Next‑Generation Segmentation: Secure Your Network with Cisco ISE & Catalyst Center

Oh. Thank you for joining everybody. We're gonna go ahead and kick this session off. I'm gonna hit record and yeah, get started.00:00Today we'll be going over next generation segmentation for secure network with Cisco ICE and secure, Catalyst Center and the SDA solution.00:20Alright, let's go over a couple of logistics before we get started. During today's session, you will have the opportunity to ask questions that you may have about ICE and catalyst center. Just type those questions into the Q and A panel, which you will find on the right side of your screen or you can raise.00:37Your hand, at the end of the session, we will be having a Q and A with Mahesh the expert. Yeah. So if you guys have any, if we have any audio issues, just go ahead and put it.00:56Put it in the chat, but the Q and A is just for Q and A and our lovely panelists will get to you. Okay, so we're gonna go ahead and meet the team. So we have myself and Amanda Herisco under customer success, we have Mahesh.01:10He is the TME and technical leader of Catalyst Center. And we have Nick Denofreo on panelists. He's also with customer success Caremon Short, customer success, Ajit, who is customer success, and will be handling the center questions along with Samit, who is the.01:29Program adoption lead. All right, thanks. Thanks to the lovely panelists. So today's agenda, we're going to cover, and by the end of this session, you'll have a good understanding of SDA segmentation.01:50And those sorts of things. So segmentation insights is the 1st item or 1st section I should say, why segmentation today's operational challenges and how Cisco can help with these operational challenges. So we're gonna go over software defined access, which is the SDA, the solution.02:10We are going to, which include ICE, trussec, and Catalyst Center.02:30Oh, sorry, skipped too far. So then Mahesh, we're gonna take it over to Mahesh to go over ICE and catalyst center solution or the requirements, the protocols, the integration step by step policy configuration and pro policy propagation workflows.02:38Then he's gonna give us a live demo on how to integrate and then we're gonna do the call to action and resources that we're giving you today.02:58All right. So 1st section we're going over segmentation insights. So why do we need segmentation? So.03:101st of all segmentation reduces network congestion. E.g., hospital medical devices. They can be segmented from the visitor network so that medical devices will be unaffected by any of the web browsing. Segmentation improves cybersecurity by limiting how far an attack can.03:27E.g., segmentation or segmentation keeps malware outbreaks to one section of one section and from it keeps it from attacking others in that same area. So segmentation can stop harmful traffic from reaching device.03:47Devices that are unable to protect themselves.04:06And also segmentation reduces the cost associated associated with the regulations. So a lot of people don't expect like the regulations so like PCI regulatory regulatory restraints.04:13So you don't want like your payment processing stuff with your guests or even your user stuff. So, ok. And so let's start with the beginning of traditional segmentation. So let's start to understand the beginning of segmentation. Traditionally, network sec.04:31Documentation was founded on the base of like IP access controls. However.04:51As we know, IP access controls like access list specifically are local attribute, and even when you get into like brfs and stuff like that, they're very local to that device and they're not adaptive, so it can create a huge headache when designing security policies.04:57In today's highly mobile workplace.05:17And this is an example of all the regions and where you would have to place those IP access lists to restrict. Okay, so let's go over what a lot of people are like, hey.05:24Wrong with access list, right? So let's take into consideration the example above.05:44Right, the figure shows that using a traditional ACL to manage security needs. Like let's go e.g. for S one through S four represents a range of IP source addresses and D one through D six, each represents a different.05:49Range actually from.06:09Destination addresses. So any S1S1 address source address needs to be able to get to D one through D six. The destination address is using HTTPS, like let's say we're using a specific special port like 8081. And let's say we're going.06:11Need to use another report like 445.06:31So, these, to get to these, and each of these represents since it represents a range, right? We would have to put specific addresses and all of those ports into a huge access list, right? So let.06:34Let's let's say let's add in S3S4, right? So we do some quick math math on that. We're gonna have to have a total of 96.06:54ACEs and an ACL for, you know, for just one, one access list, but let's say you have 250 sites, right? That's just not scalable in terms of the access lists and operational costs. So if you look at here, so.07:04This is just overload. There's NO business intent, and technologies keep changing and improving, but the IP stays the same. Hence we get the overload here.07:25And with a bigger network and bigger ACLs, the attack surface just gets bigger. So, ok, so let's go over the key challenges that we just described. So key challenges were segmentation in a traditional network.07:39Right, it's complex to manage as we looked at with the ACLs multiple steps, user credentials, complex interactions between touch points, and the security, you know, with rapid growth of wireless and all of the iots, ACs, you know, medical devices with.07:59Like ekgs and eggs.08:19It's very difficult to ensure that end secure end to end security has become a significant, right? It's a significant challenge, right? And again, with all those IoT devices, and the traditional segmentation network, you lack the proper tools for insight.08:23IT has challenged to often optimize performance while scaling the network and to minimize downtime. So, ok. So.08:44So let's go over, let's go over the how we can help as Cisco, right? So Cisco has Cisco SDA access automates user access policy, so organizations can.08:59Sure the right policies are established for any user, user device application across the network.09:19With our unified access policies across the LAN and WLAN. A consistent user experience is created without compromising security. By combining security and network operations, SD access enhances visibility by defining access policies and automating network.09:27Configuration to implement those policies. Alright, so we have automated network fabric, a single fabric for wired and wireless with full automation, we have group based policy and segmentation, so this enforces the group access policies to ensure that.09:47To ensure network oh sorry secure network through the segmentation. And this is in combination of micro macro segmentation and micro segmentation, right? So this is how we're gonna enforce those group policies and ensure secure network throughout the.10:05So segmentation.10:25And then AI driven insights. So secure, I'm sorry, catalyst center has analytics, AI analytics, and visibility into the user's application and their experience throughout that application. Since SEA.10:27Is complete automation through is more scalable compared to the box by box approach, which results in reduced manual errors and just the consistent config.10:46And we have, we have the identity based identity based policy enforcement. So unlike traditional networks SDA access, decouples the user from the VLAN and the IP address, and the policy.11:04Enforcement happens based off the identity, which means wired wireless media, it doesn't matter, they can have any IP address, they can roam around freely because the policy will follow it based off of the identity of the user.11:23Okay, and finally catalyst center connects collects a bunch of information. We have a lot of information from different sources and analyze it and correlate correlates it. This information is provided to and provided.11:38To you in some actionable insights.11:58Against the user and again it'll significantly, I'm sorry, so insights against the user to significantly improve the user experience. Alright, so let's go.12:03Over software defined access as a solution.12:22So we have components, some components to SDA, right? We have ICE, which is context aware, and ICE brings in that isn't new.12:25But it definitely encompasses catalyst center with the macro segmentation and the micro segmentation portion. So ICE is a leading identity based network access control and policy enforcement system, which allows an administrator to.12:42And centrally control policies wired and wireless and VPN endpoints.13:02And throughout that process, ICE builds context around endpoints, which includes who the user is via the credentials that they shared, what device the user is connecting to, when the user connected or the endpoint connected, how, so what's the mode of connection or