Day 2: Cisco ISE meets Catalyst Center

Oh good morning, everyone. Thank you for joining us. Today we are going to continue our journey with the zero trust breach expert inside series. Last week we talked.00:00All about ICE profiling, and this session is focused on 2nd part where we move from visibility to segmentation and we will talk about connecting ICE and catalyst center.00:20Next slide please. Before we start housekeeping points, we want this session as always to be interactive, so feel free to ask your questions in Q and A panel. Just make sure you select all panelists before you hit that send button. We are ready to answer your question.00:32Questions. Next slide please. And let me introduce the team for today. Our presenter for today will be Peta and Ondra and myself. And without further ado, let me hand over to Peta.00:51Alright, thank you Veronica. It's a pleasure to be with you on the, on this second session or day two of the, of the series. So what I'll show for you today or what I have prepared for you, there's a couple of interesting topics. Of course, we'll talk about why you would want to integrate in the 1st place, some of the benefits that you will get out of the integration.01:11I'll start with the lower hanging fruit when it comes to assurance.01:31Some automation and what you'll see also, what's a little bit new in three one version of catalyst center. Then we'll jump into how to actually integrate. We have a small demo of the workflow itself, some prerequisites, and then later on we'll go on the a little bit deeper when it comes to segmentation, when it.01:36Comes to, you know, what it is, if you never heard about it before or, you know, we're gonna talk a little bit about what that can bring to you and your enterprise.01:56And how you can help manage it also, not just on ICE itself, but together with catalyst center, how that can also be a little bit also not just automated, but how you can also provision it as well. And then finally, we'll talk about AI analytics. Last but not least, of course, there.02:06There's a lot of interesting use cases there we can we can talk about and also I have a few slides prepared on how to actually enable it because this might not be something that's.02:26Covered well in the past or some of the documentation, it might be a little bit scarce scarce there but we actually have some links prepared for you. Veronica will drop them in the chat for you so you can also immediately grab them, bookmark them or whatever you need.02:37So yeah, and of course like Veronica mentioned, feel free to use the Q and A panel to to ask any questions, right? All right, so to get on with it, so why you would want to integrate these two products together? One note that I have to get out of the way.02:52Right right now is that SD access is not a requirement for, at least for this assurance and automation sections that I'll show to you just now. So of course when we talk about segmentation is gonna be a different story, but like I said for the lower hanging fruit, you don't really need to go for SD access, right? And sometimes when I speak to customers.03:10Whenever there's a catalyst center and ICE in the same picture, there's usually the, a little bit of the thing that well it has to be SD access or SDA. No, it doesn't have to be, right? So you can pick and choose what kind of benefits suit you more, and then you'll see that not everything needs to be immediately going into the SD access world.03:30So, the very 1st thing is this is where my colleagues on the previous session did a really good job explaining about how the different profiling works on ICE and how that's a lot more powerful than just that you can see here without it.03:49It's not something that we can get for wired clients, e.g., especially we cannot really get that information just out of the box, right? So this is where, we take that very powerful profiling capabilities from ICE.04:06And we try to have it more integrated into the assurance dashboards you can see right away, you can get a lot more information about the device type itself, and you'll see we'll go into a lot of more details about what kind of additional information you can expect to see, what kind of labels you can work with. Of course, the other benefits you can see is also if you.04:21Using.1X.04:41You can see the username as well of the particular user and that can be really useful. You'll see in a couple of next slides that can come in really handy. One thing to of course say is I mentioned here on the slide is for wired clients. When it comes to wireless clients, we have the capability to leverage this kind of information from the 9800.04:43But in this case for wire clients it's not so easy, so this is where ICE really comes in handy to, to help us out to get a lot more of the contextual information. And of course I'll mention how that actually works in the background in one of the next slides as well.05:03So to give you an example for, let's say some kind of troubleshooting use case, let's say a user calls in, he's not really happy about how his day is going. Let's say in this example, we have George Baker, you know, he's saying he's calling in, you know, there's some kind of problem, but he doesn't really tell you, you know, what device it is or doesn't really give you a lot of information.05:17In general, so what can we find immediately when you search for this user? Of course we can see that what kind of group it belongs to. In this case it's marketing, of course not.05:37Let's say, in this case, yeah. So we have also not just the the the marketing group that he belongs to, but also what devices we have that belong to that particular user. So like I mentioned, if he's using.1X to actually authenticate on more than one device, you can actually see.05:49All of those devices that belong to it. So we can leverage this information from ICE as well, so we have this information like it says here for who, what, when, where, so a lot more contextual information rather than just the raw networks telemetry sources that we have that you can see from the MAC address or IP address.06:07And this helps you in the way that you don't really have to jump to that awkward dance of having to ask them, hey, what's your MAC address? What's your IP address? And in this case, imagine the Mac address is particularly a nasty example where you have B88D Did he really say a B or a D? And then if you're a little bit fancy and your user knows.06:25You know the alphabet then still that doesn't help you that much in case, e.g., during the middle of your troubleshooting, he moves around, connects to a different, maybe even a different, different network or because we have a lot more randomized Mac addresses these days.06:43Even if you put that one MAC address, there's NO guarantee that it's gonna stay the same next time you try to troubleshoot with the same user, right? So having something to tie that information down to a particular, you know, contacts that you can use can be very valuable and especially.07:02Speed up the the troubleshooting effort. So where you might see this especially if you go on the assurance dashboards, of course, if you're familiar with how assurance works on catalyst center, you know that we have all these different three 60 views.07:18So we have the, the device three 60, the the client three 60, but what some are not really familiar with is that we also have the user three 60 view, which in this case is when you put in the search bar, the username of the particular person you're trying to, to help troubleshoot something for, you notice that we group all of these.07:33Different devices.07:53Under this one umbrella, e.g., this user three 60 view. So you can see all the different tabs for all the different devices. These are all essentially client three 60 views grouped in one place. So easier to, to find all these different things together, right? And then when you're looking into it, you'll see it's pretty much the same. If you ever used it before, it has all the all the same.07:55Client three 60 details.08:15And speaking of those extra client three 60 details, we have now in version 313 and onwards, we have some additional things that you get when you integrate ICE, when it comes to the assurance contextual information. In this case, you're able to see a little bit more about if there are any failure reasons.08:17That come from ICE or some kind of triple AAA issues, you'll be able to get a little bit more information out of it than before. Before