ISE meets Catalyst Center

Welcome everyone, and thank you for joining today's expert Insight webinar.00:12On ICE means catalyst center. So if you manage a network today, you know the pain of manual provisioning, the issues that come with mismatched shared secrets and the nightmare of troubleshooting client access.00:17Right. So today we are going to show you how combining the intent based automation from catalyst center with the identity intelligence of ICE fundamentally changes how you operate your network. I'm sorry.00:32And I'm joined by Kevin Guidinger. We are customer success specialists here at Cisco. We are focused on catalyst center and ICE technologies. I'd also like to welcome our team of wonderful panelists, I/O DG, Anand, Nick.00:48Matt will be answering your questions live and over the next 90 min, we are going to dive deep into how these two platforms work together to automate and secure your network edge. So the goal of our expert insight series is to share knowledge.01:05In a format that where the information provided builds off of the previous sessions and it continues to help drive your adoption. Our session today is the culmination of our elevate series. Our goal today is purely practical. We will show you the integration workflow.01:24The show you how to automate your AAA configurations, how to manage your security group tags, take care of stress sync, and also how to use the AI endpoint analytics feature. That will help you secure unknown endpoints that connect your network.01:43While we are going through our presentation and demos today, you might have some questions that come up and you can post them in the Q and A section of the Webex meeting that you can find by clicking on the three dots in the bottom right corner of your Webex window. Our panelists will look into your questions and respond, and in the event that your question goes up.02:01Answered, we will record your information so we'll reach out to you with an appropriate answer at a later time.02:21With that, let's look at the agenda for today's session. So firstly, we will begin by understanding the need for this integration followed by the prerequisites that you need to take care of from the perspective of Atlas Center and ICE. We will then go through the initial integration workflow, the heartbeat of the entire integration.02:30And as a part of the integration I'll also take you through the configuration needed to externally.02:50Authenticating to catalyst center through ICE using. Then I will show you how Catalyst Center can automate deploying your AAA settings on your network devices and also wired clients. We'll also be looking at the config automation by Catalyst Center briefly and all the.02:57The different options you have there.03:17And from there, we'll cover the trust sec policy management, which is also the biggest advantage from this integration, and finally wrap it up with the AI endpoint analytics and also the associated test course. Now, historically networking and security.03:18Have always been siloed.03:38The network team provision the switch and the security team managed the radio server. Now today the idea is to converge them both together helping us move from a manual box by box configuration to intent based networking. So while catalyst center acts as the single source of truth for your device inventory.03:40And triple AA configuration.04:00ICE on the other hand provides you the granular policy engine for your trust sec and for all the complex authorization rules. Think of catalyst center as your network's intent and provisioning engine, right? Whereas.04:02ICE would be your policy and identity engine.04:22Now Catalyst Center pushes the device configurations down to the switches, whereas the ICE handles the actual user authentication as well as pushes the context back up to catalyst center via PX grid. So we have three main use cases with catalyst center. 1st one is the AAA automation where your tech.04:26Configurations are provisioned automatically on your devices, and that also helps them get automatically registered as network access devices or nads on your ICE instance.04:472nd use case is for the SDA policy matrix where Catalyst Center syncs up the policy data from ice server and you are able to intuitively and creatively manage and create your access policies from catalyst center itself. We have a very user friendly matrix that you can use and easily manage.04:59The flow of traffic. You'll also be able to visualize the traffic flows that we'll we'll be looking at. I'll be showing you further into the session. The 3rd use case is the exchange of endpoint data and in this rearm, catalyst center receives endpoint authentication, things like posture status from the ICE to bolster itself.05:19Client assurance data, whereas ICE on the other hand receives the endpoint analytics attributes from the catalyst center. And all of this exchange between these two products happens through HTTPS, REST API, and through PX grid.05:38So let's get into the weeds. We'll begin with the most essential parts of the coexistence between these two products. So firstly, we'll look at the catalyst center and ICE server integration, and secondly, I'll show you how to set up ICE for externally authenticating into.05:55So these are the integration requirements at a minimum, we suggest that you use a minimum of 237X on the catalyst center and on ICE you need to at least run the three.three patch ten or newer. The versions highlighted on this slide are the recommended releases that you can still upgrade to which we always gest as a.06:13Best practice.06:33Regardless it's important to ensure that both products are running the compatible versions, so it's something to remember if you are upgrading one of the products, you need to also make sure that the other product is also upgraded to a compatible version. You can refer to our catalyst center compatibility matrix the website to check the compatible versions.06:34Before we proceed with the integration, these are some of the prerequisites and key things to keep in mind. So certificates, they are one of the most common areas why this integration could fail. So in case you are using a CSI certificate for catalyst center, make sure that your FQDN as well as the IP addresses of all the interfaces on.06:57Their catalyst center are included in the sand field of the certificate.07:17So if you are running a three node cluster, e.g., you need to make sure that the IP address of all the interfaces must be included in the sandfield. And the same goes for ICE. You need to ensure that the certificate on your admin node contains the IP address as well as the FQDN in the SAN field.07:22The Cisco ICE host on which you have PX grid enabled must also be reachable from catalyst center on the IP address of the E zero interface of Cisco ICE. And coming to the credential strategy, we recommend you create a dedicated super admin.07:39Are an ERS admin account on your I server specifically for this integration. You can also choose to disable password expiry that helps avoid a drop in the integration e.g. when the account expires, you could avoid running into that situation.07:57Connectivity wise, you need to ensure that the ice host on which is enabled is reachable from your catalyst center. And there are some of the ports where connectivity needs to be ensured. We have them shown here for HTTPS ERS.08:16And a PS grid to work. Also, if you have an existing brownfield ICE deployment, you need to ensure that your device names in the ICE server match the host names that are in your catalyst center inventory. Otherwise, the auto sync of the devices between the two products will fail.08:32So those are the prerequisites and foundation. And this is our eight step integration workflow. Step one through five are your standard integration, so catalyst center uses the rest API to push the network access devices or nads into ICE.08:52And then it uses the subscribe to live endpoint data. 2nd part of this integration happens on step six seven and eight. So we highly recommend that you configure catalyst center to use the cax for external authentication and also for switch management.09:11So this is because offers the same login functionality as radius, but it also reduces policy complexity that you would usually find with radius, right? And it could also potentially improve your ice performance and maximize the value of your device admin licenses.09:30Which you might have in abundance. By using your switches consume a single device admin license and that will help preserve your radius licenses strictly for your end users. And it, it does help you with a massive cost optimization.09:48So our 1st demo is the heart of this integration. We will begin by following the steps that we saw in the previous workflow. I will enable ERS read write, I'll enable PX grid, configure eyes on catalyst center, and finally, I'll be using Cisco ICE to enable the external authentication.10:08On catalyst center THROUGHX, and in this case, I have the active directory, you know, configured as the source, so they are able to, the users are able to log in into catsy. So without further ado, let's go into the demo.10:28All right, as you can see, this is my catalyst server instance. So what we would do 1st is we would go into the menu and then click on system, go into settings and scroll down to external services, authentication and