Secure network access, principles of ISE implementation...ISE supports distributed log collection...

Cisco Expo

Secure network access, principles of ISEimplementationGyörgy Ács

Consulting Systems Engineer, C|EH – Cisco

T-SECA1

• Twitter www.twitter.com/CiscoCZ

• Talk2cisco www.talk2cisco.cz/dotazy

• SMS 721 994 600

Agenda

What is TrustSec

What is ISE

ISE Design

High Availability

Migration

• Identity Based Network Services (IBNS):

802.1X for wired access

Profiling by NAC Profiler

Guest = NGS

• Cisco NAC Appliance:

VLAN control via SNMP Control Plane

Profiling by NAC Profiler

Guest = NGS

802.1X

Multiple Options for Wired Access

• Wireless Access

802.1X controlled by WLC

WLC has local enforcement

Separate Policies on ACS

• Remote Access VPN

Policy controlled by ASA, or:

Policy controlled by in-line NAC

Separate Policies on ACS

Policy

Wireless and VPN Access

Wireless

802.1X

TrustSec Brings it all Together

TrustSec

NACIBNS

Complete System for Network Access Control & Enforcement

Nexus® 7K, 5K and 2K

Data Center

Wireless

Campus

NetworkWired

Cat 6K

Egress Enforcement

MACsec

Profiler

Posture

Guest Services

RADIUS

Ingress Enforcement

802.1X

• Centralized Policy

• RADIUS Server

• Posture Assessment

• Guest Access Services

• Device Profiling

• Monitoring

• Troubleshooting

• Reporting

Profiler

Manager

Server

Identity

Services

Engine

Policy Server Designed for TrustSec

NADPAP

Policy Administration Point

All Management UI Activities

Synchronizing all ISE Nodes

All Policy is Synchronized from PAP to PSNs

Policy Service Node

The “Work-Horse”

RADIUS, Profiling, WebAuth

Posture, Sponsor Portal

Client Provisioning

SWITCHPORT

Network Access Device

Access-Layer Devices

Enforcement Point for all Policy

RADIUS From NAD to Policy Service Node

RADIUS From PSN to NAD w/ Enforcement Result

Logging

Monitoring and Reporting

Logging and Reporting Data

Logging

PSN Queries AD

Directly

RADIUS Accounting

May be a Single ISE Appliance for all Functions…

Campus A

Campus B

Branch A

Switch

802.1X

M&T PSN

Switch

802.1X

Branch B

Switch

802.1X

Switch

802.1X

… or Fully Distributed System where all functions are broken out.

Campus A

Branch A

ASA VPN

Switch

802.1X

Switch

802.1X

Branch B

Switch

802.1X

Switch

802.1X

HA Inline

Posture Nodes

Pri. Admin

Campus B

PSNSec. Admin

Pri. MNT

Sec. MNT

• Interface to configure and view policies

• Responsible for policy sync across all nodes

• Provides: Licensing

Admin authentication & authorization

Admin audit

• Each ISE deployment must have at least one PAPOnly 1x Primary and 1x Backup PAP possible

Primary Management Appliance

PAP (Primary)

PAP (Secondary)

M&T(Primary)

M&T(Secondary)

Policy Sync

Logging

• Changes made via Primary PAP DB are automatically synced to Secondary PAP and all PSNs.

• Evaluates and makes policy decisions This IS the RADIUS Server for your Network Access Devices

• Per policy decision, responsible for: Network access (such as AAA RADIUS services) Posture Guest access (web portals) Profiling Client Provisioning

• Each ISE deployment must have one or more PSNs Up to 40 PSNs

• Node Groups may be used for Load-Balanced Clusters More on this later in presentation

The “Work Horse”

ISE supports distributed log collection across all nodes to optimize local data collection, aggregation and centralized correlation and storage.

Each ISE node collects logs locally from itself; Policy Service nodes running Profiler Services may also collect log (profile) data from NADs.

