Seamless Segmentation Integration: Enhancing Security with Cisco ISE and Ecosystem Platforms

Good morning, everyone. Today we are gonna deliver our next session from security Expert insight series. My name is Mil Martinez and I will be your host for today.00:09To our presenters today are gonna beating he's gonna be presenting and be delivering our demo. He's our demo specialist. Now, let me review a few topics before we start. On the 1st part, just a brief reminder, our previous models were.00:21Model one foundations of network segmentation, VLANs ACLs and identity with Cisco ICE, and our model two was unlocking Cisco dynamics segmentation and security group tagging with ICE. Today, we are gonna.00:41Review the model three, which is seamless segmentation integration enhancing security with cisco's and ecosystem platforms. Now, to drive the sessions better, we are gonna have our QA Q and A over a Slido. Please make sure to ask your questions through that specific portal. It's gonna be.00:54Important because right now the Q and A from the session is disabled. The light information you're gonna find it here. I'm gonna leave it also in the next slide because what I want to ask before we start with the session is a quick question. Which are other topics that you are interested in? And the reason we are asking is also to review some other.01:14The information that would be important for our customers. So that's the main reason we are looking to have some feedback from your side and of course it's it would be important for you to give us that specific insight.01:34He's not triggering this part. Hold on a second. All right. Thank you Miguel. Quickly, you know, my name is. I'm a customer success technical leader with CX. I'm here to present this session with my demo specialist Humira Ruise.01:49And the topic that we would like to focus on today is RTC that is containment with FMC and ICE. So, we all know the world has changed, right? For years.02:04We have tried to secure a changing world by simply adding more tools, more firewalls, more logs, more silos. But in an error of hybrid work and cloud native apps, the perimeter is gone.02:20Or maybe shifted. Our old, you know, manual approach is struggling to keep up. We are here today to talk about and to stop managing the individual products and start orchestrating, you know, unified automated defense that actually matches.02:35The speed of our business. The goal of integration should not be, you know, cleaning up the tech stack. It is actually about moving from reactive manual intervention to proactive, intelligent response based system.02:53So when our security tools finally speak the same language, they don't just alert us. You know, they act us together. So let's, you know, shift our focus from chasing threats to building a system that neutralizes.03:11Before they ever become a problem. Let me try to help you understand this with the help of a zero trust model. In any organization to achieve resilience.03:27We believe that an organization must perform these four functions in order to implement zero trust. The very 1st one is accurately established trust. Unless you know what devices.03:43Users applications are on your network. You cannot really define risk. You cannot define how to mitigate them and you cannot put control in place. So visibility is where it all starts.03:58And here, ICE that is identity service engine authenticates all users and endpoints and can profile and posture them to provide visibility into who and what they are. 2nd function is consistently enforce trust based access.04:14Now this can be used to authorized, you know, endpoints and provide segmentation to enforce the very important principle of least privilege. We started doing this, you know, in a traditional way by pushing ACLs.04:34VLANs, but now in a modern days we do it with sgts. The 3rd function is continuously verified trust. We all know changes inevitable, especially when it comes to risk.04:50So continuously verify trust by reassessing the trust level and adjust, you know, access accordingly once the initial authentication or access has been granted. The 4th function is very critical because.05:07Here, ICE is able to leverage the many security products and service integrations. It can dynamically respond to change in trust by investigating and orchestrating response to potential incidents.05:25With increased visibility into suspicious changes in trust level. Now, even with, the traditional security mitigation in place, we can still have an incident, we can still have a threat.05:41What is important here to understand that the threat, does move lateral? In such situations where one infective device can infect the whole network and suddenly you feed trap.05:58So it's important to automate containment of infected endpoints and revoke network access of the user so that they should not move laterally. Now the biggest challenge is do we have a single product?06:14That can do all of this. Just one product. If you are considering Cisco ICE, then you are partially correct because ICE can do amazing things. In this particular slide, you can see ICE can push VLANs, sgts, ACLs.06:31Down to the network devices in the authorization options. Plus it can contain compromised devices by dynamically moving a user to a quarantine VLAN when something suspicious happens. In short, ICE can do all that.06:50I can suggest segmentation and relies on network access devices to enforce segmentation on the wire. So it can say something like, you know, this user belongs to this particular group of VLAN.07:07But at the end it's the firewall or switch, which enforces the segmentation. Ice can contain a device, but ICE doesn't know when to contain. Something else is needed in the network.07:24That can tell ICE that, hey, something happened in the network and you need to contain this user or endpoint. And it could be a firewall with the malware module installed on it. Again, ICE can do the visibility classification, but it relies on the network devices to enforce.07:39Segmentation. On the other hand, if you look at enforcement devices, what they all care about is traffic. The source destination IP.07:58Port numbers, protocols, network devices usually do it or used to do it based on the IP address, but they don't know who is behind that specific IP address.08:13Is it like a company chief communication officer or HR who has downloaded the? What if they knew it? What if network access devices knew this whole information that it is the chief communication officer?08:28And we have to quarantine that ELT member and only allow the Webex access and ensure nothing else go out to the network. This is called reaction.08:45Based on a cause, based on a trigger and based on a role. And imagine what if your firewall could do that when it's integrated with ICE using PX grid. It will make the life of the incident in your department much easier.09:01In this particular slide, you can see many attributes can affect an endpoint authorization to the network, who the user is, what device they're using, how they're connecting, when they're connecting, from where they're connecting, whether they are compliant or not.09:21Blah blah blah. We collectively refer to these policies as a context, which ICE uses to make an authorization decision, which can be classified as STT, that is security group tag.09:38Now ICE can share this context with other security devices or services using different mechanisms. Our focus in this session is PX grid, but it can also use REST API, it can use syslog.09:55Etc. All right, so far, all the context I gave you is to understand why in this changing world, we need security integrations. Now we will discuss how can we do it.10:12You must have, you know, gone through some of the PX with webinars in the past since we are also talking about integration between ICE and FMC using PX grid. I'll give you a very little taste of PX with what exactly it is. So PX grid.10:31Is a subscription based communication framework. We as a Cisco, we came up with this whole idea many years ago and then it's a RFC now and it is being used by many non Cisco products. ICE is the only controller.10:47In the PX Grid platform, there could be other participants, but they they could join as a subscriber. Once PX Grid platform is started, guys can share the user context with the ecosystem partners.11:07Information like switch port, IP users, session etc. Now, here we will focus on four different, you know, scenarios that we can use with pxgrid. The 1st and the most common is ice to notify all subscribed applications.11:25About a new endpoint, and it is associates associated context. 