TechWiseTV Workshop: Cisco ISE 2.1 (Identity Services Engine)
•Download as PPTX, PDF•
3 likes•1,928 views
These are the slides used in the Live Webinar August 3, 2016 at 10:00 am Pacific Time / 1:00 pm Eastern Time. You can listen/watch the replay of that show at techwisetv.com. Just click on 'workshops.' The TechWiseTV Episode is also on that site or on YouTube at https://youtu.be/zZHRLsaKD3U Demos to checkout: ISE Streamlined Visibility: https://communities.cisco.com/videos/15260 ISE Context Visibility: https://communities.cisco.com/videos/15264 ISE EasyConnect: https://communities.cisco.com/videos/15285 ISE Threat-centric NAC (AMP): https://communities.cisco.com/videos/15269 ISE Threat-centric NAC (Qualys): https://communities.cisco.com/videos/15270
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (16)
Similar to TechWiseTV Workshop: Cisco ISE 2.1 (Identity Services Engine)
Similar to TechWiseTV Workshop: Cisco ISE 2.1 (Identity Services Engine) (20)
More from Robb Boyd
More from Robb Boyd (20)
Recently uploaded
Recently uploaded (20)
TechWiseTV Workshop: Cisco ISE 2.1 (Identity Services Engine)
- 1. See It All, Secure It Now with Cisco ISE 2.1 Tim Abbott August 3, 2016
- 2. Tim Abbott Security Business Group August 2016 What’s New Cisco Identity Services Engine (ISE) 2.1
- 3. 4© 2016 Cisco and/or its affiliates. All rights reserved. Today’s network requires better visibility and stronger control Key trends creating weaknesses in legacy networks Mobility and BYOD in the workplace Digitization of data Internet Of Things (IOT) connecting everything
- 4. 5© 2016 Cisco and/or its affiliates. All rights reserved. While protecting an ever increasing amount of data in your system 300% Digitization Attack surface expansion Fragmentation Average enterprise network data growth over next 5 years1 1Cisco Global Cloud Index: http://www.cisco.com/c/en/us/solutions/collateral/service-provider/global-cloud-index-gci/Cloud_Index_White_Paper.html
- 5. 6© 2016 Cisco and/or its affiliates. All rights reserved. Stop and contain threats With ISE you can See and share rich user and device details Control all access throughout the network from one place
- 6. 7© 2016 Cisco and/or its affiliates. All rights reserved. What is new in ISE 2.1 and AnyConnect 4.3 Threat-Centric NAC Cisco ISE 2.1ACS to ISE Migration Rapid Threat Containment (RTC) TrustSec / ACI Policy Plane Integration Streamlined Visibility Wizard Easy Connect Context Visibility ISE Technology Partner & pxGrid Enhancements AnyConnect NVM Enhancements with Version 4.3 Dashboard Enhancements
- 7. 8© 2016 Cisco and/or its affiliates. All rights reserved. Control all access from one place Simplify access delivery across wired, wireless, and VPN connections Gain awareness of everything hitting your network Provide access consistently and efficiently Relieve the stress of complex access management
- 8. 9© 2016 Cisco and/or its affiliates. All rights reserved. Simplify access management while maintaining security Easy Connect Benefits What’s new for ISE 2.1? Easy Connect is a quick, flexible user authentication method that applies when endpoints don’t support 802.1x. Easy Connect monitors user login via Active Directory and maps the user’s identity to give access. Capabilities • Active-session monitoring across both AD and Network log-ins • Session maintenance from Wired MAB clients to NADs • Directory notification publication via pxGrid • Address legacy and unsupported NADs with TrustSec • Assignment of VLANs, dACLs, SGTs and more for users authorized via Easy Connect Easy Connect merges RADIUS identity with AD Login identity to deliver differentiated access Most secure with integrated 802.1x, supplicants and certificates Basic with whitelisting Access Security Better and flexible with ISE Easy Connect Complexity Identity mapping Active Directory (AD) Login Publish to pxGrid SXP speaker Access Security Complexity Access Security Complexity Easy Connect, a secure alternative to whitelistingIncreased visibility into active network sessions authenticated against AD Immediate value with no need to touch each endpoint or require users to authenticate again Flexible deployment that doesn’t require a supplicant or PKI, allowing ISE to issue COA for added security Publish to pxGrid MnTNetwork Access Device w/o 802.1x
- 9. 11© 2016 Cisco and/or its affiliates. All rights reserved. Integration of TrustSec and ACI policy groups enables customers to address breach, segmentation and compliance challenges by sharing policy groups between TrustSec-enabled networks and ACI datacenters. Enable consistent security policy across the enterprise TrustSec - ACI policy plane integration Consistent security policy groups can be shared between TrustSec and ACI domains: • Campus security groups can be used in ACI policies: ACI learns TrustSec Security Group Tags (SGTs), and these SGTs are available for use by the APIC policy • Endpoint groups (EPGs) can be used in campus policies: ISE retrieves EPGs and creates SGTs in harmony Capabilities Policy integration example – Campus and Data Center Benefits What’s new for ISE 2.1? Unified security policy leveraging user, device, application & threat state in group-based policies Simplified security management Complementary group-based policy approaches simplify security design, operations and compliance Consistent segmentation across the datacenter, branches, users and devices Campus / Branch TrustSec Policy Domain Voice BYODAuditorEmployeeNon- Compliant Campus Networks Branch WAN APIC Data Center ACI Policy DomainTrustSec SGTs mapped to and from ACI EPGs ACI FabricTrustSec domain AppWeb www Database Point of Sale
