to closed.41:43I can also add attributes like host mode and real timer. Here I'm setting it to multi authentication. I have changed the real timer as well, and we can all do this directly from the UI itself, right? We don't have to enter any commands.42:00And I'm also entering the configuration here as well, whether I want the role based enforcement to be enabled or not. And once I push that, it goes through a sequence of steps and it will also show a.42:17As a preview of what is being deployed, how our intent has been translated into configuration, right?42:37So we see side by side view of the configuration that is to be deployed and the running current configuration on the switch. And once we provision that, we will be able to see all the changes.42:44That we pushed getting reflected from here, right? So we go into layer two configuration again, authentication, as you can see.1X is enabled. The trust sec enforcement is enabled, the VLANs are there, and then the port configuration that we applied for this port.43:04Here has also been applied Now that brings us to group based policies. With group based policies, the idea here is to move away.43:22From your IP based access list and use business logic instead, right? So configuring something along the lines of users within an employee group talking to the devices within the confidential server group, right? So things like that are far easier to manage than mapping subnets.43:42So this slide here shows us how Cisco trustsec replaces thousands of individual IP based rules with a concise matrix of groups, right? The ice server handles the assignment of these sgts to users and workloads.44:00Effectively hiding the underlying network complexity. So as you can see from this image on the left, we see that the individual users are abstracted into logical user groups like employees and contractors. This means you NO longer need to write policies for every individual device, right?44:19So you write one policy for the entire group and then catalyst center pushes that the network fabric. On the right, the same logic applies to the server groups, by grouping workloads together, you're able to drastically reduce the number of destination entities which prevents the policy bloat.44:37And in the center is the intent based matrix, so instead of managing complex firewall rules, we can simply define the relationship between a user group and a server group, right? As I said, e.g., contractors can only access general access servers, right? So as simple as that.44:56So Atlas Center acts as the single point of management to deploy these group based policies across your entire network, and that ensures that the access contracts between the security groups are enforced consistently regardless of where your user or the server physically sits.45:14So how do we sort these devices into groups? The core idea here is to move away from a network centric security where we are worrying about IPs, subnets, right? And we are then moving towards a business centric security.45:33As you can see in this example, we categorized everything from contractors, building management systems, manufacturing robots, and finance servers into logical groups, right? We leverage Cisco eyes to look at the who, what, and where.45:51And by pulling data from sources like Active directory, device profiles and location services, ICE automatically assigns the scalable group tag to that entity. And the beauty is that this is independent of the topology. So once you have a device tagged, the security identity follows it.46:08Everywhere.46:28So in cases where you have a printer moving to a new floor or a contractor logging in from a different building, right? The policy will still remain consistent. And with catalyst center, we can then easily manage these groups to ensure that our business intent is informed, enforced unified.46:29Probably across the infrastructure.46:49The common question that we get is where do I manage my sgts, right? The answer is both but for different reasons. So the catalyst center gives you the what, meaning the business intent, so you can use it for your macro segmentation, you can use it to define your business level groups and also to visualize.46:55Is how the traffic flows across your network.47:15Ice on the other hand gives the how, meaning your enforcement logic. So you can use it for your granular authorization in cases where you are needing to create complex conditional rules, right? E.g., a contractor can access finance only if the device is complaint, right? So that is going.47:18To be a nice rule.47:38So you can define your groups in catalyst center, let them sync with ICE, and then you build your deep dive rules within the ICE. One note on the scale, the SGACL limits are platform specific as a rule of thumb stay well under roughly 48 to 64.47:40Access control entries for SGACL and also check your platform docs for any specific limits. Now, to get started with using trustsec, we navigate to the catalyst center UI.47:59We click on provision and then group based access control. And when you're configuring this for the very 1st time, you need to trigger a migration of the existing policy data from your ICE instance over to catalyst center, right? After that both will stay in sync