policy service. Here you would be able to add both.10:51The triple A server or ICE instance. Now ICE gives you those extra capabilities, the assurance and automation capabilities, which is why we are going ahead with that today.11:11But you also have the aaa option, so in case you just wanted to create external authentication, you could just go with the AAA as your option. So we'll go ahead with ICE and once we select that, we are given the fields.11:22Is to enter the IP address of your ice server, the shared secret, the username password of the account and the FQDN of your server.11:42So we'll go into our ice server and we'll create our PX grid and we have to also enable the ERS read write. So the 1st step we came into deployment and then we are selecting PX grid. As you can see it's already enabled in this case. So the next.11:51Thing we would do is to enable ERS read, right? So we go into settings, API settings, and then.12:11Make sure that this toggle is turned on for. It's also suggested that to disable CSRF, and then click save. And once both the ERS read rate are enabled, then we would go into.12:18Your admin access, create your users specifically for catalyst center, as I said, and you can do this as a super admin or it can also be an ERS admin. We create this username it as center, provide the password.12:35And then we go back into the catalyst center. So we get the IP address of the ice server that we have to enter over here and then enter the shared secret.12:52We have to create the shared secret by adding catalyst center as the network device. So we come into administration network device and create something for catalyst center. We name it as catalyst center part four.13:08Give it the IP address of our catalyst center instance, and then we would also create, we would also enable radius and now if you have multiple IP addresses, as I said, if you have a.13:23This center cluster.13:43Or you could also if you have a virtual IP, you need to also make sure that you're adding all of those into here. So that's something to remember, we'll croll down and we'll enablement settings, create a shared secret.13:44Since we are going to use in this case, you could also select a radius and you could also shared secret for that as well. Once we do that, save changes, submit, and then we have it.14:04We have the catalyst center created as a network device. This is the FQDN that we'll also need when configuring the ice server in the catalyst center integration. Firstly, we'll enter the shared secret that we created and then update the username and password so that.14:19Of the account we created in the server and then the FQDN that we copied and you'll also have advanced settings, whether you want to connect to PX grid or not, this is selected by default. The default protocol is also radius, but again, as I said.14:39And we are going to encourage using so we'll do TACACS in this case as well.14:59And click save. So once that is done, the certificate exchange happens. As you can see, you'll have to accept the cert exchange and it will go through a sequence of steps, initiate the connection, discover the nodes, connect to PX grid, all of that, right? And once that is done.15:05You see that the server shows up as you know one of the server in your integration, right? And it has to come up with an active status. If you had multiple nodes in your server, those would be discovered and added over here as well. In this case we just have one instance, so.15:25It is showing up as active and, the IP address of it. And when you click on its status, when you click on active, it would take you to.15:43It will take you to the dashboard. So when you click on the status it will take you to the dashboard. It will show you the status of your ice servers. But now we'll go ahead and you know move on to the external authentication. So we'll go into system set users and roles.16:01And we look at the groups that we have. So far we just have one local user that is the admin user which has a super admin role. And then when we go into the user groups, we have the super admin role, the network admin role, observer role that exists by default. But here in this case, we've also.16:18You created another user group called assurance only, it gives us access to only assurance features within catalyst center.16:38Right, so I just created this user group for demo purposes so that we have two users that we could create to log in into these two user groups remotely. So we have all these user groups created in Atlas Center.16:46And once that is done, we'll move on to external authentication. Here is where you would find your AAA attributes for your and your radius server, as well as you have the option to enter your primary AAA server.17:05So now we go back into ICE, we add our shell profiles, we go through the workflow of you know creating our policy sets and then mapping them to the users, right? So the 1st step, I want to show you that my ICE server is connected.17:23To the active directory.17:43And these are all the groups that it has gathered from my active directory. I've created one for assurance only and the other for super admin. And this is how it looks in my active directory. We have assurance only security group, the super admin security group, and then both.17:45The users as well over here. So we are gonna use this as our active directory source. And then we are going to proceed with creating the shell profile, so we'll go into work centers, device admin and then policy elements.18:05Results and profiles. And here is where you would be able to create your profile, right? And we are going to name it for super admin. This one is going to be for super admin and the next one will be for assurance only.18:25And here we are going to attach the custom attributes from our catalyst center, right? So we are going to get the AAA attribute from here, which is the Cisco AV pair. So we'll copy that from here and paste it into the shell profile.18:43And the value would be your user group, the name of your user group, right? The role, which will be super admin role and copy that.18:59And hit save, and we are gonna duplicate this one, create another for the assurance only user group as well. We'll do the same thing rename it to assurance only.19:21And attach the attribute and the value since it's duplicated already is there but you'll have to replace the name of the user group to once that is done, we click save and the next step would be.19:36To get into the policy set.19:56We'll go ahead, create a policy set, and we'll select the default device admin as the allowed protocol. Here we are going to add the attribute of network access and.20:04Will provide the device IP address of catalyst center.20:24Save and then we go into the policy set now and for the authentication, we are going to map it to our active directory as the source, right? Right now it's set to all user ID stores, but I'm gonna select the one specifically for active directory.20:33And then for authorization, we'll do something similar as well. We'll attach this to the shell profile that we just created. But again, you know, for the, we'll go into the condition studio and map it to the active directory.20:53Users, so this is the shell profile that we just created. We are gonna map it to the policy set and we are gonna create a similar one for assurance only as well.21:12You're gonna map it to the active directory source for assurance only. And then also select the assurance operational profile. Click save. Now that's very simple, right? Very straightforward. And once we do that, we should be able to test the logins. So.21:35We can.21:56Now we have to also go into the external authentication and make sure that the AAA attributes are correct. So in case we are using we need to set the AAA attribute to Cisco every pair or if it is running radius, this has to be in place and we'll have to update that. Make sure that your primary AAA server settings are also.21:57You can enter the shared secret over here there's some advanced settings for both radius and since we are gonna use tacacs, I'm gonna select that and hit update.22:18And we enable external user so that these settings go into effect, and now we are gonna test the logins we have an incognito tab for the same.22:41We are logging in as our active Directory user, the username and password and since this is the super admin, I get all the privileges associated with that user group. So I can see I have the super admin role here. And similarly, if I test the login as an assurance only user I'd be able.23:02Able to.23:21I see only assurance features as you can see once we logged in profiles and settings, you can see the role is set to assurance only. And even when we click on the menu, you see only assurance features showing up over here. So it's very simple and straightforward. We encourage you to use the ice.23:22The work for your external authentications.23:42And also set it up set up your users to log in remotely. So now that we've performed the initial integration through PX grid, we enabled ERS read write, we also enabled external authentication, we need to now tell our switches to talk to ICE.23:46So catalyst center uses an intent based model.24:07Tied to your site hierarchy. So this is where when you assign a device to a site, it inherits all the triple aa settings that you've designed for that site center. So it's a very