- 10. 12© 2016 Cisco and/or its affiliates. All rights reserved. Make policy changes in a flexible manner TrustSec change management and workflow capabilities • Modify SGACLs using a Staging Matrix and test them before pushing to production • View changes in comparison to the production matrix • Leverage seamless integration with ISE RBAC • Choose to apply changes to all TrustSec-enabled network devices or only to selected devices • Request and gain approval on policy changes using a new workflow Capabilities Stage and test policy changes to verify impact, and roll out on your terms Benefits What’s new for ISE 2.1? New change management capabilities enable you to test TrustSec security policy changes before deployment, and gradually deploy changes to different parts of the network. Reduced risk Minimize the likelihood of changes causing problems Greater control See impact of policy adjustments in a controlled environment and fine-tune them before deployment Increased flexibility Roll out policies when you want, where you want HR Finance BYOD- Corp BYOD- Vendor HR PERMIT DENY PERMIT PERMIT Finance DENY PERMIT PERMIT PERMIT BYOD- Corp DENY DENY PERMIT DENY BYOD- Vendor DENY DENY DENY PERMIT Source Protected Assets Stage policy changes Deploy changes in production to all devices or a selected sub-set HR Finance BYOD- Corp BYOD- Vendor HR DENY PERMIT PERMIT PERMIT Finance DENY DENY PERMIT DENY BYOD- Corp PERMIT PERMIT DENY PERMIT BYOD- Vendor DENY DENY PERMIT DENY Source Protected Assets X X Test and fine-tune
- 11. 13© 2016 Cisco and/or its affiliates. All rights reserved. ISE now includes all of the core the device administration capabilities found in ACS, delivering contextual awareness and device administration capabilities in a single, central solution. Unify device administration and access control Enhanced device administration support • Migration tool automatically migrates ACS configuration data to ISE • Support for core ACS5 features and dedicated device administration Work Center supporting TACACS+ • Command-level authorization with detailed logs for auditing • Dynamic, role-based access control • Discover, identify & monitor all IP-enabled endpoints Capabilities Manage device administration and access control policies in a single place Benefits What’s new for ISE 2.1? Richer contextual policies Build policies informed by contextual data from devices, infrastructure, and services Flexible, granular control Control and audit network device configuration Unified, centralized management Get a full view of all policy elements in a single management console Cisco ISE Threat & Vulnerability Who WhatWhen How Where Deviceadministration ACS ISE ContextAwareness Security Admin Team TACACS+ Work Center Network Admin Team TACACS+ Work Center
- 12. 14© 2016 Cisco and/or its affiliates. All rights reserved. See and share rich user and device details See who and what is on your network and share across network solutions Consistent Cross-Platform User/Device Visibility & Control Improve your existing security and network solutions Make Network Events Actionable
- 13. 15© 2016 Cisco and/or its affiliates. All rights reserved. Get the information YOU need faster than ever Dashboard customization and workflow enhancements • Build custom dashboards; user controls what to view • Add/remove/rename tabs and dashboard components (“dashlets”) • Adjust layout – re-order dashlets, select from layout templates, and drag and drop dashlets • Export to Excel and PDF • Use new task-oriented Work Centers focused on BYOD, Posture, and Profiling Capabilities Benefits What’s new for ISE 2.1? Enhanced reporting and easier customization using dashlets to quickly adjust and create views that fit your specific needs. New task-oriented workcenters for guest, BYOD, posture, profiling, and network access. See the details that matter to you Easily create your own single pane of glass for quick insights Integrate with existing analytics Connect with your Office analytics through Excel exports Get things done more easily Use new Work Centers to accelerate core activities Each individual can customize the main screen easily and quickly Three new Work Centers streamline management activities Director of Security NOC EngineerSecurity Engineer Dashboard Customization New Work Centers