and the policies will flow both ways.48:15And if you later decide that the eyes needs to be managing the policies, you can make that setting by going into the group based access control configuration. For those migrating many existing security group ACLs between the same two groups.48:34So in case you need multiple contracts between one source and destination pair, keep the group based access control set to ICE and manage it over there because catalyst center allows you only a single contract per pair. And after the migration is successful, the 1st step is to.48:51Go into the security groups, which is their 3rd tab.49:11And this will list the current set of groups and their associated tags, the descriptions and the policies that they are tied into. So in this demo here, e.g., we'll look at how we can create two new security groups and we'll see how we can deploy them into the fabric door.49:16I mean.49:36So we are gonna create one security group for contractors, name it as SG_content, and then we'll create another one for our servers, IoT.49:42Devices. So once the two security groups are created, we can see them displayed over here, right? Along with the tag values and we can deploy it now to sync this data with ICE.49:59And similarly, we can create an access contract as well to define the relationship between them. You can create one contract of say web access only and you can apply that to many group pairs. However you you need to be specific for sponsitive groups or.50:18You can also apply broader contract for general the general ones. For our demo here, we created a new access contract called as NO ping and that is to simply block ICMP traffic. You can add more rules to this list and specify them all.50:36Over here, just like the standard firewall rules or ACLs, these will be processed in a top down order, right? So the network will evaluate the packet against the 1st rule. If it doesn't match, it moves on to 2nd one and so on. And if it hits a match, it takes the action permit or deny.50:56And it will stop looking further. And if a packet doesn't match any of the rules you've defined in your contract, it will be dropped by default. You can change the default action to permit as well. And that helps you keep your matrix clean and it will also let you build a reusable library of contracts.51:13That you can apply across.51:33Many group pairs. So, so far we build the two security groups for the contractors and the IoT devices. We created access contract called as NO ping that blocks the ICMP traffic. In this slide we are looking at the policy matrix, which is one of the biggest benefit of this.51:35Integration, so here you are able to see your entire security posture as a grid of groups as you can see on the left. So firstly, we have a simple and straightforward example. We'll build a policy to apply the low ping access contract between the two security groups that we created.51:55So as you can see, I'm gonna select the matrix between the SG car and DSG contractor group. And here I can select our rules and then apply.52:19Similarly, we are gonna create one between the contractors and the carp where we are gonna block the ping. And on the right, as you can see I have a ping running in the background, and when we deploy these changes, we'll see that the ping is blocked.52:37Yeah ICP the ICMP traffic is blocked. We can change back the contract, right? We can click on change contract.52:57And set it to default and that will disable the policy and we can push the changes.53:15By clicking on deploy now, and once we do that, we can see that the ping is back into a running state. So what we've seen as a result is we can enforce East west traffic restrictions directly on the switch.53:35Are using access contracts?53:55And that completely eliminates the need for firewall here pinning or even having to create your complex access controllers. This slide here highlights 2nd major benefit of this integration. This is the policy analytics and catalyst center.53:57This offers a sankey diagram, a visualization of the flow data based on the security groups, the rice profiles as well as the stealth watch host groups. So in our case, we are able to see where the traffic flows involving the contractor security groups and the corporate corporate security groups are occurring, right? So.54:15And if you see the traffic flows, you know that these groups are actively being used and enforced on those specific segments of the network, right? And you can also click on this filter button on the communicating with filter to select only one of the group types for further granularity.54:35You can see exactly which groups are talking to each other even before you enforce a block policy. So what does this all deliver? We are talking about three massive shifts in how you manage your network. Firstly, NO more firewall hairpinning.54:54And traditional networks you often have to route traffic all the way to your central firewall just to check if the two devices on the same floor should be talking to each other, right? And with trust set, we enforce that policy right at the edge on the switch where your device is connected, right? So we keep the traffic local and the.55:12The security type.55:32Secondly, we NO longer manage thousands