What’s New in ISE 3.4 3

Oh those who have registered for that event. As many of you are looking into your current ICE deployments, we'll 1st be diving into what's new.00:00Do an ICE three.four and three.five and after the short break, we'll continue by focusing on upgrade planning and best practices.00:20Our goal is to ensure you have the roadmap and tools necessary for a smooth transition to the latest versions of ICE and we're aware of the new features and functionality available to you. To lead us through this deep dive, I'm joined by our presenter from our customer success specialist team, Mac Williams, and our demo specialist Omero Ruise.00:28Before I hand it over to our presenter, we want to make sure this session is as interactive as possible for you and we want to hear from you. We'll be using Slido throughout the session to gather your questions and address the topics that are top of mind for you. Please take a moment to join us over on Slido using the event code one seven.00:4777580.01:06And the passcode ice Feb 26, which should also be up on the screen. You can use the QR code or manually go to slido.com to enter that information in. During the session we asked that you utilize the Q and A panel within Webex down to the bottom right. You may have to hit the three dots to bring up the Q and A panel.01:09But we do ask that you refrain from using the general chat box as the panelists will just redirect you over to the Q and A box.01:29Your in input helps drive the flow of these modules, so please don't be shy with your questions and without further ado, let's get started. Mac, it's over to you.01:37And you maybe muted Michael.01:56Welcome everyone. Sorry, that's how we always start off with a mute. Well, welcome. I wanted to let you know that we are going to cover three.four and three.five and the features that are in there and help you to understand how you should select the proper version.02:01Version for whichever deployment you are looking for in ICE. One thing that I would like to say is we appreciate your feedback from the Slidos and.02:19What we're gonna look at today is upgrading, planning and best practices and how we would upgrade ICE. So one thing I always like to start off with is why would you upgrade? Most of the time we usually are upgrading because we want to make sure that we are, you know, in sync with the normal features that are, you know.02:31Are Included in the products as they are released. But when you think about why you wouldn't want to upgrade, today we're encountering a lot of different changes in technology. In fact, if you think about this from a standpoint of where we are now, we've seen major.02:51You know major pushes in AI, we've seen agents that people are using to even some of the nefarious agents out there attacking and doing things in IAI. We've also seen.03:10That in the past, security, the security footprint needs to expand in order to protect our environments maybe we are used to on prem solutions. But now we have users that are in the cloud. We have users that are roaming all over the place.03:26Place and so what we're trying to do is make sure that we are able to secure our environments and we need to be able to use our tools and be updated on what's happening out there in the wild. So that's kind of why we want to upgrade, right?03:46You know, in the past, we may have been comfortable running, you know, a certain version of software and maybe we got familiar with it and maybe we're a little nervous about that, so we're gonna try and alleviate those fears for you today to help you understand why it's important to upgrade. And so this is kind of our agenda for today, and then 2nd.04:04The part of we're gonna talk about how you would plan and prepare for an upgrade. Sometimes that can be a challenge for us as well, trying to figure out where we should.04:24Where we should, what we should do, how we should determine it, how we should plan for that. And then we're gonna talk about some of the post upgrade tasks. So, what does ICE do for you?04:35Well, the, before, before we get into what ICE does, let's talk about what ICE is. ICE is a tool that can help you identify and enable.04:52Your zero trust solution in your workplace environment. It allows you to provide a secure network access for every user and device with visibility and control required for the security of your enterprise environment. So let's what we're, what we mean by that is you may have users that are roaming all over.05:09You may have users that are on prem, you may have endpoints that are not users cameras.05:29You know, devices that need to be authenticated. What will we do if a someone gets into a device and or unplugs a device and plugs in a workstation? How would you handle that? These are things that ICE is designed to help you resolve.05:37So.05:57In your enterprise environment, ICE will help you to deliver the complete visibility that you need for identifying, classifying, and assembling the necessary contextual data about your users and the endpoints. It's gonna help you authenticate and authorize them based on the needs of their roles and functions.05:58ICE provides network segmentation also to align with the least privileged security concept. And ICE makes it simple and easy to allow authorized network communication around your endpoints, and it's also blocking everything else.06:18According to your existing identity services for your users, so you establish these policies and then you're able to enforce them. And then you can also integrate that with your active directory or your authentication tools and mobile or enterprise device management applications. And so.06:34This helps you to provide the granular segmentation in your network access edge and eliminates the need for additional security appliances. Complicated infrastructure configurations or expensive internal firewalls.06:54And I also, shares this contextual information with user and device information bi directionally with other Cisco security products and other security technology alliances, partners. So by sharing a user, by sharing the user.07:11User and device information with these additional security products and services.07:31In ICE, it helps you to assess and correlate vulnerabilities and threats for an automatic rapid threat containment. So as these of 3rd party devices, all these tools are working together. You get all this contextual information that's tored in a database and then you can use ICE to create policies that you are able to enforce.07:37Using all these tools. So in this section, we're gonna discuss a few of the key things that are important when you're planning and preparing for your upgrade. I have a sli quick Slido question here that I wanted to ask.07:58So