- 14. 16© 2016 Cisco and/or its affiliates. All rights reserved. • Deploy quickly and easily; network access device discovery is set up as an asynchronous process • Get the data you need for network access device configuration in a few clicks • View network devices and user details in a convenient, easily-consumable interface • Access historical context data on endpoints that have been on the network in prior weeks and months Capabilities Benefits What’s new for ISE 2.1? ISE 2.1 delivers a new level of visibility into users & endpoints by making data more consumable. It includes a redesigned user interface (UI) that enables you to get set up and gain insights faster and more easily. Improve visibility through an intuitive interface Streamlined Visibility Wizard enhancements Faster time to value with extensive, easy-to-read reports in a matter of hours Insightful reporting That pulls from a rich, broad set of network and user data Plug-and-play setup that takes just a few clicks and as little as 10 minutes User Location User Location Company Network ? ? ? ?? ? ? ?? ?? ? Visibility Wizard
- 15. 17© 2016 Cisco and/or its affiliates. All rights reserved. Gain a deeper understanding of endpoint activity Context Visibility enhancements • Store data on 1.5M endpoints across 50 attributes, not just endpoints that are currently active • Benefit from in-disk storage (elastic search) • Get insight more easily through a better UI • Perform forensic analysis on endpoints on the network in a previous week or month • Import/export data as needed • Aggregate endpoint information in one place Capabilities Benefits What’s new for ISE 2.1? The ability to aggregate, store and search high volumes of endpoint data, giving you greater visibility. ISE 2.1 collects data from multiple sources into one place, and its enhanced database stores more historical data than ever. Unified view Access all of the endpoint data you need from one place Simple, fast discovery Get to the information you’re looking for in a few seconds Deeper visibility Perform detailed, retroactive forensic analysis after an endpoint has left the network LogsSys logsReports II00 I0I0 0I John on his iPad in Building 8 has Vulnerability <XYZ>
- 16. 19© 2016 Cisco and/or its affiliates. All rights reserved. Leverage our growing partner ecosystem Integration with new ecosystem solutions across many use cases Threat-Centric NAC Cloud Access Security Broker User Behavior Analytics Partner use cases Identity Access Management Network Visibility Mobile Device Management Rapid Threat Containment & Threat Defense Benefits What’s new for ISE 2.1? Integration with new ecosystem partner solutions through the pxGrid framework, and expansion of existing partnerships to new use cases. Improved responsiveness & control Unify security and network event data and respond faster by facilitating access to the Cisco network Greater visibility Gain visibility into user and device activity, threats, vulnerabilities, and more for deeper analytics & reports Simplified management Manage policy in a single place by integrating ISE with other vendor solutions
- 17. 20© 2016 Cisco and/or its affiliates. All rights reserved. Gain increased visibility across your network Detect suspicious behavior more effectively AnyConnect Network Visibility Module (NVM) enhancements • Stay informed with continuous monitoring and always-on” capability that limits blindspots • Collect and send data when on-premises and/or VPN-connected (including split tunneling) • Get 24-hour rolling cache of netflow data when disconnected • Receive auditing intelligence with built-in reporting and analytics • Limit user experience impact with stream-level interception • Benefit from flexibility and customization – e.g. collect only the attributes needed, cached data throttling Capabilities Benefits What’s new for ISE 2.1? ISE 2.1 includes enhancements that deliver more flexibility in AnyConnect NVM use. NVM enables greater visibility across users, endpoints, and applications, and facilitates analytics on contextual telemetry data. Gain a holistic view across your entire network with greater insight from behavioral analytics and contextual data Defend more effectively against potential threats with greater visibility extended to all endpoints Improve network operations with forensic analysis to inform design, capacity planning and troubleshooting AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx Collect Analyze Report AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx AhsidhiaoshdalAhsidhiaoshdalsdkladjhkskadjsndAhsidhiaoshdalsdkl adjhkskadjsnd, asdnxAhsidhiaoshdalsdkladjhkskadjsnd, Ahsidhiaoshdalsdkladjhkskadjsnd, dnxsdkladjhkskadjsnd,asdnxAhsidhiaoshdalsdkladjhkskadjsnd,dnx
- 18. 21© 2016 Cisco and/or its affiliates. All rights reserved. Stop and contain threats Reduce risk and contain threats by dynamically controlling network access Ease security policy setting Limit unnecessary network exposure Prevent threats from compromising your network in real time