intuitive, very easy way to manage your triple AAA settings on multiple devices at once belonging.24:10That site. So generally when you're pushing automation.24:30For day zero, day one and telemetry are bound to the site hierarchy, right? And that is why it is important to have all of these created at the start of your deployment. So this is another critical side slide catalyst center gives you two ways, two ways to push.24:33One is the site hierarchy or you can also use day and templates, but site hierarchy is the recommended method.24:55And it's also important to remember that both these options are mutually exclusive, meaning if you are using site hierarchy and if you are deploying your AAA configurations in bulk, quickly onto all devices of that site, then site hierarchy is the recommended option for your standard or deployments.25:02And in cases where you have advanced configurations where your AAA settings center aren't being sufficient, then you can opt for the IBNS two.zero and you can use your day end templates to deploy that configuration.25:22So the rule of thumb is that you must choose either the site hierarchy method or the provisioning since they cannot both be used simultaneously together without running into conflict side. And the best part is since we have the enabled the RS read write on the server and.25:38Since we have integrated it.25:58Now catalyst center will automatically push all the inventory data to ICE. So whenever you provision these aaa settings to all the devices within a site, and all the devices discovered over there and all the devices to which the configuration has been pushed will automatically be shared with ICE.26:00Through the ERs, right? This eliminates the need for having to manually create the device again in the server, right? And here is how the aaa settings would look like in a catalyst center, right? We'll also look at the demo. You are able to go into network settings, select the particular site where you intend.26:19For the AAA to be provisioned. In this case it is global in this snippet, but it can be global or site specific, but it's important to remember that the settings are inherited to all the underlying sites, buildings or floor sites.26:39And you can provision the AAA settings individually for the network devices and the wired clients or endpoints in that site. And as I mentioned earlier, we recommend that you configures for catalyst center to manage your network access devices.26:54Or and this ensures that they consume a single device admin license and preserves your radius licenses or user and endpoints. So in this demo, we are going to discover a few devices in catalyst center and then provision site level.27:11Triple AAA settings, we are gonna show you how to enable this site level settings and provision them onto the devices that have been discovered and verify that the newly provisioned devices are also being shown as the NAT devices in ICE.27:29Let me switch over to that demo. So as you can see, we have already added the server, right? It's in an active status. You can go into system settings, external services, authentication and policy servers here.27:48Able to see the list of ice servers that you've configured, and when you click on the active state, it will take you to the dashboard, it will show you the status of all the services, right? Whether it is running, whether it's connected the PX grid status as well, the IP address and, and the status.28:07And once we verified that, we are then gonna go into a design network settings. Here is where you would configure your AAA settings, right? Be it for your network or the client endpoint. You have the option to enter the ice or the AAA server details. Select the.28:31Protocol radius.28:51Select the PAN node, the IP address of the PAN node, the PSN, and enter the shared secret. You also have the option of configuring DHCP, DNS, NTP on all those settings in bulk to the devices. Now as you can see here, the hierarchy is set to global.28:54So all these settings will be automatically applied on the sites underneath. Then we also have similar settings for clients and endpoints. We've already selected other AAA servers here as we've entered the pan server IP, the primary server.29:13And then the shared secret, right?29:33And similarly, we have all the additional details for DHCP, NTP and DNS, and once that is done, once you entered your settings over here, you would click on save.29:36And now we'll have to discover some devices if we want to provision these settings on them, right? So we'll go into tools discovery. I already have an existing discovery job, which is configured with the IP IP range of my devices.29:54So I'm gonna just rerun the same job here. So I'm gonna click on the three dots and rediscover, and once I run the discovery, I can go into tasks.30:12Check the status of my discovery.30:32And verify, you know, how many devices have been discovered. As you can see, this is the task discovery task, and as I can see there are three devices that have been discovered, right? And I can go into my inventory to check what are those right provision inventory.30:34And it would show me now what are the devices I can set my inventory focus to inventory, right? See the status of the inventory collection.30:54Right? And as you can see, it is still taking some time, it is syncing up with Las center, collecting all the information. And once it is fully managed and reachable, we'll switch to the provision focus because we need to provision the AAA settings.31:04Once we do that, we'll select both the devices, both the switches, and then click on provision site. We'll, we'll go into actions, we'll select the devices, go into actions, provision.31:21And then provision the device. As you can see here, you are given the option to pick a site. Here we are gonna select a site for both the devices. So we are gonna click on assign all and then we are gonna select one of the buildings.31:36And then this is the summary of all the settings that would go in, the aaa settings that would go in as you can see, you know, before even pushing the, before even it does the provisioning it lists all the settings that you've configured for this global site.31:58Right, you'd be able to verify all of that before pushing it out. These are the server their client server as well, all those details for both the devices. So you could apply these settings right away or you can also.32:14So.32:34Schedule them for a later time. Catalyst center also gives you the option to preview all the settings that go in so you could also see that option. We're gonna do the preview, apply, and then it is gonna perform some initial checks, whether there are any pending operations on the device from It checks for the device compliance, all the value.32:35Conditions before it goes ahead and provisions.32:54So this is the workflow of the steps that take place, right? It validates all the parameters that we're entering. It generates the, it converts our settings into a CLI template, right? And it pushes out the configuration to the device.32:59You go ahead and deploy, and as you can see, the provisioning status here in the inventories changes from not provisioned to pending and then to provision, right?33:16So once the job executes, we can see that it's in the pending state now because the config is being pushed and eventually this is it has to be successful, right? The provisioning state has to be successful.33:32Okay, and we are also going to verify that since the devices have been provisioned, we want to check that they have been discovered in ICE as well automatically, so we'll go into administration, network resources, network devices, and then it should show these devices are getting automatically.33:58Registered right as you can see, it will take some time to sync up, but eventually you should be seeing the devices over here so we've also assigned some roles for the device.34:17But, ice server, so as you can see both the devices have been discovered in the ice server, so this is a very useful feature so that you don't have to manually enter this device. This list will be maintained through auto sync.34:37Okay, so that was the demo about triple AAA settings, AAA provisioning, how you can deploy aaa settings in bulk to an entire site. So what just happened, right? So in a sense you we provisioned the site level settings and it properly.34:57All the AAA information on broad scale of devices within just a couple of clicks, right? And also without manual entry, the NAT devices are also synced into auto synced into the ICE portal.35:17Through the RS API read write access that we gave it. So catalyst center just applied the config and synced it with ice, but what if we needed to push more complex configuration, right? What if your AAA settings are insufficient, what if you needed to push templates, right? So I would wanna go into quality.35:29But I before that, I would like to take an example of a scenario.35:50You know where you would need to push a template. So I'll cover that briefly. So imagine where you have ice server in a monitor or a low impact mode, which in case ICE will discover and profile your endpoints discover what endpoint is on the network and where it is, right?35:55So taking that as an example, we can, we will look at how you can use templates in catalyst center to quickly deploy.1X configuration on your switches, right? And also