Foundations of Network Segmentation: VLANs, ACLs, and Identity with Cisco ISE

Good morning, everyone. Today we're gonna start our next next security expert insight series.00:10This is gonna be mainly focused on Cisco identity services and our presenters today are gonna be Amanda Short and Cameron short. Now, before we start, let me talk a little bit about the series. Just for awareness, this is gonna be the segmentation series. We're gonna have three modules.00:16We are gonna cover today the 1st one, which is foundations of network segmentation, ACLs, and identity with Cisco eyes. But also we are gonna have another two models that are gonna be delivered on the on the following weeks. The next model is gonna be regarding.00:36Unlocking Cisco as you see the title, we are gonna be talking more about this feature of course dynamic segmentation and security group tagging with ICE, and on our 3rd model, we're gonna be talking about seamless segmentation integration. In security with Cisco is another products, of course, that's gonna be helpful for us and for you to understand.00:51How eyes can have more value while integrating.01:11Now, for this eh, for this series we are gonna be using a slider for the Q and A So please here you are gonna find the QR, the QR, the code and the passcode to enter to the slido. Please try to enter. I'm gonna hear hang on for a.01:16Second, it's gonna be important because this is the only way to interact with you. If you have any questions, if there's any comment that you would like to make or any doubt that you have regarding the presentation, please let us know through the Q and A and someone will answer it.01:35So let's give it a minute for everyone to try to join. And before we start the presentation, I wanna make a question to you. So we, this is something that we are considering for our next presentations, for our next sessions, webinars that we are.01:49We're gonna be delivering. So let's jump very quickly. I want to review with you which other topics would you like to review in future sessions? If you are in a slider, again, here you have the information, you can join, but please answer these questions so we can also.02:09Consider those topics and of course consider your input for our next sessions. Let's give a few minutes to see if anyone participates here.02:30ICE integration with catalyst center, ok? Any other.02:57Comments someone else wants to to suggest a topic here? Which are saying licensing on the chat, ok.03:07And there's another, another one that is coming in. Let's give it a minute and we'll start. Perfect. Well.03:35I'm gonna leave the the poll open if you want to participate, please let us know. In the meantime, I will pass the ball to Amanda who's gonna start with the presentation for today. Thank you very much. Awesome.03:51Thanks Miguel. We'll start sharing my perfect. So today's agenda, like Miguel said, we're gonna be going over the ICE foundations.04:08So ICE as a solution, understanding triple A radius, and that goes over.1X and map, the ICE configuration, and we were gonna do a deep dive of identity based network services, but we are gonna show you guys instead of throughout the demos.04:27So, let's go over to the segmentation portion. So exactly why do we need segmentation? So 1st of all, we need to understand the reason and the reason we need segmentation. Segmentation reduces network congestion. E.g., a hospital's network devices can be segmented from its visitors.04:48Network. And so that medical devices are unaffected by the others like web browsing congestion. Segmentation improves cybersecurity by limiting how far.05:09And why the attack can spread. E.g., segmentation keeps a malware break in one specific section without actually affecting the other systems within the network. Segmentation can also help stop harmful traffic from reaching devices that are unable to protect themselves.05:20For an example like infusion pumps that are conducted to.05:40Maybe like a separate Wi-Fi and have much more robust robust security, network segmentation can also help harmful traffic from ever reaching those infusion bumps. Segmentation.05:46There's a timer on here. Sorry about that. Segmentation reduced costs associated with regulatory compliance by limiting the number of, in scope systems. E.g., segmentation separates the systems that can process payments from ones that don't, and this.06:01Helps with regulatory compliances and requirements throughout the audit process by by specifically zoning into those scope, the scope with those network systems or those.06:21Hospital systems on that on that segmentation portion and not the entire network. So let's go over traditional segmentation. Let's by understand the beginning of the segmentation itself. Traditionally, network security has been around and used based off.06:34Of IP access controls. However, IP access lists are a local attribute and they're not really adaptive. So they create a management headache.06:53When designing security policies. E.g., this is the best example of segmentation of traditional segmentation. So in terms of what is wrong with an ACL exactly, so let's take a head and, and look at this example, right?07:05So we have, managers right here and they need to access sales, HR and finance devices. So if we're building out this access list and.07:24Each of each source has to go to each destination. We're gonna be looking at a huge access list and it's gonna actually build because oh my gosh, I need to turn this timer off. My apologies. It's gonna have to build, right? Because we're gonna need all of these to access here and it's just gonna become a huge headache for managed for the IT administra.07:37Traders.07:57Right, so what's wrong with the status quo? It lacks the business intent. It's overload as well as it, you'll end up with this huge thousand line ACL making it challenging and for troubleshooting.07:59And identifying exactly which one has to be changed throughout, you know, when let's say we added one network, right?08:19This is gonna be very difficult to manage, and you'll have to put this in other places as well. So the traditional way of doing this for I'm so sorry about that guys, I have a timer on here and I'm not sure how. Okay, so.08:29A traditional way of doing this for every.08:49Is something hold on, sorry about that. Let me get this timer out the heck None we shouldn't.08:52Be a timer on