Downloaded 65 times
Uploaded byDanny Liu
Ise 1 2-bdm-v4
Cisco ISE provides comprehensive secure access through device profiling, posture assessment, and contextual identity to apply appropriate network access policies. It centrally manages policy enforcement on wired, wireless and VPN networks to increase security, productivity and operational efficiency. Cisco ISE automates user onboarding and ensures compliant devices receive network access while improperly postured devices are remediated.
More Related Content
Ise 1 2-bdm-v4
- 1. Cisco Confidential 1C97-726694-00© 2013 Cisco and/or its affiliates. All rights reserved.
- 2. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 End-User Behaviors IT Trends • Over 15 billion devices by 2015, with average worker with 3 devices • New workspace: anywhere, anytime • 71% of Gen Y workforce do not obey policies • 60% will download sensitive data on a personal device • Must control the multiple devices and guests • Security: Top concern for BYOD • Mobile malware has doubled (from 2010 to 2011) • IT consumed with network fragmentation Reduce Security Risk Improve End-User Productivity Increase Operation Efficiency
- 3. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Comprehensive Secure Access More Productive Workers and End Users Lower Operating Costs
- 4. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 Retail Healthcare Education Financial Manufacturing Government BYOD Guest Access Secure Access
- 5. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 Who What Where When How Virtual machine client, IP device, guest, employee, and remote user Cisco® ISE Wired Wireless VPN Business-Relevant Policies Replaces AAA and RADIUS, NAC, guest management, and device identity servers Security Policy Attributes Identity Context
- 6. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 BYOD Users get safely on the Internet fast and easy Guest Access It is easy to provide guests limited-time and limited- resource access Secure Access on Wired and Wireless Network and VPN Control with one policy across wired, wireless, and remote infrastructure Cisco TrustSec® Network Policy Rules written in business terms control access
- 7. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 Get users on the net in minutes, not hours Simple self-service portal for any user to get quickly on the net without help or hassle Reduce burden on IT and help desk staff Reliable automation reduces user problems to near zero so… Immediate secure access Rigorous identity and access policy enforcement
- 8. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8 Near-zero IT and help desk burden • Employee hosted • Full guest lifecycle Accommodate and control • Limited to Internet • Time sensitive Streamlined system • Integrated into the all-in-one enterprise policy control—Cisco® ISE console
- 9. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9 Automated onboarding and device security Policy-governed unified access Enforcement embedded in the intelligent network Dependable anywhere access Increase IT Productivity Wired RemoteWireless
- 10. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10 Distributed Enforcement Throughout Network Switch Router DC Firewall DC Switch Distributed Enforcement Throughout Network Network Context Classification Security Group TagTag
- 11. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11 Main Features and Benefits Comprehensive Secure Access Operation Efficiency More Productivity Device Profiling and Posture Contextual Identity (Intelligent Identity) Policy Management Network Enforcement and Control Point Device Profiling and Posture
- 12. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12 Comprehensive Secure Access Initial Posture Validation MS Patches Av and AS Installation Application and Process Running State MDM Integration Corporate and Personal Device Posture Check and MDM Remediation New Feature MDM Policy Check Device registration status Device compliance status Disk encryption status Pin lock status Jailbreak status Manufacturer Model IMEI Serial number OS version Phone number
- 13. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13 Comprehensive Secure Access Cisco Device Sensor Device Sensor (Network Based) Active Endpoint Scanning Device Feed* Cisco ISE Active scanning: Enhanced accuracy Integrated profiling: Visibility in scale Device feed — identity in scale Cisco® ISE augments passive network insight with active endpoint data Network infrastructure provides local sensing function Manufacturers and ecosystem provide constant updates to new devices * Scheduled for Spring 2013 New Feature
- 14. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14 Comprehensive Secure Access Identity (IEEE 802.1X)-Enabled Network CONTEXT IDENTITY Vicky Sanchez Frank LeeSecurity Camera Gateway Francois Didier Personal iPad Employee, Marketing Wireline 3 p.m. Guest Wireless 9 a.m. Agentless Asset Chicago Branch Consultant HQ - Strategy Remote Access 6 p.m. Employee Owned Wireless HQ Who What Where When How Guest access Profiling Posture IEEE 802.1X MAB WebAuth Cisco Switches, Routers, and Wireless Access Points
- 15. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15 Centralized management Across wired and wireless network and VPN Simplified troubleshooting Operation Efficiency
- 16. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16 Policy-Based Access Control Scalable Enforcement VLANs Access Control Lists * Device Sensing Identity and Context-Aware Network Remote VPN User Wireless User Wired User Devices Virtual Desktop Data Center Intranet Internet Security Zones Increased Operation Efficiency
- 17. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17 Lower Operating Costs NY VPN UK CA DC-MTV (SRV1) DC-MTV (SAP1) DC-RTP (SCM2) DC-RTP (ESXix) Security Group Filtering Cisco Distinction Employee Firewall Rules = 10 Production Server Rules = 50 • Customer managed > 500,000 firewall rules with 24 people • Cisco TrustSec® and Cisco® ASA reduced that to 6 people