- 19. 22© 2016 Cisco and/or its affiliates. All rights reserved. Compliant Where How Vulnerability Gain greater visibility and control with new threat and vulnerability data Threat-centric NAC • Author intelligent policies informed with new threat and vulnerability data • Eliminate unknowns and ensure device compliance • Take immediate action on high-priority issues • Gain awareness when a vulnerability score changes or a threat is detected, and adjust network privileges • Automate containment of vulnerable endpoints based on vulnerability score Capabilities Threat Who What When Benefits What’s new for ISE 2.1? ISE now incorporates vulnerability assessments from Qualys and threat incident intelligence from Talos and AMP, helping you ensure your policies account for the latest vulnerabilities and threats. Deeper visibility that extends to all endpoints on the network Expanded control driven by threat intelligence and vulnerability assessment data Faster response with automated, real-time policy updates based on vulnerability data Cisco ISE AMP
- 20. 24© 2016 Cisco and/or its affiliates. All rights reserved. Use the latest rapid threat containment (RTC) capabilities Firepower Management Center (FMC) 6.1 and Identity Service Engine (ISE) 2.1 integration • Integrated pxGrid remediation module - no more pxGrid connection agent • Session information obtained from ISE via pxGrid • SGTs can be used in FMC 6.1 access control policies • Ability to integrate with AMP for malware protection • Remediation options: Quarantine, Unquarantine, Port Shutdown • Quarantine actions triggered per policy with Cisco Firepower and ISE integration • Infected users can be notified and directed to a portal for remediation Capabilities Benefits What’s new for ISE 2.1? Cisco Firepower Management Center 6.1 integrates with ISE 2.1, helping you automatically address suspicious activity on your network based on pre- defined policies and dynamically stop threats before they spread. Automate threat defense by leveraging ISE to alert the network of suspicious activity according to policy Gain greater scalability by using the pxGrid framework Leverage a growing ecosystem of partners that provide rapid threat containment by integrating with ISE Automatically defend against threats with FMC and ISE FMC correlates sensor data, detects file and alerts ISE to change access policy to suspicious Device is contained; user is redirected to remediation portal User downloads a malicious file; sensors scan user activity and file Network access is restored after remediation ISE automatically restricts access based on new policy Improved scalability pxGrid controller
- 21. 25© 2016 Cisco and/or its affiliates. All rights reserved. Get started today Talk to your Cisco account manager Find out more on cisco.com/go/ise
- 23. 27© 2016 Cisco and/or its affiliates. All rights reserved. Thank you for watching.
Editor's Notes
- This cover slide should be updated with current information and left on screen as people log in. - Replace ‘Topic’, ‘Guest Speaker’ , ‘Date’
- Gain awareness of everything hitting your network Get more context about your network users than just an IP address: Who is accessing your network, what they are using it for, where users are, how users gain access ISE provides a more comprehensive set of probes to get contextual awareness needed to profile correctly, giving visibility to user name, time of access, location, device type and access type ISE can be utilized as the single source to segment and enforce policy across your entire network because it can both share and receive context information from various platforms Use context to guide access policy decisions. Differentiate which end users can access what, and use information on the device they login with to determine if they can access sensitive material Provide more context than just an IP address to your network solutions. With over half of employees working outside the office and 75% of employees using multiple devices, ISE’s unsurpassed analytics that drive enhanced device authentication is essential Know what devices are connecting to your network Gain granular visibility into what your end users are connecting to your network. See device details such as whether they are corporate or non-corporate assets, mobile or desktop, Android or iOS device, and more Provide access consistently and efficiently Deliver appropriate access based upon device, role, location, and other attributes Use a wide range of access control lists (ACLs) to determine what your various network users can access Roll out highly secure network access without manually configuring endpoints for authentication and authorization Utilize pre-configured profile templates and multiple-level guest access to get up-and-running quickly ISE uses standard RADIUS and TACACS+ protocols for authentication, authorization, and accounting (AAA) Enforce wired, wireless, and remote policies from a single platform ISE provides end users with consistent access no matter how they are connected to your network. Policies are seamlessly cascaded across all types of access points Use dynamic visual tools that offer real-time previews of the portal screens that end