Security Best Practices in Cisco Data Center – ND & ACI

Hello everybody and welcome to today's expert Insights series. My name is Michael Brickoff and I will be your moderator for today's session on security best practices and.00:09Cisco data center for ACI and ND.00:20Our presenters today, our presenter today will be Irene Albertson as well as Dave Winn will be taking care of the demo. So we're doing things a little bit differently. Typically we have a Q and A panel for the Webex session. We're going to be utilizing the Slido platform for.00:23Q and A as well as some interactive questions. So if you have the time, if you have the chance, definitely go to slido.com or you can use the QR code on the left hand side of the slide. Type in the hashtag aCI_ND_SEC for security and the passcode.00:44Is just security.01:04And once you get there, you should see that there's an icebreaker question available for you to answer. If it's easier, you can use the Slido application that's associated with Webex at the bottom right.01:06Of your Webex panel. You can launch Slido natively through the Webex or you can just use your web browser to go to slido.com and enter the hashtag as well as the passcode there.01:23While folks are doing that and going through signing up for the different Slido questions there, let me just tell you a little bit more about the session. So we'll start with an exploration into security goals as well as some fabric hardening and some more, more generic.01:45Generalizations about how you should manage your networks from an administrative sense, specifically with ACI and nexus dashboard.02:02We'll go through a couple of security best practices as well as have our friend Dave show us a demo specific to security hardening within ACI and Nexus dashboard. And then towards the end, we'll open up the floor, and if you do require or desire a consultation with a customer success specialist.02:09For any sort of your adoption needs, there'll be a chance at the end during the satisfaction survey to give us all of those good questions and requests.02:28With that, yeah, let me hand off to Irene and we can start off the presentation. All right. Well, thank you very much, Michael. Thank you. Welcome everyone. Thank you for joining. So for.02:49For this presentation or for this webinar, let's briefly review the foundation of security and the key security objectives we are trying to achieve as a network professionals. So the primary objective of data center security is to protect business.03:03Critical applications, right? Infrastructure and data while maintaining operational agility. So Cisco ACI and the Nexus dashboard provided policy driven security framework designed to reduce the attack surface by limiting unnecessary.03:21Access to the environment and enforcing segmentation, security controls help contain breaches through micro segmentation and zero trust principles, you know, preventing threats from spreading laterally across the environment. And equally important is the need to protect the management plane, right?03:41Ensuring that administrative access, APIs, controllers and orchestration platforms remain secure from an authorized access and compromise.04:01So, security policies must also secure workloads and applications regardless of their location, right? Whether it's on premises, whether it's virtualized or containerized or cloud connected. So organizations in the, you know, therefore that organizations require comprehensive.04:12For visibility, monitoring and compliance validation to detect threats, investigate incidents and demonstrate adherence to regulatory and corporate security requirements. So therefore, we see that security goals, right? So the security goals are.04:32To the industry, not just, you know, necessarily Cisco ACI or Nexus dashboard, but the industry, right? So we need to reduce attack surface, we need to contain bridges, protect management control plane, we need to secure workloads and ensure visibility and compliance.04:52So fabric hardening, right? Why is it important? So, before s securing applications and the workloads, the underlying network fabric itself must be protected, right? Networks are constantly under attack. So the data center fabric serves as.05:11The foundation for all connectivity, right? Policy enforcements and management operations. So that is the, you know, core of, you know, applications in the data center. If the fabric is compromised, attackers may gain the ability to intercept traffic, disrupt services, manipulate routes.05:31Information or obtain an authorized administrative access. So hardening network devices reduces the risk of a malicious attacks being successful, right? So a hardened fabric improves overall resilience, minimizes separational risk and provides a trusted foundation number which.05:51Segmentation, workload security and compliance controls can be built. So having your fabric behind the firewall is not enough, right? Harden your fabric as if there were NO firewalls.06:11So for security in place, right, hardening, what we see in this slide, right? Security begins long before the system is deployed in production. So Cisco develops its data center solutions using secure by design methodology, right? Cisco.06:25ACI and Nexus dashboard include built in security features designed to protect the infrastructure out of the box while providing customers with additional hardening options to meet their specific security and compliance requirements. So Cisco commitment to security is validated through that independent test.06:45And certification programs recognized by government agencies and industry.07:05Regular regulators worldwide. So what we see here right that certification, e.g., FIPS 140 series, right? That validates the use of approved cryptographic modules and the algorithms for protecting sensitive information.07:13Common criteria certification. It's internationally recognized security certification that evaluates product security functionality and assurance levels. So UCAPL, which stands for Unified Capability Approved Product list. This is the United States Department of defense.07:33Certification for product approved for secure communication environment. And the PCI compliance support, right, this certification of features and controls that help organization meet PCI DSS requirements for protecting payments card data.07:52So what the what is the key message of this slide, right? So Cisco provides a strong secure by default foundation, right? While giving organizations the flexibility to implement additional controls and hardening measures necessary for their specific operations.08:12The regulatory and the compliance requirements.08:33Principle principles of secure operations, right? So what, you know, going beyond hardening configurations. So security Cisco data center is not a one time activity, right? It is ongoing operational discipline. So well fabric hardening provides a secure foundation.08:39Of organizations must continue continuously monitor, manage, and validate their security posture to protect against evolving threats. So effective secure.08:56Operations combine people, processes, and technology, right, to ensure that security controls remain effective throughout the life cycle of the environment. So Cisco ACI and Nexus dashboard support this operation security principles through centralized management role based.09:11Administration and auditing telemetry and integration with enterprise security tools. So.09:30You know, the core principle what we see here, the core principle of secure operations, it's a monitor Cisco security advisories and responses, implement, authentication, authorization and accounting, right? Also known as triple A Enforce rule.09:41Case access control in your environment when possible. Centralized log collection in monitoring, use only secure protocols of you know in