On the ISE server, in addition to having security groups
and security group ACLs and having them applied
between those security groups, it's
also important to tell ISE that our network access
devices that we're integrating with and working with
should be told about and have Cisco TrustSec enabled on them.
So that's the part I'd like to walk you
through in this video right now.
And there's more than one way to get there,
but because we're dealing with TrustSec, we go to Work Centers
and then, we go to TrustSec and Components, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then, we go to TrustSec and Components,
that'll get us close.
There we go.
So under Components, we have Network Devices,
and this is just referring to our network access device
that we've set up previously.
Switch1 was the 3560, which doesn't support TrustSec.
However, the 3750x does, and so if we
go into the details for that, here what we're going to do
is enable the additional functionality of TrustSec
on that network access device.
So this was put in previously.
We have the network device group, not security device WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have the network device group, not security device
group, that has the site1--
it's a switch.
We have the radius password that we configured on that device.
And if we scroll down under Advanced TrustSec Settings,
make sure that's checked.
You're enabling it.
I said I want to use this ID.
I put in the password, the same one
we just did on the network access device
in the previous video.
I also, this was the default COA,
which is change of authorization,
as a method for the ISE to communicate
updates and new policy down to the switch.
And in the 802.1x videos, we enabled the network access
device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
device.
It was config to support that.
I also supplied the username and password
where ISE could log in to this network access
device, this 3750 switch, if it needs to update any group tag
mappings.
For example, if there's a group that had the tag of 17,
and now it's 28, that needs to be communicated.
So I supplied that information as well.
I also set up the PAC, the Protected Access Credentials,
by clicking on generate PAC, and then
I specified the encryption key, and that's the same encryption
key that I specified over on the network access device as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
key that I specified over on the network access device as well.
So that's already in place and working.
We verified that.
And also, one of the other things we can do here
is we can click on this Test Connection, which
is kind of handy, and it'll come up
with a little checkbox saying, Yep,
I can connect to that device.
It's good.
So that work is already done.
So now, this switch acting as a network access device
is also capable of understanding and cooperating and enforcing
policy based on TrustSec and our TrustSec policies
that we looked at in the previous video.
So now that we have security groups, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So now that we have security groups,
we have security group ACLs, we have a TrustSec policy,
and we've also configured the network access device
to support TrustSec, what's next?
Next is to actually put some devices or entities
in those security groups, make sure they
have those groups assigned with the appropriate tags,
and that way we can actually test to verify whether or not,
based on security group tags, the network access device has
the ability to permit or deny traffic
based on our TrustSec policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
based on our TrustSec policy.
And that's exactly what you and I get
to do in the very next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.