of lines of ACLs. You don't have to worry about IP addresses, subnets or complex access control entries that break every time someone moves a disk. We've replaced that manual error prone complexity with a simple logical model.55:34And thirdly, we have a true East west enforcement by using group based policies, you can restrict lateral movement between users, servers, and IoT devices, and that helps you effectively top a threat from spreading if a single device is compromised.55:53And finally, this is the policy matrix. We were looking at this earlier, so instead of a CLI or a spreadsheet, you have a visual grid. You can see your source source groups on the left, your destination groups on the top, and you can simply decide the relationship in the middle.56:13From this matrix, so it's simple visual visual and automated. Now that we've looked into trust sec, we made segmentation easier and we've secured our users so far, but what about the devices that we don't know, right?56:30So let's talk about endpoint visibility. So before I get into endpoint visibility, I'd like to share what comes into catalyst center through ICE because center is the PX grid subscriber. It ingests real time authentication data from your ICE server, right?56:47So if a user cannot connect, you don't need to dig through the eyes live logs. You can open your client 03:16 catalyst center assurance and you can instantly see if they failed a.1X authentication, what their Mac address is and what SGT they were assigned. So it acts as your single pane of glass for.57:05Troubleshooting your clients. And just as ICE was able to use EX grid to notify services about new endpoints, ICE can also share an endpoint group based policy information with the IP to SGT mapping.57:26Now, today's workplace is full of unmanaged devices. We have a roughly one to five ratio of managed to unmanaged devices, right? Most of these devices are often unpatchable, they are unencrypted and they're easy to spoof.57:45So if an attacker mimics the MAC address or the DHCP attributes, they can bypass your traditional security and can gain unauthorized access. So that's why we use AI and point analytics, right? So by combining the packet inspection, telemetry and ice probes, we accurately classify.58:01These unknown devices and then assign them the right SGT. So even an unmanaged device stays isolated, monitored and protected.58:21And another thing to consider is what we can do about the unmanaged assets, right? So if we look at this slide, we see a clear divide. Our laptops and managed devices are secure because they're using.1X which is robust credential based authentication.58:34But for our IoT devices, e.g., a smart thermostat, they don't have a supplicant to provide those credentials. So they are they fail.1X and they fall back to Map or Mac authentication bypass, and Map relies on a Mac address database and which creates two problems, right? The 1st is the catch up.58:49All risk.59:09E.g., where an IoT device isn't in that database, isn't in the MAC address database, we often default to a catch all policy just to keep the business running and that's a massive security gap. 2nd is the risk of spoofing. Now, as we discussed Mac addresses can be easily spoofed. An attacker can.59:10Simply clone a known MAC address and the network could blindly grant them access.59:30So we need to make map secure and smarter. So moving from a trusting a Mac address to verifying the device through deep profiling. We've established that the map is a necessary email, but we also need to be clear of why it is dangerous.59:36The MAC address must not only be, not be our only source of truth.59:56As you can see on the left, the Mac spoofing is trivial. The attacker doesn't need any special equipment, they just need to clone the Mac address of an authorized device. The network will treat them as a trusted member of that group. But it gets worse, right? On the right we see the attribute spoofing where the attackers are getting smarter, they.01:00:02Know that the modern security systems look at more than just the Mac address, but they also look at the DHCP headers, vendor strings and the device classes, right? So in this case the attacker doesn't just copy the MAC address, but they also spoof the DHCP class ID. And by mimicking these attributes.01:00:21They trick the profiling engine.01:00:41Into classifying them as a trusted device type. And that is why we need to verify the behavior and context and not just what a device claims to be. And that is what our next features are going to solve. So we solve impersonation with AI and point analytics. The goal is.01:00:43Simple here moving from a network of unknowns to one where every device is identified and trusted.01:01:03Though so catalyst center acts as a hub, it pulls information from many sources through deep packet inspection, telemetry probes, and even your existing CMDB records, right? So it runs all of this through machine learning to produce a definitive profile.01:01:10And while it does work locally, we strongly recommend that you connect to the Cisco Cloud based intelligence. By leveraging the cloud, Atlas Center gets updated with the latest global device signatures.01:01:28Ensuring that even the new IoT devices hitting the market