Day 1: Mastering ISE Profiling

Good morning, everyone. Thank you for joining us. Today we are going to start our journey with the zero trust breach expert inside series.00:09This is two days series and today is the 1st part. The today's session is focused on mastering ice profiling. We want this session to be really interactive, so feel free to ask your questions in the Q and A panel. Just make sure that you select all panelists when you are.00:18Asking the question before you hit send button.00:38And let me introduce the team for today on presenters side we have Farik, Henry, Tatiana, and Emmanuel, and from the panelist side we have Surendra, Tarek and myself.00:43And before we start, we would like to share a few words about who we are and what we do, why we are here today. We are all part of security customer success group, where we try to help you with adoption of the products that you already invested in. And we achieved this through a range of services inclu.01:04Including adoption consultations, health checks, accelerators, and expert insight series.01:24Today's webinar is exactly part of expect inside series offering we have. We really value your feedback so we are keen to understand what kind of topics you would like to see next. What would you like us to cover? So please.01:31Take a minute by the end of this Webex session and fill in the survey, let us know what would you like to see, what kind of topics you would like us to cover, and quick peek into agenda for today so you know what's ahead of you. We'll start.01:46Quick overview of ICE profiling, then Henry will talk about traditional profiling using certainty factors. Then we will have a 15 min break, and after the break Tatiana and Emmanuel will talk about smart endpoint visibility with ICE 3.5.02:06And without further ado, let me hand over to. Thank you, Veronica. Hi, everyone. Over the next few minutes, I would like to walk you through an overview of the ICE profiling, specifically how profiling help us to build a complete picture of every.02:23Device connected to our network.02:44The core idea here is simple, it's just authentication alone isn't just enough anymore. Let's think about the landscape of the modern office, right? In the modern office, we have IoT devices, printers, cameras, medical devices. These endpoints.02:46Don't have a user stealing as a keyword to provide credentials.03:05Or they often offer little identity information on their own. The profiling is essentially a way to classifying those devices so we know exactly what they are, even when they can tell us themselves. Let's look at what the network actually.03:09Before we implement profiling.03:31We have a lot of unknowns. We are essentially working in the dark. We probably will be able to see MAC addresses, IP addresses or even billing assignment, but that's about it. From the operational standpoint, this could create, you know, real headache or security teams are ***.03:33Potentially flying blind because they don't know what is exactly on the wire.03:53Or network team likes of context, which means our authorization decisions, they are really genetic and we are just basically guessing what happens when something goes wrong?03:58Troubleshooting is just a namer because we are doing reactive troubleshooting instead of doing data driven troubleshooting. The fundamental problem is that the endpoint identity is just fragmental.04:13We can see that device is there, but we don't know if that device is a printer, if that device is a managed laptop or that device is an IT, IoT sensor. We don't know the OS or we don't know what is this device doing on our network. This is exactly where ICE profiling.04:28And change the game. Profiling help us to move away from just seeing raw data and start building a comprehensive identity record by continuously correlating different attributes. So.04:48How do we actually break that visibility gap? This is the 1st major step in our revolution. Moving from unknowns to knowns. At this stage, the endpoint isn't just a stranger on the network anymore.05:06It's because ICE start acting like a detective, it starts gathering telemetry from various sources. The key concept here is that attribute correlation, it's important for us to understand that ICE is just.05:21Look at one package and you know it makes it it doesn't make a snap decision from one package. Instead, what is doing or every device is some sort of opening a file for that device are collecting tools from that device and the more data tickles in.05:36The profile gets richer and more detailed information from that device.05:56Once we have enough information, the profiler engine checks that data against our policies and classify the device. You know what the best part is? This is completely dynamic. If a device changes behavior or we receive new information, ICE updates the classification on the fly. It's just a self improvement.06:00In process that becomes more accurate, the longer the devices staying on our network.06:20So where does this lead us? This is what we call a mature state of profiling. At this point we move past simply collecting raw data to successfully build a rich and meaningful identity for that endpoint.06:29Instead of just seeing an IP address on the screen, we now have full context. We know exactly what that device is, what that device is doing, and what is the role in our network. When you have this level of visibility, you stop managing individual connection and start managing policies.06:46You can confidently say this is a printer, this is a unwanted device, this is an IoT device and you start you know making and creating a specific right access for each device. E.g., if you have a corp.07:06For a laptop, then you can give.07:26A good level of access rather than a printer, right? But what is exactly the definition of profiling? At its hard, profiling is just a service that dynamically classified the endpoints.07:29The moment they connect to the network. It's not a static list that have someone you know manually updating. This is just a living breeding classification process that happens during the authentication. But to really understand it.07:49I want to talk about what is context. When we talk about context in ICE, we are really talking about the who, the what, the when, the where, and so on. All this information.08:07It's just a collection of data that allow us to move from just seeing a MAC address to have full identity. On this slide, I want you to see what is the comparison between a bad context.08:23On the left where we just essentially flying blind. And on the right we have what we consider a good context, but we have rich and granular data we need to make smart and automated decisions. As you can see, the more data we collect.08:39The more real that device becomes to our security policies. But how do I actually gather all this context? As you can see here, there are several methods at our disposal and each of them play specific roles.08:561st, we have the standard probes configuring directly on ICE. These are your bread and butter collection methods. Second, we have the what we call the device sensor. Device sensor is.09:15Part of our network devices and give us visibility right from the access layer. We also have the Accidex which pulls granular telemetry directly from the Cisco secure client and finally the feed service.09:33This is a critical piece of the puzzle. Why? It's because ICE regularly pulls updates to its profiling database and it's bittle because new devices types are hitting the market every single day.09:50Without this update, your profiling accuracy will naturally degrade over the time. The big takeaway here and well thing that I want you to remember is that profiling is cumulative. The most successful deployment, they don't just rely on a single probe. They come.10:05Wine.10:25Multiple sources to build the most accurate and reliable picture possible. But how do actually we turn the profiling on? The heavy lifting for profiling happen on our psns or the policy service notes? And if.10:28You think about it, it makes perfect sense because the psns are your, let's say front line of your deployment. They are the ones interacting directly with your network devices and the traffic coming from those endpoints.10:46To get started, you will just need to head over to the deployment section in ICE, go to your node configuration select the PSN and find the policy service toggle, make sure it's enabled. You also need to make sure the enabled profiling service checks box.11:01Is is checked, right? Once you're in the probe configuration screen, you can select exactly which probes you want to run based on your network specifics based on your on your network specific. Just a quick heads up here. ICE comes with several extension.11:18Probes.11:38Enabled by default, so you're actually getting some visibility right even from the box, even when you haven't start customizing your probe selection. But if there is something.11:39I want you to take away from the probes. It's that the probe selection is a critical decision you have to make. Why? It's because usually it's tempting to.11:58Turn everything on to get the maximum visibility. But this is actually a common pitfall. Enable every available probe can quickly lead to excessive traffic unnecessary load on your PSN, even flood of duplicate data that metro was.12:13Shooting a nightmare rather than help you. So instead of turn everything on, just be strategic. Your prop selection should be driven by your specific of the your environment. E.g., what devices are actually in your network and what does your network looks like.12:33And what's your scale. If you want more information on probe selection, profiling best practices or even profiling in general, we encourage you to review your profiling design guide. You will see the link in our chat.12:52And that covers the profiling overview. I'll turn over to Henry, who is going to take us through the specific of traditional profiling. Henry, the floor is yours. Thank you everyone. Oh, thank you very much for it. So good morning everyone and thank you for joining us this morning.13:09I'll start by sharing my screen. Okay so hopefully you can see my screen. So Fari just kind of set the the scene for what I'm gonna be talking about. So just gonna, you know, go over, you know.13:29I means already covered, why do we need profiling and what does profiling does for us? I'm just touch it briefly. And then we're gonna dive into how ICE handles profiling. So we're gonna look into the probes. We're gonna look at the profiling conditions and policies and how ICE leverage those different.13:47And tools to profile a device. So including things like COA exception actions, feeds and purch, which is.14:07Some of the, you know, good housekeeping stuff that we need to be looking into. And then hopefully we'll end up with a demo. So fingers crossed, I've got a live demo lined up. So usually these things go very badly, but hopefully this time right.14:15Everything would work. Okay, so far it's covered about why do we need profiling, right? Turned it unknown into known visibility and all that stuff, right? So here's a question for you guys. Do you know about every devices that connects to your network, right? Do you have visibility of what it is? Are they.14:33Managed device unmanaged device, and do you have the capability to.14:50Remove those devices off the network if they are misbehaving. Do you have that capability today? And for those of you who's already got ICE deployed in your network, after this call, just go on your dashboard and look at what's in the unknown.14:58See if you're comfortable with that number, right? And this is a screenshot I took from other customers I work with, and that 61 % of devices unknown out of hundred and 30000. That's over 80000 unknown endpoints in their ICE database, right?15:15Now, I know one of some of you guys will be like, oh, Henry, but this could be, you know, randomized Mac address, junk Mac addresses, guests, you know, guest endpoint and stuff like that. And I would say, yeah, yeah, that's probably it but you know.15:31If we take a look at, you know, how zero Trust guides us with these sort of things, right? From a zero trust perspective, right? We are always told, you know, never to assume and verify, ok? And this is what profiling is gonna help us. It's gonna help us verify, you know, at least learn about what those devices.15:46Are and class classify them, ok?16:06So, that being said, let's take a look at the profiling step in ice. So 1st thing that ICE we need to do and touch on probes. So and ICE needs to get information about those devices in order for it to.16:10Start making decisions. So information will come from probes and we'll we'll look at the probes. So this will be endpoint attributes, which then ICE will feed that into its profiling engines and then we'll match those against profiling rules. Now profiling rules, Cisco provide a lot of them, out of.16:27The box and we can also create our own custom profiling rules.16:46And those rules would accumulate, and we can nest them together and then eventually they will fit into a profiling policy, which then in turn, oh, where's my, where's my laser pointer? One sec. So which then feeds into a profiling policy.16:50And that profiling policy which we can then assign to an endpoint, we can then leverage that in our authorization conditions, right? So in this example here, we can see that if the endpoint policy equals to a Cisco