2nd is when another security product or service share information with ICE to improve its context and update policy authorization based on the new information that they're receiving.11:43The 3rd is threat mitigation and the very important because threat mitigation is possibly when ICE receives an explicit quarantine action from a trusted application. So in this case, FMC is going to give that.12:02You know, explicit quarantine action two eyes, and this is often the result of a malware detection. Now when you talk about SNA that is your stealthwatch we used to call it, it actually triggers that based on any anomalies or maybe a behavioral trigger.12:21On that trusted endpoint or user that is connected with the network. And finally, we have the least common I would say. I don't see this being used a lot. This is a context brokerage. We know that.12:40PX Grid is an open protocol so security products may publish their own information for subscription by any other services. Now, why we need to use PX Grid two.zero versus one.zero.12:551st of all ice three.one NO longer provides support for PX grid one.zero. Since it's based on web sockets and REST API, the PX grid two.zero is more scalable and is supported by all Cisco.13:15Security products that currently integrate with ICE via PX grid. Based on, you know, my experience, most of the customers, they have migrated from the depreciated PX grid one.zero to the modern PX grid two.zero.13:34Which is now required by all ICE versions three.one and above. And I think with full support across Cisco product portfolio, upgrading to two.zero is the essential step for building high performance.13:54And future proof security network. And here are some of the, you know, products I have listed that's what you need like as a minimum version to support pxgrid two.zero. Some of the cool products we have.14:11Here we have Cisco, you know, partners. Oh, sorry. This is our security integration with ICE. Okay, so in this particular slide, we are trying to exhibit that what all products can be integrated with ICE.14:31What is the minimum version we need and how you can integrate those products with ICE, whether you need PX grid or you need a REST API or something else. But if you have any roadmap questions.14:46You know, for that you need to look at the roadmap, for any other product that is not on this list. So this is our Cisco security technical alliance partners list.15:02ICE has many security techno technology partners to choose from. All of these partners take advantage of context sharing their PX grid. To either improve their active security information or even share their details with other PX grid participants.15:19We have a link here if you want to see what all different partners we have added in that list after March 2026, you can go to that link and check that out. So earlier, you know, we looked at.15:35The reasons why integration is essential. Now, here is a practical approach or a path to get there. We have some resources for you if you want to go and check the webinars, we have those links in the PPT that will be shared. And then we have some instant demos if you need to have access to those demos.15:52Reach out to your accounts team so they can arrange access for you guys. Again, this session is purely based on on prem PX grid. However, since we are discussing PX grid.16:11We would like to briefly discuss BX grid cloud as well. So Cisco is committed to simplify the network. We all know that and simplify how it is like built, operated and secured. We are striving.16:27To accomplish this across our portfolio. And with that vision, we introduced PX grid cloud sometime in three.four. Think of a PX grid cloud as a universal connector.16:43That lets your different security tools talk to each other into Cisco seamlessly. Our team is definitely looking into normalizing data from multiple sources to bring this level of visibility and PX grid.16:59And ICE, in this particular workflow, they are the integral part of the solution. It is a screenshot from ICE, you can go to administration and access the integration catalog to check.17:15What products we have today that you can use to integrate ICE with PX grid cloud? Again, it will give you the time based experience native way to manage your network PX grid cloud integrations and connect your infrastructure.17:31To the cloud in just a few clicks. Alright, so now we are gonna talk about the Cisco secure endpoint and FMC. This is what we're gonna show you as a demo as well in the later part of this.17:48Presentation. So in this example, all our endpoints, this is an assumption that all our endpoints have secure endpoint installed ensuring constant monitoring. When our trusted employee Jim.18:08Connects to the network on the on the left hand side, he's given full access to the resources he needs. During his work day Jim clicks on a bad link or a phishing email to download a suspicious file.18:28Causing an infection on his computer. Right then the secure endpoint immediately identifies that as a threat and reported that is a IOC to the FMC. Because of ICE PX grid integration FMC notifies.18:45Cisco eyes of the high severity threat and ICE then issues a COA directly to the switch. Right after that, you know, Jim device instantly moved into the quarantine state.19:05Effectively neutralizing the threat and preventing lateral attack. Now as we assumed, and let's assume again that a firewall or malware module has detected an event that shouldn't have existed at the 1st place.19:23When the malware was detected, we have blocked the user, but now how are you going to trust that user anymore? At the least, you can say that this user is now at an elevated risk.19:40Maybe for, I think we we have this time varies from company to the company, but it could be like between 48 h to 72 h. We are going to assign the user to a different group and going to have a deeper look at its traffic during that duration.19:55You can also assign a stronger IPS policy, change the lookup. Earlier, you know, you wanted to have.EXC files to be sandboxed for that user group. Now you maybe.20:15You may want to, you know, have all PDF and Word documents to be sandboxed as well. So yeah, you can apply different strategies on the user or the endpoint for the driven analysis. Block the user to maybe access.20:29Certain portion of your data center. Why we are talking about this? Because this is what we call rapid threat containment. You have to use FMC in this particular scenario to react.20:45To an event and send a message to ICE to quarantine the user. So FMC or any network