For me, the implementation and verification of a technology,
including TrustSec, is a very fun thing
to do, see the fruit of all our labors
as it actually does what we expected it to do,
and if it doesn't, we look at the radius live logs,
and we troubleshoot why not.
So let me share with you the lay of the land.
We've got a slightly different topology
with one additional device, and then, we'll
implement our TrustSec policy and then verify that it works.
So here is the slightly modified topology
from our previous videos.
I've got this 3750x switch which supports TrustSec. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I've got this 3750x switch which supports TrustSec.
ISE and it are all synced up and ready to go
based on the configurations we did in the previous videos.
And I've got Bob, who is connected via Port 1.
It's actually 2/0/1 on this 24 port, 48 port-- anyway,
It's a lot of ports--
3750 switch.
And what we'll do is we'll make sure
that Bob ends up in the security group called Ops or ISE Ops.
And then we have Luis coming in on Port 2.
Again, 802.1x authenticated, and we'll make sure that he is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, 802.1x authenticated, and we'll make sure that he is
coming in and associated with a security group called ISE
Admins.
And then, this PC right here actually
is a little Raspberry Pi device.
I have MAB enabled on that port so it's going to connect.
It's going to time out with 802.1x, go for MAB,
go to the identity store.
It also is going to authenticate.
And what we can do based on its authorization,
is we can put it into a secure group called PCB_PCS.
And then, once those devices are in those groups,
the policies about who should be able to connect WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the policies about who should be able to connect
to where with what protocols should be enforced.
So to make this work, we need to associate security groups
with those individuals who are logging in.
So I think before we assign those, -3 do this.
Let's go to the switch, and here on the switch on those three
ports, I'm going to bounce all three of them.
So that interface range, going to give it 2/0/1-3, Do a shut.
Then, I'll do a no shut.
And I suppose I don't have terminal monitor on because I'm
not getting messages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
not getting messages.
That's OK.
So if we go to Operations and Live Logs,
we can actually see the details of that.
So there is Bob, current session.
There is Luis, current session, and I'm not seeing the client,
the Raspberry Pi, but that's because, if we go back to this
guy, the terminal monitor, that's because it should fail
the 802.1x, and then after a period of time, it'll try MAB,
and then, it'll authenticate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then, it'll authenticate.
And SXP is another video.
So we'll save that for another video.
It's another way of communicating the security
group tag mappings to switches over networks
that don't completely support end-to-end Cisco's TrustSec.
All right, I guess I must've missed it.
Let me click on Refresh.
There it is right there, OK.
So we've got three sessions, one from Bob, one from Luis,
and one from this guy that-- let's
just check him out real quick.
That's my Raspberry Pi, and it authenticated
on our authentication, MAB, MAB authorization rule. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on our authentication, MAB, MAB authorization rule.
Fantastic, I just wanted to make sure we
had something to work with when we start modifying our policy.
So we're going to modify our policy
by going to Policy, Policy Sets-- now,
this is different, very different
than the TrustSec policy.
So under Work Centers, TrustSec, and TrustSec Policy,
this is our matrix regarding which security groups can
talk to which security groups and what access
control lists are applied there.
This policy here is the policy sets
regarding the initial authentication
and what's supported, and if it's matched,
then we go into the individual rules for authentication WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then we go into the individual rules for authentication
and authorization.
So based on the log we just looked at, it did hit all three
of those, hit our site, switch, policy set,
which matched devices going from Site1
and coming in from a switch, fair enough.
We'll expand that, and that shows our details
for that policy set.
So we have the authentication effect.
I know that all three authenticated from the logs
so I'm going to go right to Authorization,
and that's where we'll make our changes.
So down here under Authorization,
let's just verify these three authorisation WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's just verify these three authorisation
profile we're set to, ISE Operations,
ISE Admins, and PCB-PC Authorization Profile.
To verify that, we'll go to Operations and Live Logs.
And let's check on Bob first.
And if we scroll down, ISE Operations, fantastic.