device blah blah blah, Cisco error net 1815, then this is our authorization profile, right?17:08And then we can without authorization profile, we can do all sort of things like we can send, we can assign the SGT if you want to do, we can send we can do dynamic VLAN assignment, we can do you know Docker and all that sort of fancy stuff that you guys are probably already very familiar with.17:28Okay, so let's start looking into the probes itself. So the probes is what's gonna bring those attributes into ice. So as already said, so this is probably a similar slide that what showed earlier. So.17:47Profiling is enabled on your PSN, so these are your policy service nodes, ok? Now, it is recommended that if you have multiple psns in your network, that the profiling configuration is.18:05You know, is identical. Now there's a caveat to that, right? I understand that not every PSN is doing the same job in a network. You know, some psns could be doing, you know, device admin only and there's NO need for us to turn on the profiling engine. And that's fine, you know? And there could be.18:22Psns are sitting in a customer's DMZ only handling guest traffic e.g. and you know you can argue whether we need to be doing profiling on guest endpoints, you know. So yeah, so profiling is enabled on your psns and.18:41Each PSN will have its own profiling configuration. Now, if you have a bunch of psns in the cluster, and they all handling regists traffic and you kind of doing load balancing between those different PSN, then yeah, ideally you want the profiling configuration to be identical.18:59Okay. So these are the profiling engines that we've got. So so the ones that's turned on, so DHCP, HTTP radius, AD, SNMP query, and these are the ones that's enabled by default, right? And.19:18In most cases, this should be plenty for all your profiling needs, right? They should give you, you know, 8085, even 90 % of all your profiling needs, right? Unless you've got some very exotic devices or some really old.19:36IoT devices, then, you know, maybe you can leverage some of the more active probes, you know, such like, I don't know the thing like maybe sending netflow over to ICE and, you know, using Nmap and stuff are even DNS, you know. So let's look at some of those. So NetFlow.19:54So netflow, well, by default, you know, you just configure some netflows or ICE I think from three.three we support version nine so you configure your flows, send it to ice, ICE ingested the netflows, and then you can leverage those attributes that we learned by next.20:13Flow in our profiling conditions. Now, now this is one to be very careful with, right? Cause you can very, very easily overwhelm your psns if you start standing, you know, a large number of flows to those, right? So ICE is not really.20:33You know, design for this but it is useful in very niche cases, right? So the next one DHCP DHCP now is a very easy and cheap probe for you to configure, right? So you configure and I've got a slide about this actually after that, so you basically.20:52Add your PSN as an IP helper and then, you know, ICE will get res receive requests DHCP requests. It won't respond to those DHCP requests, but you will look at those DHCP messages and then try to extract attribute from those. So this is a very quick one and very useful one.21:12So DHCP span is where you're gonna create a span port on one of your routers or switches, and then, you know, start sending span traffic over to over to, to ICE. I've not seen one of those being used in production again.21:31And, you know, if you cannot use IP helper, then maybe this would be a good one for you for you to use.21:50The next one HTTP, so HTTP becomes useful, you know, mostly for devices accessing ICE via the portal. So, the central web authentication portal, you know, our sponsor portal, our AUP portal, you know, all those portals that handled.21:57Sorry, oh.22:17So whenever a device connects to one of those portal, ICE will look at the HTTP request and it will like extract like the HTTP header then get the user agent and stuff like that. So again, this is a, you know, if you've got the requirement for, you know.22:20Fingerprinting the browser that the user is using and you know this is a good one to, to leverage. The radius server is one that we use heavily. So, and we've got a couple of slides on on the radius probe. So this probe allows us to collect.22:38Get a lot of layer two information. So layer two information in terms of CDP LLDP, and then some of the more, you know, application like DHCP, HTTP.22:58Attributes and all those get sent over to ICE via accounting messages, right? It's a very, very efficient way for ICE to learn about endpoints very quickly, ok? And we've got a dedicated slide on that.23:09N Map is well Nmap if you're familiar with the NMAP tool, the network mapper, it's exactly that, it allows ICE to, to scan an endpoint for open ports or scan an entire subnet.23:25You know, and then look at what those devices are and look at the open ports and then we can use some of those ports within our profiling rules. Now Nmap is a very intensive one so again this is something that you wanna use.23:40You know, very carefully, right? And again, if you have in a large production network, you know, you could get told of if you start scanning the entire if running and with the entire network is if you've got things like.23:58IPS or IDS in the network, they will get trickiered saying that this is a reconistant action if you're doing a port scan on an entire subnet. So use that one very sparingly. DNS DNS is a good one, so.24:15When ICE learns about, the IP address of a, of a device, you know, ICE can learn about the IP address from either by DHCP or radius or some of the other probes, and then ICE can do a reverse DNS lookup.24:30So you have to have the DNS server configured in ICE so that you can do the the reverse lookup for the FQDN. And then SNMP query, again, you know, it collects similar probes to what our radius probe configures, so same with SNMP trap, you can configure those SNMP configuration on.24:47Ice and your switches and then, you know, ICE will exchange, will grab those information.25:07Active directory. Now this is a really good one that we use for, you know, many for Windows devices, so it gives us a lot of information with for devices that domain joined as well as users. So we use that a lot for, you know, getting user information.25:12From us as well as, you know, as I mentioned, domain domain join devices. And then the last one PX grid. PX Grid is our platform exchange grid. So this is a service that allows ICE to.25:30Integrate with external platform. So with PX grid, it allows ICE to learn from external platform as well as to share information from external platform, right? So in the medical industry, e.g., we've got a lot of medical integration that you leverages PX grid.25:50I think there's a long list of vendors, 3rd party vendors that can, that uses PX Grid to integrate with ICE. But the main one is if you are integrating ICE with Catalyst Center or DNAC, ok? This leverages with PX grid. And then those PX Grid will bring back what we call asset.26:07Information so those asset information can provide a lot of attributes about our devices. So I think this one, I'm not sure maybe one of our colleagues is gonna be covering that in the session next week, so.26:27Make sure you attend those to see our PXV probe in in action. Okay, so the ones in in that's been highlighted in pink are the one we're gonna be focusing focusing on in this in this session.26:42Okay, so this is an example of the DHCP probe. Okay, so I've got a, a VLAN interface on my switch that I've configured with an IP help address, the IP help address is pointing to one of my PSN, and you can see here's some of the information via the DHCP.26:57Messages that we are receiving. So you can see that we can, we can, you know, we can see the model of the devices, we can see the IP address, you know, and a bunch of other attributes that becomes very useful when it comes to profiling. So.27:18This is the configuration for device sensor on my switch. Now the one on the right here, this is what you need to do to configure device sensor on your WLC. So check check check and that's it done. On the, on the switch itself is a little bit more involved, so you need to configure what called a list filter list.27:37So that top one is for DHCP list and we've got a bunch of options that we're telling it to include in that list.27:57We've got some CDP lists that we've got also got a bunch of TLVs, type length values, attributes to send and also we've got an LLDP list. So all those lists are slightly, you know, it's giving us slightly different information and then the magic happens here where we say device sensors send it all into.28:06Accounting.28:26Messages, right? And here I've got a screenshot of some of the information that the switch collects. So if you run show device sensor cache on your switch, if you've got device sensor configured, these are some of the information that you're gonna see in the cache and.28:27The switch will cash all the information and then send it over to ICE by accounting messages. And this is what ICE will see, right? So we can see, e.g., some CDP version. We can see some Cisco stuff here, Cisco AP, we can see some platform terms, some model number, as well as device name here.28:47Can you you send it but normally sorry well I've missed that. Oh, David, one of the guys will answer because your message popped up but it disappeared quickly off of my screen.29:10And here we can see, you know, some lldps so we can see kind of similar but slightly different in terms of the information that those two different protocols are, are giving us. And this is a screenshot of.29:23The active directory. So we can see a lot of information about the endpoint, right? So one of the main things that we want to look at is, e.g., does the host exist? You know, is it joined, is it part of the domain, right? Is it joined to the domain? What's the version? OS version?29:40You know, what are the AD groups that this particular that this particular endpoint is part of and so on and so forth, including the host name. So AD very good gives us a lot of information about you know those.29:58The Windows endpoint. So we talked a little bit about nmap. So N map, as I mentioned, is what we define as an active probe, right? It's an active probe in the sense that it reached it it physically reached out to the endpoint and query the endpoint, right? And this is the only, this is the only probe.30:16That does that?30:36And all the other probes that we've talked about are what we call passive probe, right? So they're already glancing information that is already flowing across the network and they're just grabbing that and sending it over to us. So that's what we call passive, right? So n MAP scans, you know, you can trigger manual NMAP scan if you want to.30:37You can define the node, so make sure that the probe is enabled on the node on on the PSN, choose a node and then you can define the subnet, you know, again, be carefully with that because, you know, if you've got a very large subnet with a lot of endpoints, they can be, they can take a lot of time for.30:57For that job to run.31:17Okay, to scan the internet network, you know, it's a lengthy process and highly resource, highly resource intensive as you can see here, ok? So things you can do with nmap. So you can do the OS scan, you can look up the SNMP ports, you can look at the.31:19Support and as well as look at discovery jobs as well. So with Nmap, you know, you can only run one of those jobs at a time.31:38So like I mentioned, you can run it manually or you can run, you can run it automatically as part of, profiling conditions, right? You can trigger a scan you know.31:47Okay, so here I've included some results of you know nmax scan results, you know, from, from a windows machine, so you can see some of the ports are returned, and this is what I.32:03Who's telling me it's a Cisco router I doubt that's Cisco router, but that's not Cisco router in my lab. So it's probably a switch.32:22That I've run a scan job next against it and these are some of the results that has been returned. Okay, so we've talked a lot about the probes.32:28So, so far we've told the probes are now sending a lot of information into ice. So the next thing we're gonna be looking at is the profiling policy. So the profiling policies.32:43It is what ICE uses to categorize an endpoint, right? So whenever we discover an endpoint, we learn the attributes for that endpoint, and then we use a profiling policy to cla to categorize and classify that endpoint.33:00Okay, so there's a profiling policy for Cisco Aeronet 15 1815 I've stuck with Aeronet 1815 because this is the same profiler that profiling policy that we're gonna be leveraging throughout this entire presentation and hopefully in the demo later.33:15Okay, so we got the name of the policy here, got a little description, so the policy is enabled, checkbox. We've got a minimum certainty factor. So the minimum certainty factor is.33:32Basically it it it is a number that shows that we must meet in order for that policy to apply. So alright? So if we follow down here, we've got a bunch of conditions, right? We've dived deeper into the conditions so if we've got four conditions here, so each conditions have got.33:49A certain attribute that they are doing a check against, so if we meet one dose condition, then we're