for those who rather intend to use day end templates, you can push CLA configurations concurrently across your fabric.36:14With zero syntax errors.36:34So if you prefer running the IBNS two.zero configuration on your ports, you can use the ginger or velocity templates that we have available in center to reliably, you can reliably push the same configuration to many devices, hundreds of devices concurrently.36:36So in this demo, we'll show you how to quickly get started with building.1X CLI template in a catalyst switch. As you can see, we go into design CLI templates and then we create a project.36:55We name it as a.1X then we create a template, here you have the option of selecting what is the template type, whether you want to use ginger or Velocity as the.37:11Template language, and then you would select the device family where you would be applying this. And in our case it's gonna be an IT 300 switch. So we'll go ahead and select that family over here.37:31And there's also device tags that you could associate with this template. So anytime you're going to focus on a certain thing, you could just filter these templates using the tag and look into them. So here is all the.1X configuration that I'm gonna push to my ports.37:46So we are gonna commit the changes and then we'll also have to create a profile. So we'll move on to the next step, which is design CLI template.38:08And then ok so here we are, we'll go into network profiles.38:30Create a new profile for switching and we are gonna map the template that we created to this profile, right? So we'll name the profile and then attach the template that we created and the next step is.38:46We need to assign, we need to map this template or this profile to a specific site.39:05So we'll assign the site for this one where we want to push this template right. And so when we assign the site, all the devices belonging to that site will show up at the time of pushing the template.39:12Then we are going to going, gonna go into the templates, design CLI templates and then select our template.39:41Provision, and as you can see, we would be given the list of all the devices belonging to the spectrum site which we mapped it. Click on next. Push the template.39:57We're gonna also be able to see a summary of you know all the config that will be pushed to the device. We can compare it to the running configuration that is already on the device. We'll go on to the task, verify the status.40:16And as you can see, we have the three templates pushed out over here successfully so here is the configuration of one of the port after this template was deployed.40:37As you can see we have the IP device tracking switched on, we have the flow control enabled on it, but the important bit we can also see here is the the.one explosed mode, right? So in this case, even if the endpoint cannot log in or if it is not already configured as a map device.40:57It won't be able to get onto the network.41:17But using catalyst center, we secured the ports on our network within just a few clicks, right? And once a user connects to this port, we will be able to see those endpoints on ice server. We will be able to see things such as the name of the device, the authentication policy, and the authorization profile, right?41:19And we also have this another option in the Atlas center, which is the per device access control policy. So beginning in 237, we introduced some incredible UI workflows so that you are able to push out your layer two and.1x config per port or globally to all the ports without having to touch.41:39The CLI or without having to deal with the templates side.41:59So for the next step, we are going to configure access control policies and authentication policies directly from the device details page without, as I said, having to create a template, right? As we build out our security groups and center, we will notice how they populate in twice.42:04Can go into ICE and build by those sgts to our authorization profiles. And finally as a result, the end goal would be that we enforce East west traffic restrictions directly on the switch using access contract.42:24So in this case, this is a 9300 switch. This device is added into catalyst center from device from the inventory we go into the device details. We then go into the layer two configuration, as you can see, you know, the layer two configuration is listed on the left. We have multiple options here. You can perform.42:41Authentication settings, process settings, and you can deploy all these settings either as per port or onto multiple ports at once.43:02So in this case we selected the interface, a particular interface, change the.1X mode from open to closed. Adjust the reauthentication timers and you know also make the trust second enforcement. All from a graphical interface, right? We also have the option to choose the host mode that.43:12It's either multi domain if they have just one endpoint in a data VLAN.43:32Or you can also choose multi or if you have two or more endpoints in the data, right? So you have all these granular settings made available in catalyst center. All you have to do is come into here and, you know, select those settings. Catalyst center will automatically generate the CLI syntax for you in the background and it pushes that it out to this way.43:37Making your secure your edge very simple, right?43:58So this is the demo for that and how we are gonna do it. So we go into device the layer two configuration and we will click on authentication. Dot one X is disabled by default, so we are gonna enable that edit it and click on enabled.44:02And then we'll also go into trust sec. We can provide a device STD, you can enable enforcement and give it the VLANs, but that is the VLAN range and then the port configuration on which port do we wanna, you know, do we.44:18On this configuration to be applied, right? So we can edit those settings over here. You can edit the.1X mode.44:38To be closed or open, right? You can add your.1X configurations into here in the attributes and here we are gonna select multi authentication as the host and also readjust the timer.44:46Then the CTS configuration as well. So it's very easy, you know, in terms of making your.1X, your trust sec settings directly from catalyst center on a per portal.45:04A Global level. And once we provision all these settings, it will go through this workflow again and then we'll be able to click on deploy and this is the very intuitive comparison that we get, right? What is the config to be deployed that we just created and also what is running on the device.45:20We can quickly take a look. So we can see all these syntax being created, the roles, the sqts and pushed out to the device. So authentication should now be enabled. The trustec enforcement should also be now enabled.45:39You can verify that from the device here. The port configuration would also show you the non default config, the trust sec.45:59Configuration as well you will be able to verify that. So here's the port configuration that we pushed out and then the trust sec as well. These settings are same as before because we did not change from the default. Now that brings us to a very.46:10Useful feature of this integration, the group based access control.46:30The group based policies. As we all know, group based policies allow us to move away from your IP based access control and instead help us use a business logic from catalyst center. So configuring something along the lines of users.46:34Within an employee group, talking to the devices within a confidential server group, right? We are just talking pure business intent here, right? That's much easier to manage than mapping your subnets, right? So this slide shows us how Cisco trust sec replaces thousands of.46:51Your individual IP based rules with a concise matrix matrix of groups, right? The ice server handles the assignment of these sgts to your users and workloads and that helps you effectively hide.47:11The all the complexity that happens in the background, right? So on the left we see the individual users, they're abstracted into logical user groups like employee, partners, contractors, and guests, right? This means you NO longer need to write policy for every individual device. You just write one policy for the entire group and then pushes that out to the network fabric. On the right you.47:25Have the same logic that applies to server groups, so you can group together workloads. You are able to drastically reduce the number of destination entities. You can segment them together.47:45And ultimately that will help you reduce all the policy load, right? The center of the slide represents the metrics, the intent based policy matrix, right? So instead of managing your complex firewall rules, you can simply define the relationship between a user group and a server group. So e.g..47:57The contractors are only able to access them general access servers, right? So you could do something like that using this matrix. So acts as your single point of management to deploy these group based policies across the entire network.48:17And that ensures that the access contracts between your security groups are also enforced consistently regardless of where your user is or where the server is even physically located. So.48:31This helps us identify users for group based policies. So ultimately we want to identify users and devices for group based policies