what percentage of your security breach breaches from last year of sec, not your security breaches, but of security breaches in general from last year do you think were attributed to outdated software?08:16Looks like we're getting some responses here.08:36So according to a lot of the reports that we've evaluated from Sophos and other entities that, that watched this, there was between 32 and 48 % of security breaches from last year were attributed to outdated software. It's almost nearly half of them are.08:46Related to some sort of outdated software, and that number increased.09:06Over the last year by 52 %. So, in one year we had over a 52 % increase in these types of attacks. So as as you can see due to the perponderance of.09:11AI and and of nefarious AI agents and things like this in the wild, some of these attacks are being automated. So how are we gonna respond to those? Well, that's what ICE can help you do with this with rapid threat containment. So.09:28And this, so as we move forward here, according to these feature enhancements, it's important to mention that if you upgrade to a newer ice version, often we're covering some of these new features and functionalities that can help improve your.09:45Security to help improve your network management.10:05E.g., well, if we talk about ICE three three, that introduced features like upgraded GUI, which made it easier, access to the GUI through HTTPS and had some features for TLS one.three and certificate authentication for API calls and the likes. So we are constantly responding.10:09And trying to be forward thinking in these threats and how we respond to them. So while these security improvements are always a must, Cisco does understand the importance of implementing constant fixes and that's what I'm trying to point out here is that we are addressing these security vulnerabilities and exploits in older versions of.10:29As well.10:49And we're reducing the risk of security breaches by doing that. Also, something else that's relevant is that we're always trying to include bug fixes that can help us to improve the overall stability and performance of the ICE deployment. And one thing that I like to mention as well is that we.10:50Also, when you upgrade to the supported version, a lot of times there are a lot of fixes in the GUI that make deployment or under or creating policies even easier than it was in the past.11:10Kind of streamlining the process and making it more intuitive. So when you upgrade to a supported version, you're ensuring that you're accessing ongoing maintenance and security updates, and it's gonna help you ensure that your deployment is gonna be compatible with future technologies and network requirements. And that's really important.11:25Because, we want to be able to use all that contextual information that we get from our other tools to help us secure environments.11:46So that being said, we're gonna talk about a few things in the life cycle, software life cycle. So, which, what is the state of my, current version of software? That's something that you want to evaluate, and we do have health checks that.11:56That we perform for our customers, where we can come in, we can look at your ICE deployment, we can help you understand exactly where you are, what state you are in and what we would recommend. There's also something that comes up that sometimes it's called ICE meltdown. This is where you build ICE to your current environment.12:16And then your environment grows because your organization gets larger or you gain more customers or you have more traffic increases in your environment and then you need to kind of right size ice for that deployment. So there's things like that that we have to keep track of. And it's important.12:36And to review these and that's what that health check can help you do. And then also it's important to review your life cycle. How old is your software? How current are you at responding to threats? How how are you able to respond to threats, current threats? And then there's also important dates regarding the.12:56End of software maintenance and end of support. You don't wanna have software that's deployed that is NO longer supported because it's aged out of life. So we want to make sure we're covering that as well and make sure that we can get the maintenance and support we need in the event that we need assistance. And then.13:16We have Cisco suggested versions when you go online and you look at the downloads for Cisco ICE, you will see that there is one with the star there. That is the suggested version that we recommend that everyone be on at that particular point in time. So we recommend that you also.13:35Keep abreast of those. So ICE release cycles prior to ICE two.seven, there were odd versions which have, we call those short life cycles. So the ice release dates.13:54On those were, three months and then it would be like a half year or a year for end of life announcement from the end of life announcement. Then about a one year, one and a half years past the end of life announcement, then we would have what would be called the end of software.14:13For maintenance. So at that point you're not able to get software support for after that one and a half years unless you have a special contract or some sort. And then at the end of two years, that's the complete end of support. So you can see as time passes, to.14:33Certain versions will age out and that's kind of what we're showing here on this slide that if you have any of these versions running, make sure that you have one that you can actually get support.14:53And four because from time to time we do put out patches with updates that will help you to stay stay current. So these are the long term releases. These are four years, those are the even numbers versions. So when you see those.15:05The ice release date, it'll be out for a year, six months to a year, and then we have an end of life announcement after about a year. And then, and then there's the end of software maintenance announcement at two years, so.15:22You can see, at the end of four years, we're going to end the support for that software, so if you have any of these older versions like 2324, you really are at putting yourself at risk in your environment and you probably should be looking to get some assistance to help upgrade those or.15:41Upgrade them yourself. And you can see here we have ICE three.two.16:01That, end of software maintenance was, is 30 November 2027. So if you go on our site, you'll see that we recommend that you upgrade to three.four.16:08So that's the current current version right now that we recommend, but you will see that also that just looking at the chart here that there are some versions if you're running three.O or anything