are recognized instantly. So in short, we take an unknown on the left, we feed it through the catalyst center intelligence engine and get the known device profile on the right.01:01:43So this is how we turn a bypass into a secure validated connection. And moving beyond the Mac address trap, we need a deeper level of intelligence. So we need to learn four distinct factors for every single endpoint on the network. We call this as the.01:01:59A multi factor classification or MFC. So instead of just a Mac address, the device profile is now built on four pillars, right? One is the device type, whether this is a laptop, thermostat or a smartphone.01:02:19Who built the device, the hardware manufacturer, and what is the specific model number and the operating system, right? What, what software is it running? And all this power comes from shared intelligence. The the ICE as well, you know, shares what it learns at authentication and Atlas center.01:02:32By itself adds rich deep packet inspection and telemetry data. And in your industrial networks, you can even integrate this with your cybers vision, Cisco cyber vision for your OT fingerprinting. And here is where profiling becomes true intelligence through.01:02:51Do inspection powered by the SDAVC agent also.01:03:11Known as nbar. So when a device connects, we do 1st packet classification, taking the 1st packet against the cache because most flows are predictable, this gives an instant answer without wasting your CPU resources. But for the unknown devices, we trigger a deep packet inspection.01:03:15And here, our protocol engine looks at the fields across different layers. We use N bar to identify the endpoint type itself. The engine reads protocol fields to identify the device. E.g., if it sees the, if it sees that the device is running the dicom protocol, it flags it as a medic.01:03:33Scanner, then confirms it with related protocols, right? And these hints are stored in a device table and synchronized in real time between the switch, the catalyst center, and the ICE server. And if the device behavior changes, the probe updates and.01:03:54The system sends those updates to endpoint analytics immediately. But what about the total unknowns, right? Our machine learning engine that devices share traffic patterns and groups them into clusters?01:04:13So similar to the green and the gray groups that you have here and this is where you come in, right? You label the green cluster as smart thermostats and the other one as smart lights and then the machine learning takes over. It learns those patterns, validates them.01:04:29And the next time a similar device connects, it labels them automatically. So the system gets smarter, the more you use it. So that helps you reduce the unknown sand manual work. And crowdsourcing take this further, right? So e.g., if you had multiple catalyst center deployments around the globe.01:04:46When your EMEA deployment learns a new label, it's shared securely with the Cisco AI cloud. The cloud acts as the global brain. It validates and improves the profiling for everyone. So when a similar device appears in your Asia deployment, the cloud instantly suggests that.01:05:06The label EMEA had already thought it, right? So you benefit from the collective learning of the entire Cisco community. You don't have to manually profile every single device type that enters your network. Instead, you're leveraging the work done by other admins around the globe.01:05:26Making your network smarter, faster, and more secure. And once you enable endpoint analytics, you also unlock an additional dictionary within ICE, and this is called as the endpoint analytics dictionary.01:05:43This includes the device info as well as the four endpoint analytics attributes, right? The device type, the manufacturer, model OS and the trust score. And all of them you can use directly in your authorization policies.01:05:59Right, so in addition to the attributes, the device type, the manufacturer, the OS, we also have the trust score now. So here a trust score or 6th or higher gets the good SGT, right? The but if it is untrustworthy, so here.01:06:16Here, e.g., if we have a trust score that is less than six, it gets a different SGT.01:06:36Right, and that is how we can define our ICE policies. And coming to enabling the endpoint analytics, it takes three steps. The 1st step is to activate C bar on your switches Enable the enhanced bi directional ICE integration.01:06:42So both share the profiling data and then turn on the AI network analytics for the cloud machine learning engine. The cloud piece is optional, but it is recommended since you'll have more granularity in identifying the endpoints.01:06:59So some of the prerequisites that we need to ensure for this enablement is the ICE is integrated in the catalyst center, which you've already taken care of. The AI settings need to be enabled in catalyst center for your endpoint analytics and tailors.01:07:15The C bar needs to be enabled on your devices and we also need to ensure that the catalyst center is connected to Cisco Cloud. Although it's not mandatory, it is always recommended, you know, for better features. So the 1st step is activating the deep packet inspection, so.01:07:32So here in this case C bar is similar