to simplify our security operations. We break this down into three core pillars. So firstly, we simplify onboarding.48:47Whether you are dealing with IoT, whether you are dealing with cloud based or even bring your own devices, right? Workloads, right? So whether you're dealing with any of these workloads, ICE ICE automatically identifies the entity and assigns it a scalable group tag, right? And that will help us eliminate the need.49:03For creating complex and static IP based rules.49:23Now secondly, we actively reduce risk, so trust sec is one of those features that we rely on for this. It allows us to restrict any kind of lateral movement that occurs across the network, right? So if you identify a device as vulnerable of or if it is acting even suspiciously, right? We cannot automatically.49:27Source isolated at the hardware level and it will help us contain the potential threats.49:47Without doing any manual firewall configuration. And also we reduce the burden on your by using Atlas Center to push these policies to we automate the process of adding you know your access contracts making the changes, right? And that significantly lower.49:52It's your operational cost, it reduces human error and also, you know, provides you everything in a very intuitive dashboard.50:12So that you have a consistent security policy that follows the user. So in short, we are moving from a manual and a possibly error prone management model to an automated and identity centric security posture.50:21So let us talk about how we actually classify these entities into intent based groups, right? So the core idea here is to move away from network centric security, as I said, and move toward a business center security, right? So on this slide you can see we categorized everything from contractors.50:38Manufacturing robots, finance servers into different segment them into different logical groups.50:58And we looked at how we do this, right? We leverage Cisco eyes to look at the who, what and where and also by pulling data from sources like Active directory, device profiles or even location services, your eyes would automatically assign the SGT as I said. So now.51:04So the beauty of this approach when we integrate these two products together is it's once the device is tagged.51:24The security identity follows it everywhere. So that information is also shared with catalyst center, right? Whether it's a printer moving to a new floor or a contractor logging in from a different building, you know, we can help remain, keep the policy consistent throughout.51:31And with catalyst center, the benefit that we get is we can easily manage these groups so that the business center is enforced uniformly. Now this is a very common question that we keep getting. Where do we manage our sgts, right? So the answer is both, but for different reason.51:47So while catalyst center provides you the what meaning the catalyst center provides you the business center, so you can use that for your macro segmentation defining your business level groups.52:08And also to visualize how traffic flows across your network, right? So in catalyst center you have an analytics map that gives you a very a nice sankey diagram of all the traffic flows that are happening and you can quickly take a look at the traffic flows before you make your decisions. ICE on the other hand provides the how, meaning it.52:21Provides you the enforcement logic so you can use eyes for your granular authorization for all your complex conditional rules.52:41E.g., if you need a policy that says a contractor can only access the finance server if the device posture is compliant, right? So then that is going to be a nice function, right? So since we want to have the ideal workflow very simple.52:48What we would do is you define your groups in catalyst center, let them sync up with ICE, and then you build your deep dive rules within your ICE server, right? So you use ICE to build your deep dive rules. So by using catalyst center to design your group architectures and ICE to manage.53:06The fine grained elements, fine grained policy elements, you'll be able to get the best of both worlds, the architectural simplicity from as well as the precise and powerful security control from ICE. So.53:24Before we get started with trustsec, before we get started with group based access control, we go to the catalyst center UI. This is how we would get there, right? Provision, and then click on group based access control. Excuse me. So.53:40This is how it would look like when you're configuring it for the very 1st time, right? So you'll have to trigger a migration of all the existing policy data from your ICE instance over to catalyst center, right? And once the migration is complete, you'll be able to see the policies from your ICE server getting reflected.53:58And if you had any policies in already, if you had any existing policies in catalyst center.54:19Those will also be copied to the ICE instance, so so both the products will be in sync. Now post migration, if for some reason you are you decide that you want ice to manage your policies, you can make that setting by going into group based access control. So you can just.54:26See this configuration icon over here right you can get there and you can select that setting, right? So ICE will be the policy manager.54:46So after the migration is successful, the 1st step is to go into the security groups tab and once we click there, we'll be able to look at all the list of the groups that we have right now, the associated tags, you know, which is the meat of the security group, right? Very important. And the description of the.54:58This group, the policies that they are tied into, right? You'd be able to see that over here.55:18So in this demo, we will look at how we can create two new security groups and deploy them into the fabric domain, right? So we click on security create security group. Here we are creating a group called SG con.55:24We give it a tag value and then we are gonna create another group as GIOT, and then we'll assign it the default time, right? And once the security groups are created, you would be able to see them listed over here.55:43So as you can see, these are the security groups we created, and once we do that, we are gonna deploy it out to our fabric, right? And when we do this, when we create our security groups in Atlas Center, they also automatically get populated into ICE.56:01So you would be able to go into tie those your authorization profiles and do stuff like that and the next demo, so now that the security groups are created, the tags have been created. The next step is to create the access.56:19Contract, right? That is gonna help us define the relationship between the security groups that we created, right?56:39So we are gonna create an access contract, so in this case we will create an access contract. You you could do that either you know of for a single rule or you can even.56:46Apply multiple rules within a single access contract.57:06You can even apply one single access contract to multiple pairs of groups, right? And in terms of granularity, you can create very specific contracts for sensitive groups or you can even create a broad contracts that you can apply for multiple into multiple policies.57:10So for the sake of demo in our case we created a new access contract. It is called as we named it as NO ping with the intended functionality to block your ICMP traffic, this is just to show it to you for the demo purpose. You can add more rules over here and specify them just like.57:30Any other standard firewall rule, right? These will be processed in a top down order, right? So the network will evaluate the packet of the 1st rule if it doesn't match it goes down to 2nd and so on, right? And if it hits a match, it takes the action and stops looking further.57:50If a packet doesn't match any of the rules, you defined in the contract it will be dropped by default, but you can also adjust the default action over here. And this helps bundle complex logic into single contract, so the policy matrix in caption center stays clean.58:07And also instead of creating a new policy for every single group to group relationship, you can create a library of contracts. As you can see, I have multiple access contracts here and you can then apply the same access contract to dozens of different security groups.58:28So, so far we created the security groups. We also created the access contract and this demo is all about mapping them together. So we are gonna create the policy and this is the matrix that I was talking about, which is one of the biggest benefit of leveraging this integration. So here you are able to see.58:45Their entire security posture as a grid.59:05Of groups, right? So firstly simple and straightforward example will build a policy to apply the NO ping access contract for the east west traffic between SG carp and the SG content security group, right? We can see, so once we create these.59:08Policies in both the directions. We are gonna save now. We are also testing the ping on the side. We are gonna deploy these policies and once they get deployed, you can see that the ping gets timed out, right?59:28And once we set it back, once we go into the policy, once we set it to the default, or you know once we we just disable the policy, we will be able to see that the ping gets back into a running state. So we set it to default