And if we go back, and then we go to Luis,
that is ISE Admins, great.
And we'll go back to this one that did MAB, and this is PCB, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll go back to this one that did MAB, and this is PCB,
and sure enough, they got the correct authorization profiles.
I just wanted to make sure that they were matching and getting
the properties and policies that we expected them to.
All right, so back to Policy and Policy Sets.
We're going to take this policy set
and go down to Authorization, and we just
confirmed that they're matching based on the authorization
profiles that they were assigned,
and to assign a security group--
hold on to your hats--
here's how you can do it dynamically is if it's ISE Ops,
and they are a member of group ISE Operations, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and they are a member of group ISE Operations,
they're going to get this authorization profile,
and if we use this option, we can assign a security group
as well.
So we can just say we want to assign ISE Ops to the security
group called ISE Ops--
we named it very similar.
And then, for ISE Admins, we want
to assign them to the security group of ISE Admins.
And then for the MAB authorization
rule and our little Raspberry Pi,
we want to go ahead and assign that to our security group
called this, the PCB-PCs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
called this, the PCB-PCs.
And click on Save.
So that says it's saved.
And what you'd also want to pay attention to
is this notification right here.
If there needs to be a push where the network access
device says there's been a change,
and they need to get it, there is
an option that often shows up here
that says go ahead and push.
So you can click on Push and push it out.
In the lab environment, I would recommend
doing something like this.
That's our client.
Let me go back to our switch.
So on the switch, we could use this command, tts refresh, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So on the switch, we could use this command, tts refresh,
and then we could refresh the environmental data,
and take a look at that.
See if there's any error messages there.
And then, we could also refresh policy as well.
All right, let me scoot you over here a little bit.
So let's take a look at some commands
that we could use right here that
could be very, very helpful.
One of the commands we show, cts,
and we could do security groups, and that would show us
our security groups.
OK, great, so there's our three security groups,
and it's showing us the actual security group tag numbers that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and it's showing us the actual security group tag numbers that
are assigned to those.
We could also do a show authentication,
and we'll type in sessions.
And it's showing us that we have three authenticated sessions
right here.
And then, we can see that one was done with MAB and that two
were done with .1x.
Another great command is show cts role-based and then
sgt-map, and it's going to show us--
if I put in the rest of the commands-- and let's
go ahead and do it for all.
It's going to show us the mappings.
And this, oh my gosh.
That security group, that's the default security group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That security group, that's the default security group
tag for the switch itself and not the clients.
Let me bounce the interfaces, and then we
should see some different information here.
So interface range, gigabit 2/0/1 through then put 3,
and then, we'll do a shutdown.
And give that a moment, and then, no shut.
All right, and then give that a moment to come up.
So we should have three because we have our policies
in place on the ISE server, and these ports are now coming up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in place on the ISE server, and these ports are now coming up.
That should trigger a reauthentication,
which the security group tags for each
of those respective groups should show up
on those devices.
So if we do a show cts role-based sgt-map all
and press Enter, oh and look at this.
No tcp destination equals 23.
I must have a typo in my ACL.
That's what that says right there.
It says, Keith, you're syntax is all
messed up with the no telnet.
Let's go fix that.
Let's go fix that right now.
So going back to ISE, we'll click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So going back to ISE, we'll click on
Work Centers and TrustSec and TrustSec Components,
and let me clean up my ACL.
Oh no, look at that.
I said no.
Oh, my gosh.
That's one of the things I said, no, don't do it.
That should probably be a deny, and I
would hope that in the future they
have a check access list syntax deny tcp destination equals
23, not no.
I'm glad I had logging on.
All right, let me save that, and let me also go up here.
And if there's a push that's needed, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if there's a push that's needed,
it usually shows up here.
Let's give that a moment.
Let me go back to this guy.
Oh, look.
It has a security groups now, or 11, 12, and 13.
However, it does not have the ACL because it was wrong.
So let's do a cts refresh policy,
and I just want to verify the ACL didn't come in wrong.