Each node transports its Audit Logging data to each Monitoring node as Syslog: Profiler events are buffered and forwarded to primary Admin node to update db.

NADs may also send Syslog directly to Monitoring node on UDP/20514 for activity logging, diagnostics, and troubleshooting.

NADs Policy Service

Monitoring

Netflow,

SNMP Traps,

RADIUS

External Log

Servers

Syslog (UDP/20514)

Alarm-triggered

SyslogSyslog

(UDP/20514)

HTTP SPAN,

SPAN/Helper/Proxy

External Log Targets: Syslog (UDP/20514)

Profiler Syslog

(UDP/30514)

(Buffered)

(Not Buffered)

* VM Design guidance is to match or exceed the ISE physical appliance specifications upon which node sizing is based.

Hard disks with 10K or higher RPM are highly recommended.

Policy Service Sizing and Performance

Factor

Platform

Appliance Maximum

Endpoints

Profiler Events Posture Auths

Physical

Small ISE 3315 / 1121 3000 500/sec 70/sec

Medium ISE 3355 6000 500/sec 70/sec

Large ISE 3395 10,000 1200/sec 110/sec

Virtual S/M/L VM 10,000 * TBD TBD

• Major TrustSec component that enforces network policies.

• NAD sends request to the PSN for implementing authorization decisions for resources.

• Common enforcement mechanisms:

VLAN Assignment

Security Group Access (SGA)*

• Basic NAD types

Cisco Catalyst Switches

Cisco Wireless LAN Controllers

Cisco ASA “VPN Concentrator”

Inline Enforcement:

Dedicated Inline solution where infrastructure does not support RADIUS Change of Authorization (RFC 5176/3576, dACL, etc.)

Only needed in posture/profiling use cases

Acts as a RADIUS Proxy in Bridged or Routed Gateway mode

*Inline Enforcement can not be combined with other services

Special Case: ISE Becomes an in-line Appliance

VPN RADIUS RADIUS

iPeP PSN

Data Center 1

Node A

10.1.100.3

Data Center 2

Replication over Layer 3

• If a single box fails then all runtime services continue using another box

RADIUS Services

Guest Services

Profiling Services

-Posture Services

-etc etc

• NADs are configured with multiple RADIUS servers

PAP/PSN/M&T PAP/PSN/M&T

radius-server host 10.1.100.3 key Cisco123

radius-server host 10.1.200.3 key Cisco123

Node B

10.1.200.3

PAP (Primary)

PAP (Secondary

-> Primary) Policy Sync

Logging

• Upon failure of Primary PAP, admin user can connect to Secondary PAP; all changes via backup PAP are automatically synced to all PSNs.

• Admin must first manually promote Secondary PAP to be Primary.

M&T(Primary)

M&T(Secondary)

• NADs can be configured with redundant RADIUS servers (PSN nodes).

• PSNs can also be configured in a cluster, or “node group”, behind a load balancer. NADs send requests to LB virtual IP for PSN services.

• PSNs in node group maintain heartbeat to verify member health.

Switch

PAP (Primary)

PSN Node Group

Load Balancers

Network

Access

Devices

PAP (Secondary)

Policy

Replication

AAA connection

• In HA mode, two ISE appliances are deployed in an Active/Standby configuration; mutual interfaces share a common Service IP for user/management traffic; active iPEP responds to Service IP.

• Each active interface requires L2 connectivity to its mutual peer: trusted (eth0), untrusted (eth1), and HA (eth2 or eth3)

Internal

Network

Internet

AP WLC

ISE iPEP

ACTIVE

L3 Switch

ISE iPEP

STANDBY

L3 SwitchASA

Wireless

VPN User

eth1 eth0

Service IP

Heartbeat

VLAN 11 VLAN 12

Logging

• Up to Two (2) M&T Nodes per ISE Deployment

• All PSNs will automatically Sync logs with both M&T nodes.The PAP displays dashboard and reporting from the Primary PAP to Admin