your environment, perform configuration and change management and use strong passwords and multi factor authentications.09:59So the takeaway from this slide, so the, you know, the key message from this slide, right? The most secure architecture can still be compromised by weak operational practices. So secure operational ensure that Cisco ACI and.10:20Dashboard remain resilient, compliant, and protected throughout the life cycle, but by continuously monitoring, controlling and validating security posture of the environment.10:40So monitor security advisory, right? So let's just take a look at this principle. So, we have established, right, that the security is continuous process, and one of the most important operational practices is staying informed about new legis.10:53Discovered vulnerabilities and the security updates. So cisco's, product security incident response team also known as Psort for short, is responsible for identifying, investigating and publishing information related to security vulnerabilities affair.11:13Expecting Cisco products. So reviewing that Cisco P source advisories, help organizations access risk, prioritize remediation efforts and maintain a secure and compliant environment.11:33So the recommendations here, right? So monitor Cisco P source security advisories regularly, review affected products, severity rating and recommended fixes. Note that NXOS and appec advisories are typically released on the 4th.11:49Wednesday of February and August at four or 16 h time. And some of the you know critical issues maybe published out of cycles, so keep an eye on that as well.12:09So, force right information, just visit we encourage you to visit this site, right? Cisco.com forward so forward/go forward/P sort or you can Google Cisco P sort it will take you to cisco.com and dot.12:24Forward/go forward/P sword.12:44So you can receive security vulnerability information from, Cisco. So we have a ok so some information I mean actually there's a two several ways to stay connected, right? And receive.12:47That latest security vulnerability information from Cisco, and we have several, as I said, several ways to get this information.13:07So 1st of all, it's security portal and I'll put And I both this ok so you you already Michael, ok. Thank you Michael, so you posted that URLs into chat. So I just we encourage you to visit those URLs, Cisco secure portal, right?13:15So when we you're gonna see latest advisories and security information, you can subscribe to cost from a customer, right? Cost, a-security-announced at cisco.com with mailing list where you receive this notification from Cisco. You can follow this.13:35Feed for real time updates, right? You can follow that URL post it in the chat as well. You can also integrate vulnerability monitoring using the Cisco open VON API project, right? So you can navigate to developer.cisco.com for.13:57That site for/and you can learn more about this project as well. And you can configure personalized security notifications through Cisco.com right when you navigate a notification, you can log into your account and select.14:15What notification you want to receive, right? So it could be sort of field notices, end of sale end of support, and you can specify also whether it's email by email or RSS feed.14:35So here's a note here at the screen. Nexus Dashboard Insights proactively notifies you about vulnerability affecting your fabric. So there are not here Nexus dashboard, right? So Nexus Dashboard Insights is a part of Nexus dashboard. So in this particular webinar.14:51We are referencing Nexus dashboard four.two in Nexus dashboard four.two, you will not be able to see the designation of Nexus dashboard insights. Nexus dashboard is a part now of Nexus dashboard, right? So that's something you know embedded or.15:10Integrated, right? But the concept here what's important note here that Nexus dashboard proactively notifies you about the vulnerability affecting your fabric. So if you have a nexus dashboard in your environment and you have it, you know, set it up, so you will receive this information you know through your Nexus dashboard interface.15:30It's.15:50From a Cisco, from a Cisco resources. So next we are going to talk about a new release cadence. So maintaining current software releases is one of the most effective ways to res reduce security risks. So.15:51Cisco P sort investigate and the.16:11You know, just close this vulnerabilities which will already you know reviewed. So for new release cadence, right? So starting with Cisco ACI six.zero, Cisco introduced us some more predictable software.16:16Release cadence to simplify life cycle management and help customers maintain a secure and supported environment. So this will give us a predictable release schedule with four year life cycles we can see here and this life cycle goes through different phase phases.16:36Development cycle, maintenance cycle, extended support with fixes and tax support cycle.16:56Of this effect starting this Cisco six.x, right? Six.zero, so there's NO more differentiation between short lived releases and long lived releases, right? So now effectively six.X train, right? So we have one train which we can, you know.17:04Select based on our business and technical needs, right? So the the software version. Three feature releases from the 1st customer shipment releases and 4th release becomes a maintenance release, right? The designated this letter.17:26M when you see something like M, that would be maintenance release. In the 1st, as I said, the 1st release will target gold star releases, right? Gold star. This is when you navigate to Cisco software, download repository, you will see gold star indication next to.17:44Software release, meaning that is a BU recommended release and this is something you know you can implement in your environment.18:05So hardware support spends multiple releases and is tied to a single software version. Extended support, right, including P sorts fixes is available for a limited period. So, with the recommendation here, right? So based on this.18:12Based on this information. So the recommendations plan upgrade proactively and migrate to support it to release before extended support and security fixes expire. And this will ensure that continuing protection from newly discovered voice.18:33Vulnerabilities. So the, as I said key takeaway, there's, as I said simplified approach to a software, Cisco software differentiation and you know based on those phases we have here, so.18:52You know, plan to upgrade your software accordingly.19:12Okay, so next we'll talk about authentication, authorization, and accounting. So security administrative access is critical to protect or to protecting data center fabric. So Cisco ACI and Nexus dashboard use a comprehensive authentication, authorization, and.19:17Accounting framework to control access to all, management interfaces, including graphical user interface, the CLI, and rest APIs.19:37So in the combined this role based access control or R back, right, functionality, triple A ensures that all authorized users can access the fabric and perform approved actions.19:47So the triple A framework provides authentication, right? Which verifies user identity, authorization, right, the restrict users to approved action and roles, accounting logs and audit user activities. So Cisco ACI and next.20:03This dashboard support AAA framework for local users and for remote users and remote users with, you know, integration with external authentication services. And we'll take closer look at those integration with external.20:22Authentication services and upcoming slides, but you know just for right now we can see that ACI and nexus dashboard, they have a common authentication services such such as LDAP radius plus, right? And some of and then ACI nexus dashboard supports, you know, separate.20:42Authentication