The next identity-based authentication
and authorization technology that we're
going to be talking about is Cisco TrustSec,
and how it can leverage security group tags.
Look, this technology, it's not exactly new,
but it's rapidly gaining in popularity,
because it's all about intent-based networking.
This is one of the core and key components
that makes the SD-Access fabric in DNA Center actually work.
This is how it implements the microsegmentation policy.
So if you haven't watched the content on DNA Center yet, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if you haven't watched the content on DNA Center yet,
go back and watch that skill real quick,
because this next Nugget is going
to make a whole lot more sense once you actually
see it in action.
But for now what we're going to be talking about
is how we can define policies based
on who a person is rather than their IP address or their VLAN.
Let's get going.
Cisco TrustSec is really flipping the networking world
on its head.
I mean, it really takes the traditional way
of doing networking, and it basically just throws it away,
and says, we've got a cooler way of doing things that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and says, we've got a cooler way of doing things that's
going to be based on who the person is,
rather than what their IP address or their VLAN is.
This is how we can control access from one resource
to another based on their identity, rather than
their network configuration.
This is so cool.
And it's a major, major component
to Cisco's SD-Access product.
In fact, it's really what makes it work.
This is what we call the microsegmentation policy.
Let's talk about what Cisco TrustSec in these security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's talk about what Cisco TrustSec in these security
group tags really do at the end of the day.
So now here's the scenario.
What I want you to imagine is we have a username,
like a guy named Bob.
And what Bob wants to do is he wants
to go through their network, which
may contain a series of switches,
or routers, which go to more switches.
And Bob wants to access a file share.
And while this diagram is pretty simplistic--
we've got two switches and a router here--
imagine this is actually a gigantic enterprise WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
imagine this is actually a gigantic enterprise
campus with thousands upon thousands of devices,
and hundreds of thousands of users
who may be bringing their own devices,
and so on, and so on, and so on.
This is where it gets really complicated
to extend security from one endpoint all
the way to the other.
There's going to be VLAN ACLs.
And there's going to be IP ACLs.
And then there's going to be routing,
and security permissions, and NTFS, and blah, blah, blah.
You get the idea.
Trying to stretch Bob's permission WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Trying to stretch Bob's permission
all the way across a campus can get out of hand fast.
And that's the problem that Cisco TrustSec tries to solve.
You see, when Bob plugs his computer, maybe his laptop
that he brought from home, into the network,
the network can perform authentication services
like we've seen using something like Cisco's ISE.
But this is where Cisco TrustSec shakes things up a bit.
It uses something called security group tags.
And it tags all of Bob's traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it tags all of Bob's traffic.
Specifically this switch right here,
the entrance point into the network,
tags all of Bob's traffic.
What kind of tag, you might be asking.
Literally, on the layer 2 frame, it
could be just a simple tag as something like a 4
that says Bob belongs to group number 4.
On the flip side of the network, we'll have the server here.
Maybe the server gets authenticated
with MAC authentication bypass all the way to ISE.
And it will receive a security group tag of 5. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it will receive a security group tag of 5.
At this point, we, the network administrators, the ISE
administrators, can say users in this group
are permitted to access resources in this group.
We don't have to worry about VLANs,
and routing, and all that.
I mean, there has to be IP connectivity,
but we don't have to enforce any sort of security policy
on any of the devices along the path at this point.
When Bob sends his traffic in to access the file server,
this switch will see, ah, wait, I'm a TrustSec-enabled device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this switch will see, ah, wait, I'm a TrustSec-enabled device.
I work with the Cisco TrustSec protocol.
And after authenticating Bob using ISE,
I have to tag all of Bob's frames with a tag of 4.
So as it makes its way through the network all the way
to the endpoint here, before Bob's traffic exits the switch,
this switch has to check can 4 access 5.
So it checks in with the policy server here.
And if the answer is yes, guess what happens. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if the answer is yes, guess what happens.
Bob's traffic makes it out towards the server,
and the server sends the reply traffic
all the way back down to Bob.
So you've got to think about how this really comes into play.
Within ISE, we have users.
We either manually create these users,
or maybe we import them from Active Directory.
And then each of these users we can classify into groups.
We may have an IT group.
We may have an HR group.
We may have an engineering group.
We may have a third-party consultants group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We may have a third-party consultants group.
And then on the opposite end of the network,
we may have groups of devices.
We may have IT servers.
We may have HR servers.
We may have printers.
We may have IoT devices.
So using security group tags in Cisco TrustSec,
we now only focus on the people and the devices,
rather than the network itself and this greatly
simplifies how we can implement policy and intent WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
simplifies how we can implement policy and intent
in a large security based enterprise.
Heck, it makes it easy in small enterprises,
because, again, we're just focusing on user administration
at this point.
Never forget the fact that the network
isn't the only IT infrastructure in the entire enterprise.
You've also got servers, probably Windows servers.
You've also got Active Directory, and file servers,
and NTFS permissions.
So if you can leverage already existing identity stores
to enforce network access policies, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to enforce network access policies,
think about how much easier this makes your job.
That's the point of Cisco TrustSec and the security group
tags.
I hope this has been informative for you.
And I'd like to thank you for viewing.