gonna increase the certainty factor by this amount 13, ok? So in this case, if we meet all four conditions, you know, then we're gonna have a total of, you know, how.34:09A hundred and 20 points.34:28In total. But in order for us to match this particular policy, we need a minimum of 30, ok? So in this case, only one, only one, only one of these condition rules needs to be met in order for us to meet this.34:31Okay, I've got another slides against that so so exception action. So exception action is that is a mechanism that allows ICE to issue a change of authorization. So I've got a separate slide on that, which we will.34:49We'll come back to this again, right? Network scan, so as part of this policy, you can also trigger an end MAP job like we've talked about nmap. So, if you've got you know some devices that.35:09You know just you know just relying on passive attributes that does not give you the pro, the, the visibility that you require. You can also run an scan as part of the policy. And also if you have.35:24If you want ICE to automatically create an identity group for any device, whenever a device matches this particular policy, so ICE can create a matching identity group name this name here and then add that that endpoint that matches this particular policy automatically into that.35:41Into this identity group, ok? So profiler, profiling policy can also be hierarchical. So i. E. You can have a parent policy as well as a bunch of subpolicies, right? And for you too, so e.g., in this case here, we've got APs, but the parent policy is Cisco polic.36:01So in order for a device to match this particular policy, it also needs to match the parent policy.36:22Okay, so it needs to be classified as a Cisco access point before it can be classified as a Cisco AP error at 1815, right? Associated CoAs, so COA is change of authorization, so we'll come back to that in a minute. We've got a dedicated slide for that.36:29Okay, so just gonna see how I'm doing for time. So change of authorization COA, so change of authorization is a mechanism that allows ICE to instruct our network access device, so either our switch or WLC.36:49To re authenticate the device, right? So it's a part of our RFC. This is here, so if you guys are a little bit bored you can go and read this RFC. Very interesting. So it allows us to initiate an unsolicited communication to the network access device to update its access policy, right?37:06So whenever ICE learns something new about an endpoint, we need to re authenticate that device, right? So that we see if it matches a different policy in our policy set. So this is a mechanism that ICE uses the change of authorization.37:26And by default, you know, this is a ICE configuration. COA use UDP 1700. It is customizable. If you are using, I don't know, certain 3rd party switch that does use a different port or you want to use different port, that is fully customizable. But by default we use UDP 1700.37:42Okay, and on the switch configuration, you also need to create configure this, this line here, this configuration need to add this. Triple A server dynamic radius dynamic author, ok? And then you ports to your to your PSN, so it's gonna be sending those COE messages.38:00If you don't see the if you don't configure this and you will notice.38:21In your ice conf in your ice logs, you would say something along the line that COA failed or NO response for change of authorization method or something like that, ok? If you ever see that, that will tell you that, you know, this configuration is missing on your switch, ok? So go check that out.38:26Okay, so continuing on the change of authorization, so change of authorization can be configured globally or per policy, ok? Now there's a couple of caveats here. So the global, NO COAS so.38:49If you under global policy, you can figure NO COA, so that kind of like turns off COA for everything, right? Including the policy. But then if you got something else like reauth, e.g., then.39:07You know, some of the other option will take precedence. So profiler COA. The profiling condition, sorry the profiler policy COA will take precedence, ok? So the COA tabs we got NO COA, so that speaks for itself, don't send any COA, don't do anything. So port bounce is.39:19There's a literally do a shut, NO shut, right? So why do we have this one? So port bounce is usually for troublesome devices. So troublesome in the sense that if we are doing things like we're doing dynamic VLAN assignment, right? So we've got.39:40A device that can profile and in order for us to do, you know, to to a change of authorization, and we're doing a dynamic view line assignment in order for us to force that device to do, you know, to release their existing IP address and to learn a new IP address. Sometimes we have to do that then.39:56Board bounce especially with a lot of older devices that cannot detect that, you know, they're sitting in a new VLAN without bouncing. Also keep a you know board bounces like I mentioned is a shut, NO shut, right? So if you got any PoE devices, phones, APs.40:16Just be aware that those are gonna go down and it's gonna take a few minutes for them to come back on, right? Usually reauth, so you're kind of just doing a softer reauth, well, you know, your usually works in most cases, right? But you can try. Try reauth and then if that.40:32Doesn't work especially, you know, anything that doing like, you know.40:52VLAN assignment or some other stuff, yeah, try forward bounce. Okay, so we can assign the, the COA as part of the profiler policy, so like I mentioned, if you've got NO COA confirm configured as a global setting, then NO COA.40:56So we can either tell the profile to use the global settings or we can define our own CRA types on the policy level. Okay, so exception action.41:15So exception action is a very important feature, right? So exception action is the means by which ICE profiler services trigger a response, right? So whenever a profiling event happened or there's a change in profiling, this is the.41:30You know, this is how ICE can tell triggers a change of authorization, ok, using exception action. By default, we have three of them. You can't change those, you can't delete them, but you can do, you can create your own.41:49Custom, you know, exception option. So, these three here, so the 1st one is authorization chain. Send the COA when a profile transition in a different I think I've got some typo here. Right, so basically the this one is.42:05Whenever ICE decide that, you know, the authorization policy needs to change, ICE can trigger an exception action, which will force a change of authorization, ok? Same thing with when we delete an endpoint.42:22ICE needs to send a COA so that the endpoint is deleted, and then if that endpoint is still active, we need to relearn about the endpoint and this is what gets sent endpoint delete. So again, we're forcing a COA. And the last one is when ICE learn about.42:39About a device for the 1st time.42:59So ICE generates, uses this exception action to generate the COA because the events that that endpoint goes from being unknown to being known, you know, being profiled for the 1st time. So this is very important, right?43:02Okay, so another thing that our exception action can do is to statically assign an endpoint to, a profile. So e.g., as part of your pro profiling policy, if you meet certain conditions, you can say right ok.43:21You know, if you've met this condition, then I'm gonna statically assign you to, to one of those, you know, profiling policies here, ok? Now there are certain use cases that you can use that for. I've not, personally used them but you know.43:39Because I'm not a fan of statically assigning anything in ice so, again, if we go back to our zero trust architecture, you know, statically assigning an endpoint is a NO NO, right? But I understand there are certain, there are certain conditions, you know, a certain times where you may need to.43:55Do that, you know, and that's fine. Okay, so our profiling policy, so we got a bunch of, so got a bunch of messages popping up on my screen, sorry about that.44:15Okay, so profiling rules. So we are ingesting a bunch of attributes to talk about our profiling policies. So our profiling policies consists of rules. Okay, so just continuing from that profiling policy that we saw earlier, if you look at the rules here.44:33So we've got four rules, and here I've expanded on the rules. So the rules for that one, that 1st check is that if the DHCP class identifier contains this, then we're gonna increase the certainty factor by 30. Same as the other one. DHCP version six. So we're looking at attributes that's been returned.44:53Done by different probes, ok?45:13So these 1st two are using DHCP, this next two is using CDP, right? So NO LLDP here, because Cisco device it's a Cisco provided profiling rule, so why would you use LLDP, right? We use CDP, ok? So these are, so you can whenever you.45:18Creating your custom, profiling rules.45:38Okay, so look at some of the attributes that you are learning, ok? And we'll, we'll talk about that a little bit further later, you know, look at the attributes that you're learning and then make sure that they remain constant and they are, you know, they are seen across all similar devices, right? And then you can leverage those in your profiling conditions.45:42So, continuing on our profiling conditions, so we've expanded on the profiling condition for the DHCP class identifier contains this value here and in ICE.46:03This is the attributes that we're learning because we've configured DHCP and this is what we're learning in ICE. So that profiling condition, which has got this attribute value here and this is the attribute name matches this. So this will be a match. So our certainty factor will go by 30.46:17Okay, another example with CDP, again, you know, type CDP attribute name CDP cache platform contain this attribute value. These are Cisco provided, as I mentioned, and this is what we can see in this particular attribute in ICE, right?46:34So we're learning about that platform. Okay, so now, logical profiles, so logical profiles allows us to combine multiple profiling policies into a logical group. So say e.g..46:53So we had, you know, we've got, profiling policies for brother printer, for canon printer, for extent printer. You don't wanna have an authorization policy that says printers if endpoints dot.47:13Endpoint policy equals printers oh god, I do apologize, someone might have just bear with me 1 s 1 s, apologies about it.47:31Okay, so sorry about that ok yeah so logical profiles allows us to, group all those policies, so in this case I've got a bunch of printer policies that we've grouped it and then in our logical, in our authorization policy, which I say printers, if.48:01Endpoint.logical profile, so the name of that prof logical profile, which contains all these talent policies, then so and so you know apply this particular authorization policy.48:21Okay, so it's kind of a way to make things a lot easier, a lot cleaner, in terms of our creating our authorization policies. Okay, so in the case where we have.48:33Custom profiling policy, so profiling policies that you've created yourself, if they are, if we get a match, e.g., say you've configured a profiling policy that overlaps with one of your custom profiling policies, how do we break that tie?48:52Okay, so the policies that takes precedence is the one with the highest certainty factor, ok? So keep that in mind. So the certainty factor range can go from one to 6500.49:0965000 sorry ok so most of the Cisco policies are using in the lower range, right? So if you create your own custom policies and you want to make sure that they take precedence, always range.49:25Your total certainty factor to higher level, if you want them to take certain precedent because if they're lower, then a policy with a higher certainty factor, will take precedent, right? Now it doesn't matter if your profiling, if your profiling policy contains five rules and you're missing all the five rules.49:40You know, it's all down to the total of the certainty factor, ok? So just keep that in mind. Custom profiling policies, if you want them to take precedents, always go higher number, right? Okay, so profiling policies have we, as we.50:01As we've seen leverages profiling conditions. So profiling profiling conditions are updated via our profiling feeds, so you can update online automatically, you can schedule those updates or you can do it offline, right? Where you can download a profile at package.50:20And so on.50:39Okay, now endpoint purge. Just a little bit of housekeeping. Endpoint purge, so as we've seen on my opening slide, we had a, you know, a bunch of devices sitting in this category here, right? Sitting in this group of unknown. So in our identity groups, our.50:41Import identity groups. We gotta, you know.51:00We've got a database here that contains, like we've got a group named unknown that contains a bunch of, you know, randomized IP address, a bunch of junk IP addresses, right? So good practice to schedule a purging job. So.51:04You can create one that says if, you know, if the unknown, right? And the endpoint purge elapsed days is greater than 30, then purge everything that, you know, in that in that group here, that's greater than 30 days, right? It's a good way to keep things tidy. Now one thing that I would recommend.51:22Against doing is start creating a purge rules at the top level of your identity groups, right? Try to not