you could see, hey, there's a triple A problem, but not really that much more out of it, right? In this version, we also have the live logs integrated as well, which I think is a great feature because you don't have to then jump from one.08:36Dashboard to the other, just to troubleshoot a little bit.08:56When it comes from the ICE perspective as well when it comes to the radius live logs, e.g.. And of course you have this in how this looks to give you an example in some of these screenshots. So if you go again to this same client three 60 view, you'll notice that below the the timeline, the help bar, we have, of course, the, if there's an onboarding issue, which.08:59Which is the issue when you're trying to connect to the network, you'll see there's a failure, but then it says also the reason itself, so authentication rejected by AAA server and the actual details is failed to negotiate, e.g., EAP for whatever reason there's an issue with some of the inner methods MS chat, whatever, you'll be able to see that as well. And.09:19And if you scroll down you have the troubleshooting three 60.09:39Let's say pie charts or pie views or the circular view you can see it here. If you click on the view details of that one, you can also see, a little bit more when you click on the AAA, you can see a little bit more about the reasons as well, but you can also see the other top ice failure reasons. You can get an idea if what you're seeing is, you know.09:43A little bit of a, let's say isolated issue or is it really something that's more systematic to your particular network that you're looking into, right? That this user belongs to? In this case you can see there's.10:03Of course the failure to negotiate, but there's also some peep failures with the handshake and stuff like that. That's really gonna depend on your network, but if you end up integrating these two solutions, I would say it's good to keep an eye out for it whenever you're trying to troubleshoot some connection issues.10:13And I mentioned of course you have the live log view, which you can now see if you scroll down a little bit more, we're still, we are still in the client three 60 view. So if you scroll down a little bit further down below, you'll see we also have the event viewer, which is just the chronological view of all the different events that are happening to this particular client, and here.10:32When it comes to the authentication part for the ICE, you'll notice if you click on it to get a little bit more details, you'll see we have the ICE steps themselves, which is.10:51I think pretty great because these are the actual live logs from the ICE that you can see within the event viewer. So you don't have to go and open another tab, you don't have to then remember how you log in on your ice server, e.g., if you're already logged in on catalyst center, you can see it from there.10:59And if you see, you can also see a little bit more information about the authentication profile itself and, the security group et cetera etc. So you get a lot of information just from scrolling down a little bit and just clicking on a few more extra clicks here. So all in one place, I think it's a great little feature.11:14To check out. Now that was when it comes to assurance, switching gears a little bit more to the automation perspective, where can this integration help you as an administrator or someone who has to configure some, some of these things is.11:33When you have the integration complete, you can go into the network settings. So if you have your network hierarchy all set up and you have your sites and everything ready, you can go to the network settings and then for particular sites you can actually choose to add the triple server. And in this case it's a bit of an older slide. You can see it says DNA center instead of catalyst center, but I left it here because.11:49It's actually easier to put on one single screenshot. The new version has it in different tabs, so it's not as nice, but in this case you can see we have two different ways that you can add your AAA server in this case the iserve itself, so you can add it for when it comes to the network.12:10Let's say purposes or the client endpoint. So when it comes to the network, imagine it's for your own network devices. When you want to SSH, e.g., to a device, this is where you can set up that it goes to ICE for authentication, right? So it's more for your network management perspective. You also have the clients or endpoints.12:26And this is where you can set up an ICE server where if you want to have, like I mentioned.1X for your for your network, for either on the wire side, the switches or if you want to have it on the ssids, e.g., this is where you will have it for your particular clients. So here you notice when you want to select.12:44Either one of these, you have to add 1st the pan, which is more of the administrative node, and then you have the option to add the actual PSN node or the service node that you want to use, right? And this will also depend on how your interfaces are configured, but always make sure to select.13:03The one that you expect to be used when these devices are communicating between each other, right? The PAN is there just as more of an admin view to see which ICE server you're actually communicating with. Alright, so once you have that actually set up as well and when you provision some devices.13:18With these particular network settings that we discussed in the previous slide, you notice that we also have a way for catalyst center to push this information to ICE to add these network devices on ICE itself. So that means that you don't have to go then when you're, let's say provisioning a new site, you're adding a hundred new switches, you don't have to then add.13:39Add these network devices specifically on ICE caller center will do that for you. And as well, any updates?13:58Of these devices that change in the meantime that can also be pushed to ice. So catalyst center can update ICE with all of these different changes. So this is also one of those things that can help you a little bit with provisioning any new changes or provisioning new devices, e.g., there's a lot of different things.14:05That here can be a little bit more automated in a way.14:25And speaking about updating ICE with changes, if you're maybe familiar with the RMA workflow of how that works on catalyst center. So if you have, let's say, provisioned some of these switches or devices or access points, in this case it's an example for a switch.14:30We save this information on catalyst center in the inventory, so we know where the device belongs, you have to assign it to a site, and we also know the configurations that we have on this particular device. So if this device dies for whatever reason, you can initiate what we call the RMA workflow, which is just saying you're gonna mark.14:47The old device for replacement, and then you can either do a plug and play where you just grab a switch from a box, plug it into the same position or you can just grab another switch from inventory if you wanted. Then we push all of this configuration again including you know all of these different certificates we had before and also we update Cisco ICE in the.15:06Process.15:26When this RMA workflow is complete. So that's also one part of the workflow where it helps you automate, so you don't have to worry about when you're swapping devices that you'd not forget to, to update anything as well. And speaking of one thing, you can also automate if you're using, let's say the intent.15:27Based workflows from, from catalyst center to help automate your wireless network or your wireless controller. Then one other benefit you can get out of it as well is.15:47You could, let's say just do the more simpler.1X networks, of course, for let's say for your employees that you can also provision these ssids and you can also add the AAA server that you, you have integrated. What you can also do is automate a little bit about the guest network as well. So when you add a new.15:57SSID, you have the option of choosing do you want the employee, do you want guests?16:17In this case, if you choose the guest one, you can have a different portal that you want to use. So in this case, a popular example is the central web authentication or CWA. You can automate that using Catalyst Center, where you can also choose.16:22What type of portal you want, right? And here, of course choose the which is server you want to, to have it belong to. And then you can also