here. Sorry about that guys.09:12Okay, ok, see coming very hard. Oh my gosh, to manage, right? So we don't have it's complex to manage. Oh my gosh I'm so sorry.09:191 s.09:39We'll do it based off here. Everybody see? Okay, we'll do it this way, it's fine. Okay, so yes. So they're complex to manage, and you have to do multiple interactions with multiple touch points. So what.09:42That's the problem, right? The segmentation for security with rapid growth of wireless and IoT devices ensuring comprehensive end to end security has become a challenge, right?10:02And on top of that, it lacks visibility with the growth of IoT devices, we are quickly losing the race of trying to control all of these like AC controllers and ID pumps and stuff like that.10:14So, let's do ICE access control solution overview. Okay, so today specifically, we will be talking about Mac authentication bypass, AO2.1X in conjunction with downloadable access lists and VLAN assignment.10:32But before we can do that, let's try and understand, triple AAA, ok? So before anything can be authenticated or anything can connect to the network, right? The whole zero trust principles is we have to 1st identify.10:55By who you are.11:15Right, are you an employee or are you a contractor? After we identify if you're an employee or a contractor, ok, well, let's see exactly what you have access to. Are you gonna have access to protective service servers as a contractor? No, you don't need to have any of that, but the employee who actually does work in IT.11:16He and as a server admin, for instance, can.11:36Access the protected servers, shared services and public public network, right? Okay, so let's go over radius eight oh two.1X and mab. So I.11:41Active identity. So we're talking about eight oh two.1X and there's some web off.12:00When you get your username and password, you do above off or easy connect for passive and Mac mab, which is Mac address authentication bypass. Let's go over the radius flow.12:07Okay, so once the equal start comes, it's usually gonna become coming from the endpoint itself, right? So we're gonna do equals start the network. This is all gonna happen over layer two traffic. It doesn't actually get encapsulated with the.12:25Radius header until it hits the the gateway and it goes over layer three, ok? So the switch is gonna say, hey, I need this, I need your identity, then there's gonna be a response.12:42That is gonna be sent over an access request. The optional portion of this conversation is going to be that access challenge. And normally you'll see this when there's a certificate involved, and we'll show you later in the demo. And that's gonna be sent over an E request.12:58The user is going to respond with an eap response, sorry, and then we're gonna have that go over the access request. Now this this whole conversation right here from the challenge request can go on quite long depending on how big.13:15That certificate is. Sometimes I'll have to send the entire chain and it's just gonna go back and forth until we get an access or accept or reject from.13:35From the radio server in this case, right? And that's to validate that identity, that real key portion of the zero trust is to validate that identity. And in this case we're getting an access incept, the NAD sends the accounting start and then the radio.13:47This confirms with an accounting response.14:06After the session is disconnected, the NAD says sends an accounting stop, and then the radius will confirm, the radius server will confirm, and then that session is terminated. So what is the mechanism for authentication within eight oh two.1x? Well, you do have plenty of.14:09Options. You can use EAP, any flavor EAP, eap TLS peep. I will say that Peep MS chapters gonna be going away very soon due to the new requirements with credential Guard and Microsoft.14:28So the standard, a standard best base method for transportation is authentication information utilizes encapsulated and encrypted radius authentication methods, and a variety of options are supported.14:45Due to the flexibility, we need a lot of the flexibility when we have these different, devices now and this is with mab. So this is mainly for supplicants that don't really have, a head end to them, right? So there's.15:04A phone, you know, a lot of some companies have not moved on from the 7940 twos, the older phones that don't really support the.15:23A certificate off call call manager or legacy printers and stuff like that. So security cameras stuff that really doesn't have an option to use radius. So that's gonna use mab. And it's gonna be a very like much shorter conversation when it comes.15:35Into that radius flow.15:55So, bypassing known MAC addresses, so I was gonna build that database dynamically with profiling and it's gonna use all the best practices are gonna use device sensor.16:00But it doesn't require when you're doing mab, to start that Mac address table and then ICE is gonna build it dynamically with profiling. Okay, so the components of eight oh two.1X, so we're gonna have a supplicant.16:16A network device, which is the authenticator, and then we're gonna have the authentication server, which in this term is ice. And then we can have the identity store at the back end. In this case, it's gonna be.16:37In this case in the demo, you'll see that it's active directory, and we're gonna be using cert based authentication. So the there's different designs that you could do for the network network device. So, but it all depends on what hardware is in place, what.16:53Version is a refresh required.17:12Right, and exactly what do you want these endpoints to have access to or even the users, right? Some endpoints are gonna need mab. Some are gonna need, are gonna require a circuit or a circuit, sorry, a server. An authorization, you're, we're sending down either a VLAN or an access.17:14Access list, but this is gonna be a dynamic access list. This isn't gonna be something that is locally defined on the switch although you could do that but we're gonna be signing it down dynamically with.17:34Adacco. And your radius server is gonna be AAA server but in this case it's gonna be eyes ok we're preparing the switch for identity based network access.17:47So, determine the the requirements that are needed for, for your environment. So we have a critical ACL, so that's gonna be when, ok, when the.18:08Radius server isn't responding. You