do that because sometimes something gets misconfigured and the next thing you know, you purge everything single device that ICE learns about, right?51:42And I've seen this happen, and it's painful to then go find backups and then to restore all those, all those endpoints especially when your most of your policies are relying on profiling, right? So just be careful with this.51:57Okay, so I'll talk about a lot of stuff, right? So we cannot cover everything profiling in a 45 min session, right? So guys, these are the links here I think Veronica is gonna be pasting those in the chat.52:13Go have a look there and there's everything you need to know about profiling and not just profiling, everything to do with ice, right? So this is our iceberg, right? Cisco loves, you know, you know, making pun names with ice, you know, iceberg, ice, you know, ice picks and all that sort of stuff.52:28You know, they gotta sense to human those guys. So yeah, go check this out.52:48Okay, let's run into a demo. Let me just check how we're doing for the time, ok? Right, let me end this slide. Okay, let me so.52:54I was having some issue. Oh, ok. So I was having some issues with my switch over here. Okay, so in my network, I have two APs, so we're gonna focus on this guy here, right? We've got an AP here.53:13Let's have a look at what's going on here. So show authentication, sessions and then let's dive into this guy here. Use zero/three, and then if I can type.53:30Sorry, details. Okay, so we've got these devices, so that's a MAC address. So let's just focus on that C eight, just remember ACC eight because that's what we're gonna be focusing on.53:45So we can see that the device was authenticated via map. Okay, it's authenticated in the.data domain and the status is authorized, ok.54:04So while we're here, let's take a look at the device sensor cache, right? So show, device essential cache, and then let's type all, right? That's a keyword. Okay.54:18So we can see there's a bunch of LLDP attributes, there's a bunch of CDP attributes, ok? So these are all the attributes, so these are right that one at the top was for.54:35Gig 104 and that one here is all gig 103, ok? So these are the attributes that the switchers learn. So if we do show device sensor details.54:52Okay, so these are we can see that our device sensor is enabled, ok? And these are the filter list that we have configured, so we've got a CDP LLDP DHCP, right? I don't have DHCP V six because I'm not using DHCPV six in my lab, ok?55:09Right, so let's go to my, I I will not refresh this because just in case things goes a little bit wrong. So I restarted my, my switch earlier this morning, so I'm gonna go 6 h NO 60.55:26Minutes and then what we're gonna filter on, let's go filter on the ACC eight endpoints, so let's take a look.55:45Add the logs for this particular endpoint because I want to see bear with me 1 s, might need to go further back.55:53Okay.56:13Alright I might need to refresh it. Let's refresh. Let's see if we get some new logs. Okay, so what's the time? Yep? Right, let's get rid of that.56:15This is a problem where we do live demo. Bear me one sec, I'm just gonna go oh sorry last hundred records, ok. That's not gonna be good enough.56:34Okay, so it's not showing me what I wanted to show you guys, but don't matter, let's.56:53Okay.57:13Right, not to worry. Okay, let's go into our context visibility. Let me just refresh this, see if there's any connected devices here. Do we have any connected? Oh, NO connected devices. Okay, yeah, my lab's broke. Anyway.57:16Let's get rid of that. Let's go look for that C eight. Where is it and what's that one? That's the older one. Let's go next one. This one here. Let's look at the, what ICE has learned about this particular.57:33This particular endpoint. Okay, got 2 min left. Okay, so the username is the MAC address because we are doing math.57:52Okay, the endpoint profile that got matched is this guy here, AP error 1815. Now these here if you're interested in what do what does MFC means? Multi factor classification.58:08To stick around for our next session, I think Tasiana, and our call and our colleagues are gonna be diving into this. So stick around after that and then we'll dive into what those MFC means, ok? So if we look at the the attributes that we learned for that particular APs, so static assignment force, which is why.58:24What we want. We don't like static assignment, but unless it's absolutely necessary, ok? The endpoint policy that we match is this guy here, ok? Now.58:44Let's look at, ah, right? Certainty factor for that particular policy was hundred and five, which is why we matched this, ok? If we come down further down we can see some of the CDP attribute that iso.58:55It's picked up.59:14Okay, we can see some LLDP attributes that is picked up, ok? And a bunch of radius stuff, and then we can see the endpoint source, right? This is the source of the information, right? Is our.59:15Radius probe, ok? So we've talked about our radius probe before, right? And then, right, we've got 1 min, so one thing I wanted to show you guys is an example of a change of authorization message which unfortunately.59:35I don't have, my cache has yeah it's timed out. So yeah, unfortunately I can't show you any change of authorization method messages, but we are at the hour, so.59:54I will thank you guys. Thank you very much for attending. I hope this session was informative to you guys and with that said, I will pass it back to Veronica. Thank you. Thank you, Henry and Fariz for sharing the information on traditional profiling with us. We will take 15 min break now.01:00:10And when we get back, Tatiana and Emmanuel will dive into smart endpoint visibility with ICE 3.5.01:00:30So just go grab coffee or tea or stretch your legs and let's meet here in 15 min.01:00:38So welcome back everyone. I hope you are all refreshed and let's dive right into our 3.5 profiling features. Tatiana floor is yours. Thank you Veronica. I just would like to confirm if you can see my screen, if you can hear me.01:00:58Yes, perfect. All right. So good afternoon everyone, and thank you for staying with us. I hope majority states and we didn't lose you during the break. So my name is Tatiana and I'm a customer success specialist focused on the Cisco zero trust.01:01:15So today together with Emmanuel, our, my colleague from the security consulting team and and ICE implementation experts that we are going to walk you through what we believe one of the most important profiling updates.01:01:36So our goal isn't just to list features, it's actually to show you these capabilities and how they translate into better with the. Okay, just a quick reminder before we begin that please use.01:01:54Q and A panel to ask you questions. We really want this to be an interactive session. And if at any point something resonates, raises a concern or you just want a deeper dive.01:02:14On the specific topic, drop your question into the Q and A panel and our panelists will address them. So here's our journey for today's session. We will start with what's new in ICE three.five profiling.01:02:26The headline changes. Then we will go deep on the MFC profiler and cloud MFC profiler and which is the biggest single improvement in this release. We'll then look at the visibility and monitoring, so some rules regarding the point purch profiler resiliency.01:02:44And system three 60 what you can monitor there. From there Emmanuel will cover the new profiling configuration APIs that will let you automate your profiling configuration. And we will close with how all of this ties into the Cisco AI endpoint analytics.01:03:04Okay, so why does profiling matter so much right now? My colleague already Fariz already earlier today mentioned about the need of the visibility and to understand what devices are connecting to your network.01:03:22But I also want to pay your attention to some changes that we have in the recent ice three.five release because they were, there were like really big improvements into the profiling. And to make this session even more interactive.01:03:42So we will be using Slido to ask you questions throughout the session, so please scan the QR codes with your mobiles.01:04:02And, and put your name or leave it as anonymous. This is as you prefer and the 1st question is if you're already or your organization is using ice three.five release.01:04:10Or maybe you're planning to upgrade or you're still evaluating ok see some responses. You can also address this question in the Webex Slido app.01:04:27If you see one or using your mobile as you prefer.01:04:46Okay, so I see majority are not using ice three.five at this moment and this is good then this session is right for you because.01:05:02If you're still considering, if you need to up upgrade to is three.five so treat the next 30 min as you upgrade business case. So initially we introduced multi factor classification or MFC in ICE three dot.01:05:20This was a major architecture improvement to traditional profiling, but it was still a baseline of what we have now. So at that point in ICE three.three instead of identifying endpoints based on like single prop result or isolated attributes.01:05:41ICE began correlating multiple identity factors such as manufacturer model and operating system and device type. So in ICE three.five, we significantly enhanced the MFC framework and.01:05:59The 1st enhancement is the redesigned classification engine and profiling workflow. So it improves how profiling rules are evaluated and how multiple data sources are combined to generate more accurate endpoint classification.01:06:14Another improvement is a cloud assistant profiling bits that ICE can leverage Cisco cloud intelligence built from the thousands of real world fingerprints to improve endpoint classification accuracy, and reduce number of unknown endpoints.01:06:30And this is what we call the cloud MFC profiler. Another enhancement is expanded trustful services, so the integration with authoritative sources.01:06:47That ICE now can map information from posture MDM platforms and integrations directly in the MFC attributes. The measure addition is SNMP scan, it allows ICE to identify devices, unmanaged infrastructure endpoints.01:07:03We also improve the operational visibility around the profiling itself and administrators now have enhanced monitoring and status summaries for SNMP props and profiling operations and they can make troubleshooting and profiling validation much easier in the larger deployments.01:07:21So the overall for profiling functionality, the transition from ice three.three where we introduced some of these features to ICE three.five is about moving from the basic multi factor profiling toward intelligence adaptive and cloud enhanced endpoint classification.01:07:39Okay, in many environments, devices such as printers, UPS systems, CCTV cameras, stage readers, the medical devices or OT equipment that doesn't perform.1X authentication and often generates.01:07:59A very limited profiling data when using probes such as DNS DHCP or radius. It's very hard to profile those devices, and in five we address this challenge by introducing the triggered SNMP scan.01:08:19That support up to SNMP version three. So now administrators can perform scheduled or on demand SNMP scans across the specific subnets or IP address ranges and endpoint response with identifying attributes such as operating system, the hardware information, maybe device.01:08:38Specifically values.01:08:58ICE then maps those attributes into multi factor classification attributes. So that MFC result can immediately drive authorization decisions inside the policy. And e.g., assigning a security group tag or placing the endpoints into the restricted.01:09:00Or applying segmentation policies for the infrastructure devices. Because removing the number of unknown devices as also Henry mentioned during his part and showed on the dashboard that this is a big problem that we can see.01:09:21With the many customers because many small like devices maybe like companies equipment, like custom equipment that's being used is not profiled by the default profile and policies that are available in ICE. So these adds not only your visibility as administrator but also.01:09:38I'll put in those MFC labels MFC results into the authorization policy. You can give your CCTV cameras or printers authenticating via map, like specific.01:09:57Access within the network that will not allow in case there will be any attaffer to perform the max spoofing address. It will not allow to go further in the network.01:10:15So this is a short demonstration, sorry, short demonstration, how SNMP scan can be configured. This is a new option being added under the network scans and it's pretty easy and straightforward. You just add a new scan.01:10:35Put a name that's for you as administrator will be meaningful like some description is also good in case there are like more administrators. Select the SNMP version that's been used by your devices and the credentials. You need to select the source PSN that will be performing this, so it's located closer.01:10:53To the, to the network that you would like to scan and specify the network. It can be like a subnets or it can be just one device. Once it's saved, you can see it in the list of scans, you see this star status which is.01:11:13Mentioning that it's enabled let me also navigate here so on the top you can see like general information since we have in this demo just one scan, so it's very easy to