the method that they connect.13:09Good, so wireless VPN wire wired.13:29And their posture. Are they compliant to join the network in in terms of like the endpoint? And in order, we actually share these with different solutions. So we're gonna go over PX grid. So these are the attributes that we.13:31Collect and then we send it over to Catalyst Center and including with the security group tag. Okay, so let's go over catalyst center. Here you can see that catalyst center is the core component.13:51To SDA and that communicates throughout the network infrastructure so that ICE and ICE to enable customers to perform a variety of operations within this both the network infrastructure and ICE are consistently sending telemetry data telemetry data.14:11To catalyst center. Catalyst Center then utilizes that data and present presents insights, trends, and health statistics within assurance. So that's the Catalyst Assurance Center. While that covers the operational aspects of managing the network.14:32Work post implementation, there's much more power in what catalyst center can do. Catalyst Center can easily create design requirements, security policies config configuration and software standardization, and that's really huge when you have like a big network, right? You can.14:51Definitely standardize all the config, all the software that your organization could be using. That and this is what makes call center one of the most advanced advanced network, network tools for you guys.15:09So what does segmentation propagate or the operation segmentation operation in the SDA fabric look like? So.15:27We have catalyst center Catalyst Center here, and I have my policies defined on ice. For employee communication. So we have a user right a regular user who connects to the network and gives her credentials based off of and based off of her credentials. She is all.15:45Authorized and identified as an employee.16:03As an employee, the switch, switches, switches are pulling down that policy information, and that relevant data for employee based access. And then likely likewise on the contractor side.16:07Right? He connects and is authorized and he's identified as a contractor, and as a result, authenticating users, we've identified and now we go ahead and we group them into logical groups and that helps us build our policy. So when an employee tries to.16:26Communicate with the contractor, right? And the switch pulls down that, environmental data, the policies, right? It's gonna look like this right here with your, your matrix, right? So can my contractor.16:46You have a contractor, ok, employee, but your contractor is the destination. So this is the source, the employee. Can you? No, it's gonna hit a deny all. So you're not gonna be able to communicate with that. And in a nutshell, trust sec works.17:07Is comparable like to when we get an employee badge. So our badges are used to identify ourselves, and we have to swipe it everywhere into like a facilities to get into like lockdoors and stuff like that, get into buildings, get into.17:25Get into like the network closets, right? So, we have to carry that around everywhere and it gives us access. In terms of this badge, we're going to say we're representing an SGT, which is your scalable group tag in terms of the micro segmentation portion. So these tags are carried throughout the network.17:44So that any trust sec enforcement device along that can evaluate that policy and pull down that policy and it is enforced by the routers and the switches.18:03And even firewalls, access points, stuff like that. So let's go over what this solves, right? So we gave you the problems, we gave you the overview. Let's go over to what this actually solves. So secure networking it easy.18:14Complex policies and micro segmentation for zero trust. So this is the cornerstone to like zero trust, right? You are creating micro segmentation and within a macro segmentation network, right?18:33Rapid threat containment.18:53Of endpoints which uses like if a device is infected, right? We can rapidly contain them and isolate that endpoint and then managing the expansion of the IoT devices connecting to the network.18:54And for digital service, right? So enhanced end user experience with deep AI driven application insights. This, and then resolves user issues with multi vendor Wi Fi analytics. This is.19:14Due to our amazing partnership as Cisco with Samsung, Intel, Apple, chipsets, we can get those insights from those users of what issues they're having and use those for quick troubleshooting as well. And we.19:33Can improve the hybrid workplace, we integrate with Cisco Webex and Microsoft Teams. This gives us insight to collaboration applications, right? We can see and optimize how these applications are working.19:53And it simplifies its simplifies operations. So automated driven, provision, so automation, AI and configuration of network devices that streamlines IT integration processes for application and improves operations, right? And these are gonna give you.20:09The.20:29This is gonna give you the what's it called? The, I can't say it right now, the actual suggestions, right? It's gonna say, hey, we should use this instead of it's gonna give that automatically with a AI assisted diagnostics and remediation. So that's gonna improve.20:32Move downtime, reduce it, and it's gonna improve your operations.20:50Okay, and we're gonna hand it over to Mahesh. Thank you, Amanda. Good morning, good afternoon, everyone. My name is Mahesh Agildi. I'm a technical marketing engineer. I've been with Cisco for close to.20:56Twelve plus years, I've been at TME on on switching, security, currently a TME on software defined access. So with that high level background or high level intro into catalyst center micro segmentation, I know it's not too depth, but very high level pitch.21:13Let's now on, let's now dig a little bit deeper.21:33On some of those concepts, right? 1st, SD access is a overlay fabric architecture which Cisco launched back in 2016 2017 time frame. Today we have around 4000 or up to 5000 customers, some of them are air gapped so we don't get telemetry.21:37From those customers. So somewhere between 4000 to 5000 customers who have deployed this architecture because they see a real benefit with this architecture. So on a high level, let's quickly look at, again, this is just one slide which I'm using to on a high level talk about what's SD access.21:56And what components are involved as part of SD access architecture what Cisco has. So if you look at the components center is one primary component there, which is basically used for your automation and assurance purpose. So that's the controller to which you log in and.22:14Define your intent and that intent gets converted into, you know, configurations at the backend, right? So what, but you just define an intent with few clicks at the back end we take care of pushing all the Cisco's best practice configurations to those switches, routers, wireless LAN controllers, right? So it's, it's a it's a combination of wired and wireless.22:32As fabric, right? You just use a controller as a single plane of glass to configure or to bring up your wire as well as your wireless infrastructure.22:52Catalyst Center certainly integrates with ICE because ICE plays a major role in in SD access architecture. I'll have a dedicated slide to talk about what are those roles. ICE plays in in a software defined access network.23:00And then you have the actual wired and wireless components. You have your switches, you have your wireless LAN controllers, both these wired and wireless components form something called a fabric site. Again fabric site is just a logical.23:16Abstract which we have created on the, on the UI, where you group all these devices or you pick a site and you configure something called a fabric site, which means you're enabling fabric role on those devices, right? So, so the devices which are part of the fabric sites are.23:32Maybe if you have a three time architecture, your core becomes something called a border nodes and borders are the one which talks BGP on the northbound and it talks Lisp and VXLAN on the southbound, right? So LISP and vxlan are the control and data plane protocol we use within the fabric.23:48Why VXLAN? Again, it has a lot of benefits due to which we choose VXLAN. It get it supports layer two, layer three, it carries all those segmentation constructs, what we support which Amanda highlighted the macro, which is nothing but a VRF based segmentation and the micro which is the.24:06SGT based segmentation of the segmentation. So the VXLAN header by default has capabilities to carry those segments in an overlay, right? Again, it's an overlay technology like IPsec, like GRE, like, like MPLS because some of these overlays we have used in the past. So we are using.24:23We're building an underlay on top of that, we are configuring an overlay so that all of these users endpoints are part of an overlay and they're NO more part of an underlay, right? And once they are in the overlay yes, like similar to MPLS, we could add or vrfs in this case, we