customize this portal, not a super well known feature, but you can also do it. You don't have to, let's say depend on whatever default it is there, you can customize it and you can also.16:38Like the different pages here that we have, e.g., the login page, the registration page, the success or failure pages, the logos, et cetera, et cetera, right? So that's something that can help you out a little bit, especially if you're not familiar with how let's say central web authentication works, it's easy to forget to have, you know, a checkbox here and there, e.g., for macfill.16:58Did you forget to put the radius snack, the AAA override, e.g.? So there's a lot of these different checkboxes that can be automated as well.17:19It's in catalyst center and then it also adds the pre authentication access lists that allow the communication to happen towards your ICE servers so you don't have to do that yourself, and it also helps prevent any loops that might help that might happen if you didn't put this portal properly in that pre authentication access list, alright?17:26That's before getting, giving the user the full access.17:46So that's something that's also done for you if you use it this way. Alright, so those are the, let's say assurance automation, a little bit of a lower hanging fruit. So how you actually integrate.17:49These two, these two things together. So when we talk about the catalyst center nice communication 1st, there is a couple of protocols that will happen in the background that we use for different services and then you'll see that we use.18:07For assurance perspective, we use a lot of the PX grid context that we get out of, ICE, but to 1st get that kind of sharing with happening, we also have to make sure that we have the proper trust established the relationship and also we use the rest API or the ERA.18:25S API to actually tell ICE what we need and who we are in this case catalyst center. So you'll see this process is going to revolve around these particular settings.18:45And, we'll also drop in the chat the, the actual administrator guide on how to do it. And in this case, but the important thing is to mention, of course, Services is very important to have enabled and also ERS for the actual REST APIs to actually configure these things. Of course, you.18:57Will need to have super administrative privileges as well. This is not something you can do if you have.19:17Read only on any one of these two, platforms, you will need to be a super admin for this to actually allow you to, to execute the integration workflow. If you didn't finalize yet your certificates, now is a good time to actually do that. Finish that up if you especially if you're signing anything with an external certificate authority.19:23We always say, get that done 1st, have everything when it comes to certificates in order before you go ahead with the integration. It's a lot easier to integrate if all of this is already in place than integrating than having to remove that integration, then change.19:43The certificates and then redo it again. It's better to just do it once rather than twice, right? And talking about certificates again especially if you have a three node cluster and of course if you have the virtual IP or VIP, always make sure that all of those IP addresses are mentioned in the certificate itself. So.19:57There there's NO way of.20:17Some mismatch happening when we're trust trying to verify the trust relationship between these two different solutions. And of course mentions the, the IP address or the fully qualified domain name must be present also in the subject field name. So that FQDN is also very important to keep in mind when it.20:19And of course making sure that none of them are actually expired.20:40Kind of goes without saying but always make sure that there are valid certificates. So how this works in the background, of course we have the catalyst center, either a single node or a cluster. We reach out to the ice server itself in order to push this kind of configuration that we had in mind for the integration.20:44But of course we also established this kind of trust and this is where those certificates come in.21:03Where we exchange those and it's very important that they actually match the IP address and the FQDN before we can actually say that this is gonna be trusted. The next step is that we'll have catalyst center using these ERS APIs and he's gonna ask for getting the certificate of course for the PX grid itself so that we can get a little bit more about that contextual.21:09All information I was mentioning before, right? So this is where we'll also exchange the PX grid certificate, so a lot of certificate work that happens up front.21:29That's why it's super important to have it all, all cleared up and ready to go. Otherwise you're not gonna have a good time integrating. Alright, so to show you how that looks in a little bit of a live demos, there was a lot of talking there, but to show you here, if you go on the system page, the system.21:38Three 61st. We'll show how that looks here. So you notice under the if you scroll down there's this.21:58Externally connected systems and you'll see there's NO ice server configured at the moment. You can also click configure here and then we'll jump straight to this page where, you can go to configure the authentication servers or you can go directly to this page in the system settings.22:04It's up to you how you want to go about it. In this case, we have the dropdown, here with the add button, make sure to select ICE, and not AAA. In this case ICE, we put of course the, the server and everything there, but we're jumping 1st to ICE to get some things out of the way 1st, we go to the administra.22:20Your deployment page and what we usually recommend doing here is to grab as much of this information here as copy paste from here as possible especially the FQDN. So here we have the, our, you know, the host name, the FQDN the IP address as well. So like we said, the best practice here for us is just copy paste from there, right?22:40So we have the, server IP address. Of course, this is for our ICE server, and then the next thing we have to configure is this shared secret. The shared secret itself is going to be what we're going to push on devices themselves in order to establish that trust that key with the ICE server itself, right?22:58So this is that, that shared secret or that key, for the radius part.23:18The username and password that's going to be for our ICE, of course. And in this case, make sure that's correct. And here the FQDN like I mentioned, always the best idea to copy paste that from this deployment page here. And then you can see the advanced settings, we have of course the connect to PX grid that's going to be by.23:25By Default there make sure that's not disabled and of course all our other radius parameters.23:45We're gonna leave them as is. One other thing you can do in ICE, if you go to administrator and PX grid services in the settings, you can automatically approve any new certificate based accounts. This is not by default, I believe in in the newer versions or if you don't want to do this, you can also manually approve the PX Grid here.23:49Going back to catalyst center, we're gonna click save and then you'll notice at least for us in this case.24:09Because we're working for this. In the lab, we don't actually have, a globally trusted certificate signed, we're just using self signed certificate for our purposes, you'll notice we got an error saying, hey, you know, we don't know who this is, there's this certificate is not trusted. Do you trust it, do you wanna continue, right? For our case, don't do this in production, of course, but for our case in the lab, we're gonna.24:15Like accept.24:35And you see it doesn't take a long, this is not sped up in the video itself. It's, it's pretty snappy here for us, at least in the lab, right? And then you have the option to click to go back to the three 60 view. And in the three 60 view, you'll notice now we have our eyes, we have the primary, the PX grid notes. You can see that they're available.24:37What I can recommend here is to also, after the integration is complete, if there are any issues with the integration that might occur after some time. And usually what I've seen from customers is sometimes the PX grid certificates, if it gets renewed or it expired, you might notice here that your primary.24:55Communication, your primary server is up and available, but the PX grid is not available. So what