In a very, very small network, we
can put access control lists in place
for filtering to control the traffic between, for example,
sales and engineering.
However, in a larger network with people roaming around,
we need something better.
And that something better is called TrustSec.
[MUSIC PLAYING]
And let's take a look at the components.
Now here's the concept behind TrustSec.
What we're going to do is instead of saying this IP
address or this range of IP addresses
can be permitted here or there, what we'll do
is we'll categorize our devices on the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is we'll categorize our devices on the network.
So here, I have a whole bunch of groups.
I've got something for BYOD, bring your own device,
one called computers, domain services, employees, guests,
et cetera.
And then there's an SGT, a security group
tag that's going to be associated with those.
And then once we've done this, we
can create access control lists to permit or deny
certain types of traffic and we can
specify what we want to allow between various groups,
regardless of where they are on the network.
This is how we can specify what we
want to have happen between two different objects
in our network.
So always follow the matrix. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So always follow the matrix.
[LAUGHS] Follow the matrix.
So for example, BYOD and ISE, if we go to that intersection,
it's permitting some traffic, some SSH traffic.
If we go to domain services and guests,
we have a deny in that column.
And the way this is implemented in a network that
supports TrustSec is that the forwarding devices are looking
at those tags.
And they can implement the policy
regardless of where it is.
So in this example, if we a guest computer that's
trying to access domain services, it's a big no.
And this can be enforced regardless
of where that client came in or what domain services they're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of where that client came in or what domain services they're
trying to access or reach.
Now one of the considerations from a design perspective
is that if we want TrustSec to work,
we need TrustSec compliant or capable devices that
can look at those tags based on the frames that are going back
and forth in our network, and then either permit
or deny based on those tags.
Because that's how TrustSec is implemented, by the tags
and then the forwarding devices in the path
either forwarding or blocking that traffic based
on those security group tags.
Another aspect to security design
is we can encrypt our traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is we can encrypt our traffic.
Now I'm not referring to like a VPN end to end tunnel.
I'm referring to encrypting the traffic
as it's going from the computer, the node, into the switch.
And to do that, we can use something called MACSec,
M-A-C-S-E-C. And it's encrypting the actual traffic.
So if we're using SGT, security group tags,
that tagging information along with everything else
can be encrypted.
So what happens is the traffic, if it's
going from a node to a switch, that's called a downlink
MACSec.
If it's going between two switches,
it's called uplink MACSec.
And the key here is that they'll encrypt it, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the key here is that they'll encrypt it,
they'll ship it across, the frame across.
The other switch will decrypt it because it
needs to read the security group tags.
It can analyze those, make decisions
on forwarding or dropping, and then
it forwards it out if the decision was to forward,
it can then go ahead and encrypt it once again using MACSec.
So in this video, I want to impress upon your mind two
basic concepts.
One is TrustSec, which is the ability to create that matrix
and identify what you want to permit or deny
with the permissions based on the objects and their security
group tags.
And that's implemented by the network.
So we don't have to do a fixed ACL on an interface anymore. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we don't have to do a fixed ACL on an interface anymore.
We can let a TrustSec capable network enforce that for us.
And then to hide the content of those SGTs,
those tags, and the data being sent
between devices and the switches,
and between switches and other switches,
we can use MACsec, which does link
by link encryption of that traffic.
So thanks for joining me in this set of videos.
I'll see you in the next one.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.