services, you know, based on the use cases. Okay, so role based access control ok so this case here nexus dashboard implemented pre.21:01Principle of least and privilege using role based access control, right? That ensuring users automation tools and 3rd party system have only the permissions required to perform their tasks. So, users are assigned one or more roles, right? The define permission options.21:21We also define security domains, right? Which determine which resources users can access. Access can be limited to specific tenants, domains, fabric components or custom object groups, you know or fabrics. You know, this is something, you know, depends on of course.21:42Use case and it's whether it's applied to ACI or Nexus dashboard so we have a flexibility there as well. So we can combine the rules and security domains.22:01Or combining roles and security domains enable granular access control, right? So you as an admin have that flexibility to be as granular as possible. So ACI and Nexus dashboard gives you that great flexibility.22:10Access to physical switch CLI requires at least read only admin privilege and consider the this you know implement the role based access control principle for users doing switch level troubleshooting.22:28Centralized log collection. Centralized logs improves visibility, accelerates troubleshooting and support security investigations, so system and audit logs should be exported to a secure remote location, right?22:48A platform to protect against log tempering and enable event correlation across the environment.23:08So system logs in audit logs should be sent to a remote location as I already mentioned. In this, you know, that this activity or this action right protects logs from deletion or temporary. So Cisco ACI and nexus dashboards would.23:16Support syslog, right? For UDP TCP and the SSL that's ACI specific, right? For nexus dashboard within support syslog UDP TCP rest API subscription and SNMP V2V3, right? V2C and V three as well. So for more information visit, we are.23:36Issue to visit Cisco epic faults events and system managed messages management guide for Cisco ACI, right? For more information for Cisco ACI and working with system settings release four.two, right, for Nexus dashboard.23:56So you think you can also, you know, Google this information and it will take you to, this particular location for ACI and Nexus dashboard and nexus dashboard, you know, because we are referencing to Nexus dashboard for that too. So, that is, you know, useful information, you can receive more useful.24:11The information from those locations.24:31Okay, use secure protocols, right? So another principle, use secure protocols. So network management traffic often carries sensitive information and should always be protected using secure protocols and modern encryption as standard. And this is something not specific.24:35To ACI on Nexus dashboard. So this is something we'll learn from a security from the industry, right? So use HTTPS instead of HTTP, use SSH instead of telnet, use SCP, SFTP instead of FTP, use SSH.24:55MMP V three instead of SNMP V two even though you know those protocols are supported, but you know use us you know the security protocols as possible.25:15In your environment. So you must use secure authentication and encryption algorithms, right? So disable weak cryptographic algorithm in ciphers and as I said, avoid legacy protocols such as MD five SHA one, TLS, 1.0 and 1.1.25:25So this information also available@cisco.com, those, you know, links are we posted earlier, you know, specific to ACI and Nexus dashboard.25:45So here we can see a screenshot of Cisco ACI, right? So this is not an example of hardening configuration and just a indication of where those settings can be found, right? So we can see here when we navigate to appic fabric fabric policies and we can see there and.25:57The part, right? So policy spot and we can see what protocols we want to enable and want to disable et cetera. So as I said, it's not necessarily a recommendation, right? So the just the screen of where those policies configured. Just you know keep in mind and when you work in your environment, right, so implementing.26:17That's principle in your environment and, you know, create the policies based on your use cases. So this is for ACI and the Nexus dashboard.26:37So there's a little bit different approach, right? But you know the principle concept applied the same for ACI and the nexus dashboard. Configuration management.26:46So for configuration management helps maintain secure and stable fabric by ensuring changes and changing that, controlled, documented and recoverable later, right? Or when we need it. So regular configuration backups in.27:02Enable that rapid recovery, support auditing and help identify when security related changes occurred. So, important to keep in mind, right? So we implement the formal change management process. This is something once again we'll also learn.27:22From the industry principle. Maintain regular configuration backups and archives and the Cisco ECR and Nexus dashboard provide this ability right to so to save or perform this configuration backup to remote locations. Use configuration history for audio.27:42And troubleshooting, protect archive configurations in, you know, as they contains sensitive information, right? Especially when.28:03You know, we're using configuration backup for fabrics and restrict access to backup repositories, right? So make that the role based access control in actions and define which, you know, which role will.28:15Be able to access those.28:34Backups. Okay, so I believe we are at our 1st slide at questions, so I will pass the ball back to Michael to take us through this 1st question.28:37Yeah, just a quick Slido question for folks. If you're an ACI user, a Nexus dashboard user or both, we've had a few answers here. It looks like four people answered. A lot of people are ACI only, some Nexus dashboard only, one person here is doing both, which is awesome.28:55So yeah, we'll keep that poll open. You guys can answer the questions as they come in. And then let me re share the presentation here alright thank you Michael. So now.29:12Now we are back to our presentation strong passwords, so this is also important concept in security.29:32So as we know, week passwords remain one of the most common attack vectors, strong password policies and multi factor authentication significantly reduced the risk of unauthorized access. So what are the recommendations, right? This is something once again not.29:42Necessarily new to us with already learned from our, you know, security practices. So use upper and lowercase letters, right? So this is also you know that industry standards are applicable to Cisco ACI and Nexus dashboard. So use that upper and lowercase letters, include the numbers in.30:02Special characters use at least eight characters for passwords, right? Twelve plus characters recommended. Avoid dictionary words in common phrases. Do not use personal information, avoid repetitive or predictable patterns in enable multi factor.30:22Authentication for administrative access.30:42Okay, so next securing the management plane, for user alright with user authentication. So what we can see here is table, right? So a table, not necessarily a comparison but we can just you know to visualize.30:45Authentication providers available, the Cisco ACI and Nexus dashboard, right? So I mentioned, as I mentioned in the beginning of the presentation, ACI and Nexus dashboard supports you know common services, authentication providers, right? LDAP, radius plus, so we can.31:07Specify parameters here. So from this ACI we have RSA secure ID, this nexus dashboard OIDC, this ACI we have a door with Nexus dashboard multi cluster, ACI we have open authentication to that MZ.31:26Effective ACI five.two in