ISE Trust Sec

[adamgibs7]

Dears,

I am really new to trust sec and we have a ISE in a corporate, how I can take benefit of trust sec if I am having ASA-SM as a core datacenter firewall and ASA-5525X on a perimeter firewall and 2960XR switches on the access layer with IP base licenses

I am using following features of ISE which fits to my corporate also trust sec will fit but I don't know how I can design and implement trust sec feature. I can say it is a replacement of CDA ( context directory Agent) or it does much more than CDA ???

1. Any connect client for Dot1x
2. Posture
3. Profiling
4. VPN users authentication
5. Tacacs administration
6. Pxgrid with firepower

Thanks

[Rob Ingram]

Using ISE you can assign a Trustsec TAG (SGT) to each user/computer, this is defined in the authorization policy, and can be assigned depending on AD group membership and/or whether the user passes or fails posture etc. These SGTs can be used in the firewall ruleset to permit/deny access. If you integrate ISE with Firepower using pxgrid you can initiate user quarantine if their computer has malware etc.

This link is the best place to start for TrustSec information

[Marvin Rhoads]

@Rob Ingram I don't believe the ASA-SM is on the Trustsec Compatibility Matrix.

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/software-platform-capability-matrix.pdf

[adamgibs7]

Dears

Thanks for the reply,

+5 to you both, I will reply further on this post as I have many question on the trust sec.

Regards