can have probes be sent out and say, hey, after three or so failures, mark that radius server dead and then move down to the next one. If both are required are marked dead on the switch, then that critical ACL is.18:25You're going to allow traffic.18:44During the the network outage or not network but the radio server outage. And remember a access reject is still a response, so it's even if you get like three rejects, that means that the server is still responding and that critical access ACL is not gonna jump in and kick on.18:48Till your servers are actually marked dead, which means NO response at all.19:07Right, so for IBMS two point oh, we are gonna need the server template authorizations. And if you require the web web authentication, just depending on what.19:12Exactly you need. We also do have interface templates that you can be using, ok? So right now, we are gonna be going over the global configs. So these are gonna be the same. Rather you have.19:28IVNS two point oh or one point oh, these are your foundational, your foundational configurations. So you're gonna need enable AAA, so that's the triple A new model, the session ID common.19:48Then you have to define your radius servers, right? So the IP address, off port 1812, and then the county port 1813. And then the automated tester, this is optional, but this is what's gonna kick in for the critical access ACL. So if you're not getting.20:05Be any response from the automated tester, it's going to.20:25That's what's gonna kick on that critical access critical ACL is if you get NO response from that test user. Of course, you need your, your key. This does need to match on ICE.20:32As well as the switch or you're, you're gonna get the unknown switch or unknown network access device error in your live logs. And then you're gonna have a radius server attribute six for log on off, these are for the best practices also to.20:47Allow the.21:08Dynamic ACL to be applied. So we have the radio server attribute 82531 for the Mac format, and 31 to send the NAS port detail. And then we have to go ahead and define the dead criteria, so this says.21:10I believe it's in it's in minutes, I think so, I think it's in minutes for three, three tries, right? And the total dead time is 15. So then over here where we see the triple A.21:30Triple AAA group, server radius, ICE. So these are the, this group needs to contain the name that you placed here. So ice O one and then ice O two.21:50And then you have to put a source interface that that radius communication is gonna come out of. So that could either be a VLAN, VLAN that you have on there or it could be your uplink interface. And then you're gonna have your your standard triple AAA authentication.22:04Dot one X default group ice AAA, authorization network default ice, and then you're gonna need that accounting update info periodic and the.1X default start stop. Okay, and then.22:24Here is where you'd be configuring your change or dynamic authorizations for COA and you have to have this server key that's gonna match over here as well. Okay, and we have IBNS two point.22:41So this is local, you can have it locally defined on the switch or you can actually have the radius server send it down. So the requirements is to configure the AAA dead alive status. Your critical off must.23:03Be configured on for activation and the reassumption is to flow to reinitialize the, the critical off sessions. So let's let me break that down. So let's say we have to have we have a dead action, right? So if it's marked dead reinitialized.23:21Reinitialize, right? Reinitialize. If it sees that the actual media servers are marked alive, then all of the sessions are gonna reinitialize, right? And try and reauth. And this is gonna be your interface template. So these configuration.23:41Are gonna be applied to the specific port, right? And these are actually this is something that you're gonna see a little bit further down is where this kind of reduces that bloat.24:01On, on the interface itself. You can also do downloadable service templates. Most of the time we'll have locally configured templates. I haven't seen many where the customers will do the downloadable. Normally we will see it, we'll see.24:12Did it be locally defined?24:32And this is where we're gonna see the configuration really stand out is on the port, right? So you have, internet interface gig 101. We're just throwing this VLAN on here, your normal mode access, and then you're gonna see all these authentication event fail authorized.24:35Guys so this is your.24:55Server dead action, you're gonna authorize VLAN a hundred. No response action, authorize a hundred or open mode. Order is gonna be.1X and mab. Your priority.1X and mab. Sometimes people will flip this for a flex more flexibility on those eight oh two or on those Map devices where the.24:59Phones where they want the phones to be the 1st to be authenticated 1st, because it does take a little bit longer to reach the call manager and actually get its config file and stuff. So a lot of people prefer to have them the priority be map and then.1X.25:18And then for control auto so off authentication, timer, reauthenticate server. So this right here actually saying that the authentication server, which is ICE, right? The re authentic, the timer.25:35It's speaking to the timer is gonna be sent to from ICE and applied onto the switch port, ok? And then violation restrict mab. But once we come peak over here at the, the new style, which is IBNS two point oh.25:52You're gonna see the access session. So the control direction in port control auto, and everything else is going to be in that template so that service policy type control subscriber, this template is gonna have.26:11Okay, what method is gonna go 1st, right? So ten class always do to a failure failure, authenticate using.1X 1st and then normally they'll have another line saying 20 authenticate using mab if fail.26:31So, before you actually change to this file, you can have it display. You don't have to do it like full, before you actually move to this because after you.26:45Initiate the command authentication convert to new style. You're not gonna be able to change it back. You would actually have to default the switch. So you have to do authentication display new style, and that way you can validate that config before actually, you know, pulling the plug and making it.27:04Permanent. So