this nexus dashboard effective Nexus dashboard for that one Microsoft intra ID. So as you can see here, we have a wide variety here, so we can select you know authentication providers, whether it's with ACI or Nexus dashboard.31:46Based on our, you know, technical business and business needs, you know, for our organization.32:05So in recommendation here of course configure remote authentication using your centralized identity platform. You know, once again, it's based on your specific use case. Okay, so here you know AAA fallback and local domain. So once again we can see here.32:11Table, not necessarily a comparison, but what we can see here common and specific to ACI or Nexus dashboard. So the purpose right for triple eight fallbacks, the terminology itself fallback is specific to ACI, we don't see that fallback necessarily in Nexus dashboard, right? Nexus.32:32Dashboard refers to a local domain.32:51But we'll see that terminology specific to a ACI fallback. So however, the purpose, right, for that fallback or local local domain domain is back up user authentication domain for appic login and default local authentication domain for Nexus dashboard login. So it's a.32:54Allows local user login when remote triple A server fails, right? So we can switch to fallback. In local user authentication within Nexus dashboard platform once again that's full local domain. We're gonna use fallback domain, we're gonna use with a graphical user interface with CLI, with.33:13Rest API right with full back domain prefixes. And we can use log login local domain with Nexus dashboard through graphical user interface with selective authentication domains.33:33So related to right triple AAA authentication and login domains and the local domain in a Nexus dashboard related to role based access control, multi tenancy, user access management access fabrics. Scope, user authentication fallback, right? For the fabric.33:49In the Nexus dashboard, when we're referring to Nexus dashboards, right? So this login domain we authenticate and we can access control to nexus dashboard, you know, fabrics associated with this in the, and.34:08Services, right? Services running on and because it's an integrated or unified image right now a unified platform. So with this login domain we login once and we can, you know, use that login with services throughout nexus dashboards.34:22So configuration, we configured that in appex AAA login domain settings and on the Nexus dashboard management dashboard user and tenant domain settings. So that's very as far as for user application in the logins, you know, full back domain local domain, right? So this is associated.34:42So role based access control.35:02Subject, right? And it's very lengthy, subject we're not gonna cover the entire role based access control here, but simply because we don't have time for this particular webinar. So we do offer a separate session for you know subjects with for subject with.35:09Covers here, e.g., role based access control and user you know user permissions, so this is something you know could be delivered through the separate session. So through this webinar, we're going through the applicable or available options, but it's not.35:26Seen a fully exhausted information here because there's so many so much more so we can, you know, provide additional sessions for you. So if you would like to schedule additional sessions, this is something can be provided as well.35:46Okay, so, continue with AAA full back and local domain so fallback account ensures that administra administrators can still access the fabric if external authentication.36:00Services become unavailable, right? Or unreachable. So, and the key points here, right, this is supported this radius stack AX LDAP, RSA and dual, right? This is something we already covered in the previous slides just very quickly so we can see that, you know, there's a variety.36:20The of external services we can provide here and the full back uses local authentication by default, right? It should never be changed.36:40The by default triple AAA server availability is checked using ICMP ACA and the recommendation here enable server monitoring to validate server health through periodic log.36:52Login, you know, test using the dummy account and this will provide more accurate detection than just simple ICMP reachability alone. So that's the configuration, right? Configure server recommendation I'm sorry. Configure server monitoring to Monitora server line.37:09All of this.37:29Okay so another slide about, you know, full back and local domain. Once again it's not the full information about the domain just you know some of the principles of the full back domain and local domain. So the local.37:31Admin, account is critical by glass account, right? It should not be used when necessary. I mean it should only be used when it's necessary. So local admin account cannot be deleted, right? And it's reserved or will reserve it for emergency access and recovery scenario.37:51So set a strong password, which we already covered in previous slides. So set a strong password that is known or is not known by, another single individual, right? So for admin, just keep your strong password and store that password securely.38:11And we'll retrieve it only when required.38:31So the recommendation here, right, do not use admin user for regular operations, right? So plus if you're using admin for, for every user and who who has access to your environment ACI or Nexus dashboards, you will not be able to detect that or.38:36That audit logs may not be useful as, you know, with different accounts. So the recommendation do not use admin user for regular operation and if needed create different local user with admin permissions.38:55Okay, so X five oh nine certificates and SSH keys. So while username and password will remain the primary authentication method Cisco ACI and access dashboard support stronger authentication.39:09Mechanism for automation and CLI access.39:29So X519 certificates for rest API authentication, right? We can use that certification when we work with the REST API and CLI, and this is a signature based authentication for each transaction more secure than just, you know, username and password authentication, and.39:34It's a recommended for automation tools such as Ansible and terraform. So SSH keys for clis and CLI access eliminate the need for password based logins and they support up to 32 SSH public keys per user.39:53So, graphical user interface access continues to use username and password authentication, right? However, you know, so if you were working with REST API and CLI recommendation is to leverage X five oh nine certificates for, you know, for this particular.40:13Activities and use SSH keys for CLI access for local users.40:33So starting this ACI for that two.four release in nexus dashboard for that one.one, right? So user accounts can be automatically locked after a configurable number of failed login attempts, right? Helping protect against brute force attacks.40:40So the consideration here, so when a remote user is locked out, it's locked out for any remote authentication server types. So login failures due to triple A server being unreachable or down are not counted, and login failures due to bad SSH keys or in.41:00Valid certificates are not considered. And when being locked out from one epic, the user is locked out from all nodes including switches, so which is also true for nexus dashboards especially if you have Nexus dashboard you know three node classroom.41:20So those, you know, configurable through the policies in ACI nexus dashboard, you can create those you know specific parameters when your user locked out from from unsuccessful when you have un unsuccessful attempts.41:37Okay, so here's we have user rules, right? So this is specific to ACI when we work with ACI, we have admin, tenant