to n bar.01:07:51So the C stands for controller so catalyst center is managing all the the function on all these switches, and from 237 this feature is enabled for devices by default when they're added to a site. You can individually enable C bar from provision and application visibility and.01:07:56The device role needs to be accessed for it to be ready.01:08:15And you can also update the protocol pack with the latest signatures from here. 2nd step is to enable enhanced ICE integration. So we did the integration, but we also need to enable the enhanced integration that acts particularly on endpoint attributes.01:08:19Groups and profiles. So that means we need to share the profiling information, right? So just by turning on these two options, we can take care of that. The one for forwarding the attributes from ICE and one to publish the endpoint attributes over to ICE.01:08:39And the 3rd step is to enable the cloud integration, right? So this is there is a global switch called the AI network analytics and that is like a transport pipe between the catalyst center and the AI cloud. And once you've enabled this, you can choose which additional functions you want to enable, be it the endpoint smart.01:09:01Grouping are the AI spoofing detection and as you can see, you can also select which data center that you would like to use.01:09:21If you have a stricter data residency requirements. So let's look into a demo of how you can enable the endpoint analytics feature in catalyst center and get started with it, right?01:09:30So here I'm in the homepage of my catalyst center, right? And, ideally if I had endpoint analytics installed I would have a widget showing up here for endpoint analytics, but since I don't have it installed already, I'm gonna go into system.01:09:51And software management, I'll have to download the endpoint analytics package from here, right? I can go ahead and select it and install.01:10:08And once the installation completes.01:10:28You will be able to see the AI endpoint analytics showing up in your application catalog, right? This is the version that we have right now, and then when you go back.01:10:35Get into your homepage that you see a new widget appearing where you can set up your AI endpoint analytics feature and before we enable the endpoint analytics feature, we are also going to.01:10:55Enable our AI analytics option. So for that we'll go into settings, external services and then Cisco AI analytics and here we can see that I've already enabled my.01:11:14AI network analytics toggle button. I've also enabled the AI enhanced.01:11:33And as I said, you also have the AI endpoint analytics feature which are the grouping and the spoofing detection as well that you can opt into. And once you select that, you'll have to accept the agreement.01:11:41And it will test center will reach out to the cloud, test the connectivity, and as you can see right now, my instance is connecting to the US East instance of the cloud and we'll go back to.01:11:59The catalyst center homepage and.01:12:19Click on setup AI endpoint analytics and these are the prerequisites and configurations, right? So we need to have a 909K series access devices and the telemetry appliance running 1731 or later.01:12:21Right? There are also requirements about the ICE versions. So there is also a deployment guide a hyperlink in the bottom right it links to a community post, a Cisco community post where you have useful information about setting up this feature. I suggest you check it out as well.01:12:41And when you click on configure, so these are all the prerequisites that we need to make sure are selected, right? So one we have the DPA enablement, then we have the ICE configuration, and then.01:13:03The AI analytics integration. So since we've already integrated with ice, that has been checked off and also the AI analytics integration which we have selected all the toggle buttons to connect with the AI cloud. And then the 3rd step is the DPA.01:13:18The enablement, the C bar enablement. So as of now, I have the C bar status as disabled on my switches. So I can go into application visibility setup for which we have a direct hyperlink provided here and that will take us to the application visibility page.01:13:38And here I can click on the network devices enablement tab Select the switches where I'd like to deploy or enable C bar, and here you can also look at the list of interfaces that are selected where the C bar configuration will be.01:14:01Apply.01:14:21So you can go ahead and apply, apply the C bar configuration. It will go through the pre checks then the workflow of enabling C bar.01:14:29And here, you can see similarly to the other templates, you know, we can see the configuration that is being deployed as a part of the C bar configuration, right? So we can have a comparison of the running configuration to the one that is being currently deployed over here.01:14:48And once I've provisioned C bar, I can check the status of it from tasks and see that the enablement is successful and in a few minutes, this will.01:15:15The enable status for this will change to enabled, right? Will take a little bit of time for the configuration to be applied. And once that is done, as you can see, the C bar configuration has