Using Trustsec with Third party NAC solution

[carl.townshend]

Hi Guys

Would it be possible to do segmentation by using Trustsec SGT with a third party NAC solution such as Forescout?

Would we need anything else?

[Rob Ingram]

@carl.townshend yes SGTs can be applied using Forescout - https://docs.forescout.com/bundle/CounterACT_Administration_Guide_8.0.1/resource/CounterACT_Administration_Guide_8.0.1.pdf

Forescout configuration would be better discussed in the forescout forums.

[ammahend]

Thanks Rob I wasn’t aware of this, Would you recommend deploying trustsec with forecout tho ? 

[Rob Ingram]

@ammahend no, I wouldn't personally recommend deploying trustsec without ISE. A third party vendor is likely to not fully support all the features and support might be an issue.

[ammahend]

Also briefly going through the forescout document they talk about assigning sgt as part of authorization, but there is no mention of enforcement based on sgt or some sort of policy matrix.

[ammahend]

Don’t think so, at least I haven’t deployed it, you will need ISE with advantage license and network infrastructure should be comparable with trust-sec compatibility matrix below.

https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/trustsec/policy-platform-capability-matrix.pdf

additionally getting DNA center appliance would be a good idea as central point of management, automation and enforcement and policy creation for trustsec. 

[thomas · Accepted solution]

Anyone may assign an SGT in a RADIUS session - it's just a RADIUS Vendor-Specific Attribute (VSA) from Cisco that any vendor may implement in a RADIUS authorization response. That's the beauty of standard protocols like RADIUS.

But how does your network device(s) know about your SGTs and SGACLs in the first place???

The hard part is going to be initial and ongoing updates of the TrustSec Matrix with all of the SGTs and SGACLs to your network devices.  That would be a very tedious process to manually update all of those across all of your network devices without ISE. This is the special sauce with ISE. 

See our recent ISE Webinar: 

Group-Based Segmentation Basics
Speaker: Jonathan Eaves, Technical Marketing Engineer
22:58 Dynamic Group Policy Download from ISE for Enforcement at Egress
26:03 Enforcement Demo