In this video, you and I could take a look
at the big picture of TrustSec and a few of the components
in the magic and logic that makes it work.
Let's start off with this diagram.
Let's imagine the device here.
If I say a user at that device is going to connect
to the switch-- now, if we are using MAC authentication bypass
or, better yet, using 802.1x, we can identify who that device is
or who that user is behind that device that's connecting.
And then coordinating with ISE, we
can go ahead and know who they are.
Now, in addition to just knowing who they are, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, in addition to just knowing who they are,
we can also use or leverage what's
known in TrustSec as a security group.
Think of a security group just like a logical group.
And that group can have members of that group,
or they can be assigned to that group.
And let's imagine that Bob, who is a member of ISE ops,
has been authenticated.
And as part of that authentication and part
of the authorization policy, we've
assigned Bob to this security group called ISE-Ops.
Now, each security group has a SGT number.
An SGT stands for Security Group tag, or in some environments, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
An SGT stands for Security Group tag, or in some environments,
it stands for Scalable Group Tag.
But it's simply a number that's associated with a security
group.
So ISE-Ops, in this example on this chalkboard,
has a security group tag of 19.
ISE-Admins-- and let's imagine that Luis,
when he logs on somewhere, is going
to be assigned these security group of ISE-Admins.
And that has a group number of 18.
And there's also another group right here.
Let's have a little Raspberry Pi, which in lab environment
is going to play the part of a little internet-of-things
device.
And let's imagine when it connects,
we're going to associate it with a security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're going to associate it with a security
group of PCB-PCs, which has a security group tag of 20.
Now what happens next is pretty amazing.
When those packets from those individuals who
are part of those security groups,
as they are being sent into the network,
not only does the system know who they are, but it's
going to include those SGTs, those tags for the groups
they're in.
And those are included in a little CMD
field in the frame of the packets, so packet by packet.
Packets from people in one group are going
to have the tag for that group.
Packets from devices in a different group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Packets from devices in a different group
are going to have a different tag number.
Now, the question might be, well Keith, so what?
If we're just implementing this little tag in each
of the frames from Bob or Luis or that PC,
how is that going to help us?
Check this out.
What we can do is we can specify what we want the rules to be
between these logical groups.
We could say, between ISE-Admins going over to ISE-Ops,
we want to permit these protocols
or deny these protocols.
Or from ISE-Admins going to the PCB-PCs group, we want a permit
or allow different protocols. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or allow different protocols.
And check this out.
We can even say this.
We can say, we want certain protocols or certain ports
allowed network wise between devices in the same group.
I mean, this is amazing.
So let's imagine it's Luis up here.
So Luis has been authenticated.
Luis is a member of ISE-Admins.
He has this little security group tag of 18.
And as his packets are flowing through the network--
let's imagine he's down here, and he's
trying to get to devices.
Maybe it's the server.
In fact, maybe it's this a PC or device
that is a member of this group PCB-PCs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that is a member of this group PCB-PCs.
Well, here's the magic.
This device-- let's imagine this is port 22 on this switch.
And here's the magic.
Switch z right here on this port, where device C is
connected, it knows--
and let's imagine that's port 22.
It's going to be aware of these security groups, the tags,
and also the rules.
So whatever rules are in place between 18
going to 20, which is the ISE-Admins going to PCB,
this switich is going to enforce that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this switich is going to enforce that.
And so if we denied telnet the switch where that packet
or frame is about to egress or go out to that device,
the security is implemented right there.
Now, if you think about it, we just
took security from a network perspective
to a whole other level because we
don't have to go in and manually configure access control
lists on layer-3 interfaces.
In ISE, we can implement or specify
what we want the policy to be, what the relationship should
be between this group and that group
or within a certain group.
And then as individuals or identities
are authenticated as they go into the network, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are authenticated as they go into the network,
they're given their appropriate tag.
And then when that traffic tries to get to its final destination
on the egress device, those security group tags
and the rules are going to be checked.
And that way we can implement a policy one time centrally
about who gets access to what regarding the groups,
and then it can be enforced dynamically
for us on all the network access devices.
It's pretty darn cool.
Now, what I'd like to do is walk you through,
from soup to dessert, on getting it done.
So in the next video, we'll take a look at security groups WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in the next video, we'll take a look at security groups
that we're going to leverage for security rules and so forth.
But I wanted to walk you through where
we can find these security groups,
how we can create them, and set up
the properties of these security groups.
And all that's coming up in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.