access device involved in this whole flow is going to send the event and ICE is going to quarantine the user endpoint.21:01Now, what is quarantine? Quarantine is something that you need to define on the eyes and you can have different definitions of quarantine based on your company policies. I mean, for some companies it can, it can be a change of VLAN, it can change of STT or.21:20It means like, you know, completely deny access. So we have discussed ICE with FMC. We are PX grid. Now let's talk about secure network analytics.21:40So ICE and SN integration is also PX grid. SNL can subscribe to security groups as a topic, sessions and SXP bindings. This integration.21:58Or the previous indication that we discussed, they function as a bi directional conversation between your identity service engine and your, you know, network access devices. So in this particular scenario, we are going to share the context via PX grid.22:13Here ICE acts as a source of truth for identity. It shares critical context that is IP to STD mapping with SNA using PX grid protocol.22:32This ensures that when an alert is generated, you are not just looking at an IP address. You are looking at a specific user device and a security group. Here, we will talk about the behavioral detection.22:48Now, I need to focus something on FMC and SNA. FMC focuses on malware and point security. It detects malicious files and known IOCs or signature based threats.23:07However, in SNA, we look at the behavior, the traffic. So SNA monitors traffic across your entire network. If it detects suspicious behavior, it can pinpoint the exact host involved in this.23:24Whole workflow. And the last section is automated response. That is your ANC adaptive network control. This is the most critical part of the flow because once a threat is confirmed.23:42SNA uses an API to instruct eyes to apply an ANC policy, and as you can see, you know, in the bottom right of the slide, this allows for immediate automated actions such as quarantine shutdown code pounds to isolate.23:59That compromised device right there.24:19All right, so we have another, you know, slide with resources on SNA. This is again just to accelerate your learning with some resources. Again, we have some instant, you know, demos on D cloud.24:28And deployment guides. So yeah, we have everything you need to get started today. Okay, now we are going to discuss Cisco Splunk integration with ICE. It was very confusing when I was starting about these apps and all that, but I.24:44Try to simplify this in this particular slide because we have different apps with different functions. So there are four different apps that you can install based on what you need to do with it. By integrating ICE with Splunk, you actually gain a centralized dashboard.25:04That transfer your raw logs into actionable insights. If you look at app one and two, so why we need them? If you run a unified Cisco ecosystems, you can rely entirely on the.25:23Cisco Catalyst add on and the app number is 7538. It acts, you know, as a single backend engine that feeds the Cisco enterprise networking that 2nd app number 7539.25:41So it what it does actually provide an end to end glass table view of user authentication paired with your network device health. Then we have Splunk DB Connect that is 2686. Splunk DB connect is a generic sequel database extension.25:56Was Plunk.26:15You can use this for easy integration to check Splunk queries and reports. And at the bottom, the most important app that you need for RTC is Splunk Soar, that is 5885. This app implements the investigative and containment actions.26:17On a Cisco ICE device. So if we just summarize why we need these apps from the business outcomes perspective, it actually provides a holistic view and improved, you know, troubleshooting by tracking network access devices.26:36And endpoint issues. It also reduce your, you know, mean time to resolution by quickly identifying critical events. It also helps you to retain your logging data for a longer period of time for compliance needs.26:52Looking at this portal, what it tells me that how we unify the Cisco environment from ICE, SD WAN to Catalyst Center directly into the Splunk platform. So all that data that you're gathering.27:15You will be looking at that data inside the Cisco Enterprise Networking app because that can create a powerful seamless data stream that breakdowns, you know, the silos.27:32And give you the full stack visibility. Now that we have established how this data flows into the platform, let me show you how it actually appears to your team on day to day basis. So.27:47Once you have data from SD WAN, ICE and DNA Center or the new name, we have this, you know, portal with source field where you can select your specific product to look at those logs.28:05There is a slight change in the new app that I have discovered. The top, you know, dashboard that I just highlighted, it has moved on your left hand side, right? So again, it, it will help you to stop toggling between disconnected tools.28:22And it will give you the real time visibility needed to quickly spot security threats and optimize network performance, and definitely it's gonna save you know some some hours of manual investigation. So finally the Splunk DV connect.28:38App, you know, that you can use to directly integrate your eyes to a broader enterprise ecosystem. So this can help you to you know manage some of the databases via oracle, Java and Python and give you a unified real time view as well.28:59Yeah, databases we have. And then you can check in the DB connect connection health portal page. Alright, so this is.29:19The last, you know, section of this presentation, Splunk sold the security orchestration, automation and response. And I just want to explain that how your, you know, security operations center teams today.29:36Are often overwhelmed by the flood of alerts from disconnected point products. This slide is going to show you how we move from that noise to a meaningful action.29:54Using this particular framework. So now would you break down this workflow into four critical stages? The 1st stage is observe here we start, you know, aggregating data from your entire security stack.30:09Firewalls endpoint protections and malware analysis. 2nd stage is orient where this data flows into Splunk enterprise, where it is transformed into actionable analytics.30:24And we get a very nice or gain, we get the gain of we actually gain the context of all the information that we have gathered. The 3rd stage is decision making. Now, even with automation.30:40The human element remains fighter. So we categorize incident across tier one, two and three ensuring that right eyes are on the right problems. And the last one is acting. This is where the magic happens.30:58Through Splunk, sore, we don't just alert. We execute responses across the same security stack automatically, and this is the core message of this entire presentation. When you integrate ICE, FMC SNA Splunk.31:16And security endpoint, they just don't alert the admins. They work together, they act and they contain the threats. The most critical part of this diagram is a feedback loop at the top.31:33Every action taken informs the analytics engine making the system smarter and faster with every incident. And again, we are not just responding. We are continuously evolving our defense.31:52Okay, so once again, we have some resources for you guys, webinars and some instant demos that you can always access if you really want to. With that, I think that's the end of my presentation.32:09And I would like to invite Homero to help us with the