you can do here is you can click on this update and then you can reinitiate that as well to come back.25:15Alright, so to walk you through a little bit more, we have these also some additional slides here that wasn't mentioned in the, the demo video itself is of course you have to enable the ERS APIs themselves. So in this case you notice that the.25:28You go from the administrator in the system settings, you click on the API settings and then you can see you navigate here. Of course, this is going to depend a little bit on the version of the ICE server, how it looks so it might change a little bit where it is in the settings, but the general idea is still the same. We need the read and writes.25:46Access for this integration to work properly. Step two enabling PX grid. So in this case, if you don't have a PX grid persona on your, any of the ICE servers, then you need to be having at least one of them enabled and active for us to communicate.26:04With, so in this case it's going to be used for, like I mentioned the.26:24Protectional information sharing. So that's very important for our assurance use cases that I was mentioning before. So in this case, it's important to have that enabled as well. You can see here where it looks, of course it might also change a little bit based on the ICE versions, but this is the general idea to enable the.26:28The PX grid persona there. Usually it's in this deployment section or deployment screen on the iserver itself.26:48And when it comes to the catalyst center itself, I won't bore you too much here because this is what I showed you in the demo itself. But it's very important here when you're selecting from the system settings to add the authentication policy server to make sure to add as ICE and not as AAA, because we have this additional contextual information.26:58Information with the and stuff like that that we get from, from specifically when we go and add an ICE server, right? So make sure don't to select the correct option here.27:18And finally, on step four is where if you didn't have that setting where you automatically approve certificate based requests for PX grid clients, here on the ICE itself, you can go on the PX grid services in the administration PX grid services menu.27:29You can go to the client management page.27:49And here you can navigate to the different clients that you have, and then you can select, in this case_client and then you can you know do the approve button and this will then enable from pending to to enabled the the client for catalyst center and this will make sure that we can.27:52Actually communicate using create Grid between these two products.28:12All right. And finally step five, you go back on catalyst center external services, either on the three 60 view like I showed you in the demo or you can go to the application policy servers, then you can see it, in here as well. You can see it's now active and then you can click refresh, you can check again.28:16From time to time just to make sure that everything is as it should be, right? Alright, so that's about how we integrate stuff and now talking about a little bit more advantages you can get out of segmentation a little bit let's say more advanced topics especially when it comes to SD access.28:33So why would you want to use that versus, you know, staying on a more traditional network? So this is another big benefit that we get out of leveraging ICE for us as well.28:54So traditionally, when you look at about the, the network itself, you would either use on different regions, some different access lists or different locations would have different, let's say network segments or different levels of access you want to give to different, users and stuff like that. So it's always a lot.29:06Bit of a challenge to actually try and.29:26Maintain that kind of control and also try to keep it up to date. And you also have a lot of different stuff you have to keep track of, so it's not as easy to do as it otherwise could be. To give you an example, you know, if you have.29:29In this kind of scenario, we say that home, let's say if you have a lot of source and destination policies that you need to make, there's a simple math here that you can do is if let's say we have one source.29:46Of users that we need to do to six different destination let's say networks, then we can say source multiply by destination by let's say we have four different permission types that we need to do. So that's easily 24 lines in your one access list for this one particular group. But if you have more.30:03Users in this case we have add up to four, then you notice that easily escalates and easily expands into a lot more different lines within the access lists and.30:23It's really a nightmare to manage, right? And especially if you consider that you need to keep those access lists up to date and also present on all of the different, let's say network devices, switches or whatever, it's really a huge hassle, right? So where.30:33It's and if someone comes in into the whole network, let's say they didn't, they weren't there from day one, they don't know the network inside and out as someone who started out might in that kind of company might be, if you look at this kind of thing, it's really not easy to figure out what's going on here, right? Can you really spot what we were trying to do with this, kind of access?30:48This list, right? And this is where we come with the, the story of the.31:08Of the trust tech, right? The CTS or trust tech services as well is where we're able to actually separate a little bit from that kind of, you know, network segment type of thinking to more thinking about in the way of different user groups.31:14Or in this case, you know, the different kinds of users you can have and then we attach to their username or different user entities. We can attach these different we call them sgts, right? We're able to map them and then it's a lot more easier to actually move them around. You don't have.31:29To worry about which network segment they're connected in, it's a lot more visible as well, so there's a lot of benefits to to go and it's a little bit easier to actually figure out what's going on based on this, right? And it's easier to maintain. So how this looks when we talk about this in an SD access fabric.31:49So you have your catalyst center on the left, your ice on the right. We have e.g. the access matrix that we have, which we can use to define which group of users let's say from the source side can actually reach what kind of destination resources on the top. And this is where you can be very much, very granular.32:05Or very much global if you want to, so it really depends on what kind of needs you want to go about it, right? In this case, we have an employee example and a contractor example. So when your user.32:25Logs in or authenticates to the network, the switch is able to actually download those kind of policy information from this particular user so it knows which kind of group it belongs to, right? So in this case, when we're going from, the same from the employee, the contractor, when they log in, we get this information and then when traffic.32:36Is happening, right? We're able to actually check this matrix and say, hey, so we have the source.32:56Which is going to be our employees. We try to do the destination. In this case, it's a contractor. We see in the matrix source here on the left on the top, the contractor, we see it's denied, so in this case that kind of communication will not happen. So it's much easier to actually manage and change, in real time as well and these.33:01Processes will then be pushed.33:21On all the applicable devices, right? You don't have to do this then you're manual, you don't have to think about which switches you need to update this to. It's what these catalyst center will do for you. It will, you know, you just tell it what you want to do and it will worry about how it's gonna do that in the background, right? So this is where it can be very interesting. When we're talking about the segmentation, we have two.33:23Two main, let's say concepts that we want to talk about is usually we have the, the macro segmentation and then the micro segmentation. So what's the difference between these two? When we talk about the macro segmentation, it's more about the more let's say global or more.33:43Let's say, hard disconnect between the the different users. So in this case we would say that we don't expect to see any kind of communication between these different user