admin, read only user and network operator, so we also have a security admin, right? So they have a different permission.41:57Here, right? So admin of course full access, then an admin access to tenant, right? Which be able to manipulate or you know provide configuration with the tenant. Read only would meaning only read only, network operator, right, can perform operational tasks, but limited configuration capability and security admin, manage security.42:17The policies and configurations. Specific phone to nexus dashboard, so we have.42:37The roles, as you can see here on the table effectiveness Nexus dashboard for that one, right? So we have a super admin which is a full access to Nexus dashboard fabric admin, full fabric management including network policies, interface configurations, software upgrades, and adding deleting fabrics. Designer, right, and Mac configuration.42:46Changes intent but cannot deploy changes to network fabric, meaning designer can stage some configuration, right? They have it ready for approval, so we have approval who can approve or deny submit the configuration changes and then observer, we have observer who can just, you know, basically read only access to.43:06The environment and support engineer rule can perform support tasks like collecting tech support, backups, backups, deploying templates, troubleshooting etc. So all this information, you know, related to ACI and Nexus dashboard of course available@Cisco.com specific to ACI role based information on the ACI.43:26By site and for Nexus dashboard for that too, right? When you.43:46And Navigate through configuration guide, you can read more information about user roles. Ok, so here's some more information about ACI rules are focused on fabric and tenant management, this rules like tenant admin and security admin. Next is.43:51Dashboard rules are unified across multiple fabrics and service services, and it's a broader rollback model supporting rules like approving support engineer. That's the one we have reviewed in the previous slide. And next is dashboard rules include explicit support for change control workflows, right? Something like.44:11Approval rule. In exist dashboard rules have AV pair values used for remote authentication integration that's also been reviewed in the previous slide in the table.44:31So that's as I said all this information as well available available in Cisco.com for console access. So console access rate provides critical last resort access to recovery and troubleshooting when formal management access.44:41Is unavailable. So if any issues prevent devices to boot or enable management access, console port is the only one alternative.45:02So also some operations do require console access, right? Such as a password recovery. So as a last resort access console access should be protected using triple A with the local authentication, right? So that's something we already reviewed in the.45:13Beginning of our presentation and this action will ensure that logging and console is always possible possible independently of triple A servers. So recommendation of course enabled two factor authentication for extra security team. And if console servers used or hardened them appropriately.45:32As well, right? So configure local authentication for console access.45:52Okay, so here we can see once again table, right? So this ACI specific and next is dashboard specific for cancel access, we can not go I will not go through the table, right? For the interest of time, just we can see that access protocols supported associated.45:59H or recommended SSH V two for CLI HTTPS, for graphical username interface same with Nexus dashboard, we can use those protocols and for rest APIs as well. So for open default open ports, right, we have on ports 22 and 04:43 for ACI when we are.46:19Accessing console and configurable host list restricts access to management interfaces.46:39Password policies, ok, so password policies are back and forth, right? Infrastructure hardening, so that's we already reviewed that R back is helpful to you know follow that security principles.46:47Expiry reuse restrictions as well with you know Nexus dashboard. So we can configure policies with Cisco ECI and we can, same policy, right? Affecting for that one, we can create that policy logging attempt with the configurable policies which you know will.47:06Help us implement secure secure console access.47:26With this principle et cetera. So that information, as I said, so this on the on this table, so this information also available@Cisco.com right can be reviewed there. So that's for recommendation for securing console access. So HTTPS.47:33Certificates.47:51So Cisco ACI nexus dashboard ships with a self signed certificates by default, right? Which may generate browser trust warnings. Replacing it with a certificate signed by trusted certificate authority, right? Improves security and user trust. So since.47:52Recommends to generate custom certificates signed by trusted certificate authority of their choice, right, of your choice. So of their choice I'm sorry certificate sign request can be created from Apic or next dashboard certificate can be uploaded to Appec Redwin sign, and the.48:12The certificate authority certificates can be also provided. So you can also see more information. So for some reason this.48:32URL is not populated, but you can review this information@Cisco.com as well, right? Full relevant platform for ACI nexus dashboard so you navigate to ACI and search for security configuration for software release of your choice, right?48:43The same for Nexus dashboard as well. So thank you Michael so you posted that information in chat. So those URL available, yeah@Cisco.com so you can just, you know, read more about this information.49:02Protecting management access as well, right? So, for management. So that once again, so table, right? So I put together the table for specific for ACI and Nexus dashboard some sort of comparison between the two or, you know, we can just, you know, see which one is available with, you know.49:18What information is available. So the management interface, right? We have a graphical user interface with CLI with ACI and the same with nexus dashboard right for multiple fabrics. We can see API access, it could be REST APIs with epic or a comprehensive REST API with JWT token.49:38Authentication, user roles defined in the app and unified role based access control graphical using API etc. So once again that is available from the cisco.com, right? So when you navigate to.49:57Configuration guide for ACI, you know, of your software release and the next is dashboard and you can just, you know, get familiar with this information. So, the the key message here right of course secure your management access as well and.50:15A contract, right? So this is specific to ACI when we specify contracts to you know secure access. So in the management access should be restricted, right? To only the required protocols and authorized management system. So Cisco ACI.50:35That management contracts provide granular control over traffic to and from fabric nodes. So by default SSH and HTTPS are only open without restrictions. So as soon as a contract is applied, contract needs to explicitly allow those.50:54Ports. For out of band management contract guidelines, you know, filter entries shall only allow right the protocols that are needed, right? E.g., if you provide NTP or DNS or SSH, HTTP AAA since like et cetera. So this is.51:15Something you know configurable in contracts and ACI and then you can apply in the correct direction. Contract should be consumed by the out of band EPG, right? Default.51:34Endpoint group or it's also known as ACI notes and contracts should be provided by the external management network instance profiles right also known as external management EPG. So the key, the key key words