demonstration of this whole use case between ICE and FMC using PX grid. So Hamiro, are you ready? I am. Thank you.32:24Great. Thank you so much. So I have a couple of slides as an intro to my demo. So today we're going to demonstrate the seamless segmentation between ICE and ecosystem platforms like the FMC.32:42And for this demonstration we have prepared this little lab with a, what we call this is a virtual area like a DMC, we have a contractor person, we have an employee.33:07We also have a wired catalyst switch, a device with NO supplicant like a phone and all of them are behind the FTD, a firewall that is connecting to the enterprise network.33:21So some of these authentications are occurring on eight oh 21X so we can get full identity. Some of them are using Mac address bypassed simply because they don't have a, a supplicant installed.33:39On the enterprise side, we have directory, we have certificate authorities, we have other services like web applications, development servers, and the authorization options that we will focus on this lab are around.33:54Down the downloadable access control list and security group tags. This is the main focus. So, I'm gonna stop here now. So what I wanted to demonstrate with this initial presentation is.34:14In a traditional network, we have IP addresses, that's basically it. We have a firewall which is inspecting orchestrating the traffic based on access control policies. So what do we see here in our.34:33Connection events.34:52We see IP addresses, that's it, source or initiator five 105 one oh 251 oh one and destination as well, those are a way variety of destinations, even we can see the country, e.g., but this is information that was.34:53By the FMC itself based on the geo location database, e.g.. We could have additional information like from security intelligence if we have the license to do.35:14A filtering on on URL categories or application categories as well. So what would we need in case to we have in our security operation center, we have a.35:26Something going and we need to investigate. Simply the the security operations center analysts will need to start what I what I would do is e.g. go to my, my computer.35:41And try to resolve, who is that person like do a ping minus A, which means try to resolve the name on one night 216851 oh one.35:56Well, I can tell that this is a Windows eleven pro zero one, but that's it. If I'm newby on the sock, maybe I don't even know the subnets like five 100 could be my DMC, I can tell this person, this computer is in the DMC, so I need to investigate who logged into that computer.36:11What do I need to do maybe go to my active directory tools so it's going to be difficult or at least consume time. So what I can do instead is integrate my.36:31FMC with ICE. So I'm going back to this. I know Jackin already presented this, but again from ice, we can tell who, what, when, how, and where, and share that information with other ecosystems.36:473rd parties, even non Cisco eh so they can learn at least e.g. who the person is, what the device is, eh, where the connection was established like wired.37:06Connection a wireless or even remote access VPN. Ok, so the next along with the demo, we will also do some sort of segmentation, so so we are, we were instructed to.37:22Allow contractors to be able to talk to development servers, but not to talk or work on production servers. On the other hand, employees where we were told to allow traffic to production servers and prohibit or block traffic to.37:41To development servers. How will we do that in a, in the traditional way? Well, basically, we will need to work on our policies, but before that we need to know who those persons are.38:00So again, I, based on the, e.g., my troubleshooting or analysis techniques, I am able to determine that a user A is a contractor user B is an employee and I cannot identify those IP addresses that they are connecting from.38:19Other way will be placed them on a different villain.38:39E.g., if I have a 4048 port switch, I would set 24 to be on development VLAN, 24 to be on production VLAN, but who prevents users from jumping in, right? Or.38:45Moving into a different call where the the outlet.39:03The jack on the cubicle is connected to the network of then I'm gonna have a problem, right? So networks are dynamic as mentioned, the boundaries got blurry or basically shifted to another place.39:07So I'm gonna do the traditional way. In ice, I can go e.g. to context visibility endpoints and filter by active or connected. Am I start analyzing I go like ok I have.39:24This user, that is a contractor and I'm missing the other user which is the employee I will find that out that this is one oh two and the other is I'm pretty sure it's one oh one. Okay, so I will go to my.39:44The traditional access control.40:04Policy. I built the policies already but they are disabled, so we have a very basic access control policy where I'm going to just review again that I have the contractor blocked to the production server.40:06I added in the under the objects network management the this host already has the production server, but I need to tell if one or two is actually the contractor, so I'm going to the contractor computer.40:26Here we have the contractor computer and just let's make sure yeah this is one oh two going back to my access control policy so I'm locking one of two to the production server, I'm going to enable this.40:43On the other hand, the employee is one oh one to the development server which is 01:21 in churn. I'm going to enable, I haven't deployed yet because I want to do the initial, so this is employee.41:05I'm going to ping the PRD server oh if I can type correctly SRV, Ping.41:21Okay, my things are going and save, let me get back to here.41:40Okay, they are here now it's still missing to do here. This is the contractor PRD SRV yes, and dev SRV.41:52Okay so let's do the deploy. Come on. Oh, I need to save obviously. So this policy traditional is targeting one device which is our FTD and the DMC, and let's give a it's about 20 30 s.42:10To complete, we can monitor this here 55. This is a live demo, so please bear with me.42:30If I had it recorded, I will pause this time so we can improve. But anyway, it's about to complete. Once it reaches 83, we should be done in like 10 s.42:48I wanted to get a quick, you know, comment here that RTC the rapid threat containment, it's a feature of FMC, not the FTD FTD, right? Because all the correlation and reaction are are to be done by FMC.43:06Correct. You are correct yes. Okay, we can see now in a traditional way we are some block in some way blocking the or achieving what we were asked for, which is.43:21Prevent access from the contractor to the prod server and vice versa on the employee prevent access to the development server. But this is not scalable if we have a.43:37An enterprise with many developers, many employees or people require access to PRD servers, you know, this is gonna explode and you will need like many administrators to accomplish this.43:53We do a quick review on the connections. Again, we will see the blocks and allows, but we we don't have any additional contextual information maybe we can see probably the access control rule not not even that. So there is not much information here.44:09Ah, so what I will do is integrate ICE with the FMC, so also the FMC can consume those sgts dynamically and use those objects dynamic objects into my access control policy, so I don't have to worry ever again about.44:30IP addresses. So how do we do the integration PX grid again. I'm gonna start with reviewing the certificate on