that's the key here is using the display. Okay, so, important things to note before we dive in to I think we're gonna go ahead and dive in.27:23To the actual demo. We're gonna turn it over to Cameron in a little bit. So to switch the IBNS version in iOS that It's based off of the versions so we have, you know, some people, they haven't gotten around to the whole infrastructure refresh, right?27:41So the things that you got to keep in mind is what the model is will determine exactly which version of the IBNS that you're gonna be choo choosing. So you can either do version one, which is normally.27:59It's still compatible in like the 2960s, but you can't move it to version two to IBNS two point oh. That's more of like the newer style for the 93 hundreds and even later software versions of 38 hundreds. And if you are doing this on wireless as well, so you have to think about the controller, the.28:16Key models OS also determines what commands and items you'll use in that policy within ICE as well.28:35And another super important thing to know is the switch integrated security features. So this is for device tracking, which needs to be enabled for the DACL and we the web redirect to function properly. So what that does, it builds a.28:44The Mac address and IP address binding table.29:03And that is how the switch will keep track of the s the sessions and apply the, the dackles and the URLs. I do want to jump in to, I know we've been talking about the NAD this whole time, but I do also want to jump into the ice configuration just so we have.29:07Have an overview before Jam Cameron takes over and kinda jumps in.29:27So, the ICE policy sets, when you're looking at the ice policy set, it's always gonna go from the top down. So from here we can see wired eight oh two.1X wireless eight oh two.1x. So whatever matches here 1st is going to.29:34And then to the right, we're gonna see the allowed protocols. So, this is gonna, this is right here. So the default network access is kind of what we're looking at in this screenshot. You're gonna see which exactly what protocols you're allowing through to connect. So right here we're allowing the.29:54The host lookup, which is the authentication, the Mac authentication bypassed.30:14And then the authentication protocols. We have a ton of protocols that you can enable and disable depending on what your requirements are in your organization. Okay.30:18And so this is the authentication and authorization policy as well. Again, ICE is gonna work it from a top down manner. So we're gonna see.1X, so wired wireless.1x. It's gonna right here is just a screenshot, so it's gonna say internal users, internal users is where exactly it's gonna look for those identities, right?30:34And then the options down below are gonna show you how it's gonna handle those failures, right? So if the authentication fails, we're gonna reject it.30:54If the user's not found, we're also going to reject it. If the process fails, just drop the package, just drop it, right? So, authorization conditions. So these conditions, you see right here they have and, right? You can also put some orders in there, to kind of compound these.31:04So it has to be wireless two.1X and BYOD registered and ETLS and the Mac addresses in the sandfield and the certificate, then you get a permit access, right? So this is the end result.31:24And then we're here I'm gonna move this really quick since we're here. Okay, so the BYOD onboarding, right? So if it's wireless eight oh two.1X and it's just EAP MS chat V two, we're gonna send them to the native supplicant provisioning. That way they can onboard that certificate and we.31:39Oh, kinda go further and see how we can strengthen the security policies, right? Okay, before we hand it over to Cameron, I did want to go over, the identity sources. So right here when we're.32:02Going.32:21Looking here, this is exactly where we're gonna be looking for our user, right? We support a plethora of of identity sources, right? So we have built in CA, we can do LDAP, OAuth, the certificate based and the API based, which is the.32:22Is your Active directory?32:42And these are where we gonna build the source sequences, right? So we can, we can look at all the the identity sources that we built in our referencing here. We can put them in a list, right? That will also go from a top down manner if you would.32:46Like. So this is what we call the identity source sequences. A sequence of inter identity databases that is used for the authentication, right? So you have internal users, all AD joint points and guest users in this example. So it's gonna go in a top down fashion if you can figure it out.33:06And I'm going to hand it over to Cameron to kind of go over the lab demo and we can take it from there Cameron. Cool, thank you. I'll be sharing my screen.33:27Here we go. Okay, so I I have a pretty simple topology today, but I'll explain why in just a second. It's really because I want to walk you guys through the components that are involved in setting up the ICE policy and and segmentation policy.33:46And so, in this environment, I have three subnets connected to one access switch and three subnets are for user data, IT admin data, and, for printers.34:02So each of these three, because we're going to be enforcing segmentation, there are restrictions that we as the admins have to decide in advance, hey, you know, logically it doesn't make sense that the printer should be able to.34:17Like RDP to a user desktop, you know, that's not something we we need to allow. Clearly that would be a sign that that something is wrong or compromised. So, I'll I'll come back to this topology and show you the config on.34:33The endpoints and on the switch, but 1st I'm going to jump into ice. We'll just keep in mind there's user data, IT user data, and printers. So my policy set, is.34:49Well, it starts with authentication, of course, FORTLS, which is what our end users and IT admin users are authenticating with. Those are configured typically through group policy just for the sake of scale, but you know if you're using.35:07Max, those can be configured through your MDM, and for ETLS authentications with wired.1x, we are sending them to the identity source or identity source is going to be a certificate authentication profile.35:25I think the easiest way to explain this is to perhaps look at the printer 1st. When the printer authenticates, it's