In this video, we get to marry two things, a security group
and a security group ACL that's going to eventually enforce
our policy with TrustSEC.
Let's begin.
Someone once told me it's wise to have a plan before we just
start implementing policy.
So I totally agree with that.
Let's make a short plan, and then we'll implement it.
So we have three security groups that we created.
We have two security group ACLs that we can apply,
and let's do this.
Let's specify that for traffic between ISE ops going over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's specify that for traffic between ISE ops going over
to PCB-PC--
to that group-- from this group to that group.
Let's go ahead and deny telnet.
And let's also do that from ISE Admins over here as well.
We'll deny telnet.
Now, that's the logical policy.
Now, the way we would apply that is we
would go into ISE in our TrustSec policies, which we'll
do here in a moment, and we'll simply say, all right, here's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do here in a moment, and we'll simply say, all right, here's
the new policy I'd like to create--
traffic from the security group called
ISE Admins going over to the security group called PCB-PC.
In retrospect, I would've called it something easier
to pronounce.
But we can specify that for traffic from here and to there
and from here to there that we want
to apply the security group ACL, the one that's denying telnet.
We could also very easily deny other traffic
that we wanted to jump simply by creating the security loop ACL
and applying it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and applying it.
We could also do this.
What if we had two devices that we wanted in the same group--
Just imagine we had two devices that
were both a part of this security group, PCB-PC.
We could create and apply a security group
ACL that applies to those devices within that group.
So if we wanted to say, you know what?
Within the group, no peer to peer
file transfer protocols in those ports,
and so forth, and we could block them,
or we could say, deny telnet from anybody in PCB-PC,
that group going to that same group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that group going to that same group.
Let's go to the ICE interface, and let's do it.
And to get to the TrustSec policies,
we'd simply go to Work Centers-- this is probably the easiest
way to get there--
Work Centers, and then, under TrustSec,
let's go down to TrustSec Policy.
Boom, we're there.
So here under Work Centers, TrustSec, and TrustSec policy,
and then I have selected Matrix, which
is going to show us all the relationships
between every group and every other group.
So over here on the left is the source,
or where we're sourcing traffic from, and over
here on the right, on the top rather, is the destination. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
here on the right, on the top rather, is the destination.
Now, there is a lot of content here.
It's like, wow.
If you've got hundreds of groups, how do you sort it out?
Well, one way of sorting out is to click on View--
let me make sure my face isn't in the way, great--
View, and we could say Condensed without Security Group ACL
Names or Condensed with Security Group ACL Names, one of these.
I'll just go ahead and say with, and that's
going to show us only the relationships where
there's a policy and access control lists supplied.
And it's saying, you know what, Keith?
That's what it calls me.
You've got no policies whatsoever yet
so I can't show you just the ones with policies WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so I can't show you just the ones with policies
because they don't exist.
So it's going to show us everything.
So if we want to make a new policy about an access control
list, a security group access control,
between two of these security groups, here's what we do.
The easiest way is you could find the spot and click here.
That's between BYOD and Development whatever
or whatever, and you could put in the policy
right there, or much better, check this out.
Just click on Add, and then from here,
just use the dropdown, the source.
Let's imagine the source is ISE Admins, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's imagine the source is ISE Admins,
and the destination security group is going to be PCB group.
So that would represent traffic sourced from the security group
ISE Admins going to the PCB group.
And then, we get to specify our downloadable ACLs, which
in my environment, I only have two, the two we just created.
Let's say, well, we talked about no telnet.
Let's do it.
So no telnet allowed, and then, I'm looking for my--
there-- I'm looking for my Apply button, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there-- I'm looking for my Apply button,
and it scrolled down on me so I need
to make the screen just a little bit smaller.
There we go.
So we can go ahead and see it, and then click on Save.
And now, that's applied.
Now, with that applied, what I could do is click on View,
and then, go to Condensed with Security Group ACL Names,
and that's just going to show me just the security groups where
there's a relationship, and that's
between these two groups.
And I will make this a little smaller, so we can see it.
Over here we have ISE Admins as the source
going to the PCB group using the access control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to the PCB group using the access control
list of no telnet.
Ta-dah.
Now let's add another one because we talked
about more than just one.
Let's go ahead and click on Add.
And let's also limit telnet from the ISE Ops as well.
So I clicked on New for new policy.
The source is going to be ISE Ops,
and I'll make this bigger in just a second.
And the destination is going to be the same PCB group, great,
and the rule, once again, is going to be no telnet,
and click on Save.
Wonderful, and now I'll make it a little bit bigger. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Wonderful, and now I'll make it a little bit bigger.
So now this is showing us the two populated cells
that we have.
We have from ISE Admins to the PCBs and also, the ISE Ops
to the PCBs, and that's our security policy
with the access control list of no telnet going to be applied.
Now, up here, I have a message saying, hey,
there's a TrustSec configuration that hasn't been pushed out
to network devices.
I'll go ahead and click on Push, and that way the network
devices that we have configured to support TrustSec
can get that information.
Although, I need to walk through that, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Although, I need to walk through that,
too, which will be in the next video.
And if we want to go back to the view of everything,
we can click on View and then say,
Show Full With or Without The Security Group ACL Names,
and if we just want to see the ones that are ours,
we can click on View and say Condensed,
and it's just going to show us the ones
that we've implemented that have something there.
So in this video, we combined our security groups
that we made with our security group ACLs,
and we applied them.
And in the example, we applied the no telnet option
between the ISE Admins and ISE Operators WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
between the ISE Admins and ISE Operators
to the PCB security group.
Now, there is yet a slight other challenge,
and that is I haven't really configured any network access
devices to support TrustSec.
So what I've done is I've upgraded a few pieces of gear
here in my lab.
I'll show you what those are next.
I wanted to make sure we had gear that supported TrustSec
so I could demo it.
And what we'll do is I'll let you know about that gear.
I'll walk you through the configuration updates
on the network access device, and then we
can proceed further into the implementation
and verification-- it's really important-- of TrustSec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and verification-- it's really important-- of TrustSec.
So I'll catch you in the next video in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.