ICE, and even before we do that, very important NTP or network services are critical for ICE operations, not only PX grid integration, but everything.44:49So I need to make sure that I can resolve names both A records and PTR. So I'm gonna use my NS lookup real quick for resolving the ICE.45:081st, I see for PI 024 PI zero 02:00 a.m. I maybe not typing correct.45:26I see, I know. I know I know what's happening. Let me get this other MS lookup. These devices are in the DMC who are receiving a different a different DNS, that's why.45:41That's the good things about live labs this is ah I'm typing so my password doesn't get messed up. There you go, ok, and let's look up.45:57C four PI zero. No I'm sorry this is the FMC zero one.46:15Is it my domain controller now? Probably. Let's see. Let's see if that integration is working. NTP is another important piece or let me bring that up.46:36Just to demonstrate that show NTP on the FMC we can go to configuration time, make sure we have a an NTP or some sort of a.46:52Network time protocol synchronization. So what else we can see here in the management interface that we have DNS configured, we have a FQDN, and this is important because for the integration it's preferable to do fqdns or fully qualified domain names.47:10Instead of IP addresses. So I will start by checking the PX grid certificate in ICE. And we have two different ways to work with certificates for PX grid. One is using the internal.47:29ICE CA or certificate authority. CA certificates eh, in every deployment you can see this partly similar schema of certificates. Every node will have.47:47S Node services, node CA and endpoint sub CA, the only one having the root CA is going to be the primary admin node. So ICE basically can issue in certificates for certain purposes, so that's one way.48:06Use the ICE internal CA for the PX grid certificate. The other alternative is using the enterprise PKI or enterprise CA like you name it. It has to be external public or private.48:21For enterprise. So in this case since this lab is also used for another type of demos, it's integrated with enterprise certificate authority. So you can see the issued by column.48:37Is a Microsoft certificate authority that that authority has one route and one sub CA node. So the certificates maybe issued by the route or by that sub CA. That's why in the.48:54Trusted certificates, we have the route and the socio trusted for infrastructure and endpoints. So once I check that, I also need to look at the deployments.49:10Settings, make sure that PX grid is enabled at the bottom. My colleague Jackin mentioned something about that's a an an alternative and it also optional the 1st we need for FMC integration.49:25Is the PX grid. Once we enable that, we need to go to administration system settings and I apologize it's not settings, it's administration PX grid settings and we need to make sure that we automatically approve new certificate based account. So.49:45This means whenever there is a client trying to establish the connection for the 1st time, using a certificate, it will be automatically approved. As long as ICE obviously trust that certificate that is being presented.50:04And finally, we will go to the client management certificates and issue a certificate to the FMC without a certificate signed request. This is when you use the internal CA from ICE. When you use an external like a enterprise.50:21PKI you basically need.50:41To generate a CSR using open SSL or other tool, bring that certificate send request to your authorities to get it signed and get it back to the FMC. In the traditional internal CA, you use the without a certificate sign request. In the common name we will.50:43Put the FMC description you can you can give optional description for integration. It is strongly recommended to add the SAN, the same as the CN. And optionally you can add.51:03The IP address, just for just to be safe, but it is not needed. But it's a it's a it's a recommendation. So the certificate format eh, we will do this the key in pen.51:22The certificate in PEM and also include the chain. The certificate password is a password that you need to remember when you are extracting these certificates from a zip file and importing them into the FMC, which I will show you shortly.51:40So once we haven't click create, we will get a zip file with the private key, with the certificate as long as the chain, as well as the chain. So before importing that certificate into FMC and and working in any integration, we need to go to object manage.51:58Under PKI, under trusted CAs, we will import those routes whether they are from the enterprise PKI or from the ICE internal CA. I have both in this case so I can type.52:20Maybe filter so you can see they have the root for the enterprise CA and I have also the root sub CA and not CA from the ICE. In case I try to do the integration either.52:36Method. In this case again is using the enterprise CA, but the end the goal or the result is the same. Finally I go to internal search and I'm going to add that certificate.52:52That was generated either from ICE, CA or from the enterprise. I will browse to that certificate, in this case I have it somewhere here.53:10Oh, let's see 55 ok so I will have the internal certificate again. So it's gonna be like this one.53:27The private key, which is M and then I will need to type the password that I use to generate that from the ICE internal CA or the password that was included when I use the openest.53:46Once I have that imported here, I will see something like this.54:07If I click, you see the issuer is the endpoint subca, so this is a certificate issued by ICE, and I click on this one, this is the enterprise PKI, this is the sub CA.54:11So I have all pieces ready and together. Finally I will go to integration, other integrations, identity. When you haven't integrated in the past, you will see a screen like this.54:27Once you have integrated, you will see or you click on here and you can do the traditional old way. There is in certain versions, I don't know if starting on firepower management center seven upwards, we have a quick configuration option.54:45This quick configuration option will save save you all that I have done just now like procuring certificates, getting the roots, subca, everything. When you click on this option and and do the.55:04Regenerates certificates. Basically what the FMC does is perform some API API calls to ICE, generates that certificate, imports that certificate, it does everything automatically for you. I did it the traditional way.55:21Well, I put the primary admin node obviously in my full tolerance high availability and environment you need to put the secondary admin.55:36Node and this section we select which certificate we will use for that integration eh I'm using the enterprise sign. I'm using the MNT root server CA is the one issued by the enterprise PKI as well as the server CA.55:51These two options at the bottom are very important because the 1st one session directory is what is gonna give you give us the contextual information, all that user location, connection method, et cetera. If you hover the mouse actually here will give you that.56:12And the SXP topic, this is very important for segmentation. We are going to receive security group tag to IP mappings. So, those are the important ones that ICE will FMC will use to dynamically replace these objects with IP addresses in our.56:30For access control policies. Finally, we will do that test. In nice, we can go to again the PX grid client management.56:50We see this because they are FMC is already connected, but when