earlier than that, you probably want to be looking at.16:22Really trying to get off of those software maintenance off off of those, those versions because the software maintenance is aging out.16:37So starting two.seven, there was NO more short term releases and long term releases. We have a new release cycle. Those are for the new versions and so we really recommend that you get off of those older versions and move to the current versions.16:52That we have in place.17:12So how do you know the advantage of each version? Well we have to go look at the release notes. So those release notes are listed online. You can go when you go to the software.cisco.com site and you look at the versions, you will see that there are release notes listed.17:20In the top right corner that you can click on those and read those and see what's in the release notes for the particular version that you're looking for. We also have videos, we have webinars and we also have blogs that also talk about, talk about these.17:40And the the focus on is an important point is not on why the versions exist, but how to, how to jump to the versions that you need because it depends a lot on each customer and what features you're gonna be turning on, what you're gonna be using.18:01And so that's something that we, that we recommend that you research looking in the release notes.18:21So, why is there a suggested version? Well, the, the major, the reason we have these versions is because of the features that we have that are released and that's what we're gonna go over today and some of these suggested versions.18:29Are going to protect you from some of the more current threats that are out there in the wild. It's also.18:49As I mentioned, we recommend you go to these golden star releases, and we're gonna consider what some of the important things are to consider when you are looking for the version that you should use and how do you make the right decision?18:57So let's talk about some of these features. So in three four, there are some really key enhancements in the golden Star release. There's a Cisco ICE resiliency.19:15Use cases. Cisco three.four introduced a feature for alarms for excessive radius network and endpoint communication, and that's to help enhance resiliency. It's important to note that when you are using.19:32When you are authentic, when a user is authenticating, they authenticate once at the beginning, but if we have to change in the future, if the user changes their stance in the future, how do we make sure that they're only accessing what they need to accomplish their job? So we have these.19:52Policies that provide periodic checks to make sure that the user is who they say they are. And then we have, we can also, we have a feature for configuring vtis. Those are virtual tunnel interfaces with native IPsec.20:12Cisco version three.four allows you to configure vtis for FIPS one forty-three compliant IPsec tunnels now. And there's also ability to debug log settings.20:32In Cisco three four which lets you configure your maximum file size file count, and you can also reset the settings for your debug logs. Another interesting feature is identity sync. Three.four added identity sync.20:47So if you are using dual and you create a dual connection, you can use identity sync after the connection. And ICE three.four enables skipping the user data sync with dual during connection creation, and it also adds a sync.21:06Configurations later.21:26Another feature is that you have support for multiple Cisco ACI connectors. Those cu customers that are using ACI can use three.four to support integration with ACI for shared group tags. And this helps you with.21:29Your segmentation, making sure users are only accessing what they need, what groups they're in. So you create these groups in ICE, they get assigned the users when they log in are automatically assigned to that group tag NO matter where they log in from, and they belong to these endpoint groups and.21:48They can access multi fabric deployments. So this also introduces a controlled feature for multiple ACI connectors, and you can do that in a, we require it to do that in a test environment.22:08We recommend that you do it in a test environment before you, you implement in production, which is standard practice, we all should be doing that, right? But we recommend that if you enable these ACI features and set up groups that you test them before you deploy in.22:24In what in your environment. Also enforcing domain controller selection has been modified in three.four so that you can select with priority. So you can choose a domain controller that you want to be, you know, the primary domain controller and and.22:40Three.four allows you to override the domain controller selection and you can set failbacks, intervals.23:00And, in the event of a failover situation. We've also enhanced password security, so ICE three.four enhanced password security by hiding shared secrets and it also, we also added encryption support.23:08Port for network device imports.23:28Also there is a new feature for localized ICE installation. ICE three.four offers what's called a localized installation option to reduce your installation time. And those of you who have installed ICE know that's sometimes it can take a minute for you to install, but if you want.23:32At the in the lab environment or something you you want to have nodes that are available so that you can have them on standby or you can have use that localized ICE installation feature, especially for your secure network servers.23:51And then, there's a pack less radius communication for trust sec integrations. So Cisco ICE three.four provides packless radius communication for trust sec integrations with iOS XE 17.15 point.24:07One.24:27Plus devices. And another feature that a lot of customers are in are interested in is PX grid filtering. So Cisco, has introduced PX grid filtering to help our clients re receive customized info.24:28Information from publishers, and that helps you.24:48Identify the the connections, the endpoints and helps you to be able to filter out a lot of the data that you're not interested looking at from PX grid. You can focus on enabling these clients to limit the amount of traffic that you.24:54See from them. And then there's radius suppression and report enhancement.25:14ICE three.four is simplifying the radius suppression and configurations. This is part of where I was mentioning that there is the the enhancements in our GUI to make things easy to use. So this improves your ability to support IPV six.25:21X only deployments and that's also offers a new command that you can use to set IP V six.25:41Default gateways. So, another thing that's my slide.25:51So another feature that we have