users experience Relieve the stress of complex access management Manage ISE service on non-Cisco solutions through one central location ISE provides 802.1x authentication support for Cisco and 3rd Party networking devices ISE enables advanced use cases for Cisco and 3rd Party networking devices Maintain up-to-date policies and compliance on all devices with TrustSec Use access control lists (ACLs) to deliver policy updates to entire segments of users, eliminating manual processes As a software-defined security controller, ISE provides greater flexibility in policy enforcement and policy-creation from a centralized location The unified secure access control alleviates tedious access management, enabling compliant devices to access the network regardless of connection type Enable your end users to onboard their own devices Alleviate the device-onboarding burden from your IT staff with self-service onboarding. End users are able to register and provision new devices according to the business policies defined by the IT administrators
- With ISE 2.1 we are introducing a feature called Easy Connect, which offers a quick, easy, and flexible method for user authentication that applies when endpoints don’t support 802.1x. We understand that 802.1x can be hard to deploy, and requires touching each endpoint. And we understand that users often complain about additional app authentications. We listened to the need for an option that doesn’t require 802.1x roll out and that doesn’t require touching each endpoint. Easy Connect addresses all of those concerns. Unlike competitors who use a MAC address to give devices network access, Easy Connect permits access to the network with user information behind it. Easy Connect finds devices based on the user, and gives differentiated access with no 802.1x involved. The moment a user authenticates with Easy Connect, ISE maps the user’s identity and pushes a tag to the endpoint to enable policy enforcement, even if the network isn’t configured with TrustSec. ISE can be an SXP speaker that directly points back from the endpoint, enabling tags to be passed along for enforcement so that TrustSec can work with a broad set of devices (e.g. third-party devices like a non-supported access switch). ISE also publishes information using pxGrid.
- ISE 2.1 delivers integration of TrustSec and ACI security policy groups, enabling consistent enterprise-wide policies that leveraging user roles and device type together with application context. The complementary group-based policy approaches of TrustSec and ACI vastly simplify security design, operations and compliance. Policy challenges such as compliance and breach prevention are not simply constrained to the datacenter or campus – these are end-to-end challenges. With this new integration, we’re helping customers address these challenges more cohesively and we’re making it easier to do so. With the integration, TrustSec Security Groups can be used in ACI contracts. External endpoint groups (EPGs) are automatically created in APIC by ISE, and group information is automatically updated by ISE. Similarly, ACI EPGs can be used in enterprise network security policies. Security Group Tags created by ISE automatically describe the assets in ACI, and intelligent application classifications from ACI can be used in TrustSec policies. This avoids moves/adds/changes in the Enterprise security policies. This integration streamlines many enterprise security objectives. For instance, if a retail bank needs segmentation in the datacenter and at branches to separate PCI-compliant infrastructure, and also wants to provide access to a user group such as auditors, TrustSec-ACI integration enables the bank to do this by using a single set of enterprise-wide groups. The ACI groups take care of the datacenter piece, while the TrustSec groups address the user piece and the bank can rest assured that there is total consistency. In addition to the campus and branch scenario, TrustSec group-based policies can work together across datacenters, and a TrustSec-enabled datacenter can link to an ACI datacenter.
- ISE 2.1 offers greater flexibility in terms of how customers can implement security policy changes when using TrustSec. Specifically, ISE 2.1 introduces new change management capabilities that enable you to stage TrustSec policy changes using a Staging Matrix so that impact can be verified before deployment. You make changes in the staging matrix, test them, edit them and can invoke an approval workflow so that only approved changes can get deployed. Another important new capability is that you can now choose to deploy changes to selected devices. This is useful if you want to make policy changes, but you want to enable them in different locations or datacenters in a controlled way, and don’t want a set of policies activated everywhere at once. If you are considering TrustSec, these new capabilities mean you can roll out TrustSec across your current IT environment in a methodical, staged way – no need for a “big-bang” roll out approach.