groups. E.g., here we have our employees users and then we have our IoT devices. Usually we don't really want one of these to communicate with.34:01Each other bearing some exceptions, of course, but.34:20For the most part, we say this is gonna be a hard separation. We don't expect to see any communication and the way this works in the background is with virtual networks or in this case the macro segmentation side, we use VRF, so that's going to be pretty much a complete isolation between these between these networks, right? And the default policy, like I said is.34:23Going to be there's NO communication. If there is supposed to be communication, that's something that you usually have to jump a little bit through different hoops to do a route leaking and stuff like that. But in most cases we say we don't really expect there to be any, right? And that's what we encourage you as well. When you're deciding how many virtual networks you're gonna have to keep in mind.34:42How much communication between these groups did you expect to see, right? And how much you would need to invest in actually enabling and then trying to police what's happening there, right? To make sure that nothing wrong goes there. And then if you want to have a little bit more.35:02Let's say control within the group itself or within the fabric, then we have something we call the micro segmentation. This is where you're able to assign within your virtual network additional security tags or contracts. Then we can say, ok, we have these particular users.35:19They're gonna be with the employee tag and these other users are gonna be contractors et cetera, et cetera, right? The same for our different devices as well. You can have cameras, you can have printers, et cetera et cetera, within the network, then you can decide if you want to allow or disallow or deny communication between these different groups, right? The default in this kind of scenari.35:34Area, but you can also change it. It is to have permission or it's permitted to communicate within the virtual network. So that's by default, but like I said, we can change it and I'll show you that in our little demo as well on how that looks when you do it through Catalyst Center itself, right?35:54And also because I was mentioned, you can do it through caller center, but you can also still keep the administrator of this kind of matrix being done on ICE itself. I'll show you in the demo where that settings are, but by, by default we let's say in this demo, we're gonna assume that you're gonna be using it, e.g..36:12Just one ice let's say one call center instance with one ICE server instance, but if there's of course some variation in there, so there's different, let's say best practices that we can say in this case if you're managing just a single matrix, then it's ok. It's, it's, you know.36:32You can do it from catalyst center itself, but if you need to manage more than one matrix on your particular network, then this is where that would be more present on the ICE server itself, and this is where you can have the enforcement being done as well.36:52Per different matrix being done, right? So this is really a decision you have to make. Where do you want to manage this user matrix when it comes to the permissions themselves. But in this case you can see here in the menu you have the option of either doing a catalyst center or keeping it on ice.37:08All right. To show you how that looks in the actual small demo we have here for you. So here I'll show you when we go to our policy and group based access control.37:28We can see that in our overview menu here, you can see that we have sorry clicked wrong but let me just restart that now, so policy.37:43And group based access control. So immediately in the overview page, we'll have the, the control of where you want to do this kind of migration, right? So here we can click on the start migration, and this is where we tell that, hey, we want to have this control on.37:59Catalyst center. We want to have our SGT definitions and matrix being controlled by Catalyst Center and not by ICE itself. Here you can see the progress, how it is, that happening within here in this section and then here if you click on this link, it will take you to that thing, but we'll look at.38:14That later. When look at the policies, you can see here the matrix I was talking about, you can see the the source on the left, the destination on top, you can see you can define how each of these flows is going and you can see here the default is permit IP, and this is where you can change that as well on the, on the top right.38:34So if you click on that, you can get a little bit more options there's in the security groups, you can see that here we have all the different sgts that you can assign to your different, user groups or user entities, always a good idea to make sure that you check the other pages as well.38:52Happens sometimes to me as well that I forget that we have two more pages. So, yeah. And if you click on the group based access control configuration here, you can see that kind of menu we have from the screenshot where you can select which, who do you want to be the administrator for the this kind of thing is the catalyst center or ICE itself? So if you did from the overview.39:09Thing where you start the migration, we assume that you want catalyst center to be the managing point of your policies, right? So in this case, we'll show you an example of a couple of different endpoints that are connected on the network.39:29So if we go on this particular switch, we'll show you on a couple of different ports how it looks like for our connected wired devices. So in this case show authentication sessions on this gigabit interface, we see we have our user John.39:41And with this IP address, eight oh three, of course you can see different information as well including the SGT value four, so this is going to be our employees SGT group, so you can see a lot of that information already just from the switch interface itself rather versus if you're looking at it from an access list, that will be a lot more hard.39:58To figure out what, what is and where.40:18Another user here, Sam, it's going to be also in the same AGGT group value four. So those are gonna be our two wired users, but we also have one from also from wireless just to show you that this fabric can extend seamlessly between wired and wireless, so it's not something that you have to.40:21Worry about in a different network segment, they can all share the same also subnet and then you can subdivide it like we mentioned with the different sgts and the different.40:41A segmentation policy that you want to run on this network. In this case we have eight.four IP address debbie. That's going to be our wireless user, right? So what we want to do is in the background, we're gonna run a continuous thing between.40:51These different endpoints so that in this case can be any kind of traffic, of course, but we're using ping to just demonstrate how that communication happens, right? Back in my college days, we used to run a small quick server to check if we were able to communicate between the different devices, not that our professor really liked it, but whatever works, right? In this case would.41:08It's gonna be boring and use a small ICMP pink that's continuous, right?41:27So what we want to show you in this case is, we go back on the policy and the group based access control. Imagine we want to say, hey, these guys are, you know, playing quick, come on. They didn't invite me there, you know? So we go here and find source employees and employees.41:33And we can change the contract. Like we said by default, it's going to be permitted, but we say, hey, we don't like what's happening there. We're gonna say change the contract. We're gonna put it to deny IP. We select change, and then you can see here how that actually looks like.41:49And then we click apply. Now, nothing is gonna happen right away until you actually go to the deploy section and click deploy. Now you can also schedule it for, let's say if you want to do it out of business hours. So now you can see immediately whatever was happening between those users, that's kind of not happening anymore, so that communication now is broken.42:05And let me see. You can see here yeah so here request times out on the one guy and the other. So you can see that it's pretty much here instantaneous when we click on the deploy. Then we say, ok, you know, we're gonna change that back to default. You