ISE Trust sec Question.

[minkumar]

Hi Team,

  Can someone give me a real time example or exaplin me in simple language "What is Trust SEC"?

Minakshi

[Saurav Lodh]

have you gone through

http://www.cisco.com/c/en/us/solutions/enterprise-networks/trustsec/index.html

[minkumar]

Hi Saurabh,

  Thanks for you reply!! I have gone through the link. However, I don't want a link. Can you explain in simple words With an example.

Minakshi

[Venkatesh Attuluri]

Example  of trustsec use :

Cisco TrustSec capabilities are embedded in Cisco ^®switches, wireless LAN (WLAN) controllers, routers, and firewalls. With TrustSec, when a user's traffic enters the network, it is classified according to characteristics such as user authentication, analysis of the device being used and it's network location. Based on these criteria, a user's endpoint is classified as a member of a particular security group; for example, it could be added to a group called Retail-Manager. Cisco switches and routers then propagate the security group information to policy-enforcement devices

Most Cisco switches and routers can transport this security group information with the user's traffic. This information is included by embedding a 16-bit Security Group Tag (SGT) value in each frame associated with the user device. The SGT can be transported over LAN, WAN and data center networks so that it is available for inspection and policy enforcement wherever appropriate.

To traverse networks or network devices that do not understand or support SGT propagation, a control-plane protocol, the SGT Exchange Protocol (SXP), allows Cisco TrustSec SGT information to be transported over any IP network to enforcement points.

Policy enforcement can be performed by Cisco firewalls, routers, or switches. The enforcement device reads the source SGT (denoting the Retail-Manager role, for example). It then evaluates the Retail-Manager's privileges to access the destination resource, which would also have an assigned SGT, such as PCI-Compliant Server or HR Database. It then determines whether the traffic should be allowed or denied.

If the enforcement device is a switch, it will apply security group ACLs (SG-ACLs). These are policies automatically downloaded from the Cisco Identity Services Engine (ISE) or the Cisco Secure Access Control Server (ACS). SG-ACLs have the benefit of being processed at wire rate on many switch platforms. Because they are downloaded from ISE, they do not need to be provisioned to switches, as traditional Access Control Lists need to be.

If the enforcement device is a Cisco firewall, it will perform stateful firewall processing using the source and destination SGTs. The Cisco Adaptive Security Appliance (ASA) Software can also make additional inspection decisions based on the source and destination SGT values. For example, it can selectively pass traffic through additional intrusion prevention analysis or direct traffic to Cisco Cloud Web Security services based upon SGT values.

[mohanak]

The Cisco TrustSec solution simplifies the provisioning and management of highly secure access to network services and applications. Unlike access control mechanisms that are based on network topology, Cisco TrustSec policies use logical groupings. Highly secure access is consistently maintained even as resources are moved in mobile and virtualized networks. Decoupling access entitlements from IP addresses and VLANs simplifies security
policy maintenance tasks, lowers operational costs, and allows common access policies to be consistently applied to wired, wireless, and VPN access. Cisco TrustSec classification and policy enforcement functions are embedded in Cisco switching, routing, wireless LAN, and firewall products. By classifying traffic according to the contextual identity of the endpoint instead of its IP address, the Cisco TrustSec solution enables more flexible access controls for dynamic networking environments and data centers.
The ultimate goal of Cisco TrustSec technology is to assign a tag (known as a Security Group Tag, or SGT) to the user’s or device’s traffic at ingress (inbound into the network), and then enforce the access policy based on the tag elsewhere in the infrastructure (in the data center, for example). This SGT is used by switches, routers, and firewalls to make forwarding decisions. For instance, an SGT may be assigned to a Guest user, so that Guest
traffic may be isolated from non-Guest traffic throughout the infrastructure. Here is a list
of some very common security groups:
●Network Infrastructure: This SGT gets assigned to all the switches, routers, WLCs, and firewalls within the organization
●Network Services: This SGT is assigned to the servers providing common services (Domain Name System, Dynamic Host Configuration Protocol, Network Time Protocol, etc.) that most everyone should be able to reach
●Executive: Many organizations classify their executives with a separate SGT, simply to ensure that Executives will never be denied access to anything
●Sales
●Finance
●HR
●Line of Business 1: SGTs are used quite often when an umbrella company has many lines of business and those lines of business cannot have access to each other’s data
●Line of Business 2, 3, and so on: See the previous entry
Note: Each end user or end device may be assigned only one SGT

For real time example please refer the document attached.