been applied.01:15:33Right successfully, and here we would be able to see the C bar health, the device health C barrie so as you can see.01:15:50So now we have a hundred percent status shown up for the C bar enabled devices.01:16:10And if you go back into the workflow as well, you would see that the C bar is enabled and in the homepage, we can see that the endpoint analytics data is being populated. So you can click on view details and that will give you more information on endpoint analytics.01:16:17And look at the configuration, what is your current status of C bar ice configuration, you know, whether you have enabled them all or not. What are the optional configurations, right? You have the tailors, IP reputation that you can also enable.01:16:38ServiceNow security sensor, and then you have the profile rule settings, the ice configuration, so these are the settings that we enabled previously, the endpoint attributes forwarding as well as the publishing. Then we have the trust analytics as well.01:16:54So we can look at those individual settings from by clicking on the configuration here. There is also the endpoint purge policies, so this can be used if you want to delete any old endpoints on a scheduled basis.01:17:13We have the subnet inspection as well. And this is how the data would appear right and this is how you would see all the data in your AI endpoint analytics dashboard, how many of the device endpoints are partially profiled fully profiled and how many of them are unknown. You also have the trust score option which lets you know, you know, what is the score that.01:17:32Center was able to calculate for those endpoints. And you can also look into the reason of the reason of why we have that trust score for a specific endpoint. So as of now, the trust score, the trust analytics.01:17:52Are relying on the authentication method and the posture, you can look at the partially profiled labels, the endpoint type.01:18:12You know, based on the hardware manufacturer, the model and the OS time. So as I said, you can look into the individual endpoints, see what is their trust score and why did it receive that trust score, so here in the trust score tab you get to see all the endpoints and you can click on them individual.01:18:29And go into those details.01:18:49We also have the endpoint inventory tab where we see all the list of our endpoints that were discovered, the endpoint type, the OS that they're running, the hardware model along with the trust score, right? What type of a machine is it?01:18:55And then you can select these endpoints and profile them with a custom rule as well, and in the trust score tab, you can look at the.01:19:19Current alerts that are configured, though you have the profiling rules as well, the current set of profiling rules that are in place and look at how our endpoints being profiled according to the rules that we have.01:19:39And then the hierarchy as well, so you have a varied set of endpoint types over here in the hierarchy.01:19:58And even detect concurrent Mac addresses, meaning if someone is actively spoofing a device on another switch port, it can flag it as a critical anomaly, right?01:20:19And this is an example of AI spoofing and how it is detected, so as you can see here, in this specific case, the trust score goes down due to the concurrent Mac address symptoms, right? In the network context. And we'll have more details into it from the endpoint analytics dashboard.01:20:32And as you can see, we are shown with the details of board devices over here. So let's talk a little bit more about trust monitoring as we've seen catalyst center calculates a trust score for each of the client from a one to ten score, right? So the higher the score, the higher the trust and.01:20:50And if the score is dropping, then it is because of the anomalies. So there are positive influences which increase the score like secure authentication methods such as.1X or the posture complaints which is based on ICE, right? But then there are also negative influences that drop the score, right?01:21:10E.g., NAT mode detection, if you run a VM or containers that are natted behind your host IP, e.g., right? So that would be a negative influence. Then you have the Talos IP reputation. So since Talos maintains a list of bad IPs.01:21:30And if a client is accessing these IPs, then the score would drop. As we've seen it can also identify the concurrent MAC addresses. The other reason it would go down if the attribute labels change over time that is also considered a negative influence.01:21:45And then we have things like weak credentials, max spoofing, open port scanning, right? So those are a few other factors that can bring a score down. So here firstly I have a positive example. So imagine a user here is using a secure author.01:22:03Authentication method.1X method with his devices and his devices get a score of eight. So his devices are posture compliant and and that is the reason the trust score goes up to ten. This means that the user's devices are trustworthy and NO anomalies have been detected over here.01:22:23But if a device starts hitting bad IP reputations flagged by Cisco Talos, then the trust score plummets to three, right? So here as we can see the being supplemented by the