can go here set to defaults.42:23To permit set to the default policy right now and that will also remove that small square circle that was there in the matrix, right? So you don't have to specifically say permit. You can just put it back to whatever the default permission is. And you see as magic comes back, all the communication there is.42:43Running and flowing again. So that's something that can be quite snappy if you deployed right away or you can schedule it to have those kind of policy changes happen. Like I said, outside the business hours, I think it's quite a powerful thing you can do and all from one single pane of glass like we like to say from, from one single page. You don't have to jump across ice to say what the different outcomes.42:59You're supposed to be, you can do it all from Catalyst Center.43:19All right, changing gears a little bit, so that was, you know, the segmentation story. That was something that you get, you know, there's a lot more to discuss there when it comes to the, as the access, the fabric, the overlay, underlay, so there's a whole different, topic out there. So that's really outside the scope of this.43:25This session, but if that's something that interests you, of course, we have different sessions for that or you can reach out to us to have a more discussion about that. But, going back to this topic when it comes to the.43:45AI point analytics. When we say for the segmentation story, it's great. If your devices that you're working with, you actually understand which, you know, which user group they belong to or what kind of policy you expect to have on them, especially if they're all able to use.1X.43:57That would be the ideal scenario. In the ideal world, however, that that's not really in the real world, that's not really what happens. We have a lot of different devices that either don't support.1X or, you know, IoT devices that are just there in the network since.44:16God knows when, so you don't really have a lot of visibility into what all of these different types of, devices are out there. It's really, you know, you cannot really apply a policy to something you don't know what is in your network. I mean you could but that wouldn't really maybe work out the the best possible way.44:29Right, so the idea is that.44:49For us to have the, the best possible way of managing all these different devices that we don't know exist, we have something we call AI endpoint analytics. So the whole idea is that we try to reduce all of those different unknown endpoints unknown devices from the network so that you can apply the policies and profile.44:51That you expect to have for those types of devices, right? So how this works in the background is we have something we call the fingerprinting or the DPI or the deepak inspection based.45:12Inspection of these different types of devices where we try to get a little bit more information out of them than just what you might see by you know just by the, the default one that comes with it. And of course we try to leverage as much of that information from ice as possible, like we said friend what our colleagues.45:23We're talking about in the previous sessions we have, very rich, let's say contextual.45:43Profiling capabilities on ICE and that's something that is going to be a major part in how we actually accomplish some of these tools as well, right? So when we look at the different way that we can classify these different devices, we have four different labeled categories that we try to discover.45:49And then which you can laser later use to actually put into your different policies, right? So we try to identify the device type.46:09Let's say this is a laptop, is it a smartphone? Is it a scanner of some sort? The hardware model itself to get a little bit more details on, on the device information there and also the hardware manufacturer and operating systems. So that can be quite interesting especially if you're looking into some of those IoT devices that might have.46:16You know, some certain vulnerabilities or stuff like that. This is where that information can also come in handy for any kind of policy decisions. So how this works in the background, like I mentioned, we do leverage something we call deep packet inspection. In this case, imagine there's.46:35CT scanner connected on one of the switches. And if we only look at it from the most basic of profile that we can do, we can say, we can see it's a Microsoft device Windows seven, right? But that doesn't really tell you the whole story. Okay, so we know we have an older device with Windows seven, but what it actually is, right?46:53So we can see it's actually from the probe. We can see that it's Microsoft device. Like I said that's not reducible on itself, but we can also see there's other protocols that are running on this device that we can identify. So this is where we can make that kind of fingerprint. In this case, we can see the Dicon protocol. This is.47:12More relevant for these kind of CT scanners, so we can say it's an endpoint type of a ct scanner. So that's immediately a lot more important than just assuming it's some random users Windows seven super old machine that we don't want on our network. We actually do want this net device on network it's quite critical to have it, right? So this immediately changes.47:29How you might want to.47:49Push what kind of policy you want to push on this kind of device, right? So this is where it can come in handy to actually know what is going on. But in this case, you might have, you know, this is easy to do if you have, if you're following the trail of a couple of devices, but what when you have really a lot of devices in your network.47:53It's a lot harder to group them. So what we have also is the machine learning algorithm behind it, where we try to group all of these different endpoints. They all might share some of these attributes, like I said, ok, have the icon protocol, they might share that, they might share a different fingerprint when it comes to the way they do DHCP. So we try to then class.48:10After these into different groups and then based on these different groups we can create.48:30Those different rules and then add those labels that I was talking about so that you, so that you actually know what these devices are. So in this case we have a really large, you know, venue or some sort where we have a lot of bosched coffee machines, e.g., that's something that we can try to label together into one of these groups and we.48:34You have different, let's say apple watchers or whatever and the other, so it it really tries to find and, you know, do this work for you if you don't have to go single device by single device and then try to figure out what exactly these, these things are in your network, right?48:54And then once you have these identified admin, you can then save those labels so that you can use them later on in the, in the whole policy pro story and the whole, you know, matrix and whatever that you want to do.49:11You can see there's a lot of different things you can, you can also do when it comes to the on the ICE as well. All right, so we have one customer that actually has these machine learning analytics enabled it and what we can do is then we can learn as well as our customers learn, we can update this in the AI cloud so that we actually.49:27We have those labels available. If you have a similar device in your network, we can try to actually also.49:47Have it, discovered for you as well. So you don't have to run again this from the complete unknown. There's already labels that we recognize, hey, those belongs to these kind of devices, we've already seen those devices before. Maybe, you know, these are the bosch coffee machines and you can confirm then if you say, hey, indeed, that is correct.49:54Then you can confirm and you can accept those labels and that's something you can do from the.50:13From the dashboard as well on the AI endpoint analytics on the Canvas center side. How this works in the background, a little bit more technical details, so if we have.1X, that's of course a little bit easier to do, but it can also be, like I said for some of these devices, they don't really support.1X so.50:17Might be Mac based authentication, right? So in this case, this is where we leverage.50:37The deep packet inspection on the switches itself, but in particular, a very important protocol that you'll see mentioned also is going to be C bar or N bar, which is going to be the network based recognition of these