- Cisco TrustSec is a way to simplify
management and provisioning of secure network access.
Traditionally, our access control mechanisms
have been based on network topologies
which has made them very rigid.
With the rise of BIOD policies and mobile technology
more flexibility is required
to consistently maintain secure access control
even with our resources moving around.
And that's the primary benefit of Cisco TrustSec
rather than relying on IP addressing or VLAN memberships
security policy enforcement would depend upon
the contextual identity of the endpoint.
This also allows administrators
to segment the network logically
without modifying the topology in any way.
That would be through VLANs, address themes and so on.
So TrustSec allows us to move those around
in a much more fluid manner.
The primary way that this is achieved these days
is with the help of the Cisco Identity Services Engine
or Cisco ISE. Using Cisco TrustSec technology
a tag is assigned to each device at the inbound
or the egress point on a TrustSec capable device.
This tag is known as a Security Group Tag,
or SGT for short. Based on the SGT given to a device
certain access policies would be enforced elsewhere
throughout the infrastructure.
Maybe in the data center as an example
that we'll look at in just a moment.
This SGT is acknowledged and used by routers,
switches and firewalls in order to
make forwarding decisions.
So as a simple example
if we have guest and corporate wifi networks,
guest network user might receive an SGT
that would isolate their traffic
from those who'd be on the corporate network
who'd have a separate SGT.
You can see those examples here
SGT 100 being for the guest network
SGT 200 being for the corporate network.
So these are very similar to the way VLAN tags work.
Here is a sample topology to see this in a bit more detail.
We have a typical Layer 2 switch that is connecting out
to our internal users, that up links to a router
and eventually terminates at a firewall.
That firewall is going to give us a connection
into our data center.
We're looking at this from a wired connection standpoint
by the way, but we could also have a wireless LAN controller
and maybe multiple wireless access points
that would also be providing user connections.
The firewall again provides access to our data center
where we have multiple servers.
In this example, let's say that this costumer
has some sort of retail presence
and they handle payment card processing,
this means that they would need to fall under PCI compliance
which is a security framework for anyone
who handles payment card processing in any way.
So in our data center, we see a server
in the data center dedicated to PCI information
and we also see a separate server for HR records.
Now there'd likely be many more as well
we're just using two here as a very simple example.
In order to reach the PCI Server, we can define a rule
in Cisco ISE that would verify the users ability
to communicate. So some things that we might do,
we might configure Cisco ISE to verify that the user
is authenticated with valid network credentials.
Or that they're member of the PCI group in active directory.
Or maybe that the machine's security posture is compliant.
And by the security posture we mean that, is the machine
up to date with the latest operating system
or with the latest patches installed?
So we can configure any or all of those to be
a part of that Cisco ISE assessment.
If the user meets these conditions,
Cisco ISE could assign an SGT to the user.
In this case that SGT might be named PCI,
just for a very simple identification
or whatever we'd configured that name to be.
Now without the SGT named PCI
no access to the PCI server would be granted.
Also, you can see here,
although we do have access to the PCI Server
with that green check mark indicating that
we have access because we have the SGT PCI
but we don't have a tag that'll allow us
to connect to the HR server. So that would not be allowed.
The endpoint itself
would not even be aware of these tags
only the network infrastructure would know
about the presence or the absence of the SGT.
The SGT itself is a 16-bit value
assigned by Cisco ISE to the users in point
or session when they log in.
Here we can see a Layer 2 frame
containing Cisco metadata, the CMD
and within that metadata we can see
the 16-bit SGT value.
Another advantage to TrustSec
is that unlike traditional segmentation techniques
this is highly scalable and efficient.
If we need to resegment or to unsegment something
it's a matter of simply reassigning
SGTs to certain user groups or devices.
As opposed to having to physically alter
our topology in any way or even
as opposed to having to add or remove VLANs.
Also note, this isn't a replacement for VLANs or subnets
those are still extremely important and valid
in our modern networks.
These are simply another option
for more granularly controlling
and for more easily managing secure access.
So that's a look at how Cisco TrustSec
can leverage the extensive capabilities
of Cisco ISE for device profiling
for posture assessment and for mobile device management
in order to simplify
secure access management on our networks.