could add security group tags to further segment within a VRF.24:43All those mechanisms are available. The control plane node can be a switch or a router in this topology I've just shown a router, the CP badge what you see there on, on the, on the, on the device. That's the control plane node. Again, you could have a dedicated control plane node, you could have it co located within the border itself, which means your core.25:03Will become bordered/control or if, if you have some high frequency roaming environments like some of the manufacturing customers have in their environment, so you could certainly use a dedicated control plane node because there's too much of less communication which is happening two and flow because of some vehicles moving across the manufacturing environment.25:23And, your distributions are layer becomes something called an intermediate node. They are just pure IP forwarders like your provider routers in MPLS, just an analogy there. Your fabric edges are the one where the fabric starts. Again, fabric edges are your access switches, they do perform all.25:43All the functionality of an access switch in a traditional network, but on top of that, it runs list. So it does talk to control plane node, it does do a VXLAN handoff to the border nodes. So those those are some of the additional capabilities which the border node, sorry, the edge nodes perform, right? So with with with that background.26:03On SD access, let's let's see what role does ICE play in, in an SD access environment. Again I'm not going to the details of what is ICE, what functionalities are supported on ICE, Amanda covered that on a high level on a specific slide, so I'll skip this.26:22Before we look at how we integrate center with ICE and what protocols we use and what benefits we get, when it comes to ICE deployment, nothing changes with respect to software defined access. The way you deploy your ICE today, you could continue to deploy in the same fashion, right? If it's a small lab environment.26:39Go with a standalone appliance or a VM.26:59Or a cloud based because ICE supports all those three options, right? And you enable all those personas, what they call it in ICE, like the pan, the mnts, the psns on a on a single standalone box, right? So if it's a lab, it's good to start with what you see on the extreme left side there.27:02If it's a medium kind of an environment or maybe if you need an HA in your, in your small deployments, you could certainly go with a two node ice deployment so that one is an active, another one is completely standby, right? And you still enable all those personas on one. So whatever badges you see on top of those ICE icon, those are some of the roles.27:21Right, so this is the PAN.27:41You know this is MNT, BX all all of those. And if you need a medium kind of deployment, let's say you have 10000 20000 50000 endpoints and you need some kind of an HA capability within the ICE deployment, then you go with this medium architecture, right? Where you dedicate a couple of devices for pans.27:43And then you run psns, which are basically processing all your radius and attacks packets, right? So that's the.28:03So the work horse within the ICE deployment are the psns. If you need a full blown distributor deployment, then you could certainly stick to what you see on the extreme right, right? Dedicated pans, dedicated mnts, and, and dedicated PX grid and PSN nodes, right? So today the current ICE shipping releases we support up to 50.28:12Nodes, right? You could use 50 psns to support up to 2 million endpoints, right? That's the scale what I supports. Again, we will look at what scale catalyst center supports and what if I have more than one catalyst centers and if I have single globalized how to integrate all of that.28:32So in short, nothing changes from the ice standpoint, the way you deploy ice continue to do the do the same. What are the benefits with integrating catalyst center with ICE? So I've called out around nine benefits here. There's one more which I have to add, which is something we've recently launched. I'll talk about that on a high.28:48High level, apologies. I don't have a specific icon. I wanted something in this animation with a with a specific icon which I couldn't build in the timeframe what I had. So I'll I'll talk about that.29:08So the, so the 1st one, what do you see on the extreme left guest access? So today if you want to implement guest access in your traditional networks or even in fabric, 1st let's look at traditional networks so that we could compare that, what benefits you get with catalyst center and and that getting integrated with ice. So if you want to implement guests today, you log into.29:19You build a guest SSID, you log into ICE, you configure policy sets, you configure authorization profiles, right? So, and then you log into the switching environments and configure all the ports to which the APs are connected. So there are three touchpoints which you do to bring up your guest.29:40Access by wireless. But once you integrate catalyst center with ICE, and if you have discovered the wireless LAN controller on the catalyst center and anyway switches are already pre discovered on catalyst center, I don't have to log into ICE nor I don't have to log into wireless LAN controller nor the switching environment.29:59You just go run through a workflow on catalyst center, which will push all the required configurations, so the workflow, you create an SSID, in the same workflow you have.30:18A portal option, if you want to create a hotspot portal, you could do it in the workflow itself. And then once you deploy that workflow, automatically catalyst center logs into ICE pushes configures the guest portal, configures the policy sets, configures your authorization profiles.30:29It'll log into controller, it'll configure an SSID and it also log into the switching environment and configure all the interface templates what's needed, like moment a switch detects an AP connected to a port, it automatically configures that port. It detects.30:44Through CDP that there's a Cisco AP connected and with CDP or LLDP, if it's not a Cisco AP through LLDP we could detect that it's an access point and then automatically the switch configures that port for onboarding your APs. So all of that would be just done with a single workflow on catalyst center, right? So that's a single.31:00The plane of glass story what we have. 2nd use case what you see the host onboarding, again, not new to us in traditional networks. We used to authenticate endpoints, devices. Similarly, even in an SD access network, we could authenticate users and and devices, but the benefit to get is.31:19Let's say if you want to enable.1X or Mac or web off any kind of authentication methods in your traditional network, right? Imagine the amount of configurations you push to those switches. But here integrating catalyst center with ice, with just few clicks of a button in the UI, which which I'll show you in the subsequent slide.31:38We will take care of pushing all those.31:59Triple AAA commands, radius commands, IBNS two.two related commands to all those switches. If you have a site with thousand switches, catalyst center will log into all those thousand switches and configure those devices with AAA radius and IBNS two.two conflicts, right? So that.32:02Later when you have a user connected to that switch, he automatically gets authenticated with ice, maybe through Map or if he has a supplicant on the, on the device with.1X enabled, he could authenticate to.1x or a cert based. All of those options are.32:18Are fully supported in an SD access environment as well. And this benefit to get integrating catalyst center with ice. Again, all the configuration what we push to the switches are all cisco's best practice config. If you need some customization in those IBS two dotto, we don't support that today but that's part of the roadmap.32:33Please do reach out to us if you have any customization in in today's IBNS to what you have on your switching environments, we are happy to help that or support that. The 3rd one, what do you see is group based policy, Amanda spoke about this. This is the segmentation story what we have in fabric, the micro segmentation, the micro segmentation, but since we are talking here.32:52Center integrating with ICE and it's more specific to micro segmentation, which means we are using trust sec as an architecture within the fabric to, when a, when a user gets authenticated with ice, ICE automatically pushes down an SGT as well if you have configured it.33:12So that the user, any packet coming out or hitting that particular port to which the user is connected, the switch will automatically tag those packets with those sgts and those SGDs are carried in the overlay with VXLAN end to end so that we could enforce it in the destination. In traditional networksec is not new.33:31We have done this in the past, but the difference between traditional networks and SD access fabric is it's completely automated. And another benefit to get is in a traditional network, it is a hop by hop behavior. Every hop