different protocols, right? So we leverage a lot of this application visibility.50:43On the devices themselves in this case, it's a catalyst 9000 switches, but you can also leverage the wireless as well for the wireless devices well. So it doesn't have to be limited to to wire devices. But in this case, the example that we'll give to you.50:59Is going to be for a wired switch on how to enable it. And like you might see from the, you know, in the assurance pages, we have all of the different health scores. We also have something we call the trust score, right? And this is.51:16Where we take all of this information that we learn from these devices and then try to categorize into how.51:36Risky or how much threat they pose to your network. And we do this on many different ways to calculate it. You can see if it's, if it's dot one X that's going to be a little bit more trustworthy than if it's e.g. Mac best Mac best authentication, right? So that's going to be a different calculation there in this particular.51:44And in the AI analytics dashboard, we have this kind of overview where you can actually see all the positive influences on the trust score and all the negative influences. So like I mentioned, if you have a secure authentication for your device, that's going to be immediately categorized as a little bit of a higher.52:04Trust scored in something that's connected just using map or maybe even open authentication, right? And the negative influence is what will lower a lot the, the trust score is if someone is actually trying to impersonate someone else using either a Mac address that already exists somewhere else in the network or they try to.52:22Use some of the attributes that don't really make sense. We'll have an example in one of the following slides as well, right? If there's any hardware or software which, might have some vulnerabilities as well or something that's a little bit risky, we try to.52:40Flag those as well or or or rather we lower the trust score for those as well. So how this looks as well, in the inventory you can see all of the different endpoints and you can also see and validate the trust scores on each one of them. So if you click on one of these, you will get an information.52:57About how that trust score was calculated.53:16So in this case we have a wired map, we have a low trust score for some reason, so i'll try to show you in a small demo we have later on, but that's the, the, the idea behind it, right? And what you can do is when you have all this information in your fingertips, when you're when you have your proper labels and when you have all the, all the trust scores.53:18Properly defined. Then what you can do is you can also create the these custom endpoint policies or authorization policies with ICE, so that we can actually do something with this information instead of just making it look pretty on a dashboard, right? I mean, it's ok to have a nice dashboard, but actually doing something with it, I think is.53:38More interesting, a little bit more actionable as well. And this is where, you know, the ICE has really great, profiling capabilities, but what it lacks is the deep packet inspection that we can do on the switches. And this is where catalyst center comes into the picture, right? So when you have both of these together, you can actually.53:58Really make these policies where we say, hey, if, you can say that if the endpoint.54:18Is type is printer. So this is what we have from the endpoint analytics and the trust score is less than four. So this is something that's going to be a little bit more risky, that could present a certain threat to your network. Then you can see you can immediately assign an SGT that's going to be a little bit more restrictive or outright quarantine that particular endpoint until you.54:25Figure out what it actually is in your network, right? Another example of course is we'll, we'll share that if it's something more malicious.54:44But in the the general idea is that you have a lot more granular profiling that you can do for all of these different devices, right? So it's not just that you select group all of them into one particular group or SGT, you can actually be a lot more granular. You can actually assign all of these different things to, to different.54:53Different sgts to different profiles and you can have a proper segmentation like we said what you expect to have, so you you know exactly what is happening.55:13In your network as well. So this is where it really ties together both of these things. And to give you an example where we have the AI spoofing detection enabled, imagine you have your IP phones in your network, you have your printers, and we have the endpoint analytics enabled.55:22So during all this time, we're collecting let's say the fingerprint or the or the information about these different endpoints, we're able to actually see, you know, who they are, the behavior model, but imagine someone unplugs the IP phone and plugs their laptop. And so this is where we can say, hey, whoa.55:38Is this not supposed to be an IP phone? We expect to see certain signaling protocols, let's say for SIP or VoIP, you know, for voice over IP, we expect to see a different kind of, behavior happening for this device, but then someone plugs in their laptop.55:56I don't think you're we're gonna expect to see there some kind of, let's say Microsoft specific protocols or whatever machine it is that is different from an IP phone. So this is where we can say, hey, this is someone that's a little bit not as expected so we can say it's an anomaly or it's a traffic pattern mismatch, and this is where we can flag it to have.56:12A lower health score, right? Sorry, not health score, but lower trust score.56:32So this is one of the, the use cases that we mentioned to show you just, how that looks in the, here we can go to the policy and for analytics and you can see here on the left we have the the total endpoints.56:37And you can immediately see how many of those are actually unknown, how many of them are partially, and how many of them are actually fully profiled within your network. So this can immediately tell you how much work you're gonna have to actually find those different devices that you can actually immediately know what they are, right? In the middle we have the trust score, which.56:55Basically it tells you how many of your devices or endpoints are with lower trust score versus higher trust score, right? And then we have the AI proposals which are that group based recognition that I mentioned before that we say, hey, we have a suggestion. We saw ten or 15 or more devices sharing the same kind of.57:15You know, IoT signature or they share the same kind of labels. We can, there's a proposal to group them in a specific label so that you can apply those different entities that we mentioned before and different outcomes, different, different policies, right? And just here I'll click on the lower health, sorry, health. Trust score and you.57:34You can see all the different devices here in this list, so you can see them based on their MAC address. In this case, the focus is the trust score. You can see that in this case we have one which have lower with AI spoofing detection. So I'll try to open one of these just to show you how that might look like an example here for you.57:54So when you open it up here, you'll see the information about this particular device and any, let's say previous Mac addresses that it might have used. Like I mentioned before, a lot of these different devices nowadays, they try to rotate their MAC address periodically or based on different, let's say.58:14The connection or SSID or the network.58:33So the same Mac address might appear, the same device might appear under different MAC addresses, right? So that's complicating our life a little bit, but in this case, because we can have a kind of a signature for this device, we can tell if this device is coming back and which kind of MAC address it might have had in the past as well, right? And then you can see here.58:36Here we have the different details about this particular device. You can see the label, right? In this case, it's supposed to be a printer HP desk jet with a print OS. And then if you go to the trust score, you can see, hey, it's a printer, but we gave it a trust score of one. Why is that, right? If you highlight over here, you can see a little bit more about the explanation about that particular.58:56Score, how is it calculated? And then you can scroll down, you