here, right? We can see the 1st.51:48In the 1st sentence where this contract should be provided consumed, right? Consumed by the out of band EPG default, right? And provided by external management network incidents profiles. So this is referring to direction between contracts, so we need to consume by.52:08Default EPG and provide by external management network.52:28Right, so this is a visual representation of this concept, right? When we have out of band EPG and we need to provide access to, e.g., provide this yes communication with on the DNS level right with e.g. out of band EPG.52:34The main controller, right? In the subnet we see here as an example, then that fifty.twenty eight.one 50 one/thirty two, right? So we provide from out of band we provide in the main controllers consumed, right? So we provide that contracts.52:53Here for each service. That is best practice recommendation, right? To provide contract if it's filters applicable to this particular contract protocols we're trying to provide communication.53:13Alright, so now we are next slide with Michael, back to you to have this, question? Yeah. Yeah, so the next question is how many years have you been working with ACI Nexus dashboard or both? It looks like we got a big cohort of individuals who I would consider.53:30Veterans. I've been working with ACI and you know the the.53:50Pretty preliminary artifacts of Nexus dashboard back when it was simply a multi site orchestrator before the actual routes of Nexus dashboard took hold. I've been working with ACI since 2016, so I'd definitely be in that more than five category there, but yeah, we'll leave the question up so give some folks more time to answer and we will have a one on one.53:54Consultation request as well as a survey towards the end after Dave's demo, so if you are interested in the one on one consult with a customer success specialist, definitely stick around and we will get you sorted.54:15Let me grab the presentation again here. Okay, thank you Michael. All righty, so hardening here. So hardening SIMC stands for Cisco integrated Management console, right? It's the baseboard management.54:27Controller that provides embedded server management for Cisco UCS a C series server where Epic runs right that ACI something runs and for nexus dashboard as well, right? So if we have a physical form function, so we're referring to UCS.54:47Sorry so as many as any other management interface CMC interface must be hardened. So for user management right enable strong passwords.55:07Enforcement and automatic password expiration, so this has configurable of these policies and use LDAP remote authentication is if possible, right? Other remote authentication options are not supported only LDAP and local. So for network security, right? Enable appear.55:18Team to block the block the IP after several successful login attempts and enable IP filtering to filter CMC access only from a restricted set of IP addresses.55:36So fabric secure mode. So fabric secure mode, also known as a fabric internet authentication security level, right? So specific to ACI here. So.55:52This feature secures the fabric from unauthorized switches controllers from joining the fabric. And there's two more modes here, right? So the permissive mode, right? Which allows automatic node discovery and the onboarding does not enforce serial number authorization.56:10And strict mode which requires valid Cisco serial number and certification of you know to allow notes to join and also requires manual administration authorization and enforced note identity verification.56:29So the best practice recommendation in this particular use in this case enable fabric intermode authentication strict mode if this is something, you know, applicable to your environment ok right so moving from.56:48This is not right keynotes on this slide. So moving from permissive mode to strict mode has NO impact right on the traffic as long as all nodes have valid SSL certificates. Before moving to strict mode, verify ACI nodes certificate status.57:07Alright, so maxsec, right? Point to point Mac layer security team. So maxsec, as we know is I triple A eight oh two.one AE standard based on laid two hop by hop encryption. So, this provides configuration.57:29Confidentiality and the integr integrity for media access independent protocols. So for Cisco ACI it's supported on fabric links including border leaf to DCI stretch fabric, access link, multi site etc. For next is the dashboards for the two right supported on data center.57:49BGP fabrics or simple on the VXLAN fabrics for interfabric links also supports for interfabric DCI, right, data center interconnect connectivity. So.58:11Once again, so I put together this table, right? Comparison table for Cisco ACI Nexus dashboard, you can read here, you know, some difference differences and common items here. So what I would like to highlight here though is for modes, maxsec modes.58:26So macsec can be deployed in different modes as we can see here depending on operational and security requirements. So we can have mast secure mode, which is only encrypted traffic is permitted. And link remains down if Mac sec negotiation fails.58:45So for should secure mode, right? This allows both encrypted and unencrypted traffic, and it's recommended during initial deployment and the migration. So what I did here, sorry, so I highlighted that particular mode for ACI because it's applicable to ACI, not.59:05Applicable for Nexus dashboard at this time. So that's you know they.59:25Key message from this slide as well. So for this information, right, for this table, so this is once again it's available on cisco.com for configuration security configuration for ACI, you know, release you're running or intend to run in your environment and for a nexus dashboard as well. So the best.59:30Access here as far as for macsec modes is to start with should secure mode 1st, right? While validating key chain and connectivity and then transition to must secure mode once all devices are properly configured. So enable macsec on IP.59:50And IPN stands for interpod network that layer three connectivity can connects multi site and as I said to enable maxsec whenever supported. So of course this you know best practice recommendation, but it will depends on your use case, right? For your technical.01:00:10Based on your technical and.01:00:31Business needs, right? But if you consider a macsec then you know follow this Cisco best practice recommendations. Okay, so contracts. So for contracts you know as we can see segmentation policies, this is applied for Cisco ACI, right? When we.01:00:33When we work with ACI. So Cisco ACI implements a zero trust policy model, meaning that when we deploy or configure endpoint groups, right, and place endpoints to endpoint groups. So endpoint groups cannot or endpoints in different endpoint groups.01:00:54Cannot communicate with each other. So therefore contracts required to enable inter EPG communication. Intra EPG communications allowed but we can also restrict them with additional policies. So also policy can include the layer four lists.01:01:13Demons services such as, you know, firewall or load balances. So, as I said, this is applicable to ACI. So in this world.01:01:33Complete my presentation part, so I will pass the ball to our demo friend Dave Dave. Dave going to you for presentation for demonstration. Okay, checking on audio, I haven't speak for a long time. Can you hear me, Irene? Yeah I can hear you.01:01:44Yes, we can hear you? Okay, great, thank you. Well, welcome everybody. Hopefully you stick around until the demo. We are.01:02:03So thankful that you are here spending last hour with us and you learn something new whether it's new to you or it's been there for a long time and you haven't noticed this. I hope that you enjoy that. So for this demo, it's just kind of short and sweet or