has to support which means if you have a three tier architecture.33:51Access distribution core, you have to configure all those three layers and then every hop should be a trust set capable device. If not that the tags are dropped. But in fabric, since you're in an overlay architecture here, my intermediates or aggregations doesn't have to be a trust set capable device, right? It's just a pure IP forwarder.34:10Recommend it to be a Cisco switch, but even your intermediates could be a non Cisco switch as well. We don't care because we're taking these tags or carrying these tags in the overlay with VXLAN.34:30That's the benefit you get with fabric again. The 4th one is assurance. Once you integrate catalyst center with ice. So let's say I'll just take an example. Let's say a user gets connected to a switch. Authentication fails for the user. Today if I have to figure out what, why did the user didn't onboard, I have to log into ICE, look at the ice logs, to figure out.34:41Why did the user authentication fail, maybe a wrong credential or or or maybe whatever the reason it might, right? Or maybe it's using a map and the map is Mac address is not added to the database whatever but if you have integrated why I don't have to log into ICE to figure what happened to that user.35:01Catalyst Center assurance since it's integrated with ICE, catalyst center can pull all that information instead of you, if someone has looked at the detailed report on ICE, if why an authentication failed, it maybe around ten to 20 steps or more than that to figure out what happened where it failed. But catalyst center will give you a s.35:19Single, you know.35:39Indication that why that authentication failed for that user. Maybe if it's a wrong credential it will just say it's wrong credential due to which it's failed. So I don't have to log into ICE to figure all that out. With catalyst center itself, I could, I I I could figure out what happened to that user, why didn't he was able to log in, right? And since we're integrating catalyst center with ICE.35:42Can pull all the information related to that endpoint and show it on the assurance dashboard. When did the user get authenticated? What HTTP tag the user got? What VLAN is part of to which switch is connected, right? If your authentication fails, why did it fail? All that information is available on the assurance page itself.36:02The 5th one what you see there is multiple catalyst center to ice. I have a dedicated slide on this. I'll go through that, but in general, I have a globalized deployment, I have multiple catalyst center clusters. How can I integrate this multiple catalyst centers to ICE? ICE supports 2 million endpoints.36:20Catalyst Center today with three node cluster supports 300 K endpoints. So which means if I have more than 300 k endpoints I need multiple catalyst center clusters and how can I integrate more than one cluster to the same ICE? How can I have some kind of a sync between these clusters so that I don't have to.36:37Repeat some of these configurations on every single cluster, right? So that's the benefit you get where sync happens through ICE between those catalyst center clusters which I'll talk about. 5th, the 6th core what you see on the bottom left device administration, not new to us.36:53Similar to how you authenticate a user or a client, a device or a client, you could authenticate a switch router or controller in the in the in which is part of your underlay networks are part of the fabric. So.37:11But the benefit you get with device administration is all the configurations related to AAA TACACS, if you're using TACACS as a protocol, if you want to use radius, we do support that for device administration. All that configurations are pushed by catalyst center to all those switches.37:26As well, right? So again, you just define that with few clicks. Catalyst center best practice configurations will be pushed to all those switches so that all those devices could be authenticated with ICE if anyone is trying to log in. Asset visibility is another app which we have built on catalyst center. This works for family.37:43And non fabric, we call it AI endpoint analytics. That's the name you might see it in public documentation. What it does is this is the next generation profiling option with Catalyst Center. ICE supports around eight to ten probes to profile endpoints like radius, SNMP.38:03N map, DHCP probe, right? There are various probes on ICE to profile an endpoint, but with AI endpoint analytics, it's the next generation of it, which means switches do support something called n bar network based application recognition protocols which could detect what kind of.38:20Application those endpoints are using and those information is sent back to catalyst center through netflow. So now catalyst center knows what kind of an endpoint it might be because as I said, ICE is not fully up to date identifying all the endpoints which are getting connected into the network. Every day we see a lot of new endpoints getting connected.38:37So.38:58If ICE is not MC, if you keep upgrading the versions on ICE yes. But this is another option where you could use catalyst center to profile it as well. So we export netflows, we identifying points. If you have catalyst center integrated with ServiceNow or change management database, the catalyst center could get input.38:59From the config management database as well, so that we could identify some of those endpoints or integrates with our Cisco's AI ML cloud so that some of these netflow information which are anonymized and sent back to our cloud.39:19The cloud could suggest what kind of an endpoint it might be, right? So these are four or five inputs into catalyst center, which will help you to profile some of these endpoints on top of what ICE already provides to you. The policy analytics, there's another app on catalyst center, so today let's say if you want to configure a trust sec policy between a source and a destination.39:36The example of employee and contractor. You could either say permit or deny, which is a very easy way to configure a policy, but what if you want to go a little bit more granular in that policy? What if I want to say I want to only allow HTTPS or let's say FTP between these two contractor and employee, and I want to.39:56I want to or let's say I want to deny FTP and I want to permit everything else. So then you have to go a little bit more granular, but how do you know what ports and protocols the employee and the contractor are using today, right? Maybe a legitimate application which they're using to communicate.40:17Until unless you have some netflow exports or if you have Splunk or stealth watch to you know to figure out what kind of communication is going, today you don't have complete visibility into what ports and protocols those endpoints or devices are communicating in the network, right? Until unless you monitor netflows and figure out.40:35We give you this graphical representation on the catalyst center UI itself so that you could say, ok, employee has an SGT.40:55Tag employee, a contractor has a tag contractor between these two tags, what communication is happening, so you could monitor this for maybe one or two months and then we will plot those graphs. It's exactly those graphs what I've shown there on in the icon. And then you could decide whether you want to allow that communication or.41:03How do want to derive, so let's take a classic example. Let's say.41:23Employees trying to communicate with the with the with the badge leader, right? You know that employee shouldn't have to shouldn't talk to a badge leader or maybe let's say FTP as an example, right? You know that we don't want FTP communication to be allowed between employee and a contractor. But this.41:26Graph will clearly highlight that and then with a single click of a button, you could say, I want to allow all the other protocols, just deny FTP, right? So the configurations will be pushed by center to the switches through trust sec SG accounts and then FTP gets denied, all our communication is permitted, right? So you have a clear graphical representation of.41:43What ports and protocols are used so that you could take actions against it?42:03The last but not the least, context sharing catalyst center, ICE integrates with PX grid. That's one of the protocol we use. It's called platform exchange grid protocol with through which we could share user context, the example which I took, authentication failed, why did it fail, right? And all the user data informations.42:07Is shared from ICE through PX Grid to catalyst center as well. So that's, that's another benefit to get. One more which I said I'm not listed here.42:26It's called security service insertion SSI, in short, if you've heard about service chaining in data center where you use firewall as a service, data center supports multiple services, but in in in enterprise, we do support firewall as a service, so let's say if you have any untrusted traffic.42:37In your network, let's say con employee contractor, they're part of the same work, let's say you give them