policy state, do this similarly for the other policy.59:54And once we clear the metrics, once we clear the policy, we would be able to see the traffic resuming where you can see the ping responses working and yeah.01:00:14So in summary, what we get is a visualization of services. We get the flow count based on your group to group communication. It's a very simplified, it's a very intuitive workflow, right? That we get to do using catalyst center.01:00:31You just have to worry about the business intent and you don't have to go into the complex rules that you'll have to create. We also have the ability to add your contracts, you have modify your contracts, and then you can push them out to ICE for policy enforcement as I said.01:00:50Right. And this is what I was talking about. This is the sankey diagram, the sankey chart I was talking about. This is 2nd major benefit of integration within this feature. So this is policy and analytics in catalyst center. So when you go into policy group based control.01:01:10And look into policy analytics. This gives you a visualization of the flow data between your various security groups that are in place. You also have your ICE profiles and stealthwatch host groups also show up here. You can, you can get that done. You'll be able to filter using this filter option.01:01:30In here in the top, you'd be able to see the security group communication, what is the flow between the different ICE profiles, the stealth watch host groups as well. So in this case, we are able to see where the traffic is flowing, you know, between the sg car, the SG car where as.01:01:50And if you see these traffic flows, you know that those groups are also being actively used, right? And, you know, something is being enforced on these segments, right? And you can filter them as I said for further granularity, you can see exactly which groups are talking to each other before.01:02:09You need to make a decision on whether you have to block a certain policy or not.01:02:30Right, you can take a look at it from here. So what can we actually do with this? We looked at how to we define groups, how we manage contracts, but this slide represents the end state, right, of your security architecture. We are talking about three massive shifts in how you manage your net.01:02:34Network. Firstly, NO more firewall hairpinning. In traditional networks, you often have to route traffic all the way to a central firewall.01:02:54With trust tech, we enforce that policy right at the edge on the switch where your device is connected, right? We keep the traffic local and the security in place, right? Secondly, we don't have to manage thousands of lines of ACLs.01:03:04Right, we replace that with a simpler logical model simpler matrix. And thirdly, we finally have east west enforcement by using group web group based policies, we can restrict lateral movement between users, servers, and different security groups. And that will help us stop the threat.01:03:19Before a single device is compromised.01:03:40And this is the matrix, right? So this one doesn't have a policies applied in it, but ideally we would see a lot of policies in place between all the security groups. So instead of a spreadsheet or a CLA you have a nice visual grid.01:03:42You will see all your source groups on the left, you see your destination groups on the top and you simply decide the relationship in the middle by clicking into the grid. It's simple, it's visual and it's also automated, so that's how we make the network work for the business.01:03:59And not the other way around. So now that we've looked into we've made segmentation easier, we secured our users, but what about the endpoints that we don't know of, right? So what does this integration hold, for when it comes to endpoint visibility?01:04:15Now for that, we need to address the reality of today's workplace. We have a massive, you know, proliferation of unmanaged devices. We are seeing a one to five ratio of managed to unmanaged endpoints. So most of these devices are often unpatchable, they are unencrypted.01:04:36And, one of the critical things is they are very easy to spoof as well, especially the IoT devices, right? And if an attacker mimics the Mac address or the DHCP attributes, they can easily bypass your traditional security and be able to gain any kind of unauthorized access. And that is why we use.01:04:57Is the AI endpoint analytics?01:05:16Through the integration of catalyst center and ICE. We move beyond your simple Mac based trust and then by aggregating deep packet inspection using C bar, we use telemetry as well and also the ICE probes. We are able to accurately classify these unknown device.01:05:19Proof features, as I said like C bar, we don't just see the device but we are also able to profile it. The goal here ultimately is to reduce uncertainty. So we are going to classify devices based on the information that we gather. So profiling these devices accurately is the end goal so we can.01:05:41Automatically assign them the correct service the sgts that we built earlier, right? And that is what will help us allow the to secure the network from the edge ensuring that even if a device is unmanaged, it is still monitored, it is isolated and protected.01:06:01Another thing to consider is what can we do about the unmanaged assets, right? If we look at this slide, we see a clear divide. Our laptops and managed devices are secure. They use.1X, which is obviously robust credential based authentication, but for our IoT devices.01:06:22E.g., smart thermostant, right? They don't have a supplicant to provide provide credentials, right? So they fail eight oh 21X and they fail back they fall back to map or they they fall back to your Mac authentication bypass, right? So we rely on.01:06:41Mac address database in ICE, but this also creates two problems. The 1st is the catch all risk where if an IoT device isn't in that database, we often default to a catch all policy right just to keep the business running. And that could create a security gap.01:07:00And then we also have the risk of spoofing. Now we as we discussed MAC addresses are easily spoofed and attacker can simply clone a known Mac address and the network would possibly, you know, give access, grant them access, right? So we need to make Map more secure and that is where an AI endpoint.01:07:18Analytics and the and ICE integration comes into play. We need to move from a trusting Mac address to verifying the device identity using the deep profiling, getting all those attributes and classifying them.01:07:38Right. So now that we've established that map is necessary even but we also need to be clear clear about why it is dangerous, right? As I said, the Mac address must not be our only source of truth. And then this slide you can see on the left Mac spoofing is.01:07:54A trivial, the attacker doesn't need special equipment. They just need to clone the MAC address of an authorized device and the network would automatically read them as a trusted member of that group. But, it gets worse, right? On the right we see attributes spoofing.01:08:15So we know the attackers are getting smarter, the modern security system look at more than just the Mac address. They look at DHCP headers, they look at vendor strings, device classes, all of that, right? So here in this case attacker just doesn't copy the Mac, they also spoof the class ID.01:08:31And by mimicking these attributes, they are clicking the profiling engine into classifying them as a trusted device type.01:08:51And if we realize only on these basic identifiers, we are essentially leaving the door open for anyone who knows how to use, you know, basic tool to, you know, make all these changes, right? We need a way to verify the device's behavior and context and not just what it claims.01:08:58To be in its header, right? So that is the problem we are gonna solve with a endpoint analytics. So the way we solve the impersonation prob problem is our goal is simple. We want to move from a network full of unknowns to a network where every single device is.01:09:19Identified classified and trusted. So we do this by using a multi source data aggregation model. So we don't just rely on the ICE profiling alone. Your catalyst center will act as the central hub. It pulls intelligence from a variety of sources.01:09:39It uses DPI deep packet inspection based fingerprinting using which we look at the actual traffic behavior of that endpoint. Then we use the network telemetry probes that we use to monitor the network fabric and see how are these devices interacting. And we ingest the.01:09:57Data from your existing management systems like cmdbs, where you all already have like records of the device type, the software versions and the serial numbers so it uses multiple sources to gather this information.01:10:17Right, and it aggregates all of it runs it all through its machine learning engine and then provides a definitive profile for the device. While this feature does work locally, we do strongly recommend connecting to the Cisco Cloud based intelligence because.01:10:31By leveraging the cloud, the catalyst center would get updated with the latest global device signatures. It would also be contributing to the cloud while also learning from it, ensuring that all the newest IoT devices that are hitting the market today.01:10:51Would also be recognized instantly, right? In short, we take the