in ICE three.four is the, the ease of setup. So creating a URL in creating a URL.26:07Pusher and PX Grid Direct connector is available in three.four and it lets you allows the URL fetcher and a URL pusher connector types for PX Grid Direct for your enhanced data handling. And we also support TLS one.three.26:24For ICE workflows. So ICE three.four introduced TLS one.three support for each TLS cheap servers and secure TCP syslog client flows.26:44So that helps you to configure your PX grid and also helps you to secure your environment even more. As far as the ease of use, situation with ICE, you can have a CA authority diagnostic tool now.26:58Cisco ICE three.four adds a CA.27:18Certificate authority diagnostic tool for troubleshooting certificate issues. So that's one area where a lot of customers have had, you know, challenges and understanding what's happening in their with their certificates while we have a diagnostics tool that now can assist you there.27:21And then there's hot patch details that have been added to the show version commands so you can in the hot patch details, in the show version CLI, you can learn information about the GUI. There's also on demand.27:39PX grid data synchronization using sync now.27:59We enabled on demand full or incremental data synchronization for PX grid direct connectors. And you can also open tech cases now directly from ICE. ICE three.four allows you to open a TAC support case directly from the GUI and when you're engaged.28:04In troubleshooting. And per the, we have a per use dynamic.28:23Access controlless behavior change as well. Cisco three.four displays alarms for authorization failures now, and this is because there were missing dackles in the dashboard.28:30So this will help you with your troubleshooting efforts as well. And, I mentioned this earlier, the GUI enhancements, but now there's single click endpoint details, so you don't have to dig down and try to get to a specific endpoint, you can just single click the endpoint.28:46And then you can see column preference and retention and.29:05As you get familiar with it, you'll find it's easier to use to understand, you know, what your endpoint details are. And one thing that isn't important is that for those of you that use APIs.29:11The API experience has changed. There's a new session directory topic available for using, for use with PX grid. We introduced a session topic all.29:28The Topic for publishing events on sessions without IP addresses using PX grid. Also the upgrade process has changed. The automatic well, the automatic log bundle generation.29:43Is happening now on when you perform an upgrade. The benefit of that is that ICE will automatically generate this mini log bundle when you need to troubleshoot now, you can just pull that bundle up and see what actually happened during your upgrade.30:01So the fact that that's generated automatically helps helps a lot. And then also your backup log improvements from Cisco ice, are from the Cisco ICE CLI, the command line interface.30:21Is updates the backup log command as well and it includes all the backup log options that you find in the GUI now. So.30:39These key enhancements are are really helpful. They help, they're really critical, they help us to be able to have, more control over what's happening in ICE and also give us more visibility into.30:54What's happening in our environment. So let's see here. So now let's talk about, oh, one thing I forgot to mention here is, the patches. So the patched.31:11Two for three four, it covered software reliability remote support authorization, so let let's say administrators to authorize Cisco tech specialists for secure remote access for troubleshooting. There's time restricted debug.31:27Log enabling.31:47Those who are using blast ra blast radius, we fixed the vulnerability in the blast radius and three.four patch two, which adds a checkbox so that you can enforce message authentication validation for external.31:50Radius responses. And then there's support for tacacs over TLS in patch two which enables TACACS over TLS authentication with certificate attribute validation for and to increase your security. And then the API keys and certificate authentication.32:07Support is available now for tenable, security center. So those of you using tenable, you can port your AP API keys and your certificate based authentication for tenable, security center integration.32:27Again ease of use is listed here, but we also have enhanced in point topics. We talked about that for PX grid, and then we also now offer support in patch two. We added support for osq query conditions, so.32:44We can query we can support OS query conditions for your endpoint posture compliance and attribute retrieval.33:04Now we can go to 3435 and it's important to remember that not only does, do these features carry over into three five, but we also have additional.33:12Highlights in three five which we're going to consider now. So the three five release date was in late September of last year and we introduced a lot of significant advancements in security cloud integration and scalability. You know, as we mentioned, users aren't just on prem anymore.33:28Where they're everywhere, so that means we have to adapt. And so this release focuses on three main pillars. Those three main pillars are identity, security enhancements and superior device classification. So basically we're talking about profiling here and then platform.33:48Resilience.34:08Excuse me. So the 1st, let's take the 1st one security identity enhancements. So we've expanded on TLS one.three that we saw in one.four, and we've also continued that same trend in three.five. ICE three.five is broadening the use of.34:10TLS one.three across the platform and we're providing even stronger encryption for traffic entering and leaving the system. So it, you know, you have TLS one.two.34:30That still remains for default for compatibility purposes, but TLS one.three can now be turned on and enabled for more secure communication. And if you're familiar with tLS.one.three, you know that there's a lot more.34:41Security inside of the packets itself so that identify the user. So, that, and the encryption in there is, is much stronger, so that helps you secure your environments even better than.34:58You could with one.two. Microsoft entra ID.35:18Azure ID Active directory device authorization we built previous we built on our previous user based authorization and now ICE three.five is gonna support authorizing devices connected.35:24Via EAP TLS or.35:42Teep TLS based on their entra ID attributes. So that's a feature that you can use as you're moving away from what is considered legacy now Active directory. And if you decide to move into Microsoft entra ID, we have