topic ISE Trust Sec in Network Access Control

ISE Trust Sec

adamgibs7 — Fri, 21 Feb 2020 18:57:58 GMT

Dears,

I am really new to trust sec and we have a ISE in a corporate, how I can take benefit of trust sec if I am having ASA-SM as a core datacenter firewall and ASA-5525X on a perimeter firewall and 2960XR switches on the access layer with IP base licenses

I am using following features of ISE which fits to my corporate also trust sec will fit but I don't know how I can design and implement trust sec feature. I can say it is a replacement of CDA ( context directory Agent) or it does much more than CDA ???

Any connect client for Dot1x
Posture
Profiling
VPN users authentication
Tacacs administration
Pxgrid with firepower

Thanks

Re: ISE Trust Sec

Rob Ingram — Sat, 09 Jun 2018 21:45:33 GMT

Using ISE you can assign a Trustsec TAG (SGT) to each user/computer, this is defined in the authorization policy, and can be assigned depending on AD group membership and/or whether the user passes or fails posture etc. These SGTs can be used in the firewall ruleset to permit/deny access. If you integrate ISE with Firepower using pxgrid you can initiate user quarantine if their computer has malware etc.

This link is the best place to start for TrustSec information

Re: ISE Trust Sec

Marvin Rhoads — Mon, 11 Jun 2018 04:39:15 GMT

@Rob Ingram I don't believe the ASA-SM is on the Trustsec Compatibility Matrix.

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/software-platform-capability-matrix.pdf

Re: ISE Trust Sec

adamgibs7 — Sat, 16 Jun 2018 22:42:23 GMT

Dears

Thanks for the reply,

+5 to you both, I will reply further on this post as I have many question on the trust sec.

Regards