find it. But if you have.01:11:32Multiple scans because you can schedule those so you can just create multiple scans, so maybe like scan from time to time this your like segments or like networks of your environment of your infrastructure that's maybe a less secure. They have less physical security.01:11:50I'm more prone to.01:12:10Some max spoofing attacks so you can schedule those scans, you can create them and do the schedule when so they would be running from time to time. So on the top you will see that how many scans are running enabled or disabled.01:12:13And the information about last failed scan ok from the action so we can.01:12:31And start the scan manually so we can trigger the beginning of the scan.01:12:51And once it's going in this case it was just selected the whole network so you will see like many IP addresses in the report that you can immediately view once the scan is finished. You can see the report and.01:12:56Every IP address in this network was checked and basically if you have the SNMP enabled on this device, devices in this network, they will respond if you don't have it enabled or maybe there are NO devices under this IP address, there will be like NO response sent.01:13:12And this is just a short demonstration of how this SNMP scan works and we will.01:13:31Look a bit more into detail for this can later in this more general demonstration. Okay. So traditional profiling this is what Henry was discussing. This is now what we are calling a traditional profiling. So we.01:13:37When you're using a certainty factors, you're creating those logical profiles and now being re referenced in the Cisco documentation, you might find that this is a traditional profiling compared to the new MSC profiling. So traditional profiling works perfectly for the known device classes.01:13:57Like users workstations. So you can utilize already the big catalog of the profiles that you received by a bit, so please don't forget to update your feeds to get the latest updates and so.01:14:17Once there will be a new version, maybe like new windows version or something released, so you will get update the automatic profile that you can already use. Very good, very convenient, works perfectly, but.01:14:32In the current like modern networks maintaining accurate profiling policies at scale, it really could become operationally intense and especially when new device types continuously appear in the enterprise network.01:14:49So many customers reported the same problem. This is the pool of unknown endpoints. And this is what I also see like working with customers that the pool of unknown endpoints can be even like 60 % of of the whole endpoints like visible to ICE.01:15:04So with the cloud MFC profiler, ICE collects locally observed and point attributes and securely correlates them with Cisco Cloud intelligence that is built from thousands of real world and point fingerprints.01:15:24And this significantly improves classification accuracy and reduces the number of unknown endpoints. This functionality is not available in the fully air gapped deployments as ICE require internet connection.01:15:40And it's also important to clarify that cloud profiling enhances endpoint classification intelligent but it does not replace the traditional profiling policies. So operationally this helps to reduce unknown endpoints, improve asset visibility and enable more consistent zero trust.01:15:55Policy enforcement or unmanaged devices.01:16:15Another change I would like to address is the license consumption for profiling. So initially when ICE three.five was released, the new license model was introduced according to which advantage license is consumed upon point classification.01:16:20That after collecting feedback from our customers, the product team decided to revise this change and starting from the next batch, which is patch four, the advantage license is consumed only when profiling attribute is used in authorization policies.01:16:40So these are the way ICE was consuming profiling licenses pre three.five version. The patch four is planned to be released in the Q3 this year and.01:16:58These are very recent changes that were communicated basically like a few weeks ago and the official licensing gap is not yet updated, but it will be updated soon with this information. So it's good you connect it to our webinar that you're the 1st to know some new changes.01:17:13It's important to mention that there is NO license enforcement, but yes license are being consumed so calculated as used on the licensing reporting page on ICE, but instead of out of license error and evaluation period starts.01:17:33You're just getting like a license warning that there is an overconsumption. So evaluation period does not start and this means that you can still like upgrade to ICE three.five batch three.01:17:52Which has the new licensing rules, but you will not lose your functionality at due to advantage license over consumption. So these rules will be valid throughout this year, 2026.01:18:08And the enforcements at this moment is planned only beginning from the next year. I think this is a good opportunity to actually consider updating even before the patch four is released.01:18:28Oh let's have a deeper look at MFC profiler and a quick pause because I'm curious if you're already using MFC profiling cause it was still like introduced in ice three.three.01:18:45So maybe some of you actually tested it already.01:19:06Okay.01:19:26Okay. So I see that majority don't have the use cases, so hopefully the next 20 min will show you and it's open for you some use cases that can be applicable.01:19:30For your organization. So the MFC profiler and uses various profiling probes to produce four labels. So it's already utilizes that prop information collected from by ICE.01:19:46When you enable radius DHTP, HTTP props, it's not some additional problem that needs to be enabled, but it's using this information to produce four labels for every classified endpoints.01:20:05Which is the manufacturer model writing system and endpoint type. And how the data flow works. So endpoint attributes are collected based on the enabled probes on the PSM. Then MFC profiler service evaluates profiling rules.01:20:22And writes the four MFC labels and back to the endpoint record. If a cloud MFC profiler is enabled, which available from is three.five, the observed attributes are forwarded to the Cisco classification clouds.01:20:40Cloud returned labels are merged into the endpoint based on the rule priority. So about rule priority, we'll talk a bit later. And if Cisco AI analytics is enabled, then endpoint data is sent every 12 h.01:20:57To this specific like URL over HTTPS and the cloud produces AI proposals, which is rule plus the label suggestions. And those proposals are proposals are produced every 24 h for over the last seven days of the telemetry received.01:21:13So for, then for the four MFC labels become available as an endpoint dictionary attributes for the authorization. Change of authorization is auto triggered when the labels change and in life logs you can see the reflection of the new policy match.01:21:34We will take the closer look I think during the demo part. And yeah, there should be some link to share because I mentioned here the FQDN which is needs to be available for ice. This is for the AI analytics essence.01:21:53But I believe my colleague should share the link with required internet URLs for ICE reachability or different services.01:22:13Which also includes the cloud MFC profiler. So ICE does not require the like full internet access. It's just specific URLs and ports needs to be opened.01:22:23So now let's go through the configuration floor of MFC profiling, and we'll begin with the service itself, the MFC profiling and AI rules is enabled by default when you update to ice three.five, but it's also can be verified in the profiler settings. If you go to the work centers.01:22:40Of profiler and settings and the profiler settings tab. To be able to use AI analytics, you need to register your eyes with Cisco clouds and Cisco AI analytics has a strict license requirements.01:23:00So the smart licensing registration with advantage tier subscription. Evaluation license will not be supported, so you will not be able to register your eyes if you are in running evaluation licenses. It will be ok if you have this overcon you are an ice three.five.01:23:16When you have like over consumption.01:23:36Because this is not enforced, so that means there will be just alarm for you as administrator, but you'll be able to use AI analytics. And it's on prem and specific license registration are not supported as well. So it should be only smart licensing registration to the.01:23:38Smart licensing personal.01:23:58So for ICE three.five the enabling cloud MFC profiler will give the additional benefits when building so granular profiling policies and to enable it is a pretty simple flow, just under the administration going to the bit service this is the new section.01:24:04Will be available after the upgrade.01:24:24Where you can find the clouds multi factor classification profiler, you need to select the region which best aligns with your eyes deployment and geographic location. This is to ensure the optimal performance. And once you selected the region, you should see the connectivity fields on the display connector.01:24:27And then you can go with and click on the enable. So this will open the spread window to redirect you to the Cisco authentication portal, where you need to use your Cisco account, so cisco.com accounts.01:24:48If you don't have one, that's also fine so you can sign up. And upon successful authentication, you will be returned to the ICE configuration page and the status field will be updated to enabled.01:25:03As you can see on the slide on the step three. So when you enable the cloud MFC profiler, telemetry is automatically enabled and cannot be disabled unless the cloud MFC profiler itself is turned off.01:25:21Additionally, that needs to pay attention pay attention to that enabling the cloud MFC profiler triggers the reclassification of both new and existing active endpoints. So this needs to be kept in mind if you're planning to do this during.01:25:36Be like business hours because this can spike your CPU on the PSM. So in ICE three.three, you just could see the MFC labels.01:25:54In your context visibility tags tab, but starting from the ice three.five, the administrator can already create the MFC based profiling policy. This will be available along with the traditional profiler.01:26:12So traditionally the certainty factor policies that you can create and you'll be able to create the MFC one. And, here it's also pretty straightforward process. You just add the new profiling policy.01:26:29And the only difference that you need to pay attention to is the type that you would like to select. Will it be the custom or the direct mapping and.01:26:48The core logic difference between the custom and direct mapping rules, this is that for custom rules, they offer high flexibility and allowing administrators to define specific if then criteria tailored to your organizational needs.01:27:03So they use logic similar to either ICE policy sets, whether conditions are matched against the endpoint attributes to assign to the specific MFC label. For the direct mapping rules, they are not customizable. So in terms of logic, instead, they trust that a specific attribute from the.01:27:20Authoritative source is sufficient to classify the device and that system simply maps an existing attribute value directly into one of four MFC labels.01:27:40So what are the attribute sources that each of this is using? For the custom rules, you can leverage any learned and point attributes as a condition for classification. So this includes data from the probes that are enabled on your PSN.01:27:51And, e.g., on the slide, you can see this custom rule to identify the Cisco iOS XE devices that are running version seventeen.nine. So this is because we want to learn that those devices with old version that we need to.01:28:09Upgrades in the nearest time.01:28:29But the direct mapping rules, you rely exclusively on the authoritative sources, which are the trustful and reliable sources that include the mobile device management such as the Microsoft Intune.01:28:33It can be the direct, some custom attributes fetched from the external cmtbs like ServiceNow. It can be data from the ice posture from the Cisco secure client module.01:28:50Or it can be IoT asset data from the IoT device management. So on these slides you can see just some available attributes for the custom and the direct mapping.01:29:05All created MFC policies along with AI suggested rules that were accepted by user. That's very important when you're using AI AI profiling suggested profiling rules that until they are not accepted by the administrator.01:29:27Then you will not see them, so they will not be applied. The the real rule will not be generated. So this is additional page that is specifically for MFC profiling policies that is available on ICE three.five.01:29:46That gives you the overview of all those custom direct mapping policies that were created, the AI suggested rules, and you can see here already like the status, so if it's enabled, if it's disabled in case, sorry, in case.01:30:04As you need to do some testing and create some additional rules and then you disable it.01:30:23So the MFC profiling policies are processed in the top down and 1st match