- 18. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18 More Productivity Trusted Wi-Fi Onboarding Authenticate user Fingerprint device Apply corporate configuration Enterprise applications Automatic policies Secure and customizable captive portal Self-registration for any device Remediate actions
- 19. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19 “Instrumental in giving us visibility to enforce access policy, perform remediation, and improve compliance level” “Now students and faculty can collaborate with ease, working anywhere, anytime on campus” Positioned as leader in Gartner NAC Magic Quadrant December 2012 “Cisco TrustSec and Cisco ISE are consistent with our view of identity- centric end-to-end security that is both needed and lacking in the enterprise today.” Forrester 2011
- 20. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20 Source: Gartner NAC Magic Quadrant 2012 Gartner: "Magic Quadrant for Network Access Control," by Lawrence Orans and John Pescatore, December 8, 2011
- 21. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22 • Required enhanced global security for security-conscious company; customer service offering. • Used Cisco® ISE to manage multiple systems and devices, segmenting infrastructure • Profiling services for business units, individuals, contractors, and complete guest lifecycle wired or wireless. • Always-on secure remote access with Cisco AnyConnect® Challenge Solution ”Cisco ISE provides a best-in-class access control solution for Diebold, enabling unmatched granularity and insight about our users,” —David Kennedy, Vice President, Former CSO, Diebold
- 22. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23 Winning combination of network and device intelligence to help ensure the most comprehensive secure unified access Most extensive and efficient enforcement to achieve exceptional operation efficiency
- 23. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24 An Architectural Approach For… Professional and Technical Services, Compliance, and Cisco® Validated Designs Context-Based Policy and Management Cloud-Based Intelligence Cloud Securing the Transition to Virtualization and Cloud Collaboration 10110100 Securing Applications, Content, and Traffic BYOD Secure Access for the Distributed Workforce SwitchesAppliances WirelessVirtual RoutersPrivate Cloud Email Firewall WebVPNPolicy IPS Network-Enforced Policy
- 24. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25 Cisco Prime™ Cisco® ISE Third-Party MDM Appliance MDM Manager Cisco WLAN Controller Cisco ASA Firewall and IPS Cisco CSM and ASDM Cisco Web Security Wired Network Devices Cisco Catalyst® Switches Cisco AnyConnect® Cisco AnyConnect Cisco AnyConnect Office Wired Access Office Wireless Access Remote Access
- 25. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26 Who What Where When How Identity and Device Context Cisco ISE Virtual machine client, IP device, guest, employee, and remote user Wired Wireless VPN Business-Relevant Policies Policy Management Increases Operational Efficiency Onboarding & Remediation Increases Productivity and Improves User Experience Device Profiling & Posture Provides Comprehensive Secure Access Intelligent Identity Ensures Consistent Policies Network Enforcement Decreases Operational Costs • Consistent source of identity • Endpoint device-type awareness • Posture, access level, network location context • Enable ecosystem partner platform to share context for use in ISE network policy • Enable ecosystem partner to take network actions via ISE Benefits • Allows deeper network and security insight • Allows more detailed control over BYOD and sensitive users and groups • Helps clarify which network and security events are important and helps make them actionable • Unifies policy silos Cisco® ISE Context Sharing IT Infrastructure Network Management Network Control Cisco Network
- 26. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 27 Security Information and Event Management (SIEM) and Threat Defense Mobile Device Management Prioritize Events, User/Device-Aware Analytics, Expedite Resolution • ISE provides user and device context to SIEM and Threat Defense partners • Partners utilize context to identify users, devices, posture, location and network privilege level associated with SIEM/TD security events • Partners may take network action on users/devices via ISE Ensure Device Enrollment and Security Compliance • ISE serves as policy gateway for mobile device network access • MDM provides ISE mobile device security compliance context • ISE assigns network access privilege based on compliance context
- 27. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28 Comprehensive Secure Access More Productive Workers and End Users Lower Operating Costs
- 28. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29 Location-based personalized promotions Better patient care with tablet-based medical data Variety of learning options for online and onsite student experience Retail EducationHealthcare
- 29. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30
- 30.
- 31. Cisco Confidential 32C97-726694-00© 2013 Cisco and/or its affiliates. All rights reserved.
- 32. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33 Efficiency Time Money= or
- 33. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34 NCS Prime ISE Cisco WLAN Controller Wired Network Devices Cisco Catalyst Switches 3rd Party MDM Appliance MDM Manager IronPort WSA Dependable anywhere access Enforcement embedded in the network Automated onboarding and device security
- 34. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35 Internet Services 1Campus Cloud Data Center Policy Services 2 POLICYPOLICYPOLICYPolicy SGT Inter net Open Net Serv Net Data Center Restr ict DC Exec, IT Laptop Wired Net Permit Permit Permit Permit Permit All, iPad Internal Permit Permit Permit Deny Deny Exec, iPad VPN Permit Permit Permit Permit Deny Guest Any Permit Deny Deny Deny Deny John IT Administrator Restricted Data Center John updates Cisco® ISE for BYOD and guest access policies, which are pushed to the network. IT Confidential. Product is planned, features are not committed.