- With ISE 2.1, we expanding ISE device administration capabilities to include not only TACACS+ support, but also additional network access device administration functionality. Before, we controlled user access to the network, meaning ISE could check for guest and employee rights to make sure they were granted the right access. Device administration and TACACS+ is relevant for device administrators themselves, so that you can make sure that network administrators only have access to the network devices, and the security team only has access to the security devices, like firewalls. With ISE, you can enable role-based access control for administrative access, so that administrators have the right access—and the only the right access—to do their job. Plus, ISE offers a device administration workspace, which is a clean, modular, isolated space that doesn’t tie to the other areas of ISE. This provides a contained workspace so that an administrator with a specific role (network administrator, for example) can do authentication, authorization and accounting from a single location, helping them work more efficiently and effectively. The migration from Cisco Secure ACS to Cisco ISE 2.1 has been made as simple as possible with a built-in tool that automatically migrates ACS configuration data to ISE. However, it will not migrate monitoring and troubleshooting data. Additional note on RADIUS & TACACS+ ISE has used RADIUS for AAA administration in the past, but with ISE 2.0, we added TACACS+. TACACS+ supports a lot of the same use cases as RADIUS, but TACACS+ is a protocol that wasn’t available at all on ISE, until the ISE 2.0 release. With ISE, you now have RADIUS and TACACS+ in the same interface. Migration benefits include: Eliminate complexity and management time with unified policy management Build richer contextual policies Discover, identify, and monitor all IP-enabled endpoints Enforce dynamic access control
- Improve your Cisco security and network solutions Share contextual data on devices and users across platforms with pxGrid Cisco pxGrid context sharing enables ISE and other platforms to gather more information such as user name, time of access, location of access, device type and type of access and share it with other platforms in your network ISE collects data from other Cisco network devices in order to update and enhance policy Strengthen security across your Cisco solutions with shared Security Group Tags (SGTs) from TrustSec ISE provides better user visibility into context details for many other Cisco security solutions through pxGrid technology. Link WSA, StealthWatch, AnyConnect, or the FireSIGHT Console with ISE to better protect you before, during and after an attack. Differentiate access automatically based on ISE identity data using TrustSec. Policies created in ISE integrate seamlessly with Cisco networking infrastructure such as routers and switches to automatically segment access ISE adds to mobile device management (MDM) functionality by providing greater insight into the posture of mobile devices and enforcing appropriate network access policies Strengthen your non-Cisco security solutions Standardize policy enforcement on partner platforms via pxGrid ISE shares user and device details with partner platforms to make them user, device, and network aware and enables enhanced and consistent policy enforcement ISE collects large amounts of contextual information from a wide variety of partner sources that permit ISE to prevent inappropriate access and detect and minimize the spread of network threats Help customer IT environments integrate into Cisco networks, decreasing time, effort and cost to responding to security and network events Enhance 3rd party network devices with ISE capabilities ISE shares details with, and collects information from non-Cisco devices in order to inform user and device policy and share across your network ISE provides 802.1x authentication support for 3rd Party networking devices. ISE enables advanced use cases for 3rd Party networking devices ISE delivers comprehensive authentication and authorization against multi-forest Microsoft Active Directory domains Make better decisions with user and device insights Allocate network resources more effectively with user and device data Gain user details beyond IP such as user name, login time, location, and access type to analyze network usage. Track users’ network activities, including where they have been, and bandwidth usage to ensure resources are allocated securely and effectively ISE 2.0 offers enhanced reporting with improved filtering for live log and reports that inform business decisions Analyze and present context data to justify network upgrade spends Inform access management with user and device behavioral trends Utilize network usage reports to refine access policies based on a variety of trends, including device traits, access locations, and more. For example, a hospital can restrict access to patient files to doctors and nurses to only when they are in patient rooms, their office, or the laboratories. A network administrator can also restrict access from iPads with a specific software update that poses a threat to the network
- ISE 2.1 now supports dashboard customizations based on user preferences. Users can customize their main screen to reflect the metrics and reports that they care about most by leveraging drag & drop “dashlets” (dashboard components) or selecting from pre-made layout templates. Customizable tabs, dashlet placement and order ensure that everything the user needs is just a click or two away. And users can export reports to Excel and PDF. ISE 2.1 also adds task-oriented Work Centers for BYOD, posture, and profiling, in addition to existing Work Centers for TrustSec, device administration, guest and network access. Work Centers ease day-to-day configuration and management burdens, centralizing work associated with a given task to a single pane. Easily flip back and forth between tasks without having to jump around to disjointed data sources.
- ISE 2.1 comes with several enhancements to the Streamlined Visibility Wizard, delivering a new level of visibility by making data more consumable. It includes a redesigned graphic user interface (GUI) that enables you to get set up and gain insights faster and more easily than ever before. First, the wizard itself – it’s now as simple as plugging in a toaster, making deployment much more convenient – you can deploy in as little as 10 mins. You can set up, go to lunch, and in a few hours the wizard pulls the information it needs from your network – you can start seeing value right away. Second, you get to the data you’re looking for more quickly and easily. The reporting you receive is now more easily and quickly consumable thanks to the UI improvements. This means you can get a lot of the information about what’s on your network right from day 1. This is especially important as we move into the world of IoT, with more and more devices accessing the network.