approach. This is like with other ICE policies. So as administrator you need to move more specific policies above.01:30:30From the more general policies. So regarding the rule prioritization for MFC profiling when we are putting the label on because those four labels like our four MFC attributes.01:30:46And how do we decide which data you need to put in this label? A, e.g., we are getting different information from different sources. So for this, you have this prioritization and.01:31:06This the idea here that higher priority rule will not be overwritten by any subsequential lower priority rule. The prioritization order from the highest to the lowerst, so on the highest priority rule is the custom rules.01:31:22That's are created by the administrator and because we define the specific criteria based on some learnt attributes. The next rule in priority will be the direct mapping rules, those that use.01:31:38Our trustworthy services like MDM to map data from them into one of our labels. Then we will consider cloud rules. This is when cloud MFC profiler is enabled.01:31:54So the observed and point attributes are shared with Cisco Cloud for analyzers and those rules enhance the classification efficiency but are prioritized below the user defined custom and direct rules. Then we have the system rules, which include Cisco managed direct mapping.01:32:09Such as Wi Fi device mapping and build in profiling policies.01:32:30That generate MFC labels. Then in the priority we have AI machine learning rules. These are profiling policy proposed by the AI analytics engines and based on the network learning that.01:32:34Have been accepted by the user. So don't be afraid to enable AI analytics because until you really go there and accept the proposal, it's will not be in your system. And the last priority is for system library rules. This is the most.01:32:51Most basic level of classification and utilizing Cisco managed user agent and Mac.01:33:11Rules. So what happens if we have a conflict? So if a system rule, provides a label for the manufacturer and, but we received also from a AI analytics suggestion.01:33:19And that provides label for all the four categories, so manufacturer, written system model and point type. In this case, the manufacturer label will be taken for the higher priority rule, the system rule, and the remaining three labels would be taken from there.01:33:34AI suggested rules so well profiling policies identifies and labels devices, their policy set rules determine the actual permissions.01:33:52And security group assignments and network access level granted to those devices. So we can directly use now MFC attributes in the authorization policies. And what we recommend is to use.01:34:09To use operators such as starts with or contains rather than equals when you're matching the attributes for your condition. And this is just to accommodate any possible future changes if, e.g., you're using.01:34:28A condition as a manufacturer and now let's take a look at all of this in our demo. So this is a lab with ice three.01:34:43Dot five with NO patch installed and this is.01:35:03Initial version like general availability release, and what we'll do here, we'll just go initially to see that cloud MFC classification if this is enabled. So it was already pre enabled just to save some time during this process, but the process is pretty straightforward.01:35:08And we have the policy sets specifically for the our lab. This here will be using the map authentication. This is specifically to show you like what happens like with those devices that are using MAP authentication, like not.1X.01:35:27Authentication so.01:35:48They still treated to be less secure for from the security perspective because if you just verify the Mac address that can be spoofed and if you don't have the cleaning routine for to removing the old Mac addresses for the device that are NO longer in use.01:35:49Or that's have to be removed from the sites, then that's create the risk. So that's why we are using, we will not be using like any super specific device, just the regular Windows host, but it will be authenticating using the map. Oh, sorry.01:36:09Okay, so and in the authorization policies we have defined so this is what we also recommend to have when you're configuring the authorization policy. So we are starting from the.01:36:31More general like those group of unknown devices which have the denied access and then we have the profile devices and we are going to the device with the specific access and so then on the top of this, so the more precise is our.01:36:48Windows already using MFC label in the condition. So going to the live logs, let's start the session from the VMware client and here we can see.01:37:06So we have, we got the access so the session was successful. The authorization policy was selected as for our VMware clients. So VMware access permission was granted to this host.01:37:26From the attributes that we receive we can see what we can use to create like more specific, the custom rule, and this is the so let's check now what we have from the MFC labels already in the context visibility.01:37:43So here you can see that it was profiled by cloud profiler, and we have the endpoint side, we have the hardware and the the model that was identified everything like as a virtual machine. So we did not receive like any operating system.01:38:04Information. So what we are going to do, we will create a custom policy custom MFC policy. So we are adding a new policy precisely for this host.01:38:23So this is again like just a lab to show you the possibility. This will be a custom type of the policy, so we will map already some attributes that we are receiving from the radius prompt, which will be the NAS ports. We don't need like any other.01:38:38Conditions here like one is enough for us.01:38:58And we will map it directly to the operating system label MFC. So we have our policy created. Don't forget to save it after it was created on the.01:39:01MFC profiling policies page. Now let's confirm in the context visibility for this host that what labels we have. We don't have any operating system label. So we'll start another session.01:39:19And here we see that already authorization policy for Windows eleven was selected, so another one the one that was on top, the more precise one we have the authorization profile for it. So in the policy sets.01:39:45You can also check that the number of hits, it's updated every 15 min, so we'll refresh it and we see that number of hits for our session, that it's it was actually much so it hit our the correct policy.01:40:03Well, we saw it already in the details, but this is just how you can confirm from policy set as well. So and this is provided with by custom rules. Our operating system label is added by the custom rules, so you don't need to have the labels added from like same resource.01:40:21It can be some by the cloud profiler, some can be with AI analytics. So now we will do the scan, the SNMP scan for one of our networks.01:40:37Because we want to identify like what devices we have there. We want to get some, see like what additional information we can get from SNMP scan that we can use for profiling. So we are using SNMP version two, which is configured in our network selecting the source PSN.01:40:53We will use the scan just for one host, we will not be scanning the whole network because we want to address like specific hosts but if you want to check what devices you have there, like of course why the scan is better. So once it's created, you can trigger it manually.01:41:10Without configuring schedule. And once it's done, you see already that we have one respondent and one scanned points, you can also get the CSV file or watch it via the web interface as you prefer the results of the scan.01:41:29And the information that we got from the scan that has some data of these endpoints. And this is the the system description that we can probably like use for our profiling policy, but we will not be doing it by ourselves.01:41:47Because all the data that is collected by ICE we can receive suggestions if we have the cloud MFC enabled, right? So, and this is what we see. So once can is done, the cloud MFC already mapped the labels.01:42:06From the scan results, so you can see in context visibility confirmation that it was the user scan and the data that we got from the scan like those attributes that we received. And this is how you can replace your manual work.01:42:23Offer labeling and classifying the unknown endpoints in your network, so with SNMP scan and with cloud MFC profiler enabled, like NO need for you to search for specific attributes and then add it manually our policy.01:42:42So you can just use the scan and cloud MFC will put all the classification labels for you. Okay, so those were some use cases for which you can use the cloud MFC and SNMP scan.01:43:01But what is happening for you as administrator like if something's going wrong like what you can check, what information you can look for. 1st of all, I would like to mention the endpoint purge that Henry already like quickly mentioned in his part.01:43:20But just to give more details like why it's actually important for us to have the endpoints purge to use it, to utilize this possibility because it's really underrated functionality and we are awful here.01:43:39From our customers questions like they have the high number of the total endpoints or active endpoints on their dashboard on ICE, but they know that's actually when they check connected endpoints, they don't see the same amount.01:43:58And those because of those stale sessions or that's still are there in the ice and this is not only affects your dashboard and visibility because these accumulated data.01:44:15Is like ICE can accumulate like millions of stale endpoints records like over months and years, and this leads to performance degradation in the end. So when by default ICE provides only two generic rules.01:44:32When you just install or upgrade your eyes, this is for purging the guest and registered points if they're inactive for over 30 days, but you can also create your own purging rules and we really recommend as a best practice to include creating specific rules.01:44:52Oh sorry creating specific rules and especially for unknown endpoints to purge devices they could not be profiled and not part of your guest floor.01:45:12And this is what also Henry mentioned during this part, but what is also as a good practice to have the urgent rules for the most mobile devices using randomized MAC addresses and they because they create significant noise.01:45:26And this should be pushed frequently. And also the failed authentication devices that consistently failed to authenticate and this should be clear to reduce the, that database clutter. So in ISO three.01:45:45Dot five there was the ICE profiler service resiliency introduced.01:46:05And this is a feature set which is designed to maintain system stability by mitigating the impact of certain spikes in endpoint updates or reduced traffic. It focuses on the managing system loads to ensure that profiling service remains operational.01:46:11Even under the the critical conditions and preventing a single chat device or a fluid of events from degradating the performance of the entire ICE node. So of course when we introduced more capability into our profiling service, profiler service.01:46:28MFC profiler example we need to make sure that this is being tracked and monitored also like by our administrators to not cause any degradation of the performance of the ice. So resiliency framework consists of three main monitoring and mitigation mechanism.01:46:48And one is the profiler queue monitoring, ICE continuously monitors the utilization of the profilers pending events queue to implement admission control logic. The other one is PSN resource monitoring.01:47:09So the system monitors general hardware health, specifically checking for the high load average alarms every 15 min. And the profiler traffic monitoring, which is also a management of chatty endpoints. This mechanism identifies and controls specific devices.01:47:24Let's send an excessive number of updates within the short window, so those are that we treat as a chatty endpoint. So profile traffic monitoring.01:47:43It marks endpoints as a chatty based on the specific thresholds such as receiving more than 30 endpoints updates or 15 context visibility updates or five database updates per minute.01:48:01And as the action that will be the appropriate processing for the identified endpoints is paused for the cool of periods. The default is 5 min. This will allow system to redirect resources to other tasks.01:48:16The profiler queue monitoring, the moderate load is around 80 % utilization, then at this point the system begins to suppress interim updates and reclassifications and prioritizing the processing of new endpoints.01:48:35When the load reaches the high and maximum 90 and hundred percent of utilization, the non critical tasks are further reduced. And the system may only process entirely new endpoints to maintain basic functionality.01:48:52So for the PSN resource monitoring, if the resource usage exceeds predefined thresholds, the profiler enters degradated states and suppressing interim updates and reclassifications for the 5 min school of period.01:49:08This is to prevent a system crash. There are also updates in ICE three.five in the system three 60 and specifically in the log analytics part.01:49:24So just