employee and a contractor tag, but for whatever reason you want to inspect this traffic through a firewall. If you want to do this, that's where SSI will come in. You could say you could configure a simple policy saying employ to contractor matching so.42:56So protocols, let's take the example of FTP, employee the contractor.43:16Matching a contract called FTP, I want to redirect to a firewall to inspect that. You could certainly do that with with fabric today, right? And we will only share that FTP traffic to the firewall. Everything else is bypassed. Those endpoints can directly communicate, only the FTP traffic is subjected for inspection.43:21So this is something which you could automate today in an SD access fabric using trustsec as an architecture, and for that, you certainly need ICE to achieve that. So with that use cases, let's look at how.43:40Can we integrate catalyst center with us. So this is what we supported day one in 2017, if customers who have geo based deployments, they have one catalyst center in Asia pac, another one in Europe or another one maybe in Americas and they have for compliance reasons, maybe they have ICE.43:56Geo specific deployments as well, which is one to one integration. Every other perspective in that geo integrates to the respective ice cluster in in the same geo, right? Second option is not many customers have gone option one route, right? Some of the customers have a globalized deployment.44:13Which means it's just one ICE cluster running across all those geos where maybe pants and METs are spread across for redundancy purpose, maybe primary pan and MET maybe sitting in America, secondary pan and sitting in Europe. That's a.44:32That's a commonly deployed architecture what we see. If that's the environment you are in, then if I have multiple catalyst center clusters, maybe within the geo or across geos, how could we integrate it? So this is one of the option where you could integrate multiple catalyst centers with a common eyes. The clusters could be running fabric, non fabric.44:48It doesn't matter.45:08But this is one of the option where you do the policy authoring on ICE. By default, when you integrate catalyst center with ICE catalyst center takes over that trust sec policy authoring capabilities, right? The creating a trust sec contract creating an SGT, creating an access contract, all those privileges.45:10Will by default be available on one of the catalyst center. But if like in this option on all the catalyst centers, but but if you don't want to have that option, at least in this particular option too, we would highly recommend to keep that policy offering on ICE, so there's, there's a button in the UI which you could.45:29Pass the privileges back to ICE, which which I'll cover that in the subsequent slides, right? So this is one of the options, right? Where I manage all my policy offering on ICE, which is what I used to do on my traditional networks, but I could certainly integrate more than one catalyst center to the same ICE cluster. You could reuse the same sgts or you could have separate sgts per.45:46The cluster per catalyst center cluster, all those options are supported.46:06Right, and every catalyst center cluster is independent. Whatever virtual networks, whatever fabric you create on cluster one is independent to cluster two cluster three etc. The other option is ok so in the previous option before I go to the option three, in this option, if I want to create a virtual network or a VRF.46:10I create on every single cluster. Is there an option for me to automate this, right? So that's where the next option comes in, which we call it as multiple catalyst center device or multiple DNA center device, it goes by both those names.46:29Catalyst center is a new name which we which most of our documentation calls out in two.3237.X release onwards, we changed the name to catalyst center. All the older catalyst center releases, it was DNA center. It's just a name change capabilities are the same.46:44So MDNAC multiple catalyst center device both means the same. With this option, I integrate up to five catalyst center clusters with ICE, with a globalized cluster, but one of the clusters, again, there is a package which we use to integration, there's a package which we installed on every single cluster, and with that package, we negotiate some roles.47:01And those roles are these author and reader roles. So the 1st cluster which is getting integrated with ICE will become an author cluster, which means I could create.47:21Virtual networks or vrfs on the author cluster. We will seamlessly replicate all of that to the reader clusters as well. So I create a work or a VRF for a virtual network on author. Through ICE, we replicate that to cluster two, cluster three cluster four, and cluster n.47:32Right, so that you don't have to recreate those vrfs or use a capability called LISP extranet, which is on high level use for your route leaking capabilities. If you have two vrfs, if you want to route leak traditionally use BGP route targets to route leak.47:49But with take care of that route leaking in the UI. You just specify what's your source VRF destination VRF, route leak, and we do a bi directional route leaking in the UI, right? So customers who are not well versed with BGP route targets route leaking, we could use to do that route leaking. So I could create such extranet policy.48:04On on my author, it will seamlessly get replicated to to my reader clusters, and there are other capabilities what we support with MDNAC, but on high level, if I want to.48:25Maintain this sync between one cluster to my remaining reader clusters and that sync is what I would defined on the top right. Those those are some of the data which we sync from the author to reader. This is a limited availability feature.48:34If any one of you wants to run this, please do reach out to us. It's just this approval which you need to get from Cisco because of the limited availability capability, but this is fully supported in SDA. Today I think we have around 200 or 300 customers who are running this architecture.48:49I have also authored a prescriptive deployment guide and that guide goes through what is MDNAC, how to integrate center with ICE and how to integrate multiple of these clusters in much more detail as well.49:05So that's on integration, but let's look at the protocols what we use for integration between catalyst center device, right? So there are three primary protocols. The initial communication between catalyst center and ice, we use HTTPS. It used to be SSH in the past.49:20Again, there were NO issues with SSH, but there were some prerequisites to be met with SSH due to which we moved to a much more secure, you know, integration or relationship between the two controllers, which was HTTPS. So the initial communication is through HTTPS. Once the.49:38Certificates are exchanged between the two controllers through HTTPS. Once the trust is established, then we use REST APIs, catalyst center will use REST APIs to pull all the node details of ICE. If you have a full blown 50 node deployment, just an example, catalyst center has to because.49:55Catalyst center will only integrate with the primary pan. That's the only IP address you give when you try to integrate center with ICE. But what if the ICE has secondary pans, PX grid nodes, psns, right? All of that information will be pulled through REST API.50:12And the last one is the PX grid protocol, which I've already highlighted for user context information sharing. So that's the 3rd protocol which we use so that we could share user context between these two controllers. And you need there are.50:27Couple of prerequisites NTP is one prerequisites. Make sure the time is synced between the two controllers if it's in to the same clock source or an NTP server should be should be ok. If not, make sure they're running the same time. Certificates use a 3rd party CA cert for this integration. We do support self signed certs on both the.50:44Controllers but we would highly recommend.51:04At least in the production environments to use 3rd party certs. When you create a 3rd party certs, make sure you include all the fully qualified domain names of catalyst center, the all the interface IPs, the virtual IPs of catalyst center in the sand field of that certificate.51:07Well, if you met all these requirements, then the integration should be a straightforward one. Anything ok so I think I've already covered this part. We initially established trust by exchanging certificates between the two controllers.51:25Once the trust is established, we use REST APIs to pull all the node details, and the last but not the least is the communication between the two controllers. With that, let's quickly look at how to integrate catalyst center with ice, with the with a quick demo there. So this is the catalyst center UI. When you log in, this is the page you land.51:41When I go to system three 60.52:01Let me play back in a little high speed. So here you could see currently there's NO integration between catalyst center and ICE, then we go to the authentication or