As we're building towards a working functional TrustSec
environment, we need to have security groups.
We created three of those in the last video.
Now we're going to create security ACLs, which
specify what is allowed.
And then in the next video, we'll
take a look at applying that policy as part
of our ISE configuration.
So for now, this step is let's take a look at where we would
go in the interface, and how to create an ISE security group
ACL.
And it goes something like this.
What we're going to do is under Work Centers, and TrustSec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What we're going to do is under Work Centers, and TrustSec.
And if we go to Components, that'll
get us to the right place.
And then under components, here we
have the option for security groups, which
we did in the previous video.
And then two down from that, we have security group ACL.
Now, based on the flavor and when you get to the ISE system,
there may or may not be some defaults.
I think in prior versions there were some,
but I'm not seeing any.
But no problem.
What we're going to do is we are going to create some security
group ACLs so that we can then apply traffic that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
group ACLs so that we can then apply traffic that's
trying to go between security groups based
on those tag numbers, or within the same security group.
But the first thing is we need to create some security group
ACLs.
So to did that, we're clicking here on Security Group ACLs.
And we're going to click on Add.
Now, before we also get to this point,
we also may want to consider, what's our intention?
For the lab environment, if you're just
starting to practice and getting used to ISE,
I would say the ACLs should be something
that you can verify and test, and verify
that the ACLs that you're creating and applying actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that the ACLs that you're creating and applying actually
work.
So I'm going to start off with a couple basic ones
that my lab environment can test,
like boom, test and verify.
The first one is going to deny ICMP traffic.
I'm going to call it NO_ICMP.
And in this security group ACL, I'm going to say deny ICMP.
And the syntax for these ACLs is a little bit weird,
because it's basically going to implement
based on security tags.
And then each of the switches and so forth
is tracking with IP device tracking
what the IP address and layer 2 address is, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what the IP address and layer 2 address is,
and so forth, so they can enforce the policy.
But if we want to deny ICMP, that's the way to do it.
And if we want to permit IP, that's how we would do it.
So basically, this says deny ICMP as rule number one,
and permit IP as rule number 2.
So then we'll scroll down.
We'll click on Submit.
Now, in Downloadable ACLs, there is actually
a Check Syntax button, which I'm rooting
for in the next version of ISE, because the way
to verify that it's not OK is simply looking at the log
and saying, well, yeah, that downloadable ACL isn't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and saying, well, yeah, that downloadable ACL isn't
being accepted by your switch or your network access device.
So let's make one more.
And this time.
Let's add no telnet.
And for no telnet, we'll say no TCP destination equals--
and that would be port 23.
And then permit IP.
So that's just basically saying no telnet, nothing
going to TCP port 23, permit everything else.
We'll scroll down.
Click on Submit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Click on Submit.
And now we have two security group ACLs,
one that's denying ICMP, and permitting everything
else, and one that's denying telnet and permitting
everything else.
One more check in the checkbox on the way
to implementing TrustSec.
And that is we have security groups that we created.
We also have some security group ACLs, which are great,
but next, what we need to do is we
need to implement our policy regarding where
we want to apply those, whether it's between two groups,
or within a group.
And that's what we're going to do in the next video
by implementing a TrustSec policy that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
by implementing a TrustSec policy that
calls upon the security groups and the security group ACLs.
So I'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.