support there on EAPTLS and T.35:45TLS using those entra ID attributes. So that would be example would be like managed or compliant and the owning ownership. Also there's continuous monitoring of entra attributes. So, you know, just as you get in that.36:05Doesn't mean that you're good to go. Indefinitely. We can, or we have to be continuously monitoring to make sure these attributes haven't changed. So ICE can now continuously pull entra ID.36:25Contra ID for changes and device or user attributes and we can trigger a change of authorization automatically if the device status changes. Active directory account lockout prevention is also available for TACACS plus, so.36:39Previously, this was only available for radius.36:58And that feature now protects Active Directory accounts from being locked out because of a failed TACAX plus authentication attempt. Maybe someone forgot their password they can't get in, they have a bunch of attempts and then they get locked out. So by stopping requests and the TACAX plus.37:01We can, we can get there before they hit the active directory threshold that would lock them out. As far as advanced profiling and IoT visibility, we have cloud multi factor authentication profiler.37:19This new cloud based profiler uses a continuously updated fingerprint database to automatically classify devices by manufacturer, model of OS and type with much higher accuracy. SNMP version three endpoint profiling was also.37:37A feature that's added as to help with profiling and understanding.37:58IoT, ICE now supports SNMP based scanning, including SNMP version three to identify and profile IoT devices. So this would be your printers and cameras, those that are.38:03That don't support, you know, traditional eight oh two.1X authentication. And then, we simplified the custom profile, so a redesign structured interface has made it easier for you to create a custom profile and assign MFC labels.38:19Scalable platform improvements include, that's a 3rd area that we were talking about scalability and platform improvements. So we increased the network device scale. The supported number of network devices is doubled now. It used to be 100000, now it's 200000 for radius and TACX plus the.38:39Time environments. Red Hat OpenShift support has been added and ICE can now be deployed on Red Hat OpenShift platform, and that gives you the ability to have more flexibility for your containers or containerized environments.38:58Excuse me. So, and I mentioned that there were some changes to upgrades, so now the upgrades are running much faster and your installs are much faster and that's because of some improvements that were made in three.five to the aid OS. Now.39:16Now based on red Hat eight.ten row 08:10.39:35And we've reduced insulation and upgrade times by up to 20 min. So that's very welcome. And IP version six single stack is, support has been expanded across the admin portal for some of the common services and key profiling probes.39:41And when we're on the subject of integration and licensing, secure API authentication has been added as well. So PX Grid now supports API keys and OAuth two point oh, which enables you to have integrations with some of your 3rd party platforms like.39:58The CrowdStrike or Defender or Okta or whatever, Okta or whatever OAuth two point oh.40:18Application 3rd party applic platform you're using for your endpoints, you can now use that secure API authentication in PX grid. And then your licensing consumption alignment is three.five introduce the clearer reporting for license usage. So licensing audit and.40:27Active session reports are gonna be even clearer to understand or easier to understand and it's important because it uses a non intrusive consumption alerts designation instead of a out of compliance message. So.40:47Consumption alerts, so used to say out of compliance, but now it's gonna say consumption alerts message whenever there's over consumption in the release, and then common policy framework. So this lays the foundation for sharing content.41:07Text contextual information like your security group tags across different policy controllers, including your sassy and cloud delivered FMC. So if you have firewalls in your environment, next gen firewalls, firepower, you have other tools.41:26ACI, you can use this common policy framework to enforce policy across your environment. So I have another Slido question for you.41:45How do you determine which ICE version you are upgrading to? Let's see what we can find out here. Gold star release. That's a good one. Reading the release notes.42:04Features, ok? We're all tracking on the right star right there gold stars in there a bunch. We're tracking on the right spot. That's awesome. Yep, gold star is really good. And release notes, I like seeing that because.42:22And and features too? Performance, business needs, end of security support. Yeah, it's really good, really good. I'm glad to see that everyone is like taking advantage of our community too. Cisco community, we share information.42:41Up there that can really help you as well. 3rd party integrations.43:01Awesome. All right, so I'm glad to see we got experienced ICE users here that are like tracking in the right direction. All right, so what these features mean for you. So Cisco, we really are trying to.43:06Have you have better control of your environment, better visibility, and we want that to be easy for you. And we recognize that everything is not 100 % Cisco, but you still should be able to control and see what's going on in your environment, right? So we have these granular policies that take all this contextual information.43:22From ICE and we ensure that you have the right access for the right users.43:42And we want you to be able to do that fast. In today's world, we have to be able to move quickly. So we have to have improved tools, we have to reduce downtime and we want to enhance our troubleshooting. So we don't want to spend a lot of time looking at things, trying to find stuff, trying to figure out how to move through the GUI. We want to make sure that we're.43:47Able to respond. So that's another reason why these features are important.44:07And then scalable security. So with the cloud 1st design, we know everyone is kind of hybrid now, everyone's using cloud in some way, shape, form or fashion. And so we need to make sure that when we are scaling our environments that we're able to support that. And so everything's not on prem anymore. And some of the ideas that we might have.44:11Living our head are kind of legacy designs, but we're kind of moving out of that now and we gotta start thinking cloud 1st designs so that's what the scalable security is about being able to handle users from wherever they are.44:31And then