mention that log analytics is not enabled by default, so you need to enable it because it's consumes like additional resources from the ICE deployment. So to be sure to.01:49:43Check the documentation depending on your ICE version and the hardware, like the resources that you're using, your deployment size and resources is it SNS server or maybe like a VM?01:49:58So you have enough resources to actually enable log analytics. But this is actually a power tool also for administrators even without the profiling. So it's available starting from ICE three.two and you can use it to monitor like especially one of the most used use cases. This is.01:50:13Authentication latency that you can check in the lock analytics because it will show you the trends threats, trends of your authentications throughout the deployment and top not devices with highest authentication like top policy sets where you have.01:50:33Where that was recorded the high authentication said that you can proactively already monitor your deployments and fix some problems without waiting for customers or end users to come into you and telling that the authentication takes so long that is.01:50:51Just unusable. So going back to the new new dashboards that we have in lock analytics in ICE three.five and this is primarily focused on the additional.01:51:11Specialized dashboard that provides granular visibility into the prop data. So you can find them if you just filter search for the group name and you will see the status summary, the packets, config status.01:51:28And backends empty dashboards. So especially the most prominent enhancement is a probe status summary dashboard. And it allows administrators to monitor active probes to view all active profiling probes and individual endpoint.01:51:44The Prompt details received by ICE.01:52:04Troubleshoot some not configuration by analyzing proper packets generated for each PSN and not device and to verify if they are configured correctly to send profiling data. So you can use the granular filtering. Of course here like you don't see like all the information from the dashboard.01:52:06Just a few tiles are mentioned on the screenshot and just to show you those total endpoints per prop, e.g., that's where you can see also the probes that are being received by ICE.01:52:25And, another one is a profiler performance dashboards. This provides in depth historical analysis of the profiling service health and activity and this dashboard is crucial for monitoring the states and the performance of the profiler.01:52:47Service itself because you can see there are like multiple tiles among which like the most the most interesting will be the profiler average transactions per second that will help you to track.01:53:07And the profile service processing and to help you to understand and monitor for the use cases if those numbers are like going too high, so to identify if a profiler service already is being like overwhelmed with the request and is overloaded.01:53:26There is also like a tile for profiling props over time that identifies like the big events volumes to help administrator understand the system's tress points. So this is also for you to see if you have some.01:53:45Big period of probes usage on the unusual hours, so some abnormal behaviors like why some endpoints will be trying to authenticate on the hours where they like should not be even available for ice.01:54:03You can see the unique profile and points and the unique network devices. This shows the total count of the devices that are identified by system and this also will show you that like top ten of endpoints.01:54:22And not devices like to detect the chatty and points and nuts. Okay, so.01:54:39One last question for me. This is I would like to know if you actually currently using the system three 60, which is the monitoring and the lock analytics because we touched some dashboards on the lock analytics.01:54:55That helps you to get the view of your authentication data, so radius and the monitoring part of the system three 60 is actually helping you to get more detailed information about the.01:55:15Your eyes lots like every node what are the CPU, the memory utilization to keep it on the healthy track. And of course like there is also a possibility to generate custom dashboards tailored to your needs.01:55:34So this is the very useful functionality. I really suggest you to take a look at it. Okay yes, I see majority don't use it, so.01:55:49That's that's a good functionality if you're running ice three.two or later, you can already utilize it. Okay.01:56:05This is all from my part and now I would like to give the ball to the Emmanuel, so he could show you some profiling configuration APIs that you can use in i3.five to automate your profiling configuration.01:56:21Thank you, Tatiana. Let me share my screen and thank you for the correct explanation Tatiana, and now that we have reviewed how multi factor classification works, what type of policies can we create and how to monitor proof.01:56:38Groups using system 360I will walk through you walk you through how to leverage the new API calls that come to our system, our ice three.five solution to automate the main profiler and main multi factor classification task.01:56:54As mentioned by Tatiana, ICE profiling resiliency involves addressing high traffic scenarios and excessive resource consumption. The main focus of this pro ICE profiling feature is managing system low and to ensure the profile remains stable and operational under certain and.01:57:14Conditions. Along with other ICE API operations, there are two main API calls that can be used for profiling resiliency. E.g., by using the get API call, we can retrieve the default configuration that can also be modified or updated by using the.01:57:34Both API, which is 2nd one. And as you can see on the right side of the slide, there's there is a.01:57:53Granular information that we can retrieve and that we can use later to update this default configuration. In general, these API calls allows us to limit how to, how many updates are per minute an info can trigger before being suppressed. We can.01:58:02Also use the API call to update our configuration, our default configuration to set the thresholds to trigger actions like suppressing reclassification or event to protect our system resources.01:58:22Then we can also use these API calls as part of our daily operations to set the duration of which endpoints can be ignored before it is allowed to be processed again. These are the 1st two API calls that we have with ICE three.five.01:58:40And these two API calls are also part of our open API portfolio.01:58:59So this is available for everyone want to use and we can start getting the information via the get API even before to updating this data as per our needs.01:59:05In addition to this API to ICE API profiling resiliency, ICE three.five allows us to leverage API calls in different multi factor classification operations. 1st of all, by using the get API calls, we can either retrieve the custom or direct.01:59:21Attribute dictionaries with all possible options to create our profiling policies. We can also retrieve the current multi factor classification policies configured in our system or even export them in our PC in a JSON format and then use this information to create.01:59:41The Reports or to update our profiling inventory.02:00:01This is one of the key differentiator of using ICE multi factor classification profiling on three.five. If you want to use put, we can leverage these calls to update either a custom or a direct mapping policy or.02:00:06If we want to change the status of one of the policies or more than one policy, we can do so by using 2nd put call.02:00:26But in this case, we would need to add or define the policy ID so that we can change the status. And when I say change the status, I'm referring to set the status as enabled, which means we can enable a profiling policy or we can.02:00:36And also disabled the policy as per our needs.02:00:56We also have posts, which means for new profiling policies, we can make use of these calls to confirm if there are duplicate conditions inside a policy or we can create a custom and or direct mapping policy as per our needs.02:01:00And finally, and following other ICE API calls, we can also use a profiler API to delete one or more policies by using the profiling ID. So these are the available API calls that we can use. And again, these are also part of.02:01:20Our API portfolio that everyone can make use with ICE three.five.02:01:40But rather than just going into the documentation, let's have a quick demo. Let's review how the configuration and how to make use of these API calls in essentially in our ICE three.five system. In this case by using our tool or a well known tool called.02:01:46But before going into the API calls, before I start diving into the functionality of each one of these API calls, we need to start our configuration or our verification by checking if the.02:02:08Simplest configuration is available, which means the API settings. Remember that if you want to leverage the API calls, the 1st thing that we need to make sure it is enabled is the API server, service.02:02:25I'm sorry, if we have API service enabled, that means we will be able to use our API system or API or automation tool to send API calls towards ice. So that's the 1st case and.02:02:40I did not want to mention or to show this, but before I start with the automation journey, it is recommended to use our, admin users create a new API user so that we can use this API user in our API calls.02:02:58Instead of use any other admin user in our system.02:03:19Once this is done, the next part is to review, 1st of all, what is our current configuration. In this case, I only have one policy which is called webinar policy and it has been configured using direct mapping option.02:03:24In our case, I have created, I have imported postman collection that has all the available API calls for profiler so that we can see different functionalities based on the API call.02:03:40As mentioned, we have viewed custom dictionaries. We also have list of profile policies, which means we can list all the available profiling policies that we have in our ICE environment. But we also have.02:03:56The update option delete and either to enable or disable the policy. Let's have a look at the 1st two. 1st, I want you to see, I would like to show you, what is the response.02:04:11Again, this is one of our housekeeping option. I have created an API user in ICE so that I can use this API user for my API calls. Once this is done, I will use the 1st option, which is.02:04:27Retry the custom dictionary keys, and here I will see different options that will make use or that we can use in our profiling policies in MFC. Options such as IoT assets, IP, LLDP, MDM, MAC address.02:04:44Just to mention some that are available as the dictionary or as an attributes that we can use in our system to create the custom policies. This is the 1st type of policy which is custom policy.02:05:04After that, we can use the same call or similar call, but to retrieve the direct dictionary keys. These attributes can be used to create direct policies and as we can see, we have a little bit less of information in terms of attributes.02:05:20But those attributes are the one known attributes that can be used on our direct publicies.02:05:39Now let's have a look at this the 3rd, the 3rd apologies. Let's have a look at our 3rd option. The 3rd option is the list of profile policies.02:05:47Okay, I will go a little bit further in this case and the 3rd option will allow me to get all the available policies in our eyes, in my eye system, and then we will use two additional rules, two additional API calls to explain how to create.02:06:03With custom policies and.02:06:23Direct profile policies. In this case I'm also retrieving the information but not only the name or the policy ID, I'm also retrieving the attributes that are configured or the conditions that are con configured in this direct mapping policy. In this case, I only have one.02:06:26Which is MDM manufacturing configure. Once we have verified that our policies and our API calls worked, let's have a look at the update profiler. Again, this is how it the postman collections have been built.02:06:46For you, it will be pretty much easy to understand the structure as the postman collections come with examples like this, where you will only need to replace the policy ID field so that you can.02:07:04Oh, the API can send the correct communication and then you will need to define the name or even you can modify the direct rules that can be pushed into ICE directly. Once this is done, then we can directly use.02:07:22Our next calls, ok? So here I'm using the creates call so that you can also see what are what is here. And as we can see the the rule has been updated successfully, which means we can update the name or we can also.02:07:41Update the attributes as per our needs.02:08:01In addition to that, we are able or we have the ability to create policies, whether if this is our custom policy or if this is direct policy. And again, we only need to ensure that our structure is correct in the correct format.02:08:04In this example I'm using JSON so that the description, the attribute name and other attributes can be sent directly towards eyes.02:08:24I'm also using the other API, as mentioned, this is a post method that we are using, and here I'm sharing this information of the dictionary