you do the test, succeeded, you can optionally see additional details. But if you go back to ICE and refresh.57:01You will see this little T minus FMC thing. That was the text, the test that I actually did. Okay, this can be deleted, there is not a problem. The one that is important to keep is this one. And we can also see under diagnostics.57:17The FMC is connected and using session directory as well as other SXP bindings. What else do we need to see in ICE before we go to the FMC and build our policies based on on these dynamic objects?57:34One is the work center trust sec components. In ICE there are built in sgts like auditors, BYOD, I think guests, employees, network services and some others. And you can optionally create your own.57:52I'm pretty sure I created voice over IP, workstation and I think I created contractors as well. No, this is built in. So this is one of the components. The other component is how we tag those sessions.58:13Dynamically, like a contractor that comes in and connects to cubicle A, but tomorrow comes and connects on cubicle C on floor three. So he's gonna have a different IP, different, different.58:32Basically that. So in the policy set, this is where we have the ability to tag those sessions. So for the phone, e.g., it's a map device.58:50Under the authorization policy, I have one built in for phones. So I have my endpoint logical profile equals IP phones. We have our security group column where I assign the tag.59:05Here is where we assign the tag, so access point e.g. get a network infrastructure, a printer gets a network services, profiling devices that haven't been profiled, so I tag them with a quarantine system. That means quarantine system will have limited access to the network so they can be remediated, they can be.59:20Investigated by our security operations center team, e.g.. Or.59:41Simply they need to send a little more traffic to be profiled accordingly, to be profiled as a phone, as a printer, as an access point. So that's format, let's review for for.1X catalyst.1x. Okay, here.59:47In the authorization section, we have a computer basically because it belongs to a domain computer. I tag them with a workstation. Contractor. How do I differentiate? Well, the contractor has to belong to a certain active directory group, which is actually contractor.01:00:03So I give the tag contractor and I have employees. Employees are simply domain users. Member of domain domain users, so I tag them with the employees. Finally before jumping into building those policies in the, in the firepower management center.01:00:20I'm going I want to demonstrate how these sessions look in the switch. So, show access session, access session, ok, here we have three interface three and four and two.01:00:41Two has the phone, four has one of the.1X computers and three has the other. So if I do interface, I'm gonna get more details on this session, so one zero.01:00:58Three details, ok. You will see some additional Mac addresses. This is because this is a virtual environment, so some of the virtualization software sends Mac addresses goofy Mac addresses, but I am interested in the.01:01:14This particular one which is our user, we can see the IP obtained one oh one. This is GUCB 78, this is the username. The status is authorized on the data domain. The their authentication timer is set to 4300.01:01:3343 243200 s and in 40 almost 40000 it will reauthenticate.01:01:53What additional information we can see we have a open director directional as ACL, that means full access and we see SGT value of four. On the other hand, the four.01:02:02I'm looking for the user here we have MAPE 3804 similaration timer open direction and we have a SGT of five. This is my contractor. We see the IP address one oh two.01:02:16Alright, so I have all the components ready. I have integration between ICE and FMC. I can go in FMC to my analysis, users, active sessions. So these are the three that we saw. The special identities are the phones.01:02:33Because they don't belong to any like active directory or any any other identity source. But still I can tell, I think if I go to the right, I don't know if I see that the SGT is on another and the next one that I'm gonna show but we have the these other two members of AD?01:02:51I can also go to, user activity in the FMC, so this is an information we start learning learning from, from ICE. So we see those two users.01:03:12And we have the security group tag now. Oh, that's great. And if I go to, analysis unified events, I will see here some information, not all of the, I still don't see the source user.01:03:28I will show you how to get that but we see now source SGT, destination AGT. Something that I missed to show you in ICE is the the SGT mappings. So that's where those are coming this.01:03:45IP addresses and mappings are coming they are under work center SXP. So we did components now SXP to be able to share.01:04:00Those mappings you will need a dummy SGT device, SXP device, apologies, security group exchange protocol device. So ICE can publish the mappings into this SGT binding table. That's the table that is.01:04:16Shared with the ecosystems. Any you, you name it SNA, firepower. We saw that the list that was showing but also 3rd parties, not only and not only Cisco solutions but also other vendors that are have a like a.01:04:33Association with Cisco.01:04:53And something that I want to show you here is the the the mappings that we learned to session, those are dynamic. So that's e.g. the phone, the the session that of the users as well and anything you see local is static.01:04:55Mappings, so I can add.01:05:15A static mapping here as well. E.g., I did the development servers. So that's why in the FMC we see those mapped to an IP.01:05:19To an SGT. So, the recommendation and that's another topic and I think that was covered in our previous session and how the the SGT should be assigned.01:05:37Should be doing dynamically but also there are some static that are required. E.g., physical servers that are not authenticated to the network, so they are, it's ok to map those statically, but then let the rest of the authentications occur dynamically, so.01:05:54Having said that, I'm going to go to my integration with the identity, the realm. So, in order to get like additional user information into my logs, I will need to create.01:06:13Identity policy, but in order to create an identity policy start by adding a real like active directory LDAP, you click here and you get something like this. You will need to configure.01:06:29The domain name, your base DN and group DN, this is different for each organization by default comes this way but it may change or check with your AD team. Once this is established, you can load the groups, the groups.01:06:44And you will see a loo a list of groups created in that Active directory. And since in every Active directory, all users fall into the domain users, you only need to bring this over. You don't need to bring like enterprise.01:07:02Guest users or VPN users, DHCP users, everyone is in the domain users. So that's all you need to map those identities so they can be in embedded into the logs. Optionally you can create.01:07:19Like a directory connection with LDAP, and in a typical active directory, it's 3809 but there are some others that is secure. So once we have our AD.01:07:35We will create an identity policy. So you click basically on new policy, you name it, you're gonna get something like this, here in the identity policy, we will add a rule.01:07:50And basically it's going to match on any source, any destination, any song, any interface, any, any, but