not doing.1x. We're using Mac authentication bypass or or map that Amanda spoke about, which is where the radius authentication has the Mac address as the username.35:45And so in that case, we are looking up that printer in the internal endpoint store by Mac address. So difference for regular.1X that's using a username and password or maybe a, a host name.36:03Is we can send that to some other identity store that we believe to be the source of truth like active Directory. With certificate based authentications though, we have to, we have to figure out what is the identity from that certificate. If we just send a.36:21The certificate as an authentication request to AD, you know, that's not how AD works. So we build the certificate authentication profile, which can be seen here.36:41To indicate, what, what actually has the identity in the certificate. And in this case for my demonstration, the identity is in the subject common name field.36:53And to show you, what this looks like on the endpoint, I have a certificate that was issued with my username, it's demo user, for user authentication with ICE, and it was issued by.37:08Our company's certificate authority. And if I look at the components of the certificate itself, here we go. Demo user is the identity I want to authenticate and that exists in the subject common name field.37:27And so that's why I have, have that determined here. We can also figure that out from the certificate authority template itself. Where are we actually adding the identity? So then, now that this authentication.37:46As hit this certificate authentication profile, I know what the identity is because I pulled it from the subject common name in this case. Now I can look that up against our identity store. I have a a username or a credential to.38:03Authenticate against the identity store now. So I'm sorry. Can you show them on lookup from the AD perspective and ICE how they can find it? Sure, how they can find.38:19The Active directory? Oh, go to Active directory. Oh, ok, go ahead. Well, ok, so we can pull up the certificate templates themselves. I know in this case, this was the certificate template that was used to create.38:38Those certificates and in the subject name field of the certificate template, it says build from Active directory information with UPN and the alternative subject name, which is something we can use.38:57Or put it in the common name. Perfect. So I was ready for that. So, so that covers the authentication for our three oops, for our, our three endpoints here. We have ETLS.39:13With an AD signed certificate ETLS with an AD signed certificate, and we have MAB for the printer.39:33So now, let's look at the authorization policies. So for the users that were authenticated through Active directory, the primary benefit that we gained from that is we can look up group memberships.39:39So we can look up other AD attributes for those users.39:59In this case, I'm distinguishing IT admins are in this case in IT network engineering, Active directory security group and standard users are in domain users. Now, I have these in this order.40:04For very specific reason, which is our IT admins who are in network engineering group are also domain users. And since we're evaluating top down 1st match, if I reorder these so that domain users is the 1st one that we look up.40:20No one will ever hit this rule, if we expect that all network engineers are also in domain users. So I have that set up very specifically. Now, we also have the rule for the printer.40:36Which is based on endpoint profile. Now, in my CML lab I I can't simulate a printer, so I've I've hard coded, but this is what our printer is going to hit. And these are our three.40:52Authorization profiles that we're going to look at IT admin, user VLAN and printer downloadable ACL. So, let's go over to these are our.41:08Authorization profile. So let's start with IT admin VLAN. So in this authorization profile, and remember this is what users who are in the network engineering security group are going to get.41:25We have a downloadable ACL assigned called admin permit and we have a dynamic VLAN assignment for VLAN 20. So looking at that downloadable ACL, I can tell you it's just a permit IP any, it's very simple.41:42So the expected behavior of our admin workstation here is that it will be assigned to VLAN 20 and, has a permit IP any any downloadable ACL applied to that session on the switch port.41:58If we look at our standard users, user VLAN, we are sending a different downloadable ACL called user permit and a different VLAN assignment for VLAN ten.42:16So if we look at the components for the user permit downloadable ACL, you can see that for the sake of this demonstration, I've blocked a specific host that is not blocked for, our admin user.42:35In this case, this is the management IP of the switch at the local site. And we'll, we'll test this out and I'll show you the impact of that in a moment. And then for our printers, I do not have a VLAN assignment I'm just a.42:52Applying a downloadable ACL called printers. The downloadable ACL for printers says we're going to permit basic network services, so we'll allow DHCP, DNS to our DNS server in our environment.43:12And we're going to permit IP any to this host, which is our print server that exists in data center which is outside of this topology that's represented or visualized by that cloud there. And then we're going to deny any.43:31After that because there's nothing else we want our printer to do other than boot up, get an IP address and connect to the print server. So with those in mind, we can look at the behavior, actually 1st.43:49And let's look at the switch instead. So I can show authentication sessions and it will show me the live sessions on my switch. These are for.1X or mab. And we can actually see that method. So.44:09Gig zero one which is our IT user is using.1X gig zero two our IT admin is.1X and gig zero three, which is our printer is map. And the way that I can tell that we've actually enforced our.44:25Authorization policy here is I know that starting with users, they should be on VLAN ten. That's what we've assigned in the authorization profile. So if I do show VLAN three oh yeah actually that, that works.44:44I can see VLAN ten is assigned to gig zero one. And if I look at show run for in gig 01I don't have it specifically set or statically set for switch port access