unknown from the left, read it through catalyst center, the AI analytics engine and then get the known device profile on the right, right? So this is how we turn a bypass.01:11:08A Typical bypass into a secure and a validated connection. So to move beyond the Mac address, we need a deeper level of intelligence. We need to learn four distinct factors for every single endpoint. We call that multi factor factor classification or MFC. So instead of just a mac.01:11:26Address, the device profile is built on these pillars, right? What is the device type, whether it's a.01:11:46A laptop, a thermostat or a smartphone, who built it, what is the specific model number and the OS side, what software is it running? The real power here is a shared intelligence between catalyst center and ICE. ICE shares everything that it learns from the authentication process while catalyst center.01:11:52It contributes the data that it gathers from PPI Deepak inspection and other telemetry sources.01:12:12If you are in an industrial environment, you can even integrate it with tools like cyber vision, Cisco cyber vision, and you can get some deep insights and like specific fingerprinting. Let's begin by looking at the DPI piece. This is where we move from simple profiling.01:12:19Into, through intelligence, right? So when a device connects, we perform 1st packet classification, we look at the very 1st packet of the flow.01:12:39Destination port, the protocol and the IP info and check our case, right? Because 80 % of the application flows are predictable that case check will give us an instant determination of, you know, without wasting much EPU power.01:12:49But for the unknown devices, we trigger deep packet inspection and our protocol engine looks at fields across different layers. So we use to identify the endpoint type itself and that creates a classification hint.01:13:04Right? So e.g., if you had an if the engine detects a dicom protocol, it would immediately classify or identify the device as a medical scanner, right? So it listens for all these specific protocols associated with the device type to confirm its identity. So these hence.01:13:20These are stored in a device table and synchronized in real time between the switch.01:13:40The catalyst center and also the ICE. And if the device behavior changes, the probe gets updated and system sends those updates to endpoint analytics immediately. And what about the unknowns? So even if we don't know what the devices or machine learning engine can see that it shares traffic patterns.01:13:44And attributes with other devices. On this slide you can see there are clusters, the green group and the gray group. The system is essentially saying I don't know what these are, but.01:14:04I know that they are not the same and they both behave in a very specific consistent way. That's your classification algorithm working in the background. This is where you as the administrator administrator come in, you can create a rule to group these clusters and teach the system. E.g., you label the green cluster as your smart thermo stats and.01:14:16The white cluster has your smart lights, and once you provide those labels, the machine learning engine takes over, it learns by, you know, looking into the traffic patterns with your new labels, it validates and checks the labels against, you know, the current data it verifies the accuracy and the next time when a similar device connection.01:14:34To the network, the system will recognize it.01:14:54Instantly and puts them into one of these groups, right? Push them into assigns them one of these labels automatically. So the beauty of this is the system, the engine gets smarter, the more you use it, it reduces the number of unknowns in your environment. It minimizes the need for manual profiling and ensures that your security.01:14:57The policy is always based on.01:15:17The learned behavior, the actual behavior of the devices on your network. Cloud crowdsourcing is another thing I was talking about connectivity to the cloud, right? Since it plays a critical role in improving your machine learning. So e.g., if you had multiple, if you have multiple deployments.01:15:19Across the globe.01:15:39And e.g. your instance in EMEA learns a certain new label. If you have the cloud integrated, then it will share that information securely with the AI cloud. Cloud acts as the global brain, it aggregates all of these insights, validates them and uses them to improve the.01:15:40Profiling engine for everybody, right? So that is the essentially the crowd sourcing, right? So when a similar device connects.01:16:01To your catalyst center in a different region in apac or in in because the EMEA site already part the system what that label is for, we can now use that info and AI cloud connectivity can give you that suggestion.01:16:08That you need to label this new system that this new device that gets connected in, in your other region. So that is the power of crowdsourced intelligence, you benefit from the collective learning of your entire global community, Cisco community. You don't have to manually profile every single device type.01:16:25That enters your network instead, you know, by using this, you are leveraging the work done by other admins around the world and helping you make your network smarter, faster.01:16:45And more secure. Coming to enabling the actual feature, so this requires three main steps. You'll 1st have to activate a C bar on your switches and then enable the bidirectionalize integration. We've already enabled ICE, but this is another additional step.01:16:57That ensures that the platforms both the platforms are sharing the endpoint profiling data and then we'll also have to turn on the AI network analytics to leverage the cloud machine learning engine. As I mentioned, the cloud piece is not mandatory but still recommended since it will help you get some more granularity identifying the endpoints.01:17:15So these are, so some of the prerequisites as I said, we need to ensure is that the ICE is integrated in catalyst center. All the settings are enabled in catalyst center for AI and point analytics and your C bar is deployed.01:17:35And the cats is connected to cloud. The 1st step is to activate the deep packet inspection. So we use C bar for this purpose, it is very similar to but but the C stands for controller. So catalyst center is the one that is managing the function on all the switches, right? From to.01:17:50Three seven this feature is enabled for all devices by default when they're added to a site. You can individually enable C bar by going into provision and application visibility.01:18:10Device role has to be ready for for that to happen. We'll we'll look into that in the demo but 2nd step is to enable enhanced ICE integration. We already integrated it, but we need to enable enhanced integration, right? And just by turning on these two options, one from ICE and.01:18:23One two is we can ensure that the endpoint attributes are exchanged between both the products.01:18:42And the 3rd step, as I said is to enable the cloud integration. There is a global switch called the AI network analytics. So it's like the communication between catalyst center and the AA cloud. And once you enable this, you get those extra granularity, you get, you learn from you know the data in the cloud.01:18:49You you can also choose the DC that you would like to use here. So that's one thing I also wanted to mention. So let's look into a demo now of the endpoint analytics feature and how to enable it, right? So this is your catalyst center instance.01:19:10It's.01:19:30And, this is your homepage. We would need to check for a widget that says AI endpoint analytics. I don't have one over here, so I'll go ahead and install the module, the AI endpoint analytics module, so for that I'll go into, system and.01:19:31Then we'll go into software management and we'll see if there are, you know, if this application is up available for us to install, right? Here in our case it is there. So I'll quickly select that and install it.01:19:51This is the version and it will check for deployment dependencies, go ahead with the installation and once the module is installed, it will show up in your list of currently installed applications under software management, right?01:20:09So you can see in access policy applications, we can see AI endpoint analytics is there, it is available. This is the version. And once that has been done, when we go back to the home screen, we see this new widget appearing, right? Set up AI endpoint analytics, right? And that is where we.01:20:27Would get started. So, we go into settings. So the 1st step, as I said, we need to ensure that endpoint analytics is enabled. So we go into setting external services, Cisco AI analytics.01:20:47I already have network analytics enabled, but I also need to enable my endpoint analytics, so i'll scroll down and I'll select these toggle buttons, I'll turn them on. And once that is done.01:21:04I would go in back into the home screen, click on setup A endpoint analytics, and that would take me to the list of prerequisites and configurations, right? What are the things that you'll need which devices that it works on?01:21:21What are the versions that are required, what is the ice version that you'll need, right? To the store. We'll click on configure there is a nice deployment guide, there is a hyperlink in the bottom you