the important thing is to select passive authentication and then the realm we will select the active directory realm.01:08:06And finally, we need to assign that identity policy to our access control policy so it can correlate those events with the users being reported by ICE. So finally, I will go to my policy.01:08:22Access control. Now I will use the traditional, I mean the SGT eh so I'm going to modify this. I'm gonna target our FTD.01:08:37So I'm gonna basically remove the other policy and apply this one. I'm getting a warning because of that. I'm going to enable these policies again. I'm now using dynamic objects and this is the very nice part. You can mix combine.01:08:55Dynamic, static, network objects, dynamic objects locations, everything. That's the most beautiful part. In this case I'm using ah this is gonna be for the rapid threat containment section. I'm going to allow.01:09:10Quarantine system to talk to the remediation server, which is ending in 01:26. I'm going to enable that. If you see here, I'm not using any network, well obviously this one but i'm using also dynamic objects. Next block these quarantine devices endpoints to.01:09:26Internal network, I don't want them to talk to internal network simply because they are infected or they have a problem. So that I'm blocking private networks. Infrastructure, basically I'm allowing access points, printers and stuff talk to internal network.01:09:43What else voice over IP, I'm allowing any device dynamic voice over IP to other voice over IP dynamic objects and as well internal networks so that my phones can establish basically calls to other phones, to other extensions.01:10:01Now the workstation is gonna get full access to the network just because the workstation requires. Now employee block employee block to development servers, so now you see I'm not using IP addresses.01:10:18I'm using exclusively dynamic objects. Okay, so I'm gonna enable contractor, similar dynamic objects and employees permit all, and finally the identity.01:10:33See the the one we created previously and I'm going to save that and deploy it. Okay, we are almost done with the contextual information and I will do jump real quick to the.01:10:53Let me go back here to the deployment 75, let's see how this I'm going to restart my ping to my PR.01:11:14This is the employee, this is the contractor if I can type contractor is still pinging, ok.01:11:3383, almost done. There you go. Let's go to the unified events.01:11:50Go live.01:12:09There you go. Yeah, so now at least for my security operations center team, they have more information. They know Brenda, they can look it up in AD to see if it's employee, a contractor, Alia Manso as well.01:12:13Eh even phones and stuff like that we won't see it, but we see also the action it was blocked, we see the source destination sgts, and this is dynamic. If Brendan tomorrow connects in a different floor, even in a different.01:12:30Building, this policy is gonna enforce according to her role, which is an employee, Ellia, a contractor, anywhere she they are connecting from. So.01:12:47We have I think completed the contextual section. I'm gonna jump real quick to the rapid threat containment which is also very interesting. So I think our good colleague Jacking already showed this slide.01:13:03But who's gonna work in this particular one? Threat Mitigation explained this about Gym being having full access and the indicator of compromise and the dynamic contention. So let's move on.01:13:23Okay, in ice, we need to 1st under deployment I'm sorry. I'm gonna try to speed up. We need to enable the rapid threat containment, which is here threat centric Mac services.01:13:42Once I have that done, I go to operations, adaptive network control, and I go to policy list. Here I can create a quarantine quarantine, and these are my these are these are my options that mentioned.01:14:00So for this, this demo, this concept we did quarantine. Quarantine.01:14:22This is the only thing we need here. In the security FMC, we just we need to create a correlation policy. This policy is explici explicitly done for this demo, but it can be done like for.01:14:28Any intrusion event, any other malware, any stuff that you like. You you can build, the options are endless. Once you create the the correlation policy, you will create policies. One is to detect intrusion.01:14:46So once I detect an intrusion in this case is a particular rule in intrusion prevention rule which is ending in 03I have other rule for auto remediation. So let's say this computer was just missing updates. So this computer went to the.01:15:02Remediation server and downloaded those updates. So the FMC can detect when that endpoint went to the remediation server and removed that endpoint from the quarantine state. I also need.01:15:21The, let's see here I think the actions. So these are the responses, actually they are called responses. The quarantine action is called or configuring remediations under PX grid adaptive network control.01:15:41I created them because already because of time but we can see them here. So I have one for quarantine, one for unquarantine. The remediation type is ANC polyford, the source.01:16:01Not for the destination that that's the the only two options, so it's always for the source. So once all these components are put together.01:16:21And what else is missing? Just that policy correlation and that's it, ok. Let me move into the this guy. Okay, remember, this is the Employee this is one oh one.01:16:29I'm gonna show you here, NO, on the switch. The switch already disconnected. Sorry about that. Let me connect back to the switch real quick. I'm I'm almost done, ok? Type my.01:16:48Any chance.01:17:08This is the switch ok alright, so we have.01:17:14This is the employee. We can see the SGT four and opendear ACL. I will trigger the intrusion prevention SID. I'm going to send one ping.01:17:34This is actually the rule that triggers that. So this person unknowingly clicked on a indicator of compromise. If we go to ICE operations live logs, we can see there is a change of authorization event for that Mac address if we.01:17:50We open that up we see dynamic authorization succeeded. If we dig a little bit more, what is this about? Component agency adaptive network control and it says your reason quarantine per agency policy. Okay, wow.01:18:09Before that, let me just copy this Mac address so we can keep a, a filter. I'm gonna do 3 h. If you can examine here.01:18:29In the authorization policy prior to this event, eh, this person was matching the authorization policy at LS employee, but now it's matching another authorization policy called wired.01:18:44Catalyst quarantine. Wow. How that happened that that was dynamic. You saw I only clicked or pinged a destination, but now I am in quarantine. How that happened? I'm gonna close this report detailed I can go to the.01:19:00FMC analysis correlation events. Okay, what happened here? Oh, I see today at 1319 there was a unknown alert basically the Brenda did a.01:19:19An indicator of compromise. If I go to analysis correlation status, I can see if that actual action took place, which is the quarantine. There you go, ok. Successful comp.01:19:36I don't know why the the business unit developers named remediation because it's not actually a remediation. It's just an action. FMC told ICE to quarantine. So that was an action. It was not a remediation. If I go to the switch, right? Let's see the switch.01:19:52What do we have here? Again, same interface. Well, the same user, now the the authentication timer is lower 10 min because I want to maybe.01:20:11The