VLAN ten. So, this was a dynamic VLAN assignment, another way that we can.45:04Tell is show authentication sessions, int gig zero one detail. And this shows us everything we need to know about that session. It has some session IDs, interface MAC address. The important part for us is.45:24Server policies are what's applied through the authorization from the network access server in this case the ISPSN. So VLAN group VLAN ten shows that it was dynamically assigned, and I also have.45:40An ACL and if you recall user_permit that was the name of our ACL that we applied through the authorization profile. And I can check the same thing for gig zero two which is our IT admin.45:56We've assigned VLAN 20 with an admin permit ACL and then zero three is our printer. We did not have a VLAN assignment and we just had printers ACL.46:12And if I do show IP access lists, do have a few of them in here, but I can see here's my admin permit and it has the permit IP any that we expected. Here's printers where.46:28This is as configured in ICE, we're permitting DHCP DNS to our DNS server and IP any to our print server deny anything else. And then our user permit, which for our demonstration is just specifically denying this one IP and permitting anything else.46:46So we can check that this, is actually enforced from our workstations themselves. So this is our our user on VLAN ten represented up here on the top.47:05So I specifically blocked IP any to this host 10.12.173.10, which is the management IP for our switch. And so we will see that our pings aren't going through and if I try to SSH into it with putty.47:24I will not get a response. It'll error out in due time. But for our IT admin who the only difference is they have a permit IP any any without blocking that host. We can try the same test and.47:42As we expect, we get a ping response and I'm getting an SSH response. And so that's one scenario that we see commonly for building out these downloadable ACLs.48:03And it's, it's easy to restrict access to locations that we know for sure let's say users should not be able to access IT management network at our data center.48:19But we also know that we don't want to statically hard code that ACL on a port somewhere because the user might move to a different location. We might not want to put it upstream because the the context could change if a.48:34Let's say an IT admin for some reason has to connect to a user's PC. We don't want to just block anything from that user period or from that, from that subnet rather. We can apply this dynamically based on the user identity.48:54Entity context from the authentication on ICE. And then for our printer here just for the sake of completeness, we can see that I can, I can ping the print server that we've specifically allowed in this line here.49:14But if I try to ping, my gateway, that's blocked. Again, not an actual printer, it's just for the sake of demonstration. So that's the benefit of dynamic VLAN assignments and downloadable acl's basic segmentation.49:34And also a, a quick walkthrough of how we're actually authenticating and authorizing these devices and how to configure it yourselves. Awesome.49:53Thank you for the demo. Okay, the timings are turned off officially now, I think we're we're back to business. So like I said before, ok. So like I said, these are the important things to note, which.50:12I saw there was a question over the IBNS topic.50:32I'm not sure if we wanna, go through there through the different, through the different kind of steps, right? So IBNS two point oh defines each.50:37Events in which are monitored. Events are defined through class actions and then class actions performs the functionality required for each event. Event as requested progresses from event to event, right? So sessions started, you're always gonna author.50:53Okay, if there's an off failure failure.51:15Which right here off failure, do it to a failure, you're gonna terminate that in that.1x, and then you're gonna authenticate using map. It's kind of hard to see right now because I forgot to change the, the font color, but always.1X NO NO.51:18Response due to the failure, you're gonna authenticate via map. And this is where you would have.51:38You're always gonna terminate MAB and authenticate eight oh two.1x. So these are kind of the differences between those but ok so.52:05Sorry, my, my side toe kind of got jumbled around due to the timings and stuff. But before mab authentication, the identity of the endpoint is unknown and all traffic is blocked and the switch examines a single packet to learn and authenticate.52:22The Mac address as a source.52:42After a mabst succeeds, the identity of the endpoint is known. All traffic from the endpoint is allowed. The switch performs the source MAC address filtering to help ensure that the only the mab endpoint is allowed to send traffic, Mac address up.52:44The MAC address authentication itself is like not a new new idea, right? So we have the early predecessor for or precursor to MAB is the VLAN management policy server, which is the VMPS architecture. You would create.53:03Like this was like way back. You would create like a text file full of Mac addresses, right? And which VLANs they would belong to, but now this is a new.53:23Kind of like a new way of doing it when you're implementing ice, you would use MAB and it would grab the MAC address off of that identity through that eap traffic. So it's gonna be sending the actual MAC address as the username like Cameron was demonstrating.53:35Okay, and we'll go ahead and pass it over to Miguel. Go ahead. Thanks Amanda. Give me a second. Let me start sharing my screen and.53:52I can see it. Okay perfect. Well, it's gonna be important to mention here a few things at the end on why these basics are are important for the segmentation.54:15As you may see or probably you you saw and review here on this presentation and the demo that showed us is that at the end, the authorization is gonna be helping us to do or execute that segmentation. This is important and the reason it's really important.54:32It's because we are looking for security. The segmentation advantages are gonna be mainly the zero trust enforcement, but how? Well, of course, what we are looking is to avoid having any impact on the network. Whenever we talk about security.54:49We can review that also. The attack is not longer coming from the perimeter. Usually