- In addition to the rich data and greater convenience of the Streamlined Visibility Wizard, ISE 2.1 also comes with enhancements to Context Visibility. With ISE 2.1, you gain the ability to aggregate, store and search high volumes of endpoint data, giving you greater visibility. ISE 2.1 collects data from multiple sources into one place, and its enhanced database stores more historical data than ever. With ISE 2.0, you could log 250K endpoints – with ISE 2.1, you can now store data on 1.5M endpoints across 50 attributes, meaning you get a much deeper level of insight and can use ISE data in more scenarios. Instead of being limited to information on endpoints currently on the network , you can perform forensic analysis and get information on an endpoint that was on the network in a previous week. Another benefit is that all of this information is in one place – the database pulls in data from logs, sys logs, reports – data that was scattered in many different places. Now, it’s all aggregated, and gives you a much deeper historical view. The UI a lot simpler and easier to use, so you can hone in on the information you need much more easily.
- With pxGrid, Cisco is committed to an open, platform-based framework that allows us to improve the efficacy of Cisco's industry-leading offerings, such as the combined solution of Rapid Threat Containment with Firepower and ISE. The pxGrid framework also enables Cisco to integrate with ecosystem partners, enabling customers to use integrated, cross-vendor solutions that best fit their existing infrastructure. Threat-Centric NAC: New partner: Qualys - Qualys provides CVSS vulnerability scores, supplementing threat information from AMP and contextual awareness from ISE. Cloud Access Security Broker: New partner: NetScope User Behavior Analytics: New partner: Niara Rapid Threat Containment: Utilizing integration via pxGrid Adaptive Network Control, Cisco ISE enables security ecosystem partners from a broad variety of technology areas to take network mitigation and investigation actions in response to security events. New partners: RedShift Networks, TrapX, Attivo, Intelliment, ThreatTrack, and LemonFish Existing ecosystem partner – expanding integration to new use case: FortScale Identity Access Management: New partner: Situational Network Visibility: New partner: Lumeta Mobile Device Management: New partner: Microsoft
- One big challenge enterprises face is that it can be really difficult to obtain important data related to the devices and users accessing your network. Even when you know the contextual data you’re looking for is out there somewhere, but it is often opaque or hidden from view. And then, to complicate things even further, even when the location of critical data is clear, it is often only available within a limited silo of your network. For example, you might have access to a device name through the device manager, but the user name you’re looking for exists within the identity store, and meanwhile all of your application information would be somewhere else. Getting comprehensive visibility across all of your users, devices, locations, destinations and applications, especially when that data is in separate silos, is not easy. For that reason, it often requires multiple solutions to get a truly holistic view. With the AnyConnect Network Visibility Module introduced in ISE 2.0, AnyConnect enhances the forensic capabilities available to you by effectively using the network as a sensor and extending the sensor capability all the way to the endpoint. It provides deeper visibility into the intelligence you need across endpoints, users, and applications, and makes it available in a single location. AnyConnect consolidates all netflow traffic being generated from an endpoint, enabling that data to be sifted through by collectors (such as Splunk) to identify anomalous behavior and trends that could indicate a compromised endpoint or that a user is using a device inappropriately. You can exclude select context variables to meet privacy requirements. With the increased ability to collect contextual information across the network, you gain auditing intelligence that enables greater insight and more informed action. Network admins can look at user and application behavior to make informed improvements in network design, overall capacity, etc. Security admins can look for behavior anomalies that could help them prevent the extraction of sensitive data. Desktop admins can leverage forensic analysis to aid their ability to minimize the spread of network threats across the rest of the network. With a more holistic view of your network, your teams can collaborate to improve network operations and more effectively defend across wired, wireless, and VPN networks. Another important capability is that AnyConnect NVM is “always-on”. If a user with AnyConnect on their endpoint isn’t on VPN, AnyConnect simple stores the information until AnyConnect VPN is re-enabled and sends the information to the NVM for analysis. This reduces blindspots. We introduced AnyConnect NVM in a previous release. Our latest release includes refinements to the AnyConnect NVM capability – it’s now more flexible in terms of deployment and other capabilities. For example, NVM now offers a flexible collection policy – you can choose to collect data on only the attributes you care about, instead of collecting data on a fixed set of attributes. As another example, NVM now enables cached data throttling – you can choose how much data AnyConnect NVM will collect once a user who’s not connected via VPN gets back on the VPN.