device was remediated and then after 10 min it reauthenticates and it matches again the full access to the network. But now as at least for now we are still under quarantine. So what else do we see here? In the server policies we see an ACL oh and and an SGT value as well. It changed from four to 02:50.01:20:27And also we have this so if I do show IP access list.01:20:48Oh wow, I'm getting just allowed to resolve names, get an IP, and reach to my remediation servers. Everything else is denied. Oh wow, how how that happened? Okay, and that was dynamic. I have I did NO intervention from the.01:20:53Management consoles other than the user going to a malicious URL or the triggering an interestion event. In ice, I can go to operations adaptive network control endpoint assignment and I can see, ok, I see now a Mac address.01:21:12And it's assigned to this ANC policy quarantine. You can remediate it from here or remove it from here but it's not the recommended or maybe not the best way. The best way is to auto remediate.01:21:32So how did we build this on ICE in ICE I'm sorry. I think I mentioned you that we only required the threat centric not but NO. We also need in our policies something and that was the wired eight oh 21X catalyst.01:21:49If you see something different here from the other policies a local exception, and I won't explain why local. If you do this same in the global, it will basically copy this to all the policy sets.01:22:07It maybe good, it may not be good. Why? Catalyst switches interpret attributes different than Meraki switches or even 3rd party, not even Cisco or even between catalyst controllers wireless and catalyst wired switches, the attributes they understand are different.01:22:26So since in this particular authorization profile, I'm pushing an access control list, a lower authentication timer, I can push different things, VLAN and others you are redirection, I can do many things and I'm going to show you, but I'm putting it in the local because this applies only to.01:22:44Switches. So that's the way I recommend especially if you have a a sorted variety of endpoints net I mean network access devices, you will need to apply those policies per family, like why catalyst can understand attributes for catalyst.01:23:04Meraki can understand, wireless and wired, so that's the recommendation. That's why it's in local exception. So when the dynamic authorization occurred basically I FMC told they authenticate me this guy.01:23:23Because there was a indicator indicator of compromise and I put it in the. So what is the condition here that I use to match on that? So the endpoint basically was reauthenticated you are not trusted anymore, you authenticate please and it went down this.01:23:39Again the same conditions, authentication, and authorization it matched before matching below, it matched the quarantine. So the condition is here session ANC policy equals ANC quarantine.01:23:58That was pushed from our correlation policy, if you remember. So finally I'm gonna show you the authorization profiles under policy elements results, catalyst, quarantine. You can see we're pushing a tackle, this is dynamic or downloadable ACL.01:24:14Meraki switches don't get it. Wireless access controller, at least all versions didn't get it. They get named ACLs, which is different and many other attributes that are not exchangeable among those families. So that's why I use specific for every family.01:24:34So that's the I think that those are the only attributes and their authentication timer to 10 min and that's it. Okay, let's remediate. Okay, the user was told A, you were clicking on something malicious, please get your computer fixed. If I try.01:24:52Like to go to navigate through my daily new source. No, I cannot, basically I cannot do anything other than go to my remediation server. So let me go to my remediation server. There you go. This is my remediation server. I can get downloads from here.01:25:12While it is loading, let me go to the correlation analysis correlation. Ok, now we see the one oh one going to 01:26. Let's see the status and analysis correlation status.01:25:333 min to go. There you go. Successful completion of remediation agency and quarantine. If I go to ice, live log operations, live log, and look for my MAC address.01:25:50I just want to see events related to this specific endpoint. So that occurred like a minute ago. This is the change of authorization. I can see this the details and.01:26:08Agency again, there is not much change here on the reason for both cases is going to say the same quarantined per agency policy but actually we removed the endpoint from the quarantine. We can see that by going to operations endpoint assignment, it's gone.01:26:24In the live log, we can also review the authorization policy, let's see, that one matched that was matched this time.01:26:44Yeah, in the past it was quarantine here and now it's employee. What are you doing? TLS employee. So we're back and we can correlate that showing this on the switch whoops, here.01:27:01Now we have the user back to the full timer, the authentication timer, the ZT four and open direction ACL so auto remediate it, auto contained, so I hope there are good questions in the ch in the slider I'm done with the demo.01:27:20Back to you Miguel, just in time.01:27:40Great job. I quickly wanted to add one clarification. I think during my presentation at one point I didn't complete one of the statement that Cisco ICE and a PX grid framework, Cisco ICE is the only non controller, right?01:27:44Yeah Cisco ecosystem, but 3rd party systems can absolutely be the both publisher and subscriber I think I just said subscriber. So just wanted to add that back to you. Thank you, I will.01:28:01Here just to follow up with the comment I was doing at the beginning, here we would like to hear a little bit more about you which other eyes topics you would hear love to hear from us. Of course, this is important the feedback is always good because that way we can focus on.01:28:20The interest or the topics that you, you are looking or or you need to know more about. So if you if you're able please feel free to to drop us here some information here you have again the link to the Slido for you to join and with that.01:28:37The only topic that I would like to add while we are still here waiting and seeing if we get any, any answer is on what's next. On the what's next, eh, we don't have still anything let's say a.01:28:54It's still published on on the page, but I can give you an advance that we are gonna have a webinar on September October. We are still checking the dates, but it's gonna be mainly regarding ICE back to basics. We are gonna be talking about a little bit about upgrades, about certificate licensing. We're gonna be.01:29:10Seeing some of the basic topics that are important for us and of course that are gonna have an impact for our.01:29:30The in this case to our deployments and of course our environments. So eh, I'm not seeing any other here, so I'm gonna leave that open in case you you want to participate, and here just for awareness hold on a second. Well.01:29:37Okay, here it is. And where we can find here the cyber capsules. The cyber capsules are gonna contain information about the different topics on ICE. They are shortcups, video capsules that you can review if you want or if you want or are interested in any new topic about ICE, please make sure to take a look.01:29:53Double check and with this, we are ending our webinar. Thank you very much for joining and we'll, we'll see you on our next session. Thank you very much. Have a nice day.01:30:13