Cisco Ise 13 User Guide

Procedure
Step 1ChooseAdministration>System>Settings>TrustSecSettings.
Step 2Enterthevaluesinthefields.
Step 3ClickSave.
What to Do Next
•ConfigureTrustSecDevices,onpage595
Configure TrustSec Devices
ForCiscoISEtoprocessrequestsfromTrustSec-enableddevices,youmustdefinetheseTrustSec-enabled
devicesinCiscoISE.
Procedure
Step 1ChooseAdministration>NetworkResources>NetworkDevices.
Step 2ClickAdd.
Step 3EntertherequiredinformationintheNetworkDevicessection.
Step...

Generate a TrustSec PAC from the Settings Screen
YoucangenerateaTrustSecPACfromtheSettingsscreen.
Procedure
Step 1ChooseAdministration>System>Settings.
Step 2FromtheSettingsnavigationpaneontheleft,clickProtocols.
Step 3ChooseEAP-FAST>GeneratePAC.
Step 4GenerateTrustSecPAC.
Generate a TrustSec PAC from the Network Devices Screen
YoucangenerateaTrustSecPACfromtheNetworkDevicesscreen.
Procedure
Step 1ChooseAdministration>NetworkResources>NetworkDevices.
Step...

Generate a TrustSec PAC from the Network Devices List Screen
YoucangenerateaTrustSecPACfromtheNetworkDeviceslistscreen.
Procedure
Step 1ChooseAdministration>NetworkResources>NetworkDevices.
Step 2ClickNetworkDevices.
Step 3CheckthecheckboxnexttoadeviceforwhichyouwanttogeneratetheTrustSecPACandclickGenerate
PAC.
Step 4Providethedetailsinthefields.
Step 5ClickGeneratePAC.
Push Button
ThePushoptionintheegresspolicyinitiatesaCoAnotificationthatcallstheTrustsecdevicestoimmediately...

•Name—NamethatyouwanttoassigntotheCiscoISEserverinthisAAAServerlist.Thisnamecan
bedifferentfromthehostnameoftheCiscoISEserver.
•Description—Anoptionaldescription.
•IP—IPaddressoftheCiscoISEserverthatyouareaddingtotheAAAServerlist.
•Port—PortoverwhichcommunicationbetweentheTrustSecdeviceandservershouldtakeplace.The
defaultis1812.
Step 4ClickSubmit.
What to Do Next
ConfigureSecurityGroups.
Security Groups Configuration...

Procedure
Step 1ChoosePolicy>PolicyElements>Results>TrustSec>SecurityGroups.
Step 2ClickAddtoaddanewsecuritygroup.
Step 3Enteranameanddescription(optional)forthenewsecuritygroup.
Step 4EnteraTagValue.Tagvaluecanbesettobeenteredmanuallyorautogenerate.Youcanalsoreservearange
fortheSGT.YoucanconfigureitfromtheTrustsecglobalsettingspageunderAdministration>System>
Settings>TrustSecSettings.
Step 5ClickSave.
What to Do Next
ConfigureSecurityGroupAccessControlLists
Import Security Groups into Cisco ISE...

Procedure
Step 1ChoosePolicy>PolicyElements>Results>TrustSec>SecurityGroups.
Step 2ClickExport.
Step 3Toexportsecuritygroups,youcandooneofthefollowing:
•Checkthecheckboxesnexttothegroupthatyouwanttoexport,andchooseExport>ExportSelected.
•ChooseExport>ExportAlltoexportallthesecuritygroupsthataredefined.
Step 4Savetheexport.csvfiletoyourlocalharddisk.
Add Security Group Access Control Lists
Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step...

Permit_Web_SGACL
permittcpdsteq80
permittcpdsteq443
denyip
Deny_JumpHost_Protocols
denytcpdsteq23
denytcpdsteq23
denytcpdsteq3389
permitip
ThefollowingtablelistssyntaxforSGACLforIOS,IOSXEandNS-OSoperatintsystems.
Syntax common across IOS, IOS XE, and NX-OSSGACL CLI and ACEs
deny,exit,no,permitconfigacl
ahp,eigrp,gre,icmp,igmp,ip,nos,ospf,pcp,pim,tcp,udpdeny
permit
dst,log,srcdenytcp
denytcpsrc
denytcpdst
portnumberdenytcpdsteq
denytcpsrceq
Dst,log,srcdenyudp
denyudpsrc
denyudpdest...

EachcombinationofasourceSGTtoadestinationSGTisacellintheEgressPolicy.
YoucanviewtheEgressPolicyinthePolicy>TrustSec>EgressPolicypage.
YoucanviewtheEgresspolicyinthreedifferentways:
•SourceTreeView
•DestinationTreeView
•MatrixView
Source Tree View
TheSourceTreeviewlistsacompactandorganizedviewofsourceSGTsinacollapsedstate.Youcanexpand
anysourceSGTtoseetheinternaltablethatlistsallinformationrelatedtothatselectedsourceSGT.This...

•Unmappedcells—WhenasourceanddestinationpairofSGTsisnotrelatedtoanySGACLsandhas
nospecifiedstatus.
TheEgressPolicycelldisplaysthesourceSGT,thedestinationSGT,andtheFinalCatchAllRuleasasingle
listunderSGACLs,separatedbycommas.TheFinalCatchAllRuleisnotdisplayedifitissettoNone.An
emptycellinamatrixrepresentsanunmappedcell.
IntheEgressPolicymatrixview,youcanscrollacrossthematrixtoviewtherequiredsetofcells.Thebrowser
doesnotloadtheentirematrixdataatonce.Thebrowserrequeststheserverforthedatathatfallsinthearea...

Procedure
Step 1ChoosePolicy>TrustSec>EgressPolicy.
Step 2FromtheSourceorDestinationTreeViewpage,chooseConfigure>CreateNewSecurityGroupACL.
Step 3EntertherequireddetailsandclickSubmit.
Egress Policy Table Cells Configuration
CiscoISEallowsyoutoconfigurecellsusingvariousoptionsthatareavailableinthetoolbar.CiscoISE
doesnotallowacellconfigurationiftheselectedsourceanddestinationSGTsareidenticaltoamappedcell.
Add the Mapping of Egress Policy Cells
YoucanaddthemappingcellforEgressPolicyfromthePolicypage....