topic Re: Using Trustsec with Third party NAC solution in Network Access Control

Using Trustsec with Third party NAC solution

carl.townshend — Fri, 25 Nov 2022 10:29:20 GMT

Hi Guys

Would it be possible to do segmentation by using Trustsec SGT with a third party NAC solution such as Forescout?

Would we need anything else?

Re: Using Trustsec with Third party NAC solution

Rob Ingram — Fri, 25 Nov 2022 10:43:28 GMT

@carl.townshend yes SGTs can be applied using Forescout - https://docs.forescout.com/bundle/CounterACT_Administration_Guide_8.0.1/resource/CounterACT_Administration_Guide_8.0.1.pdf

Forescout configuration would be better discussed in the forescout forums.

Re: Using Trustsec with Third party NAC solution

Ambuj M — Fri, 25 Nov 2022 10:53:14 GMT

Don’t think so, at least I haven’t deployed it, you will need ISE with advantage license and network infrastructure should be comparable with trust-sec compatibility matrix below.

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/policy-platform-capability-matrix.pdf

additionally getting DNA center appliance would be a good idea as central point of management, automation and enforcement and policy creation for trustsec.

Re: Using Trustsec with Third party NAC solution

Ambuj M — Fri, 25 Nov 2022 10:52:39 GMT

Thanks Rob I wasn’t aware of this, Would you recommend deploying trustsec with forecout tho ?

Re: Using Trustsec with Third party NAC solution

Rob Ingram — Fri, 25 Nov 2022 10:58:31 GMT

@Ambuj M no, I wouldn't personally recommend deploying trustsec without ISE. A third party vendor is likely to not fully support all the features and support might be an issue.

Re: Using Trustsec with Third party NAC solution

Ambuj M — Fri, 25 Nov 2022 11:08:19 GMT

Also briefly going through the forescout document they talk about assigning sgt as part of authorization, but there is no mention of enforcement based on sgt or some sort of policy matrix.

Re: Using Trustsec with Third party NAC solution

thomas — Wed, 14 Dec 2022 00:47:01 GMT

Anyone may assign an SGT in a RADIUS session - it's just a RADIUS Vendor-Specific Attribute (VSA) from Cisco that any vendor may implement in a RADIUS authorization response. That's the beauty of standard protocols like RADIUS.

But how does your network device(s) know about your SGTs and SGACLs in the first place???

The hard part is going to be initial and ongoing updates of the TrustSec Matrix with all of the SGTs and SGACLs to your network devices. That would be a very tedious process to manually update all of those across all of your network devices without ISE. This is the special sauce with ISE.

See our recent ISE Webinar:

Group-Based Segmentation Basics
Speaker: Jonathan Eaves, Technical Marketing Engineer
22:58 Dynamic Group Policy Download from ISE for Enforcement at Egress
26:03 Enforcement Demo