- Ease security policy setting Set initial access policies quickly ISE ships with predefined device profile templates for a variety of devices, but also allows administrators to create their own device templates based upon business needs Create custom guest experiences with advertisements and corporate branding from one convenient place for free ISE Deployment Assistant (IDA) reduces the time to design and deploy ISE with network assessment capabilities, network device configuration, and the ability to troubleshoot failed authentications Update, maintain, and create new policies with ease Create organization-specific policies with ease. For example: If there is a security threat on the most recent software update of an Android device, create a policy to block Android access and protect your network in minutes Ensure all endpoints conform to the organization’s posture policies with a client-based agent, a temporary web agent, or a query to an external MDM/EMM system Remove the hassle of certificate management by easily deploying an internal certificate authority that simplifies certificate management, and automatically revokes certificates of stolen devices Limit unnecessary network exposure Reduce the risk of threats spreading with simple segmentation through TrustSec Since ISE is a software-defined security controller, it can enable networks to mitigate risks automatically TrustSec provides a simple, scalable way to implement segmentation across the network Use access control lists (ACLs), pre-configured profile templates, and multiple-level guest access to provide access on a strategic need-to-know basis, protecting critical segments of your network Apply uniform policy across network solutions Utilize your unified network as an enforcer to implement policy centrally and cascade it across your entire network Ensure consistent security across your entire network by sharing user and device profiles from ISE with other network solutions Prevent threats from compromising your network in real time Contain threats with automated user and device quarantining ISE integrates with Cisco FireSIGHT Management Center (FMC) to deliver Rapid Threat Containment. ISE automatically changes the Security Group Tag to suspicious, triggering policy enforcement which contains the device for remediation Remove compromised users and devices Instantly remove an endpoint’s access to the network based on preset standard or custom policies Monitor and change the authorization of an endpoint without having to modify an overall system policy
- With Threat-Centric NAC, we’re adding new vectors that enable better classification. That means you’re now able to go a step beyond contextual details on who, what, when, where and how – with ISE 2.1, you’re stopping threats by directly identifying them with vulnerability data from Qualys and threat intelligence from AMP informed by Talos, Cisco’s security intelligence arm. It starts with visibility – you’re able to see Qualys vulnerability scores and AMP threat intelligence data along with other contextual information. This information allows you to adjust policies in response. You can also enable intelligent, automated policy updates (change of authorizations) based on Qualys vulnerability data, ensuring that your policies are always up to date based on the latest vulnerability levels. Qualys uses standard CVSS scores to assign a 1-10 score to each vulnerability, helping you investigate the most important items. Similarly, information from AMP is grouped by threat assessment – e.g. distracting, painful, etc.
- ISE 2.1 now integrates with Cisco Firepower Management Center 6.1 to deliver better rapid threat containment, which basically enables the network itself to inspect and act as an enforcer of user access. By working with the pxGrid framework, FMC is able to download additional user data, device type data, device location data and SGTs from ISE. Besides the added visibility that ISE provides, this data is also actionable intelligence because it extends network control by enabling policy creation based on SGTs, device type, or other contextual data. The integration of FMC 6.1 and ISE 2.1 means you get to leverage the latest enhancements in both solutions. In the use case included here, Firepower Management Center is able to scan the activity of authorized users across all approved devices that are connected to the corporate network. Whenever suspicious activity, malware, or any other potential threats are detected, FMC alerts ISE using pxGrid, and the Security Group Tag is automatically changed to “suspicious”. Based on that new SGT, network enforcers informed by pxGrid automatically enforce policy on the network. According to policy, the device is contained for remediation or mitigation. You can set things up so the user receives a notification informing them that they have been blocked from the network due to infection. You can also automatically redirect infected users to a remediation portal where the threat is addressed and the user is seamlessly let back onto the network. Through the automated inspection and enforcement of network access policy, FMC and ISE together provide greater network security through early threat detection and rapid threat containment. Finally, customers have the ability to leverage Cisco’s growing partner ecosystem to implement the rapid threat containment solution that is best for their current infrastructure and business needs. Cisco has a rapidly growing ecosystem of partners that leverage ISE and pxGrid to deliver rapid threat security. We’ll talk in a moment about our growing partner ecosystem