M&T(Primary)

M&T(Secondary)

Node HA Scheme Auto Failover? Notes

PAP Active/Standby No Secondary PAP must be

manually promoted

PSN • Node Groups (PSN

Clusters)

• Redundant PSN

config on NADs

Yes for established

sessions; sessions

in process of setup

may require re-auth

Node group: group together PSN

nodes that reside in a single

location behind a load balancer

and share a common multicast

address

NAD NAD-Specific NAD-Specific Examples: Redundant Wireless

Controllers

iPEP Active/Standby Yes, but stateless Clients must re-auth to backup

iPEP node upon failover

M&T Active/Active Yes One node serves as Primary; all

ISE logs automatically sent to

both HA M&T nodes

Any external loggers must be

configured to log to both nodes.

Campus A

Campus B

Branch A

ASA VPN

Switch

802.1X

• All Services run on both ISE Nodes

• Set one for Primary Admin / Secondary M&T

• Set other for Primary Monitoring / Sec. Admin

• No more than 2000 Endpoints Supported

Maximum Endpoints = 2,000

M&T PSN

Switch

802.1X

Branch B

Switch

802.1X

Switch

802.1X

M&T PSN

HA Inline

Posture Nodes

Pri. Admin Pri. M&T

Campus A

Branch A

ASA VPN

Switch

802.1X

• Dedicated Management Appliances

• Pri. Admin / Sec MNT

• Pri MNT / Sec Admin

• Dedicated Policy Service Nodes

• Up to 5 PSNs

• No more than 10,000 Endpoints Supported

Maximum Endpoints = 10,000 / Maximum 5 PSNs

Switch

802.1X

Branch B

Switch

802.1X

Switch

802.1X

HA Inline

Posture Nodes

Pri. Admin

Sec. M&T

Pri. M&T

Sec. Admin

Campus B

Campus A

Branch A

ASA VPN

Switch

802.1X

• Dedicated Management Appliances

• Pri. Admin

• Sec. Admin

• Pri MNT

• Sec Admin

• Dedicated Policy Service Nodes

• Up to 40 PSNs

• Up to 100,000 Endpoints Supported

Maximum Endpoints = 100,000 / Maximum 40 PSNs

Switch

802.1X

Branch B

Switch

802.1X

Switch

802.1X

HA Inline

Posture Nodes

Pri. Admin

Campus B

PSNSec. Admin

Pri. MNT

Sec. MNT

ISE will Join the Domain

PAP Policy Service Nodes

Domain Computers

Each ISE Node will join and Query AD separately,

and have it’s own Computer Account in AD

Multiple Domains

• Then only need to join one domain.

If Trust Relationship(s) Exist

• Join one Domain

• LDAP to query the others

If no Trust Relationships

• Is Infrastructure running 802.1X today?

ACS 4.x or 5.x is policy engine

It IS possible to migrate NADs and User Accounts to ISE

• If Infrastructure is NAC Appliance:

No migration today

Future version of ISE will allow migration.

• NAC Guest Server (NGS):

No migration today (planned for future release)

• NAC Profiler:

No migration Possible

Migration Paths do Exist

• Standalone ISE ONLY

Then do your Distributed ISE Deployments

• ACS Migration Tool (Windows w/ Java)

512 GB

TrustSec 1.99 or IBNS

• We tried @ First, but there were problems.

• Policy Migration ability removed from 1.0 MR (1.0.4.x)

• It is supposed to come back in the future.

Policies cannot be migrated at this time.

Local Administrator Accounts

Any Security Group Access (SGA) Data

• No dVLAN data in AuthZ Profiles

Authorization Results

• Posture Checks

• Etc…

NAC Framework

Bad news first

• Identity Attribute Dictionaries

• RADIUS VSA Dictionaries

Dictionaries

• Local Users

• Local Endpoints

• Certificate Authentication Profiles

Identities

• Network Access Devices (NADs)

• Network Device Groups (NDGs)

Network Devices

Now the Good News

Migration Tool

NDGsNADs

Get it all organized in ACS 5 prior to using the tool.

