Now that we understand what DNA Center really
does, how it operates, it's time to dig
in to that SD-Access fabric section a little bit more.
What we now need to talk about is,
what does it bring to the table in terms of security?
What we're really talking about is
something called micro segmentation and macro
segmentation.
And how we interact with it, deploying policies
into the network, that's really, really cool
and one of the most useful things
that we can do with DNA Center.
So let's talk about how micro and macro segmentation
works and, really, the magic under the hood, Cisco TrustSec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
works and, really, the magic under the hood, Cisco TrustSec.
Let's get going.
Now, look, fair warning, what I'm about to show you,
what I'm about to describe to you
is going to sound like voodoo witchcraft magic.
You're not going to believe that this is real,
that this is what really works.
But this is what is being deployed in production
environments right now.
You see, in the previous Nugget, we set up this idea
that we could deploy our intent, and that intent
was based on some user information.
So we said something like users in group A WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we said something like users in group A
could or could not access users in group B.
So let's say they could not.
We'll prevent that from happening.
Users in group A could not access users in group B.
But let's add a layer to it.
Let's say users in group B were permitted to access servers
that we've identified in group C.
So this sets up our first business intent,
and it's all based on users.
And Cisco DNA Center is able to implement this intent
across the entire network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
across the entire network.
But it gets way, way cooler than that
when we start talking about the software-defined access fabric.
So now picture for a moment that we are on a college campus,
and we have a few buildings.
We'll call this one building A, this one building
B, and this one building C. And let's say
on each of these buildings there's
two floors, a first floor and a second floor.
Now, pretend for a moment that we
have user A. User A, based on this pink color here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have user A. User A, based on this pink color here,
is in group A. And on the second floor,
we'll say we have user B. User B, based on this color,
is in group B. When user A plugs their computer
into the network, or maybe they're
using a wireless device, whatever
the case is, they plug into the network,
the first thing they have to do is type
in a username and password.
This is going to be using something called 802.1X,
which you're going to learn about later in the course.
Just trust me on this, this is how
they can access the network, by typing in their username
and password the moment they attempt to connect.
Cisco ISE handles that authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Cisco ISE handles that authentication.
It tells them, yes, you're a valid user,
you're allowed to access the network.
And it communicates this information back to DNA Center.
And this is where stuff starts to get really crazy but really
cool.
DNA Center can identify which group they belong in.
And when it identifies what group that they belong in,
it places them in a virtual network.
A virtual network is a fully functional network,
but it's completely isolated from
all other virtual networks. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all other virtual networks.
So when user B goes to access the network,
too, maybe they plug in to their computer here,
they get authenticated to ISE.
ISE communicates that information back to DNA Center.
DNA Center says, great, I'm going to place you
in a different virtual network.
Because these are completely isolated networks,
these two users will not be able to access each other.
Under the hood, this is using technologies
that are really called VRFs.
And a VRF works kind of like a VLAN, but it works at layer 3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And a VRF works kind of like a VLAN, but it works at layer 3.
When you create a new VLAN, only participants within that VLAN
can communicate to each other, unless they get routed
from one VLAN to the next.
VRFs are exactly like that, but it's for routing.
So only devices that are within the same VRF
can communicate to each other.
But wait, there's more.
Outside of the fact that from a security standpoint,
these devices are now isolated, these users
are now isolated from each other.
One of the cooler things about SD-Access
is that it implements other technologies WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is that it implements other technologies
to help this user's experience.
User A here can now migrate or roam
through any part of the campus.
And it will maintain the exact same IP address
and participate in the exact same virtual network.
Under the hood, this is using a combination of technologies
called LISP and VXLAN.
You don't need to dig too much into those technologies.
You just have to trust that this is what it's doing,
that user A can now migrate anywhere throughout the campus WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that user A can now migrate anywhere throughout the campus
and maintain connectivity and permissions
within the same virtual network.
And the same goes for user B. User B can migrate anywhere
throughout the campus and maintain the exact same IP
address, the exact same connectivity
through the virtual network.
So coming from a security standpoint,
understanding these virtual networks
is actually a very big and important thing to do.