- 35. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 36 Internet Services 1Campus Cloud Data Center Services 2 Wired Restricted Data Center John IT Administrator Brice logs onto wired network on IT-issued laptop. Cisco® ISE authenticates, identifies context, and applies wired execution policy. Wired Confidential. Product is planned, features are not committed. Brice CFO
- 36. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 37 Internet Services 1Campus Cloud Confidential. Product is planned, features are not committed. Data Center Device Identity AAADID Wireless Restricted Data Center John IT Administrator • Brice connects his new iPad to the WLAN and logs on. • While Cisco® ISE performs AAA check of his ID, Cisco ISE Profiler identifies his device. Onboarding Wired Brice CFO Services 2
- 37. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 38 Internet Services 1Campus Cloud Data Center Wired Wireless ? R DIR REG John IT Administrator • Cisco® ISE authenticates Brice, but does not recognize the iPad. • Cisco ISE redirects Brice to the onboarding portal to register his iPad. Onboarding Services 2 Restricted Data Center Confidential. Product is planned, features are not committed. Brice CFO
- 38. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39 Internet Services 1Campus Cloud Data Center Services 2 Wired Wireless Policy Policy Restricted Data Center John IT Administrator • Cisco® ISE forms a contextual identity: Brice + iPad + location. • Cisco ISE assigns a policy based on the context and grants it role-based access. Onboarding Confidential. Product is planned, features are not committed. Contextual Identity Brice CFO
- 39. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 40 Internet Services 1Campus Cloud Data Center Services 2 Wired VPN Wireless Restricted Data Center John IT Administrator • Brice uses the same iPad from a hotel room. Cisco® ISE recognizes the context change and applies execution VPN policy.. VPN Confidential. Product is planned, features are not committed. Brice CFO
- 40. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41 Internet Services 1Campus Cloud Data Center Services 2 Wired VPN Wireless John IT Administrator Restricted Data Center • Sarah receives password through text message. She selects GuestWiFi, and Cisco ISE directs her to the guest portal to register and obtain Internet access. • Brice enters Cisco® ISE guest hotspot portal and sponsors Sarah for 1-day access. Sponsor Guest Brice CFO Sarah Vendor Confidential. Product is planned, features are not committed.
- 41. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42 Internet Services 1Campus Cloud Data Center Wired Wireless BYOD Guest Policy Management Restricted Data Center John IT Administrator Brice CFO Sarah Vendor VPN Confidential. Product is planned, features are not committed. Services 2
- 42. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 43 Comprehensive Wired, Wireless, and VPNSecureAccess More Productive Workers Lower Operating Costs Rigorous Identity Enforcement Extensive Policy Enforcement Security Compliance Automated Onboarding Automated Device Security Dependable-Anywhere Access Operation Efficiency Use Cisco® Infrastructure Next-Generation Policy Networking Control devices everywhere Control Precisely Who & what Is allowed Maintain & validate compliance Secure every device Get quick access with little IT intervention Provide consistent service Get the most from investments Save time End VLAN, ALC & FW Rule pain ISE That’s it.
- 43. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 44 Limited AdvancedEnhancedBasic Environment requires tight controls Company-only device • Manufacturing environment • Trading floor • Classified government networks • Traditional enterprise Focus on basic services and easy access for almost anybody Broader device types but Internet only • Education environments • Public institutions • Simple guests Enable differentiated services and onboarding with security both onsite and offsite Multiple device types plus access methods • Healthcare • Early BYOD adopters • Contractor enablement Company-native applications, new services, and full control Multiple device types, company issued • Innovative enterprises • Retail on demand • Mobile sales services (video, collaboration, etc.)
- 44. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 45 Wireless Upgrade License (ATP) Extend Policy for Wired and VPN Endpoints Platforms Small: Cisco® ISE 3315 and 3415* | Medium-Sized: Cisco ISE 3355 Large: Cisco ISE 3395 and 3495* | Virtual Appliance * New Wireless License Policy for Wireless Endpoints: 5-Year Term Licensing • Authentication and authorization • Guest provisioning • Link-encryption policies • Device profiling • Host posture • Security group access Base License (ATP) Policy for Wired, Wireless, and VPN Endpoints Advanced License (ATP) Policy for Wired, Wireless, and VPN Endpoints Perpetual Licensing 3- or 5-Year Term Licensing +
- 45. C97-726694-00 © 2013Cisco and/or its affiliates. All rights reserved. Cisco Confidential 46 Internet AP Third- Party Controller Layer 3 Switch Policy ServicesCisco ISE Inline Posture Node Layer 3 Switch Wireless User VPN User VPN Wireless Wired Wired eth1 eth0 eth1 eth0 VPN Infra Trusted Network Cisco ISE Inline Posture Node Entry Point for Third Party Wireless Infra • RADIUS authorization for Cisco ASA • Authorization and posture for Inline posture node Policy Services • IEEE 802.1X authorization for WLC • Authorization and posture for Inline posture node Cisco® ASA