the settings page, this is where I have an option to either integrate a triple AAA server or an ICE.52:04So with the current shipping releases, we only support integrating one ice cluster to a single catalyst center. But the other way around of integrating multiple catalyst center to single ICE is supported, but when it comes to integrating catalyst center, we only integrate with one single ice, right? So we'll look at that in the. So I'll click on ice.52:23What we need here is the PAN IP address. Well, this is my cluster I think running three.four, it's a single node where i've enabled all those personas on it. So we'll just click on the host name, we'll grab the IP address. We'll also grab the FQDN later.52:44Right, and we also need the super admin credential or the ERS you know rewrite credentials, one of them. See shared secret is a password which ICE will use, you know, later to log into those switches to push any configurations so that's where the shared secret is used. Username password as I mentioned it.53:01It's a super admin credential which I'm using for now, but you could certainly use the ERS read write. So if you look at this.53:21When I click on the advanced tab or when I enable the advanced tab, you have this enabled multiple catalyst center device, right? So this is where you use that additional package at the backend to integrate this cluster using that package with ice. So once you enable this, that's where that role negotiation happens. The 1st cluster indicating will become authored. The subsequent.53:27Clusters will become the reader nodes, right? But, but in this demo I'm not using MDNAC or multiple device. You could, as a protocols you could select both radius and the cax. Again for this demo I'm just leaving it as a default which is radius.53:47The ports are all default, those are the ICE ports, the 1813, whatever you saw earlier, leave that default. Before we go and integrate, there's one setting which you have to do on the ice side because PX grid, by default, those connections are not auto accepted.54:01Recommendation is yes, you could, you don't have to uncheck this, but you have to make sure you come back to ICE and then, you know, accept that PX grid connection which can be centered establishes, but in this demo, I'm just auto accepting it so that I don't have to do that step.54:19So we'll save that and we'll go back to catalyst center and we will, you know, click save to integrate. So once I click save, this is when catalyst center, so that's the 1st step. This is where the cert exchange happens. So it's trying to pull a cert from ice. It is where it's asking you, do you want to accept the cert?54:35If it's a 3rd party CSR, you should be good to accept it. So once you accept the trust establishment happens, it discovers those nodes in the discovery, this is where the REST APIs are used to pull all the node details from ICE, and then the last one is a PX grid communication. So once all those three protocols go through.54:54You see a successful message, then if I come back to my system three 60 on catalyst center, now I should be able to see those primary pans PX grid nodes. Since I have just one standalone cluster, I'm just seeing two IPs there, but if you have a HA with, then it'll also show you the secondary pan and secondary PX grid as well, right?55:13So if I now if I come back to my settings page where we just integrated it, there's a subscriber name which is the PX grid name. This name will certainly match between catalyst center and ice. So if you look at this, it's sending with 937. If I go back to ICE and look at my PX grid connection, so that you already see one client.55:32And it should be the same client ID there, right? 937. That's just one way to check that PX grid communication is up and running between between them, right? So with that, so we have integrated center with ICE.55:50We have pulled all the notes of all the psns on the eye side, then I come to my center design page, so this is where I add those psns, right? Again, in my environment, I just have one node, but if you have multiple psns, the dropdown should show you multiple PSN nodes as well.56:06So once I save it, again, I'm doing it at a global level, I could certainly do it per site as well. If you have, let's say ten psns, you could say for site one I want to use PSN one and two. For site two I want to use PSN three and four. You do have those options to select on the catalyst center UI.56:25Right, so that's the demo with respect to integration. So let's go back to the presentation ok so I called out that we gonna integrate a catalyst center with one single ice. But if you look at this animation here.56:41If.57:01Moment one is integrated. If I drop that down to add additional, you could only add server but not ice because we have seen customers who have more than one ICE clusters in their environment. So we only support integrating with one. If you have more than one ice cluster let's say you have a cluster for You could certainly add it as aaa.57:02Right, so the 1st cluster will be for radius, which is what we need for all to push all the AAA radius configurations and if that ICE cluster is also used for your micro segmentation, so we certainly need that as to to be added as an ICE so that we can automates all those configurations at the backend. But for tech X.57:23You could use the same ice cluster to enable TACACS role or you could add if you have a second cluster for tacax or guest whatever, you could certainly add that second ICE cluster as a server. So there's NO limit on how many servers you could add, but there's a limit on.57:43How many ICE clusters you could add to which is one today, right? So when I click on triple A, you could see we don't ask too much of information there. We don't need any super admin credentials of that server. It's just what's the IP address and and only thing we do is even though that.57:58It's ice cluster with the full blown ICE deployment. We will not use any REST APIs to pull all those details, right? It's just whatever IP address you give here, we will just use that IP address and we will configure all those network devices. So let's say if you have a cluster with a load balancer, just give the load balancer IP address here and so that you could.58:14Send all your configuration to that load balancer and let the load balancer at the backend point it to different psns, right? So in this, I've just added more than one server but just one ice cluster. I spoke about when you integrate catalyst center with ICE, catalyst center takes over the read write.58:32Privileges of the matrix.58:52Which means the matrix what you see on ICE for trustsec is NO more right capable. It will become read only. Catalyst center will have a similar matrix which, which I'll show you. But for whatever reason, you want to pass this privileges back to ice. We had a customer where they said ICE is today managed by security team catalyst center.58:54Is more of a network team. We don't want to have this privileges by the network team. We want to retain this privileges on with the security team itself who manages ICE. So if that's the scenario you are in, then it's better to pass the privileges back to ice. As I said, by default, as part of the single plane of glass story, we will.59:14Have the privileges on catalyst center but if you want to pass it back to ICE, so this is an option within that policy page on catalyst center where you could select that second option so that we pass the privileges back to ICE and catalyst center will become read only, right? When should I manage policies on catalyst center? When should I manage policies on ice? I've just called that information out.59:33Here, we don't support all the capabilities of ICE, ICE support something called multi matrix. We don't support that on the center. So if you're using multiple matrix on ICE.59:53It's better to manage it on ICE. If you have that security and network team challenges, better to manage it on ice. ICE also supports multiple SG ACL contracts per cell, like between an employee and the contractor that could have more than one contract. Catalyst center doesn't support those advanced features, so if you have such capabilities, it's better to manage it on ICE. If not.01:00:02But you're good to manage our catalyst center. When it comes to segmentation, I think Amanda spoke about it on high level macro, micro, these are the two segmentation constructs what we support in fabric. Macro is VRF based. Micro is trust sec based, example is why should an employee talk to a badge reader?01:00:21Right, they don't need any communication between them. So why not have employees in a ca in a user work, my HVAC badge readers, you know, any IoT devices, cameras all in a, in an IoT work for a building management work, right? I've just called it as things here. It could be anything. You just give whatever name you.01:00:40Want for that work so that by default there's NO communication between them. But when it comes to micro, but what within a work, let's say within the user work, I have employee and a contractor and and then there