Talos IP information and if Talos IP suggests that this is low trust, the trust score goes down.01:22:43We'll see that reflected in catalyst center and point analytics.01:23:03And this is where as we've seen in the trust score tab, we will get the details of the trust score for that specific endpoint. You can go to endpoint analytics dashboard, go into trust score tab, and you get all the list of endpoints along with the trust scores. And when you click on the score, it will give you the factors that have gone in.01:23:08To deciding the score.01:23:28And as I said, if an endpoint has authenticated securely via.1X pass the ice posture, then we'll see a perfect score often which we are having an example of here. And in this demo, we can understand more details of how you can interact with.01:23:30Set of scores in the dashboard. In general circumstances, your eyes need to be set up for adaptive network control policy or the ANC policy for you to be able to do this in catalyst center, but.01:23:49Thanks to this integration, you get full visibility within catalyst center while ICE is taking care of the head containment. So we'd go into the menu button and then click on policy AI endpoint analytics.01:24:03So this is what we were seeing previously, right? It's similar to the previous demo. So we have the endpoints listed over here and their 1st scores are classified based upon their scores, the range of their score, and you can click on the ones that are running a low score.01:24:22And understand the reason behind it by looking into the specific endpoint. So if it's a random Mac, we get all these details over here know what is the trust score, what is the IP address? What was the authentication method here in this case, this was a wired map.01:24:39So that is one other hint, right? And AI spoofing detection has detected this as a low trust endpoint. So we can click on the Mac address, you'll get more details. You can go into the trust score tab and see what was the context that endpoint analytics used to calculate the score.01:24:57What was the authentication method, the posture, and what was the threat that was detected, right? So we.01:25:17Found you know the pattern of AI spoofing, right? So the expected endpoint type, although it was an IP phone, the active applications that were running on this agent there something abnormal. So we can go ahead and apply the ANC policy.01:25:26Adaptive network control policy over here directly from catalyst center. So we can either choose to quarantine or reauthenticate this endpoint center is continued.01:25:44Managing the trust score based on the client behavior, so if the attribute started changing or if the endpoint was accessing bad IPs, then the trust score would decrease.01:26:04And this creates a fully automated closed loop security architecture, right? So catalyst center detects the anomaly, it tells the ICE server and the ICE then issues a radius change of authorization to instantly quarantine the threat.01:26:14And as a part of this process, it would apply a different SGT, right? Which would give it the access policies applicable to this SGT, right? And that is where the integration truly shines. So ICE uses your adaptive network control to act.01:26:29Meaning quarantining.01:26:49Your endpoint or you can do a port bounce or a shutdown. You can do this manually from the dashboard or you can also automate it through the ICE API, right? One practical nuance here is that your quarantine and shutdown do not need a permanent authorization policy.01:26:52But for reauthentication and port bounds, you do require authorization policy right to land the endpoint correctly. So that brings us to the end of our session. We looked at a lot of things to wrap up. We let's look at the transformation we covered.01:27:10Today we moved away from manual brittle security to dynamic group based architecture by integrating catalyst center and ICE, we've replaced thousands of static error prone ACLs with dynamic group based architecture that secures your users and devices wherever they connect.01:27:30We've turned your network into a living sensor using AI endpoint analytics to identify and protect the unknown in real time rather than just reacting to the threats after they occur. So you now have the power to define your business intent and let the network fabric and.01:27:49Build the enforcement. So the tools are here, the integration is proven and the path to a simpler and more secure network is.01:28:09So this slide lists for previous session recordings are upcoming events and resources. We suggest you please visit our expert inside catalyst center portal. We'll drop this link in the chat now.01:28:22And if you would like one on one guidance for your environment or customer success team is ready, so please feel free to reach out to us that on the email that you're gonna share. I know this was a lot of ground to cover. We covered many features, I really appreciate your patience today.01:28:33When the session ends, the short survey will appear so we'd appreciate if you can take 2 min of your time to complete it as it can help us shape our future sessions. Thank you everyone for taking time out of your busy schedules to attend our session. I hope you have a wonderful day.01:28:51