name operator. We we can also modify the operator as on demand. And here I'm using.02:08:35The same format which is JSON format that we can leverage and we can copy and paste.02:08:55For our needs. Once we are done with our policy creation, let's have a look and here we can confirm that we have created two type of policies. Custom policy, let's have a look at it. And here we are using DHCP as the condition.02:09:02With contains operator, but we have other operators as Tatiana mentioned and all of them are available in our API so that we can use these operators as well. And when it comes to direct mapping, we are using MDM manufacturer, a map to a MFC.02:09:20Table endpoint type.02:09:40Okay, here we are creating two policies and we are confirming that the two policies are also in use. Now, let's make a use of another API sorry let's use the same API which is the profile list of profiling policies.02:09:42Just to confirm that we are getting the updated data from ice direct. Here we are just confirming that we have created two rules and we are able to retrieve the information of all of the rules including the operator along with the policy ID.02:10:02And with this policy ID, we can also create or we can also delete the policy as per our needs. And here we only need to define or paste in this case our API profile ID.02:10:20As I'm showing and again this is something that we can create. Another option for our API functionalities is that we can export the profiling policies, and this is important to highlight because.02:10:37We have the ability to see the content, but also using the get export profile of policies. We also have the ability to export the policies in a JSON format, as I mentioned, and this information can also be used as part of our reporting or our monitoring or if.02:10:56When our inventory tool.02:11:16Here we are using a JSON format which is a well known data format and based on our scripting, we can create or we can modify as needed. And we also have the ability, e.g., to enable or disable the policy.02:11:18In this case, we have 1st two policies. Here I will show you that our delete call made effect. Then we only have two policies policy direct and the updated one, which is the one that I updated at the beginning of the demo.02:11:38If you want to enable or disable the policy, again, we only need to replace this field that contains on the postman collection and we need to set the status whether we want the policy to be enabled or we want the policy to be disabled using true or false.02:11:56Because it is boolean value.02:12:16Once we send the what we send the API call, we make the API call, we just need to confirm that the policy has been successfully disabled and we can retrieve this information again using our normal API calls that are being contained in our.02:12:19Collection.02:12:39And talking about postman collection, we have created a pro a repository with all the information, all the APIs along with the postman collections and an example of a script example of how to use these collections or.02:12:40For how to use these APIs in Python script. So here we are.02:13:00Showing we are sharing these postman collections so that you can also make use of them in your environment once you're starting using ICE three.five with MFC profiling. And again, this is in addition and as a compliment of.02:13:07Aware of what our colleagues showing earlier, which is in this case the traditional profiling. This can also be used in a compliment or in addition to the traditional profiling. Okay, along with the new profiler.02:13:23MFC rules, it is also possible to leverage endpoint analytics on ICE itself, as mentioned by Tatiana. However, in case a customer has catalyst center and ICE integrated, which means an SDL environment, we can also make you.02:13:43Use of this integration with endpoint analytics on catalyst center and use this information in the authorization policy on ICE.02:14:03So let's have a look at it. Let's see how it works. But before getting into the technical details, let's make an understand of why or what is unique in our profiling work and why do we need to consider profiling everything as much as possible for.02:14:13Support to reduce their own knowns that has how it has been mentioned in this.02:14:33In this session, but we also have the ability to get granular profiling using different methods and strategies, functionalities such as deep packet inspection. We can also use.02:14:39Machine learning to offer some suggestions as mentioned in the past as mentioned in the session, we can get some proposals from machine learning and AI, and then we can get additional context from other sources such as as such MDM.02:14:55CMDB etc.02:15:15And then we use this information to get more visibility, aggregate input context from multiple sources, and then we can even get a support of more than thousand application protocols that will help us to get even more details from our endpoints.02:15:17One of the important use case that has also mentioned in this session is how do we implement or how do we improve our profiling so that we can not only profile endpoints such as PCs such as.02:15:37IP phones but also IoT or OT devices. This is a great example where this type of integration can also benefit and when we talk about this type of integrations, we can help the device owners to register devices and also assign granular.02:15:55Access policies using the endpoint analytics attributes on our ICE profile policies and our ICE authorization.02:16:14When we talk about endpoint analytics and I'm sure this is something that we have already seen, we have basically four type of labels or four labels that we can be used depending of the type of endpoints that is being profiled.02:16:241st of all, we have the device tab, whether if this is a laptop, CTS scanner or a smartphone. We also have 2nd label which is the hardware model. If this is MacBook, Optica or even a galaxy, a phone.02:16:41And then we have hardware manufacturer, meaning if this is Apple, if this is Samsung and operating system, e.g., if the Mac, it's a hardware manufacturer managed or hardware manufacturer that belongs to Apple, that has an operating system called Mac OS.02:16:5609:14 dot.02:17:16Of six. This for labels can also be seen into catalyst center or also similar labels can also be seen via MFC and via endpoint analytics in our eyes context visibility as shown.02:17:17Error in this session.02:17:37Now, if we want to talk about a little bit more about based on the packet inspection, then we have this use case where our endpoint, ok, when our scanner, the CTS scanner joins the network and starts sending information.02:17:40Into our network via the switch, e.g.. Then via catalyst center, endpoint analytics and the packet inspection functionality on the switches on the catalyst, e.g., catalyst 9090 hundred. We have on 9300, we have the the packet inspections that retries.02:17:58Information directly into the switch and sends this information into the endpoint analytics so that we can also make use of endpoint analytics.02:18:19And multi factor classification similar of what we are doing on ICE. And in this case, we have endpoint type manufacturer, we have model and we also have the operating system, which are the four labels that we can use on catalyst center, but we can also make use of.02:18:29Our eyes in specifically in our authorization. So in this case we are also using the automatic system rule updates and we also talking about the endpoint analytics and the multi factor classification approach that we talk with ICE in this session.02:18:48And with this, we are able to integrate or we are able to exchange information between Catalyst Center and Cisco ICE so that we can build and improve our segmentation strategy, not only by improving their visibility, but also by.02:19:09Including or by.02:19:29In improving the segmentation via other ICE functionalities such as Cisco trussec, which means based on the multi factor classification and based on the different attributes such as endpoint type or operating system or even the score.02:19:31We can add specific permissions as part of the hour authorization.02:19:51Policies and our authorization profiles. If we have an example, this is our ice three.five and here we are using different endpoints and as we can see on the right corner on the right side, we are able to.02:19:57To Map MFC or we are able to retrieve MFC endpoints attributes, e.g., the endpoint type, the hardware manufacturer MFC hardware model and MFC OS type similar of what we discussed earlier in this session.02:20:17But in addition to that, once we have ICE and catalyst center integrated via via normal integration, we are improving and we are getting more data that we can also use in our.02:20:33Owned profiling and and our own authorization policy on ICE. E.g., in this case, we are using virtual machine, we are using endpoint type, hardware manufacturer, and this information comes directly in our Cisco ICE context visibility, but in addition to that, we are all.02:20:49Also using process core, we are retrieving process core that help us to map this information into, as I mentioned, our authorization policy.02:21:09And here we have different type of endpoints, right, the endpoint attributes and these endpoint attributes comes directly from endpoint analytics or endpoint analytics hierarchy. We can also make use of ServiceNow attributes, e.g., and.02:21:21An an addition and based on different labels and different engines.02:21:40In catalyst center, we can retrieve this information in a way of a trust score that goes, e.g., from one to ten, and then we can use and build our policies similar to what we have here.02:21:45In this case, we are retrieving the information from endpoint analytics, device type is printer, but we can also, e.g., we can also have this type of attribute of device type from one of the four multi factor classification label that comes directly on ICE. This.02:22:02Is also part of our.02:22:22A strategy to increment or to increase our visibility and improve our segmentation strategy. Again, in this example, what we are doing is adding a device or creating a policy that we can use, e.g., along with a printer.02:22:24We are adding an additional attribute that is the trust score, which is in this case less than four, and the trust score, as I shown in.02:22:44In the previous slide, the trust score is six, e.g., but sometimes it can be less than four, it can be three or it can be two. And when both conditions match, this is where we are then assigning an authorization profile and or an.02:22:55SGT that then we can use in the future for our segmentation or our visibility.02:23:15And with that, I would like to take some seconds for a minute to open the mic and ask or confirm if anyone has any questions that we can help to answer at this moment.02:23:23Tatiana, I think there is NO questions open in the chat. I'm trying to look at the chat. It seems like there's not correct. Yes NO new questions, so.02:23:44Okay. I really like to if you have any questions regarding this topic, it might be not even the part that's me and Emmanuel covered if you have questions for the earlier parts. It's also you can address them now.02:24:02And so we will answer them. I think in the meantime while we give you like some time to ask your questions, Veronica can do some few slides about the upcoming sessions.02:24:18Thank you and thank you Tatiana Emmanuel for sharing this useful information about all new features that we have in ICE 3.5. I'm pretty sure they will be useful. So before we wrap up, let's move to the next slide, please. We would like to share some free educational service with.02:24:34Provide one of them is cyber capsules. I've shared the link to access the cyber capsules in the chat, but feel free to use us for the QR code here.02:24:54Cyber capsules are is a series of videos that provide recommendations and best practices on how to use the certain products. Each video is around ten to 20 min so quite short, and these videos are help are there to help you with.02:25:06Posture of your specific products so once you once you open the link you will see per product videos in the page. Okay, next slide please. And if you found the decision helpful and you would like to learn more from our team.02:25:24See our upcoming sessions especially day two of our zero trust bridge series, which happens in a week where we will talk more about integration with Catalyst Center segmentation and as well AI analytics from a catalyst center site, so stay tuned. We also have webinars for.02:25:42Secure firewall happening in June and Duo as well.02:26:02I pasted the registration link in the chat, so feel free to review what's coming up and register for what is of interest to you. And, as we mentioned in the beginning, your feedback is really important for us and it shapes future sessions so they.02:26:07Align with your needs. Once this webinar concludes, the survey will automatically open in your browsers. So please take a minute, let us know if you like the session. We would like to know what kind of topics you would like us to cover next. So feel free to use this option that we have.02:26:27For you.02:26:47And a big thank you for your time and attention. We hope you found the information that we shared helpful and we will see you in a week. And I would like to also thank our presenters and panelists for sharing the knowledge with us today. And with that, have a nice day.02:26:47