can see actually the details about what brought that.59:16Trust core to one. In this case we have a wired map, which is Mac based authentication. So that's not immediately suspicious, but what is suspicious, we have the spoofing detection, find out that this is, you know, supposed to be a printer. We have these kind of protocols.59:23And that's really not what we're seeing. So what you can do here is if you scroll up, you can apply immediately this kind of policy where we said you can be in quarantine, you can be something else entirely you can apply a different policy or you can say, hey, this is not really, that's something we're playing around, you can reset, we can reset the trust score so that we can clear that device as well.59:39Going back to the overview, here we can show you a little bit about that proposal. So we have a couple of, let's say five, four devices or even more that have same kind of OUI or, you know, the same kind of fingerprinting would be found based on DHCP or some kind of network element fingerprints. So this is really gonna depend on your devices and your network. You might.01:00:02Be something more interesting that we have here.01:00:22And this small demo, right? And then you click on the input, you can actually see how many more there are, e.g.. And then in the hierarchy you can actually see a little bit of a overview of how that looks across the network. You can see there's really a lot of.01:00:24Different labels that we already have. So, but yeah, this is gonna look a lot more interesting if you try it in your network to see how that looks. In our small D cloud demo, it's not really as interesting there. So talking about a little bit of how do you, what do you actually need to do to enable it? So this is where.01:00:42I'll try to walk you through step by step. Like I mentioned it's gonna be examples for a wire device. For wireless is a little bit of a different story because you need to have your wireless controller being provisioned or automated using Catalyst Center, which.01:01:00Might not be the case for, you know, that many customers out there, but if you're looking into starting out just for the wire switches a little bit less daunting to do. So in this case, what you need to make sure 1st is there's NO any missing packages on the catalyst center itself, so if you go to system software management, you can check if the AI endpoint analytics.01:01:16And network analytics and application visibility services are actually installed. If they're not, you can just click on the install button on them. And then to verify in the same page for the software management, you can actually click on the current installed applications, and then you can see if these policy applications are properly installed. So once you verify that these pa.01:01:35Packages are present and installed, you can go ahead and continue to step two, which is to integrate catalyst center with.01:01:55With ICE, in this case, of course, besides the things that I mentioned to you so far depending on your ICE version, you might need to enable some additional things. If you check in the chat, I I believe Veronica dropped the, the link to this guy that tells you a little bit more details about what you need to do, but this is the the gist of it, right? You need to make sure you publish the endpoint.01:02:03And attributes and.01:02:23Endpoint profiles from endpoint analytics from ice as well in the work centers there. So that's something a little bit additional that you need to do on the ICE side of things. Going back to catalyst center, like I mentioned C bar or M bar is going to be a prominent feature that we need to use who have this kind of deep packet inspection or the.01:02:25The kind of, you know, profiling action that we want to do on these devices.01:02:45What you need to do is you go to the provision services and then in the services application visibility, you have this dashboard where you can see all the different devices in your network if they have n bar actually deployed, and you can also see if it's not employed and what reason it is if you try to, let's say deploy but it didn't work or it's not ready.01:02:49It has a readiness check for you that it can tell you, hey, this is not ready for this reason. Maybe there's a certificate not deployed or something like that. That is something you can see from this kind of dashboard, right? So once you select your devices, you can actually then click on these enable C bar on the selected devices and then we'll walk you through the workflow on having.01:03:09C bar enabled on them. So I would say follow through with the workflow to have C bar enabled and then what you can do as a final step to have all of this happening in the background as well, you can go back to system settings and in the external services, Cisco AI analytics.01:03:30You have the option to enable these particular options, right? AI network analytics is going to be very interesting, not just for AI endpoint analytics, but it also tries to group your devices so that it actually provides a little bit more information for assurance as well. So you might be.01:03:46Able to see a little bit more about your dynamic baselines, something that we train the model on to to understand how your network behaves. You can see a lot more AI features.01:04:07In the assurance dashboard as well, not just for AI endpoint analytics. So this can be an interesting one besides just this feature, right? And then what is more specific to the AI point analytics is the smart grouping that we were mentioning before, which is to find the different devices.01:04:17And the different labels that connect them together, that's going to be more for discovering the unknown, and then the spoofing detection is what I showed you a small example of in the use case where we try to have, you know, detect endpoints that are you know posing to be someone else based on their behavioral models, so that's going to be the one that I also showed you in the demo. So if you want to.01:04:33Try that out, that's something that you can enable, in this section as well. It's not mandatory to have it enabled, but this is something that if you want to play around with.01:04:53This is something that you can enable all of these different options together. Alright, that's all I had from my side. I'm checking just the time. I see have some time also for if there's any interesting questions maybe in the.01:05:01The QA, maybe Alvana if you wanna share some or just close it out I think all the questions were answered but we will keep monitoring those.01:05:20If you have anything to share, that feel free. No, thank you Veronica I was just about to say the same here. Okay, thank you thank you so much for sharing a lot of interesting facts about the integration and segmentation and especially the last part about.01:05:36Endpoint analytics.01:05:55If you found today's session helpful and if you would like to learn more from our team, I would like to share a couple of sessions that are happening in 1 June. Of all eh, on 2nd June there will be 1 h session around micro segmentation on ACI with common policy and.01:05:59This would be a part of the continuation of our segmentation journey that we started today. It centers ice as a common policy solution. So feel free to register.01:06:18I pasted the registration link in the chat or use the QR code you see on the slide here. If you can move to the next slide thank you. So on the top of this ACI segmentation webinar that I mentioned, there are as well sessions happening around.01:06:29Secure firewall on June nine and ten and getting started with dual identity and access management on 16 June. Both of the links for registrations are in the chat for you.01:06:49Next slide please. This is the last slide you as always, your feedback helps us improve and it shapes our future sessions so they are aligned with what you need. And once this webinar finishes, the survey will automatically open in your browsers.01:07:04Please take a minute, let us know if you like the sessions and what other topics you would like us like us to cover next. We really really really really appreciate your input.01:07:22And big thank you for your time and attention today. We will give you some time back, but we hope you found the information that was shared today and a week ago as well helpful. And I would like to also thank our presenter Petter and all our panelists for sharing the knowledge with us today. Thank you so much and have a nice day.01:07:32