we used to protect the perimeter and that was all. Now that doesn't happen anymore. We never know when something can be compromised, and of course it can be also internal attacks. So what we are looking at segmentation is also to reduce.55:06Use that specific attack vector, ok? That's gonna be critical.55:26So if we don't consider that part, we are gonna be in in a risk at the end. Remember that whenever we are talking about security, what we are looking also is to reduce risk. In this specific example, it's important to double check, e.g., with specifics.55:30And of course, provide more security to the to the network avoiding lateral movement. Now, how this is gonna be working, of course, whenever you use segmentation, as Amanda mentioned, we are gonna have like a specific access for a user or an endpoint. That is gonna create, of course, like a path or a vectory specific.55:49Forgot access. If by any chance we have that endpoint compromise, we have any issues with the permission, any lost credentials, any maxpoofing, we are gonna detect or we are gonna validate that that specific endpoint is not available to move or do any literal movement that can create a huge.56:09Here a huge impact on our network. That's the main objective and the main main advantage. Reduce the risk to our network.56:29So it's important for you to have this mindset. Why? Because being honest and talking about my experience, I have seen a lot of times whenever we are talking about segmentation and it's, it's difficult for customers because probably they are only leaving a permit access on ice or they are not providing a specific result. And of course, that is.56:36It creates a hole or it may open a risk for the network. That's the reason it's important for us to always try to have this mindset. Remember that.56:56Being honest, nowadays eh, security is not an option. At the end we are using or we are managing a lot of information and that could be really important for some people that doesn't have good intention, so whenever we are looking to reduce risk, this is gonna be a critical part.57:07Now, being honest eh segmentation is divided and we already talked a little bit about it, but it's important to make this quick review. Let me share me, ok. And here.57:25It's important to mention this. Through the AAA basics, we can enforce segmentation how, e.g., the authentication, authorization, we're gonna be able to identify who's accessing and of course which level of access they have. And after that we can monitor through the authentication and through the accounting. That's gonna be important.57:41And it's critical. You have that control and that visibility.58:01It's something that we cannot waste, ok? Whenever we are in this is a personal experience that I can share with you, but usually whenever we are reviewing ice and something that is important to mention is that visibility or monitoring is always an important part of it. Sometimes it gets configured and we forget about it, but it's important to re.58:05View who is accessing how they are getting access and of course with that enforcing that specific level of access.58:25Intended to be in there By any chance, I just want to double check, can you hear me? He cut out little.58:40Okay, yeah. Here I'm having some issues with my computer. It seems it's a little bit frozen. Well, let me repeat that a little bit. It's important because AAA authentication and authorization and accounting are gonna be critical for us to have visibility, ok?58:51Understand who is getting access and which level of access they are getting. That's critical. Why? Because at the end, we need to make sure they are only getting the resources that they need. In one example, it's important for us to if we have, e.g., someone from the financial team.59:11And we had someone from, let's say administrative team, we don't want that admin team to get access to the financial and being able to modify information there because at the end it's not part of the role. So that's important and also visibility is critical. I was mentioning this because at the, at some point of time.59:29It's gonna be important for you to consider that I shouldn't be configured and left there. We need to of course have review with who's accessing if we have any failed attempts, that can be done through ice or it can be done through external e.g. but it's important to double check. Why? Because if we don't.59:49Check never that part we can have any attempt to access to our network that we are not seeing, ok?01:00:10Even if they are getting access, we can see something weird. We can see the some behaviors that can even help us identify that that specific behavior. And of course, that's important for us to protect ourselves. Now, just as a quick heads up, it's always, we have always different ways to segment our network.01:00:16That's important for you to have that visibility. Of course, the 1st part is the classic, the ACLs that.01:00:36Amanda and showed us, but that's not all. Of course, we are gonna find that we have also the micro segmentation which is. I'm not gonna go into because we're gonna be talking in our next session about it in detail. He is gonna be helping with that part, but it's always critical for you to have that award.01:00:44That at the end we have the classic, the micro segmentation, but these two forms of segmentation are important. Why? Because not always we have segmentation.01:01:05Even if you are get developing your network or you are starting to to create that information or that type of security, it's important for you to at least try to implement a formal segmentation, ok?01:01:15It's not necessary always remember that to go directly to process because at the end, sometimes it's difficult to go from a greenfield to directly to the most advanced features, but of course if you have the chance, it would be ideal to do it. If you don't have the chance, at least try to do the classic.01:01:301st, it's gonna be different and probably even so you would need or it would be recommend for you to try to enforce it a little bit more with the time but and also to simplify your management because at the end it's an advantage that is gonna deliver to simplify the management. But at least try to implement one of these.01:01:50Okay, even if you have a really simple network, it's always important to try try to create it to avoid any issues with the security.01:02:10And