future ready IT, we want to stay ahead of the threats and vulnerabilities that we see. We want to stay ahead and have continuous innovation and be able to stay current and that's another reason for these upgrades.44:44So I think it's time for our demo, so with that, let me hand it over to Miro. Thank you Mark. Thank you, Mark. Pretty interesting new features, so.45:01Can you hear me right? So the features and new features introducing three four and three five described by by Mac are a lot. I will try to cover in this, the remainder of this session, the most importants so I'll start sharing.45:19My screen in the next second and make sure I shared the correct screen. Okay, let me know if you can see the screen, please.45:39Well, let me ok so Mark mentioned a lot of new features and I will start with the.45:57Now in a34 and three five Cisco introduce the ability to check if there is a hot batch installed. A hot batch is a piece of software that fixes or modifies.46:12A functionality in the application to correct a problem maybe a vulnerability. Those hot patches are required when there is an urgency to install and and remediate that problem.46:28However, sometimes when we try to apply a patch, a traditional patch on top of a hot patch, it may cause or introduce a problem. In previous versions, we were not able to see if there was a hot patch right away. We needed additional tools, so.46:44With this new feature introduced in ICE 3435, now we can see that on the GUI as well as on the CLI. In this case for this version.47:04This particular deployment, I don't have any hot patch installed so on the CLI is actually not shown, but I have an example here from the command line guide, the way it should look in case you have a hot patch. So.47:21This is how it should look. That's a good feature. Again, the importance behind this is before installing a traditional patch, make sure by checking the release notes if there any hot patch that is installed needs to be removed.47:39Now let's move to the next feature. There were navigation improvements introduced in in in the graphical user interface, which I appreciate. They have done that because we have one which is the dark mode.47:57So we can go to account settings and change for those that like a sensitive to light, they can change to dark mode. I prefer to use the light. That's one improvement.48:14The other one is changes in the graphical user interface. In previous versions, any customizations to table displays like column selection order or with.48:30Of the columns would be reset upon leaving the page. Starting three four, the preferred table settings will be saved and retained even if you switch between between browsers or devices. So you don't have to repetitively change the column width and and.48:46Organization of your column, so I have an example here. This is the context visibility endpoints. Usually I like to expand the host name column, e.g., the authentication failure reason.49:06So I can read entirely what is here, what happened on this case. In previous version, if I moved away and come back, those customizations should have been gone.49:23I need it again to expand the column, maybe reorder so I can I can drag and drop these columns and if I go away and return my customizations customizations will be gone. So this is a cool feature introduced in ICE three four.49:39I'm gonna demonstrate this with another browser, so let me bring that over currently I'm using Chrome. So I switched to.49:57H and I'm going to go to the same section I was before and we can see my column width and positions are kept. So this is a great improvement.50:15For, for all of all of those of us that like to have our table views customized. This applies also to the live log, any any table view that you can find in ICE is going to keep the recommended, not the recommended but the.50:32Custom settings. So our next feature that was mentioned by the previous section of this webinar is the TLS 1.3 support.50:48Across all features. Okay, so starting three four and three five we can by default support TLS 1.3.51:06About to settings, security, KLS 1.0 and one one are considered weak ciphers or old in the time they were the.51:23Released they were considered secure, but obviously with the past of time, these protocols have become more prone to cracking or disclosure. So TLS 1.2 and 1.3 are considered like.51:40The current standard for security. Whenever we do enable this PLS version, we will be able for ICE to support those protocols when ICE is acting as the EAP server.51:59This is basically server and client downloads for certificate location list from HTTPS servers.52:17As well as, the TCP syslog client and the LDAP client and others. Let me see where that is section is then.52:33And basically TLS 1.3 is supported on all the features now in ICE, like the admin user interface, APIs, the programmability interfaces. So when they.52:50Automation or scripts make made a call to the ice APIs it can be established as well using TLS 1.3 secures log which is configured under administration system logging.53:08If we go to remote login targets and add, when we specify the security log by default is supporting TLS 1.3 as the encryption protocol. What others PX grid integration.53:22Portals like the sponsor guest, my devices, et cetera, and any integrations that use the with like center. So that's a good feature.53:42To introduce that in IST 4051 as well that was mentioned by Mac and in the previous session was the ability to open cases through the graphical user interface, so that's, if we go to.54:02This help icon and we click on tax support. If we have a multi node deployment, we can select the node that is experiencing the problem that we want to troubleshoot and we select that node.54:19And click on open new case. Obviously for this you need a support contract eh so just consider that. The next feature that was introduced in these versions is the.54:36Active directory site preferred domain controller selection. This feature allows you to override the ICE default domain controller selection algorithm by setting a priority list of preferred domain controllers for each policy service node.54:55This feature is useful in large deployment where better control over domain controller selection, failover and fail back is needed. So how ICE traditionally selects the domain controller by default?55:13ICE performs a DNS SRV query to discover all the main controllers in the domain. So this is a DNS function. ICE then sends a CLDAP ping.55:28To those domain controllers and selects one based on site matching and availability. If there is NO domain controller available in the client side, then I select a domain controller from a broader broader domain.55:43So we can influence