many of you are working with our product, you now LDAP is not.01:02:12Not that new and you probably have already implemented in your production, but for those who just getting started with Nexus dashboard, I hope it's useful for you and we usually start the implementation with the local user account.01:02:32Theraine was talking about, right? It's kind of simple for us to.01:02:52Quickly get in and do things that we need to do, but at one in time one local account would not be enough, you know, everybody will have their own credential and we are dealing with the problem of our digital age where we don't know which password to use that we are trying to unify.01:02:57But still, as a IT personnel I can see the pain trying to figure out which account to use. So LDAP is really helpful. Just like HTTP and HTTPS, right? We all have to deal with encryption and non encryption, so.01:03:17If you wanted to have environment with them easy to set up, not to have to deal with your certificates and all of that, then this is gonna be something you all started with, but like we all wanted to write security is.01:03:32In everybody's mind. So we wanted to be secure. So after you finish this, you may have a different requirement later down the road need to do LDAP security. That's, that's great, but this demo is very simple. So in order for you to get started, you probably will have to get a documentation.01:03:48Like I have on the PowerPoint, right? Just get the information out there it will help you during the process because if you have never done it before, you probably don't know what to do, so.01:04:08Just get a list of these things. The host is the active directive server or domain controller, if you use the same thing with the Microsoft that I'm using in this lab. The port for LDAP is just 3809 priority, we just set it as default.01:04:20So the information you might need or wonder how you get that. I will show you a little bit later now in this demo, but basically you know base DN, by DN, the username and password. So in, in my case.01:04:37I wanted to be able to reuse this LDAP_bind user with a specific password so that maybe my team members, Michael, Irene or Rodrigo, right? He wants to use that same user, same password and connect to his nexus.01:04:53Dashboard cluster in the lab so that he can test something still everybody who has access to the active director groups should be able to log in into that same next dashboard cluster. That's one thing that keep in mind because you don't want to use your.01:05:13Personal account on the Active directive and when you do that only you can.01:05:33Do that time that time and when someone else trying to fix that they they will have to use either their own account. So think about of this account as your services account, ok? And then something like timeouts.01:05:39Retries those things you can tune it later based on your need in your environment. The most important attribute for LDAP here, we have two option members off.01:05:55As for, another one is the AV pair, so as I go through that live demo you can see it. So that's kind of something you need to prepare ahead of time, things like group DM to help you to tie your.01:06:12Group let me show you a screenshot that I take from the presentation. So here if you want, your engineer to be able to do everything as a super admin, you're going to have to find that.01:06:31Group in my case is CSS users in my active directive. So just keep that in mind. I'm going to switch to the Nexus dashboard here. I have done both in window 2022, which is.01:06:47I'm showing right here. Everything has been already configured. I have a domain controller with the demo.CSS domain and the user I already configure the LDAP by user here and my user and a couple of.01:07:05User that I wanted to be able to test after the LDAP integration. I can see that these are the four engineers within the CSS users class are allowed to, I mean group to be able to do the same thing, have the same rights if I have.01:07:25And to give all of these people Alex, Bruce John, and LDAP_by the submit super admin user role, then they all will be able to do everything.01:07:45They need to do after the LDAP integration is finished. So here, let's go through the Nexus dashboard configuration is quite simple, right? Once you get in here, I'm on version four dot.01:07:58Two, and then when you go to admin under users and security, but this is the local admin that came with this dashboard so you probably have that user account logging in here to do this kind of activity. So under the.01:08:15Authentication, I have NO locked domain yet.01:08:35Other than just the local one. So I'm going to create a new one here. I call it the RTP LDAP for this group in RTP where I work with. So we had using that name, and let me show you the locking. When I go to this.01:08:39Next is dashboard on the login page where I only have the local user account. It does not show me the different domain, right? Just user and password, that's it. But after I finish the integration, I should see the option to choose the LDAP, ok?01:09:00So under this page we are going to add the provider. If you have multiple LDAP server to use, that's fine. So that.01:09:19Let's put the 1st one here. My active directive is at this IP address, so just go ahead and copy it. It's good to be admin on both sides, but I understand you maybe.01:09:27A part of the network team and you work with another team, server team to get that information so that that's another thing you will have to tell the admin to create user groups for you, but that how you will show them, ok, how do you find that by ID based DN.01:09:43By the end, so let me switch back to my documentation here. I got the host, I got the port. Now base DN is just like the the last part of the by dn. So how do you find that by DN? You just go to your active directive here in.01:10:03Version 2022, you will go under that user LDAP by double click on it. And if you don't see the attribute editor, that will be something under view, ok? You have to enable advanced feature.01:10:23So that you can see that attribute, but now that it's easy, you can use AI and tell you, ok, how can I find that distinguished name from a user so they can actually give you a COI to do it for the powershell. So this is just the easy get it done, but if you work with it, you know, day in, day out, you probably.01:10:41How how to. So this is the distinguished named and and then I just go ahead and copy the whole thing here. It's gonna be my.01:11:00Bind DN and then the last part of it is gonna be the base DN. So I'm going to just copy this, ok?01:11:12Go C and go down to my next dashboard, I paste it, and then the by the end, just copy this entire and paste it.01:11:25And remember you create that LDAP_by the user you should know that Password for it Okay, it's kind of.01:11:44Confusing sometimes you see the key and the the term they use here but that's the same password, so here's where we see the LDAP attribute, if you use Cisco AD pair and follow that documentation and do it. Here we use member off.01:12:04With the capitalized O And everything else I just leave it as default, but you can tune them later if you wanted to use SSL certificate and validation. The validation user it's.01:12:20Notice out here that the user I use ldaps_bide. Let me just go ahead and do that and then password. Okay, that's it.01:12:36If I did everything correctly, it didn't make any mistake I should be able to save it here. And if you run into a problem where it rejected that request, then it's gonna be a problem with just a window version that you're using.01:12:52So here I already show the the problem because I ran into a problem on my windows 2025, so I know what it is and I fix it. But here you go through this part in your local group policy editor and you can find this. This is only