is some communication going on between them, which means I don't want to keep them in two separate PRs.01:01:00Moment they are in two separate vrfs. One, there's NO communication. Second, if you need communication, you could certainly do that through route leaking, right? You could take this traffic all the way to the north of the borders, use a device to do a route leaking based on BGP route targets and you can get the traffic back in.01:01:17Right, but again the intention here is you're going with an assumption that there's NO communication between these two, right? Due to which lets separate that out with vrfs. But if there is any communication which needs to happen, then it's not a good idea to have have them in two separate works. It's, it's good to have it within the same VRF, but within the same.01:01:33Yeah, then we could use sgts to further segment it, right? As the example what I explained earlier, if I want to deny FTP between employee and a contractor, all other communication should be permitted yes, I could do that with a simple SGA ACL or a trust set contract. I don't have to, you know, boil the ocean with creating.01:01:53Two separate vrfs because there is a limit on every, all of these constructs, every switches switch supports 02:56 words, every switch supports 02:55 or 02:56 sgts active, ICE support 16000 sgts catalyst center supports 4000 sgts. That doesn't mean that you have to go 4000 sgts that does.01:02:13Doesn't mean you have to go to 55 vrfs, right? So please use them cautiously wherever needed.01:02:33Go with the 1st level of segmentation, maybe 1020 would be the good number to start with on the vrf side. Configuring works with click of few buttons in the UI is easy, but the challenge is when you try to hand off those verbs north of the border, that's where the pain is. You have to run VRF flight, you have to run per per VRF BGP neighbor.01:02:40You have to use route targets if you want to route leak into a global routing table, so that's where none of those configurations are automated by catalyst center because it's north of the fabric and catalyst center doesn't manage those devices part of the fabric. So use trustsec in those instances so that you could further segment it. You don't have to go the route of vrfs, but I.01:02:59Again, 4000 sgts doesn't mean you have to use 4000, so maybe hundred 01:50 is good number for SGDs. I've seeing customers with thousand SGDs as well.01:03:19The pain is again not configuring them, the pain is managing that matrix of thousand cross thousand, right? Source thousand sgts, destination thousand sgts, if you want to scroll across that thousand cross thousand matrix, that's where the pain is, right? So we have integrated it.01:03:29Then let's say we have discovered devices, there are multiple methods to discover devices on catalyst center. We use something called LAN automation, we use plug and play, we use manual discovery, all those options are supported. Land automation is something which is unique to Cisco. Again, I'm not going into the details, but.01:03:46That's where it's a pure plug and play for you. Let's say if you want to bring up a branch, you don't have to configure, you don't have to even touch the console of any of those switches. Just discover your seed devices, which are your core, let's say a branch is a collapsed core, discover your core devices manually, and then we use LAN automation to completely.01:04:03Configure all those access switches, right? We use plug and play as a protocol which boots up, gets an IP address, talks to the catalyst center. Catalyst center upgrades the code on the switch, it will push all the basic.01:04:23Configurations like loopback, we will enable routing protocol like ISIS or OSPF, we will configure all the cross connects. We'll push all the SNMP credentials, username passwords, NTP syslogs, all that is taken care by cathy center, right? You don't have to do any of those underlay.01:04:33Configurations through automation. So discover devices do this provisioning process on catalyst centers selecting those devices. Once you provision, this is where catalyst center will add all those configurations to those switches, right? Whatever you define in the network settings page.01:04:49If you have aaa, if you added ICE for radius and you have defined NTP servers, you have defined SNMP, right? You define netflow. All of that configurations will be pushed by catalyst center through this provisioning process to all the devices within the site.01:05:07Right, so we're integrated center with ICE, we have discovered devices, we have pushed all these basic configurations. Next is your fabric build, which I'm not showing here, but that's the steps we usually go. So you build a fabric, once you build a fabric, that's when you enable your segmentation capabilities. So what we had since this session is more focused on.01:05:23Micro segmentation. I'm not showing you how to build a fabric. I'm not showing you how to add vrfs.01:05:42If we could certainly do or you could certainly go to cisco live.com, there are sessions where we show all this in a, in a, in our demos, we could, you could certainly look at those you could just search my name. There are sessions which we have done in the past. But what I'm showing here is just.01:05:48Okay, I've integrated, build a fabric. Let's go enable authentication, right? As I said, closed off low impact. Again, these are all the authentication methods which were supported even in the traditional networks, right? We could start with open, which is completely open. Anyone could just connect their laptop or devices into the network and they have full network access, right? You could certainly start there.01:06:03And then, either the user with open auth, either the user provides the credentials, does a map.1x, doesn't matter, right? They are on the network irrespective of whether they share a credential or not. You could certainly monitor that and later you could move to one of these.01:06:23More secure authentication methods, closed off or low impact. All of these options are supported on catalyst center as well. The benefit you get with catalyst center is moving from one method to another is just two clicks of a button in the UI. Imagine if you want to move from an open auth to a closed auth or a low impact in your traditional.01:06:41Work you have to log into every single switch, configure IBNS to dotto conflicts, configure aaa, configure radius, all of that and then move from one method to another. But here two clicks of a button in the UI, the center will configure all that configurations to you on the switches. At any point in time if you want to switch back.01:07:01Again those two clicks, you're back to open open up, right? Just try my doing this on a traditional network. That's the benefit with the controller because it's all automated, right? So this is the UI on the center, so this is where I go into a specific fabric site, I click on the authentication templates, I select what template I want.01:07:20Let's say if you want to select closed off, I select closed off, once I click yes, here are all the IBNS two configurations which will push. Again, this is not the full conflict snippet, it's just some of them, but these are all the configurations what we will push at the back end. So there will be around 300 03:50 lines of clis which we push for every single device with some templates with.01:07:38Policy maps, all that, right? Again, these are all IPNS auto related conflicts.01:07:58Okay, so we have built fabric, we have enabled authentication. Next is where segmentation will come in, right? Once I authenticate a user to.1X or man, that's when I could push an SGD to that user. So let's quickly look at this demo.01:08:03Again this is a micro segmentation demo, in the interest of time, I'll just speed up this little. So it's the same cluster, so fabric is all built. Now I go to this policy page, right? So this is where we, we configure trust sec, right? Under under the policy page. All the fabric provisioning is.01:08:20It's all under this provision.01:08:39Tab what you see here. Once I click on provision tab, that's where I build a fabric, that's where I build a virtual network. Design is where you do all the design related, right? Adding AA, adding ice to a, to a site NTP provisioning, all that. So once I click on this policy, you have this group based access control. That's your trust sec menu, right?01:08:41So once I click on group based access control, there's an overview page. Integrating catalyst center with with ICE is the 1st step which we saw in the earlier demo.01:09:01Once you integrate, you have to do this migration. And why is this migration needed? Because ICE already has matrix, ICE already has sgts. With this migration catalyst center will try to sync with ICE and pull down all of that information through APIs again, right? So once I click S here.01:09:09This Center will use REST APIs, log into ICE and pull down all the sgts, what's what's available on ICE, all the policies what's available on ice, right? So it might take few minutes depending on the