of course, remember that we are gonna have some limitations like for examples works for wired environments, name ACLs can be used for wireless. Name ACLs is more open, we can use them, but they are only specific for wired environments. Usually, whenever we are talking about the.01:02:19We cannot use that part. So it's gonna be important for you to identify it.01:02:38Now, consider that part and also be aware that the authorization is really as Cameron demonstrated, it's really linked to the segmentation and why do I take do I touch this topic again? It's gonna be important because at the end, authorization is not gonna depend only regarding the endpoint.01:02:44For the in this case the user. It also depends on the type of access they are getting. If it's wired wireless, we can create different policy sets, we can create different rules, and of course that's gonna complement a lot of the segmentation. You know, even if you have two users, one entered from wired and another one from wireless.01:03:03We can provide different levels of access according to the security, if they are going through VPN.01:03:23There's another level of access that you can enforce. So it's gonna be important because you can make that as the name implies and sorry for the you can create that segmentation between them. So that's the critical part. You don't need to enforce everything like if this user is accessing.01:03:29Give them these privileges? No, you can also define, ok, if this user is coming, if they are coming from a corporate computer, if it's a non corporate computer and make that change on the level of taxes. That's gonna be really, really important, and that's the let's say the most important part of segmentation.01:03:47Yeah, just to mention some key takeaways, segmentation is gonna be critical to all networks, as I already said a couple of times. This is something that at the end.01:04:05We cannot say that we don't require it. Now security, you know that we are seeing daily any attacks, we are seeing a risk to our networks, people trying to get more information or trying, even so just to play to to see if they can get access to to a network. So of course, security, it's impo.01:04:20Important security requires that segmentation to protect better the network. It's gonna be really, really important because at the end, if we get a compromise we can at least reduce the impact of of that compromise, but also we are able to take quicker action because at the end.01:04:41Something that I can tell you about security is that whenever we are talking about security and it's about building barriers. There is nothing that is completely secure at the end, it's impossible to reduce the risk to none, but at least we can reduce the, the risk at least as much as we can to to reduce it near to zero.01:04:58And what we are looking to do it, as building as many barriers, if you try to segment, if you create access, if you identify double factor authentication, if you start to create more barriers to your security, of course, that's gonna help you to make a more secure environment.01:05:18And of course, segmentation is part of the zero trust framework. That's always critical if you want or you're looking to do zero trust, segmentation is gonna be something that you require. Something that it's gonna be essential for zero trust.01:05:34And again, are the most basic or classic classic way to segment, but if there's any requirement or anything that you want to do it even more in advance, please feel free to to come to the next session because we're gonna be talking about prosec. That is gonna help us to more be more detailed.01:05:49With the segmentation, be more specific and of course have better ways to do it.01:06:09And last very quickly, here you are gonna find some information about our our next sessions. You can register on those two QR qrs that you are seeing on the screen. The 1st one, it's the cisco trustec, the dynamic segmentation.01:06:15That you are seeing. For that one, what we are gonna see is on this one, we are gonna see that all the topics regarding traffic, we are gonna learn more about it, dynamic segmentation, security group tagging, and of course the different things we need to consider for traffic because being honest the method whenever we are talking about traffic should change.01:06:35That we're NO longer talking about only we are gonna be talking about relationships and how that is gonna change. Of course, whenever we start to think about the different relations that we have in our network, well, we are having more like that. So it's gonna be important and this is gonna be really important.01:06:55Testing and of course to complete this segmentation series, we're gonna be talking about the security system platforms where we are gonna find how to get more value by integrating ICE with other systems.01:07:15So make sure to register, we are gonna keep providing different details on segmentation and also on following up sessions we are gonna give a little more detail on the following up sessions. Why? Because, e.g., I saw that there was a comment regarding licensing. Well, just a little bit little advance is that we are gonna have.01:07:29In our next sessions as back to basics, we're gonna be talking about some basic suffice topic for like upgrade that it's always required now that we have changed version from recommendation. I don't know if you have realized but now the goals are on the download site is three.four and three.five. We have two goal stars.01:07:50In this time eh we're gonna have different patches of course for each one of them, but be aware that this is changing a little bit. We are gonna be providing information regarding upgrades licensing, and also we are gonna be talking about certificates. So we are I'm gonna be providing a little bit more detail on the following up sessions, but just for awareness eh.01:08:09Be be.01:08:30Please follow up for on the next topics. Now eh, also we have here the cyber capsule, if you want to double check some topics, we are gonna find more information about different security topics that are quick reviews and please feel free to review them, and that's pretty much all I have for this session.01:08:32I'm gonna leave this slide here in case you you are still taking a look at the QR but thank you very much for the time and that's what we are gonna have for today. Thank you.01:08:54