So if this gigantic circle represents our entire campus,
we've now set up that may be divided down the middle,
we have a virtual network here, and we also WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we have a virtual network here, and we also
have a virtual network here.
Segmenting our users, separating our users
based on virtual networks is something
called macro segmentation.
So really, under the hood, when user A goes to log in,
ISE can identify, oh, that user is part of the HR users group.
So HR users should be placed in the HR virtual network.
Similarly, user B, over here, may be an IT staff member. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Similarly, user B, over here, may be an IT staff member.
And IT staff members might not need access to HR resources,
like other people's pay.
So when user B goes to authenticate via ISE,
ISE will be able to say, oh, this user
is in the IT users group, so they
should be placed in the IT virtual network.
This is the first way that we implement macro segmentation.
And before I even get into micro segmentation,
I want to show you what this looks like within DNA Center
and how easy this is to actually deploy.
So let me bring DNA Center up real quick,
and I'll go into Policies. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'll go into Policies.
And right here on the very end, I'm
going to click Virtual Network.
So if I click on the HR virtual network here,
do you see how easy this can actually be?
Within ISE we create users and groups.
DNA Center is able to sync our group names directly from ISE.
And all we have to do is create a new virtual network,
and drag and drop those users over into the virtual network.
That's it.
The next time an HR manager goes to authenticate to the network,
ISE will tell DNA Center this user, who is an HR manager, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ISE will tell DNA Center this user, who is an HR manager,
has successfully authenticated.
And right here, they'll just be dropped right
in the HR virtual network.
Same thing goes for IT virtual network,
we have domain administrators and help desk here.
These groups were synced directly from Cisco ISE.
But it gets more granular than that,
because within virtual networks, we can have multiple groups,
like you just saw.
We saw we had domain admins, and we saw we had help desk.
Here's a scenario for you-- could you
see a situation where help desk would ever need access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
see a situation where help desk would ever need access
to the payroll servers?
Probably not.
But I could see a situation where
the domain admins would need access to the payroll servers.
So now what we can do within the virtual network,
we could create even more granular policies.
Like the domain admins can access the payroll servers
but help desk cannot.
This type of policy that exists within the virtual network
is called micro segmentation.
So if I hide the text one more time,
I can bring DNA Center back up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I can bring DNA Center back up.
And we can show you under the group-based access control,
we can look at policies, and deploying a micro segmentation
policy is as simple as looking at the source
right here and the destination here
and seeing how they match up.
You can see if I hover over this,
this is how we can implement a policy.
So should the domain admins need access to, say,
the employees' resources or people in the employees user
group, all I have to do is click on the box
and set my policy here by changing the contract. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and set my policy here by changing the contract.
We can see I can deny it, I can deny and log it, permit it,
permit it and log it.
And I can do some other things, too,
like changing DHCP or allowing it via web access and so on.
So we can implement macro segmentation
by defining which virtual network should exist
and who should be authenticated to that.
But then we can implement micro segmentation
by choosing which groups should be allowed
to access which groups within a virtual network
in the first place.
So now, think about this journey for a second
about what SD-Access and what DNA Center can really WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
about what SD-Access and what DNA Center can really
bring to the enterprise.
Now we have simplified what it takes
to implement hundreds or thousands of network devices
because all we really have to do is define what our business
intent is.
We specify our users and who they should have access to
and what they should have access to.
And for the most part, DNA Center
can go out and automatically provision
all of the devices in the network to behave in this way.
Our in-node devices, our edge-node devices
that people plug into now will communicate to Cisco ISE WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that people plug into now will communicate to Cisco ISE
and learn what virtual networks and what VLANs should
this specific user be in.
And beyond that, using technologies
like LISP and VXLAN, our users can now
roam throughout the entire campus
and maintain the same connectivity
and the same segmentation policies
that we've implemented.
So that is what SD-Access does for us.
In the next Nugget, we're going to talk
about how DNA Center really deploys all of this magic.
I hope this has been informative for you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I hope this has been informative for you,
and I'd like to thank you for viewing.