amount of conflicts you have on ICE, but since this is a lab environment it should be quick.01:09:28So once you've done with that migration, then if I go to the policy page, so this is the matrix which is pulled down from ICE into catalyst center. So you see there's already a policy there because this policy existed on ICE. Catalyst center just synced to ICE, pulled all the policies, what's on ice. I've just forgot.01:09:44No purpose I've just configured one policy there right between a PCS server and a production server, but there could be a number of policies.01:10:04So what is in the top right that's by default sec matrix has permit and deny, which means by default it's permit with that what that means is any two sgts by default they're they are allowed to communicate with each other.01:10:10But you have an option where you could change that to deny as well. Some of the healthcare customers manufacturing customers are going towards default denied. Again, that's a step towards their zero trust architecture, so they don't want to trust anything even within the network. They want to go default deny, which means by default, any communication between all of the or any communication.01:10:26Between these STDs are denied.01:10:46Until unless they manually permit them, right? That's an option. But again, you have to be a little bit careful before you move from a permit to deny because once you go from permit to deny, you have to make sure your underlay is all reachable because once you go from permit to deny, even your underlay communication goes down because every switch has a.01:10:48Device what you see on the on the on this what I'm showing. Every device has tagged two, which is a trust sec device moment ago default deny, even between devices communication is denied, which means routing protocols will go down.01:11:10Your access to the switch will go down. So that's where you have to make sure that underlay is up is all taken care before you go to defaulting, but otherwise by default it's permit. So once I go to the security group tab, these are all the sgts what were available on ICE which were synced through API.01:11:24Yeah.01:11:44Through catalyst center. So I could add delete, all from catalyst center. I don't have to log in to ice to do any of this, right? Similar access contract I could create access contract as well. So if you recollect the page which I was showing earlier, where you could pass the privileges back, so this is the page in the UI where you could pass the privileges back to ice if you want to back.01:11:45Manage the trust sec architecture on ICE itself, not on catalyst center. So.01:12:06Before we configure a policy, as I said, I've built a fabric, I have a couple of devices, these are all my devices border controlled edges. I have some endpoints which are currently connected to these switches, so let's take a quick look at some of these endpoints before we push a policy. So.01:12:11One of the port has one offering point connected, you could see there he has logged in with a username called John. He has got an IP address eight.three. He's part of a VRF called campus. He has got an SGT value four, right? So this all authenticated with ICE.01:12:27Is pushed down all this policy. I'll go to 2nd switch, I have another endpoint on 2nd switch. We will look at the show off status again, again.1X is enabled on all these switches. So there's a second switch. It's a, it's a wired client again, it got an SGT four, it has certain IP address.01:12:43Okay, and I also have a wireless client as well. So I've got three clients, two wired and one wireless so that we could configure one single policy for both wired and wireless. That's what I'm trying to showcase here. So there's a wireless LAN controller. I have one client which has an IP address eight.four.01:12:59Again, all the clients are part of the same subnet. That's another benefit you get with fabric. You don't have to go different subnets for wired and wireless. I could segment them with hgts, but I could just stick to one single subnet for wired and wireless as well. So here's one of the client eight.three, it's a wired client H two, I'm doing a ping to H three which is another wired client.01:13:17So this is doing a ping between two wired and this is the other client which will do a ping to the wireless client, right? So wire to wired ping is going on wired to wireless another thing. Now let's go back to catalyst center and configure a policy.01:13:37So single policy for both wired and wireless. So again, all those endpoints are using HGT four, which means it's employee, so I'll select employee to employee and I'll change the contract from default which is permit to dinner.01:13:54Right? Again I'm just doing some things in this use case, but you could certainly go a little bit more granular as well. So it's configured and deploy this. This when catalyst center will use the APIs at the backend to push it to ICE.01:14:09And once the push happens, you could immediately see the things getting dropped between wire to wired and between wire to wireless as well, right? So single policy will drop both the communications there. And later we go back.01:14:24We'll remove that policy, we should see the things resume back, right? No more IP addressing, right? It's just based on tags, I could permit deny, and I could go much more granular with contracts within, within, within that policy as well.01:14:40So that's the demo I had. I think with that, I'll hand it back to Amanda or in the interest of time, we could take any live questions you have or Ajit.01:15:01Cameron team, any questions which are not answered?01:15:21There is one question right and when we make a deny in the policy map and Chris, please correct me if it is not what you're saying, but if there is a deny in the in the policy matrix, is there any logs which are being sent?01:15:27You could, you could, when you configure a policy, you could say deny with log. That's an option available on catalyst center or on ICE, so that it will get logged to the switch syslog, right? So that's an option available. By default.01:15:46There are it's up to you how you configured. You could just say deny where it gets denied and you could look at show CTS role based permissions output on the switch to see the counters, right? So that you could see hardware it's been denied.01:16:00That's one way or if you want a log to be generated yes, you could say deny with log, the policy gets pushed to the switch with logging so that the switch will generate a log for those denies. Thank you. And again, there were multiple.01:16:16People who are not able to access the Q and A panel, so if anyone couldn't ask anything in the Q and A panel, please ask us now.01:16:36Yep. Please go ahead and raise your hand and I will try and unmute you.01:16:45Alright, this is.01:17:18The final call for anyone who has a question for our expert, Hesh, please raise your hand and we will unmute you.01:17:22Going once, going twice. We're good. Okay, so let's go over really quick the key points to remember. So network security is imperative, right? So in today's ever expanding AI world, Cisco ICE and center is the solution.01:17:47Right, we can automate with trust sec and SD access to transform the network into a policy driven security fabric that enforces segmentation everywhere. Implement multi layered segmentation to ensure identity driven access contain threats, and.01:18:07To ensure consistent security policies across the entire network.01:18:26Streamline operations and get faster time to value with Catalyst Center. Did you know actually that Catalyst Center offers free virtual and cloud form factors? You guys should try it now. And let's take some actions now. We're gonna call to action, take your 1st step to integrate ICE and catalyst.01:18:31There. We're gonna drop the link in the chat.01:18:51And then how to enable trustsec? Link's gonna get dropped and do you not have a catalyst center, explore virtual and cloud options here? If you don't have ICE, we'll show you how to get started with the link dropping in the chat.01:18:53And if you want help from Cisco specialists, take a quick survey after this call and we'll connect you with a specialist. All right, we just went over the Q and A oh.01:19:13Now it just went to another window, right? And expand your expertise. There's eyes insights and check out our cyber capsule register for the up, up.01:19:29Coming session and subscribe to the cyber capsules today to stay ahead of identity and segmentation best practices. So we'll have these QR codes and register for upcoming events. We have some.01:19:49Awesome that's coming 9 April. We have another ICE meets catalyst center inside series and then we have ICE meets Azure AD oh in intra ID for 16 April and 26th.01:20:03So additional resources with the cyber capsule, we have it in English and Espenol for you guys. Check us out on YouTube, and we have our ICE own YouTube channel which regularly uploads new features, troubleshooting tips, and how to guys.01:20:20Okay, that concludes this presentation. Thank you guys all for joining.01:20:39