Shows: Counts, Successes, Failures and Warnings

• TrustSec is a Systems Approach to Network Access Control, utilizing the network infrastructure to accomplish what used to be only available in overlays.

• ISE provides the first and only Policy Engine Solution that fully converges: Authentication, Authorization, Profiling, Guest and Posture.

• All ISE nodes will maintain a full copy of the database, providing a fully redundant Authentication infrastructure.

• Best Practice: Do not use < 500GB of storage with your VM’s

• You can Migrate NAD’s, NDG’s, Users and Devices from ACS. But not policies, AuthZ results, or SGA data today.

TrustSec and ISE Design

• Twitter www.twitter.com/CiscoCZ

• Talk2Cisco www.talk2cisco.cz/dotazy

• SMS 721 994 600

• Zveme Vás na Ptali jste se… v sále LEO 1.den 17:45 – 18:302.den 16:30 – 17:00

Prosíme, ohodnoťtetuto přednášku.

T-SECA1

Secure network access, principles of ISE implementation...ISE supports distributed log collection...

Documents

Transcript of Secure network access, principles of ISE implementation...ISE supports distributed log collection...

Ise fs-200 ise-sar-functional_standard_v1_5_issued_2009

ISE Guidance â€“ IdAM Framework for the ISE - ISE.gov

ArcSight Data Platform - Open Architecture Data Collection ... · ArcSight Connector Centralized management Centralized licensing ... File, DB, Flex CEB Automatic parser selection

Xilinx ISE 7 Software Manuals and Help - PDF …...Xilinx ISE 7 Software Manuals and Help - PDF Collection These software documents support the Xilinx ® Integrated Software Environment

Trinity exams: exam examples for this talkbestinpractice.weebly.com/uploads/2/5/2/4/25247589/seville_ise_iii... · Trinity exams: exam There are 5 IS Trinity ISE ISE ISE ISE ISE ISE

Xilinx ISE 7 Software Manuals and Help - PDF Collection

CRÉDITO REAL - investor cloudcdn.investorcloud.net/creal/InformacionFinanciera/ReportesTrimestr… · State Education Non-centralized agencies Others Collection Trust Loan disbursement

Integrated Skills in English (ISE) Guide for Students — ISE I (B1)

ISE Troubleshoot

ISE Project

Ise Vmath109

ACTING AND SPEAKING QUALIFICATION SPECIFICATIONS FROM … (UKI... · 2020. 11. 12. · ISE Assessment Summary: Reading and Writing Module ISE Foundation (A2) ISE I (B1) ISE II B2)

ISE Guidance – IdAM Framework for the ISE - DNI · ISE participant the capability and trust to securely access data or systems in other ISE participant networks and enclaves. ...

Collection Bankruptcy Overview 022511 - IRS Video Portal ... · PDF fileCollection Bankruptcy Overview ... Insolvency’s Two Operations • Centralized Insolvency Operation: ... Federal

Xilinx ISE - New Paltzbai/EGC208/ISE Tutorial_Verilog_14.1.pdf · Xilinx ISE Design >64-bit Project Navigator. Creating a New Project A project in ISE is a collection of all files

ISE Graduate Program Guide - Mississippi State University · Because Mississippi State University uses centralized processing of graduate applications, all questions pertaining to

Channel Lineup Pro is a centralized, chassis-based, non ... · Aggregator/Mule pairs for corporate collection of data from multiple CLPs Automatic Data Collection • Auto Detection

Xilinx ISE 7 Software Manuals and Help - PDF Collection · Xilinx ISE 7 Software Manuals and Help - PDF Collection ... Static Timing Analysis Timing Simulation Back ... using the

Integrated Skills in English (ISE) Guide for Students — ISE ...

De-Centralized and Centralized Control for Realistic EMS ...