can use as well when you are deploying it, it takes you to the forum where.01:21:38You have the process.01:21:57But we'll go ahead do the configuration. And as you can see, these are the three requirements, the DPI enablement, the ICE configuration and the cloud connectivity, right? So these three things are needed to be completed. I already enabled the endpoint analytics toggle as we've seen in setting.01:21:59I already have the cloud integration enabled so smart grouping is happening. But then now I'll have to enable C bar, right? So, I can go into application visibility from here. You can click on the hyperlink.01:22:19And that will take me to provision services and application visibility, right? And I can go into network device enablement, select the switch where I are the switches where I want a C bar to be activated and then click on C bar and enable it.01:22:36So you can do, you can enable this on a specific interface or a bunch of interfaces. Here I'm gonna select all the interfaces and enable C bar, all the eligible interfaces and enable it there. It is gonna push out the C bar configuration.01:22:56As you can see, it goes through these list of, checks. And then here is the configuration, right? It is the visual configuration that you get, right? What is the syntax that is being pushed onto the device and what is currently running?01:23:17So I submitted the job and I would see that the C bar deployment status changed to deployed on this page. So the C bar deployment is successful, verified that from the tasks.01:23:33And I can see once I refresh that C bar deployment has completed so once that is done, I would refresh and.01:23:49We would ensure there are multiple options within C bar. You can ensure that auto update is turned on so that it updates all the protocol packs immediately as they are available and that will help identify and update its definitions and, you know, identify the new applications, right?01:24:06So once that is done, we see the C bar status changed to hundred percent here on the service health. We now have C bar active and finally, once all of those have been enabled, we are able to see the AI endpoint analytics method.01:24:30Clicks populate in our homepage, right?01:24:50You can see all the fully profiled endpoints, the unprofiled endpoints, all of those metrics. You can go into those details and it will take you when you click on view details, it will take you to the endpoint analytics dashboard. So you'll get the total endpoints, whether they are unknown, partially profiled, fully profiled.01:24:54You'll, you're able to see, you know, the status of all the different prerequisites, the DPI enablement has configuration from here. There is also some optional configuration in the bottom with your security sensors you can integrate it with ServiceNow payloads, you know, which all helps gather.01:25:13Data from more sources. There's profile rules as well that you can adjust. There is ice configuration that we previously said to enable, trust analytics, then you have the endpoint purge policy that you can also deploy.01:25:30And then in the homepage you have all this information, right? As I said, the total endpoints, the trust score, you know, how many number of endpoints do you have? What is their trust score, what is the percentile of it? All those useful information, right?01:25:49There's also the pro different tabs for profiling rules and hierarchy. You can look into them. There's all the list of different endpoint types that are pre populated in the hierarchy.01:26:10Right, so that is about enabling endpoint analytics let me move on to trust sec now. So before we look at, so we looked at.01:26:24Endpoint analytics, now we need to look into anomaly detection, right? Different ways spoofing can occur, right? So max spoofing, someone uses a MAC address of another client to access the network. We also have attribute spoofing. So things like these things like these vulnerabilities and all of these are the reason why.01:26:41You know, we have the option of using trust scores. So this is where trust analytics comes in, Atlas Center will calculate the trust score for each of the client that ranges from a value of one to ten. The higher the trust, the higher will be the score, and if the score is dropping, it is.01:27:00Because of certain anomalies that it has detected. There are positive influences which increase the score, like if it is using.1X or poster compliance.01:27:20Which is based on the information we get from ICE, that is a positive influence, then there is also negative influence, like what is the information that we are getting from IP, the reputation of it, the NAT more detection. If you're running Vmiss or containers that are natted behind a host IP, you know, those would be things like negative influences. They can.01:27:29And identify concurrent MAC addresses.01:27:49Attribute labels, it keeps monitoring them and if they change over time it is considered a negative influence as well. So things like that, right? And that will decide your trust score. This is a positive example. Here we are using a secure authentication method, we get a score, right? And since the device is posture complaint, the score goes up to ten.01:27:52Right, so that means that the user devices are trustworthy and NO anomalies have been detected. And this is where you would see the trust score in catalyst center. You go to the endpoint analytics dashboard, click the trust scores tab and it will show you the endpoint table with each of their trust scores. You can select the trust score, look into the factors that.01:28:11Have gone into deciding the score, right? So if you authenticate as I said your score is a perfect thing rate.01:28:32But it also hits you know if the device starts hitting bad IP reputation, the score permits as well. So it can also detect Mac addresses and flag it as an anomaly. And this is an example, you know, this one is an example of AI spoofing and how it is detected as you can see, the score goes down.01:28:40Because the concurrent Mac address symptom is occurring in the network context and we'll have more details into it from the endpoint analytics dashboard. And we're also shown the board devices, you know, where this concurrent Mac address symptom is happening.01:29:00So here is where the integration truly shines because catalyst center and ICE are communicating. Catalyst center tells ICE about the drop in the trust and ICE can use adaptive network control to take action. It can quarantine port bounce or shut down, right? Based on the trust score that it's seeing.01:29:20So you can also automate the process. There are multiple options here. You can do full automation using ICE APIs to deal with the ANC. And 2nd, if you don't want to use APIs, there is another option available. So earlier we spoke about authorization policies.01:29:40But now we are also including trust scores, right? E.g., here greater than good, a trust score greater than good means it can be assigned SGT rate a good SGT, but if it is untrustworthy, this gives you an example, right? It gives, give it a different SGT, right? If it's not trustworthy, if it is.01:29:57Less than six, then you apply a different policy. So is continuously monitoring the trust score based on the client behavior, so if the attributes change, the would immediately detect it because of the trust score would decrease, and this creates a fully automated closed loop security architecture.01:30:17The cat C catalyst center is gonna detect the anomaly tell ICE about it, and then the ICE issues a radius change of authorization to instantly.01:30:37And as a part of this process, it would apply a different SDT, which would give it the access policies applicable. So to wrap it up, let's look at the transformation we covered today. We moved away from an error of manual or little security by integrating and catalyst center and ICE together we replaced thousands of stack.01:30:48With dynamic group based architecture. We also looked into creating external authentication to catalyst center using ICE.01:31:07We looked into AI endpoint analytics to protect the unknown, endpoints in real time rather than just reacting to threats after they occur. You have the power to define your business intent once and just let the network fabric handle the enforcement, right? So the tools are here, the integrat.01:31:15Information has been proven and the path to a simpler or a more secure network is you know ready for you with this integration.01:31:35I know this was a lot of concepts, but I really appreciate your patience today and thank you so much for sticking with us as we complete each of the features. I hope the session was useful to you. And once the event ends and new page will be launched, we will be, we would really appreciate if you can take 2 min to complete the survey.01:31:44I would also like to share, you know, the previous session recordings, the event schedules, we will add this URL to the chat. You can pick it up from there. If you have, you know, if you need to discuss more about your specific environment or if you need one on one guidance, please reach out to our account team and ask for your customer.01:32:04Customer success team, we are here for you and you can reach out to us.01:32:24Thank you so much everyone for taking time out of your busy schedules to attend our session today. Thanks a lot. Have a wonderful day.01:32:29