So let's do this.
Config t-- I'm going to bounce the interfaces one more time.
And then we'll do a show cts role-based, sgt-map all, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll do a show cts role-based, sgt-map all,
and there's 11 and 13.
So those are the two that authenticated via 802.1x,
and .12 my little Raspberry Pi device, and it'll come in.
And there it goes.
So .1x timed out, and now, if we do a show command, there it is,
18.
All right, so the security group tag for the group it's in
is 18.
So basically, .11 and .13 should not
be able to telnet over to .12. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
be able to telnet over to .12.
So let's verify that from the client.
In fact, we can also do a show cts role-based,
and then, we [INAUDIBLE] permissions.
Check this out.
This is also showing us that from group 16 to 18
that that access list is in place, and from group 17 to 18,
it's in place.
So let's test that.
That's the no telnet option.
Let's go to the PC, and on this PC, let's do a show--
show-- let's do an IP config.
All right, so one of our addresses here is 10.80.0.11, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, so one of our addresses here is 10.80.0.11,
and if we try to ping 10.80.0.12,
which is our Raspberry Pi, that works.
And let me just verify that that really is our Raspberry Pi.
Well, I have a terminal open with it real quick.
Do a IP adder, and sure enough, it is 12, just verifying.
And also, I want to point out that you
want to do some tests before you throw in the security group ACL
because Windows devices, when you try to ping them,
they don't respond.
There's a default firewall on most devices by default. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
There's a default firewall on most devices by default.
So if you ping to the Windows machine and it doesn't respond,
it may not be because of an access list
that you have as part of your TrustSec.
It could be just the Windows machine not responding.
So in a lab, test the pings and the telnet and everything
else first.
Verify what works before you put in the security, and that way
you can do a before and after comparison
to verify that your security policy for TrustSec
is really working.
So here, I can ping that device no problem,
but if I bring up a terminal emulator, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
but if I bring up a terminal emulator,
and I try to use Telnet--
so right here, I have a telnet session to 10.80.0.12,
which is its IP address.
If I go there, it's timing out.
It is not allowing that.
So if we go back to the switch-- let me get to the right console
here--
and we did a show cts role-based permissions, that
hasn't changed.
But let's do a cts role-based, and let's go ahead
and do counters.
Press Enter.
Look at that.
This is showing it from group 16 to group 18. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is showing it from group 16 to group 18.
It's had denies, and they were in hardware.
So it has very little impact on the devices.
There's been a lot of permits or other traffic,
like see that 16 right there.
If we went back to the Windows client,
and we went to the Command Prompt, and we did ping,
and there should be five more.
Let's go ahead and refresh it.
Go back here.
So back here, the permitted was 16,
and if we look at the counters, it
is now 20, although I think I did five pings.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All right, so in any event, it is filtering the traffic.
This is the telnet activity that wasn't allowed,
and I had a lot of fun in putting this together and doing
a lot of testing.
And here's my tips for you as you
do this is test the protocols before you
put in the security group ACLs.
Make sure they all work, and then, as you add them verify,
and also, refresh your policy manually on the switch that way
you're not waiting for ISE to push
an update or anything else.
You make sure you have the latest and greatest.
Also, in the authorization policy,
you can change the security group tags nilly willy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you can change the security group tags nilly willy.
So you can change them all to the same group.
And then, you could also apply an access list, a security
group ACL, for the same group.
Say, you know what?
I want to make new policy for TrustSec
or this type of traffic from this group to the same group
and within the same group.
You can limit those protocols.
And the beautiful thing is that if you identify
the customer on the way in, and they get a security group tag,
and then, you have all your devices who are implementing
security based on those tags, the security
follows the packet.
It is packet-based microsegmentation. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It is packet-based microsegmentation.
You can control in great detail from a central location
the traffic patterns that you want to allow
and/or deny on your network, and implement it and enforce it
with TrustSec.
So thanks for joining me in this demonstration
about implementing and verifying TrustSec,
and I'll see you in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.