this by creating active directory sites and configure procured domain controllers. So how it, here's how it's done, and we will go to administration identity management, external identity sources.55:59From there, we will go and select Active directory. I'm waiting for the page to be shown for some reason.56:18It's showing supposed to be showing here. Let me log out and add blocker, correct?56:34And it was probably because I logged into the other browser. This is the 1st time I see this. Sorry for that.56:56Let's see if I can see it from here. Administration identity management. Okay. Wow, we're back sorry ok so we were to administration identity management external identity sources, active directory.57:07And, let me see the next step. Select the ICE node advanced tools, advanced tuning here. So we have our.57:26PSN. The way we influence the DC domain controller selection is by introducing a registry key with the.57:45Corresponding domain name, the value is going to be the C01 DC zero two DC zero three. This is just an example with the domain FQDN.58:01So this is how we influence a particular specific node on which domain controllers to prefer. And then we can update the value. In this case I don't have many domain controllers, so I'm just using a.58:22This as an example and and the the policy service node will use this list to prefer domain controllers. Now.58:40A priority and failed back behavior or so in this case, in case one of the domain controllers fails, we can set a value to detect this failure and recover. Try to select another domain controller and recovers.58:57So how do we do this in the same same section with another registry?59:16Key which is called I'm gonna copy that and paste it here. We can actually read the value.59:21So the the default setting is zero. If we set this value to one, we will enforce a strict priority order in the previously list of domain controllers. That means the policy service note is going to select them in the exact order.59:38I I entered it in the previous registered key, and then we have the recovery or fail back interval that we can also enter it here and read the current value Default is 100 180 s.59:58So we can change that to a value between 60 and 86400 s. So default is 180. Important notes to consider here.01:00:17This feature applies only to direct domains where the domain controllers are configured. This does not apply to trust relationship domains. This is an advanced feature, so we recommend using this feature with Cisco tag guidance to avoid any miss.01:00:32Configuration and you can monitor the the domain controller failover and failbacks activity via the operations reports, diagnostics, AD connector operations. So here, AD connections operate.01:00:52I mentioned in this small lab I only have a couple of domain controllers, so there is NO further activity to monitor here but this is where you would see the behavior if you're in case you fine tune and advance tune these settings.01:01:10Okay, so that's it on the domain controller selection. The next feature that I will demonstrate is the At a high level because I cannot do an upgrade now is the fall and the split upgrade support.01:01:28This is a new feature introduced in 3435 where now we have this screen. We can upgrade and roll back patches and the entire release, so.01:01:44E.g., if I choose to patch rollback in this case it's three five patch one. So the only patch that I am allowed to roll back is obviously the patch one.01:02:01If I intend to upgrade, I can upgrade a release or a patch as well. That means if a patch two was available I can do that here. And I can also do, the full upgrade with a patch.01:02:16I cannot do split because this is a single node deployment, but Cisco business unit for ICE has been listening to customers with regards to upgrades. We understand they in the past used to take very long time.01:02:33Complex some, we ended up calling tag to fix it so 3534 introduced a better improvements for upgrade. So I wish three six was out now so I can test and and confirm but.01:02:54It has been a great improvements on on the the upgrade process. Moving to the next feature, it's related to prevent active Directory account lockout.01:03:10Moving to that. So what was the problem? Customer using want to reduce a helpdesk help desk tickets.01:03:28Regarding account lockout from three five, ICE can query the back password count attribute from active Directory before forwarding the authentication request to the domain controller.01:03:43If the next authentication attempt would exceed the configured threshold, ICE will block the request to prevent accidental account lockout caused by this repeated failed login attempt. So how do we do that?01:03:58Eh, to start with we need to go and enable the failed authentication protection that's under administration identity management, external identity sources, and.01:04:15Active directory. We need to go to advanced settings and select this option. Prevent account lookout is disabled in scope mode and when AD is in use in a sequence, ok? I'm going to enable it.01:04:32The next thing we need to do, is to make sure that this value is lower than the current password count setting on Active directory.01:04:52Probably inactive directory is four, so this is needs to be three. If it is three, this needs to be two. So at least one below. Why? Because otherwise we would exceed the number of failed.01:05:10Passwords allowed on AD and we will lock out the account. So this is the 1st setting we need to make sure. Then in our authentication policy, this is the device administration.01:05:25We need to make sure that we are using the active directory identity source explicitly. We cannot use a source sequence or other combination.01:05:43It has to be the active Directory directly. So this is an important note. The feature is supported as well for radius. When a user account reaches the local threshold, I stop sending authentication requests for that account until.01:05:56The.01:06:16Bad password counter in Active directory is reset. Again I mentioned ensure the maximum bad password bad password attempts configuring ice is less than the active directory threshold. If user get locked out despite this feature, verify the bad.01:06:17Password account value in Active Directory and reset it. Okay, so that's it for the active directory prevention local prevention. There is a new feature as well in ICE 3.5 introduced regarding new certificate format.01:06:36The this allows or ice to handle certificate with security identifiers in the SAN without using the security identifier for authentication prevention and I could not demonstrate at this moment this feature exactly, but I can.01:06:55Show, eh, in the example of the MBN, most providers