on.01:13:09Window 2025 because this one has only two options for domain controller LDAP server channel biding token requirement and the server signing requirement. There is NO enforcement at all. So if you are on 2022, great, NO issue at all.01:13:28If, if you do have Windows 2000 2025, then you'll have to follow that and fix it. But that's it. So now next step is to map this group with the the role that we want to be on the nexus dashboard cluster, right? I wanted to give.01:13:46Everybody in my CSS user group to be able to do everything they wanted to do with next to the dashboard cluster. So I want to give them super admin.01:14:06Here I'm going to use the LDAP group map and then add it and the group DN is the group that you have in your active directive. So this group CSS user is my group. So every time I have a new CSS join our team, we just go in here and.01:14:17We an account for him or her and then give him a password, they can remote desktop to this.01:14:36Demo.CSS active directive set set up and they can also access to the next dashboard as a super admin user. So in order for me to find that group dn, I just again go to attribute editor and find that distinguished name. So that's the one.01:14:43I already copied and I already know that I have it in my.01:15:03Cheat sheet documentation here. So that's really important to get if you have another group who will be a support engineer, so you will have to create another group on your active directive, right? Here I.01:15:10I want them to be super admin, give them all the power.01:15:27So they have to do it with responsibility. If they break something, they will have to fix it. All right, so let me save it and if you got everything right, it will be it and last step to save, ok? And that's it. If, if you got to this point.01:15:31Your LDAP integration is finished. Later on you can do other things, but let's go ahead and test it. Go back to this page, refresh it. You can see now the locking domain has changed from local.01:15:50Or are not showing up at all to our LDAP. So I go ahead and test with the user that I have in here.01:16:10John Doe and the password, and here he has the ability to get in and do whatever he needs to do. He can.01:16:19Go in here, you can create a local admin account, you know, do upgrades and all that stuff that we need to do here. So that pretty much a short and and sweet demo I would like to show you.01:16:34Hopefully it will give you some good information where to get started with this, but we always recommend, right? After you get down the road, you must, you know, spend some time to think about.01:16:51How much you want your environment to be secure because with LDAP or a engineer who has access to this active directive, right?01:17:08He can do a packet capture and look at the username and password. It will all show in there and it will know it. So it depends on how much security you want to put in there, we always recommend you.01:17:23Do the best you can to protect your environment. Mostly, the attack is from the within, right? The people it's inside. So nowadays we have every, every device even now home right connected to internet. So it's kind of really dangerous.01:17:39For us to be able to close every gauge, every door that we have to the internet and I don't know how many home lab work like home lab setup you have at your house but for me I have a honey pod.01:17:57Just using a Nexus 9000 V and open that port 22 through the entire world. And every day I look in my lock and I see at least ten people from ten different IPs trying to.01:18:13Get into my nexus 9000 V and I kind of running a script just do it once a day, you know, go into my nexus 9KD and then check to see if that IP is new, is this new and they try to get into my.01:18:29Switch and fail the authentication that just go ahead and add them to the ACI list. That's a really nice things for me to take a look at and see how dangerous this is to open the the port for everybody to come and try.01:18:50They will try, they will try until the success so I don't know when we're going to have our nexus dashboard connected to the entire internet but it will be very, very, very, security issue that we will have to deal with because.01:19:07We know, we all know, they will try. This is totally different from what we usually ask our customer to oh, sorry I stopped sharing for a second.01:19:25I think I shared a wrong screen again, three, alright we have a inter site, ok?01:19:42That is a gateway for us, Cisco, to share information about your deployment with you. So this have to go through internet.01:19:58And this is totally different from what I was talking about on my Nexus 9000 V, right? At my home, I want the setup to be really simple and easy to maintain, so I just kind of have a virtual machine that's a nexus 9000 V.01:20:14And I opened port 22 on my router and whoever want to scan my home IP and do things like that, they can't do it because I I see it fun looking at it. But your system here connect to the internet and I don't know how it's going to get to, but here inter site.01:20:30Sometimes we ask you to share the information with us, but it's just a tunnel, it's just like a VPN tunnel, so your data only you and us, you know, when you share with us, NO other people can get into this tunnel and and try to get that kind of information, but just giving my.01:20:50With that.01:21:10And I hope, you know, my, my demo is helpful to you. I will turn the ball back to Michael so that he can help wrap it us up. Yeah. Awesome demo there, very informative. Let me start the.01:21:11Let me start the the final Slido survey there. So if you guys have Slido open, if the folks on the call have Slido open, they should be able to navigate to Slido and answer that one on one satisfaction consultation survey. If you do request a one on one CSS consultation.01:21:31I tried to make the instructions as you know easy to understand as possible. We would need your email address. The only people that will be reading the email address are us at Cisco when we go through the post expert insights series analysis. We'll gather up all those email addresses. We'll send out, we'll send out a reach out.01:21:50Email to to those folks and then we can plan a one on one consultation at your leisure whenever you're free.01:22:10And I did want to plug the software strategy mastery series that we have currently going on for Cisco and ACI and ND. Specifically this this session, this expert insights series session was part of that particular strategy mastery series. There's one more coming up in the middle of July.01:22:16Why, and then I believe there's a Q and A open floor type of open question and answer session.01:22:36Sit session coming up as well, where customers and partners and even internal Cisco folks can join and they can levy questions to our customer success specialists and those specialists will, you know, respond and answer maybe maybe it requires showing their screen or maybe a quick demo or something like that. So we definitely have that coming up.01:22:44I posted the tiny URL link into the Webex chat. If you're interested, there's also that QR code on the slide.01:23:04That's currently displayed, so you have two different ways to, to, to get there. And these slides will also be uploaded to Cisco communities as well as the recording of the call at the calls conclusion. And now we'll wrap it up here for us folks. We appreciate you spending, oh god close to an hour.01:23:12Four and a half here with us. We went through some, some general security practices here with our awesome presenter, Irene and then got shown a quick and easy LDAP demo from Dave.01:23:32Yeah, this has been expert insight series, security best practices here for our ACI and Nexus dashboard. We thank you so much for joining and hopefully we'll see you on the next one. Thank you so much.01:23:42