In this video, we're going to take a look at the creation
of security groups.
Now, there are some security groups that exist by default,
and certainly we can leverage those,
but I also wanted to walk you through in
the TrustSec workflow how we can create security groups,
and look at the properties of those groups.
And here we go.
One of the features that I've really
come to enjoy and appreciate inside of ISE
is the ability to use their work center.
So if you hover over work centers, they kind of line
everything up to make it pretty easy.
So hovering over work centers, let me go to TrustSec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So hovering over work centers, let me go to TrustSec.
And then we could click there.
And then all the subtabs here are the same
that we could just go right from that work center view.
So Overview, Components, TrustSec Policy, et cetera.
And what I want to do is start here with components,
and take a look at security groups with you.
So these are the security groups.
These are all here by default. We
can use them, or not use them.
We can create new ones.
And I just want to point out for the SGT
here, like for auditors, it's number nine.
And for BYOD, that group, it's number 15. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And for BYOD, that group, it's number 15.
And for contractors, it's five.
So basically, there's a unique number for each group.
That way when you put devices into that group
and they start being identified and putting
in frames and packets into the network,
they're going to include--
in the CMD field of those frames,
it's going to include that security group tag number.
And that way, the end device, who's
about to deliver the final packages, can say,
you know what?
Sorry.
I can't do it.
You're trying to go from group 5 to group 10.
And that's not being permitted by the policy.
Coming up, we'll get to that policy.
So regarding security groups, let's go ahead and just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So regarding security groups, let's go ahead and just
create three new security groups.
And to do that, we'll click on Add.
And let's call this ISE-Admins.
So we could create groups for any reason.
If we wanted to, like for example,
put all our thermostats in our building into a specific group,
we could do it.
If we wanted to put all our web servers
in a certain group, or DNS servers in a certain group,
we could.
And that way we can control access between groups, and also
within the group based on the access control
list for those groups that will implement. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
list for those groups that will implement.
So I'm going to make one for ISE-Admins.
And then we can either manually assign this,
or we can dynamically assign the security group
based on the authorization policies that we set up.
So we'll create an ISE-Admins group.
And that's it.
I'll go ahead and click on Save.
And so there's ISE-Admins.
Let's make one more security group.
And we'll call it ISE-Ops.
Any list down here, it's going to automatically assign
that 17 for us.
It's just picking the numbers.
And we'll click on Submit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll click on Submit.
And let's create one more.
And let's create one for PCB.
And I'm just going to throw my--
not my Kali Linux box.
Where's my mind?
I'm going to throw my Raspberry Pi into that group.
And I'm going to connect it to our lab network
so I can have a third device to play with and verify from.
It's going to get 18 as the security group tag.
So boom.
We now have three new security groups--
ISE-Admins, ISE-Ops, PCB_PCs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ISE-Admins, ISE-Ops, PCB_PCs.
So what we have so far are just some security groups.
Now here's what a security group does for a living.
It's just stands there unless you make it part of the policy.
So here's the overall plan.
And I'll step you through the individual steps as we proceed.
We are going to create some rules.
They call them security group ACLs,
also sometimes called scaleable group ACLs.
But in either case, these are simply
rules about what we want to allow either
between group A and group B, or what we
want to allow within a group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want to allow within a group.
So that's what we get to do in the next video is
we will create some security group
ACLs that then in the subsequent video
we can apply as part of our policy.
We can control the access between groups or within groups
based on what network protocols we want to allow
between or within those groups.
I'll see you in the next video.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.