MBM include a GUID on the SAN.01:07:13Now ICE is able to retrieve that UID attribute and keep it for authentication as well or for MDM compliance checks or other reasons like posture compliance.01:07:29Eh so that feature was introduced in 3.5. Which other feature packless radius communication for in the case you have implemented in the past, you needed to provide a.01:07:44Protected access credential I think it's called it was a file that you needed to generate from the network devices below here and on the advanced settings, we needed to.01:08:02Issue an out of band pack. Now the three five supports backless so that means we don't need to issue those back eh, out of band files. That's a good feature. I think I saw a question regarding the localized ICE installation.01:08:19Eh, what is that? I'm gonna bring back my CLI. I'm gonna do it here. So we see we have here the ISO image. This helps installing ICE directly from the local disk in case we need to.01:08:38Recover the node. That's one like a major use case that I would see. Eventually at some point a node may become unresponsive may become the database corrupted that not even a manual synchronization is bringing or recovering it.01:08:58And then we contact that and that recommends rebuilding the node and rejoining it to the domain or the to the deployment. That's the case when I see this to be a helpful because in the previous versions we needed to.01:09:18Come to our virtualization infrastructure software and basically connect the ISO image to them and e.g. in this case.01:09:35We would need to connect the, the city round to the ISO in the data store and then also modify the boot options to enforce the virtual machine to boot.01:09:53To the BIOS the next time so we can boot from the disk, from the room, I'm sorry. And this will allow us allow us to reinstall ICE. It will take longer time eh, not always we can connect the.01:10:10Iso to a data store, e.g., sometimes when we have a physical appliance, we have to connect the ISO via a remote drive on our local computer.01:10:26So that will definitely take long time to install. So this localized installation of ICE will help improve the time to recover. And the way we do is by.01:10:41Doing configuration configure eyes and option 25. So there is one it is telling me to select version. I will not do because otherwise I I will break my current.01:10:58Demo, so I'm gonna quit. But this is one reason to do the localizer install is really quicker than recovering from an ISO image connected to the.01:11:15See the wrong drive. Okay, next feature we've got about 5 min left before we need to shift into the other session just as a time check. Isn't it in 15 min?01:11:31Yeah, but we need time to give everybody a break and to Okay shift into the other webinar since we've gotta change them. Thank you very much. Okay, so I think I would like to mention one last feature that is regarding.01:11:47Support natively. I I will not do the entire demonstration because we will have a webinar dedicated for that in April so look for the dates on that but I will just real quick.01:12:04Go to the identity external identity sources rest, and ID. In this case you will need some information from intra that you will need to configure an application register an application, create a secret eh, configure the.01:12:20Permissions for the API.01:12:40Eh, but once you have all that integrated, you will be able to retrieve groups from intra. E.g., I got domain admins already, so I'm gonna bring domain users. You can configure device query, this is for device authentication. This was introducing three five.01:12:42This is not in three four.01:13:02And you can select the device ID or device name and where is ICE going to look up for that identity eh you can configure whether it's the common name on the certificate or the SAN. You can see the URI is typically the URI.01:13:03And even you can create expressions to match on that identity. You can optionally use user and device attributes like UPN on the case of the user.01:13:23Eh user principal name, I think it was here and you can use that and on device attributes you can also retrieve other attributes like compliance operating system and use these attributes in authorization policies.01:13:39So if I go to my policy set and I do a new authentication policy for my intra, I can match on the certificate.01:13:58E.g. organizational unit I don't know, it's gonna be intra ID, can be a serial number, can be the issuer even the certificate serial number, so you can use many options and you can see we can select now intra here for that.01:14:19And my authorization policies I can even use.01:14:37Attributes from those from those being learned from the intra. So what is intra ID external groups? Yeah.01:14:43E.g., that's it. All right. 1 min left before we give you some time for a break and please look out for that webinar in April regarding and and try the integration. Thank you very much. Mac, if, if you could pop back up the.01:14:59The, the presentation side with the QR codes for, follow on content. I can do that.01:15:19Well max's pulling that up. Like I mentioned at the beginning, we'll take a brief break to end up this session, give everybody a time to stretch their legs, use the restroom if you need to or grab some coffee. For those of attending the next session today, follow the link as.01:15:44Part of your registration. This recording will be posted in a post session AMA forum that's gonna be open for ten days. So if you have follow on questions, those can be posted there and our panelists will be available to provide responses to anything we couldn't get to in the session, or if you have any follow on questions.01:16:00We have a few different webinars coming up in April. We've covering integrations with Catalyst Center as well as entry ID. Two different sessions on entry ID are scheduled for April, and we'll have the QR codes here to pop up in just a moment.01:16:21This slide also has a QR code for some cyber capsules, short form videos covering various ICE topics that we put out periodically. And then the last pieces you you will receive a post webinar survey on the session. Your feedback is definitely valued and and it helps us to shape those future sessions.01:16:40And.01:16:58Matt, did you get it as the last slide in the thing or in the Yeah, there we go. Perfect. Yeah, so like I said, the recording will be posted which can be followed on that left QR code registration for those upcoming events on Catalyst Center andre ID.01:17:01For the middle one and then English and Spanish versions of our cyber capsules over there on the right.01:17:21We do appreciate everyone attending today and hope to see you on our next next session in a few minutes.01:17:27