Cisco Ise 13 User Guide

Export Egress Policy
Procedure
Step 1ChoosePolicy>TrustSec>EgressPolicy>Matrix.
Step 2ClickExport.
Step 3SavetheCSVfiletoyourlocalsystem.
Import Egress Policy
YoucancreatetheegresspolicyofflineandthenimportitintoCiscoISE.Ifyouhavealargenumberof
securitygrouptags,thencreatingthesecuritygroupACLmappingonebyonemighttakesometime.Instead,
creatingtheegresspolicyofflineandimportingitintoCiscoISEsavestimeforyou.Duringimport,Cisco...

Procedure
Step 1ChoosePolicy>TrustSec>EgressPolicy.
Step 2FromtheSourceorDestinationTreeViewpage,chooseConfigure>CreateNewSecurityGroup.
Step 3EntertherequireddetailsandclickSubmit.
Monitor Mode
TheMonitorAlloptionintheegresspolicyallowsyoutochangetheentireegresspolicyconfigurationstatus
tomonitormodewithasingleclick.ChecktheMonitorAllcheckboxintheegresspolicypagetochange
theegresspolicyconfigurationstatusofallthecellstomonitormode.WhenyouchecktheMonitorAllcheck...

Default Policy
DefaultPolicyreferstothecell.AnysourceSGTismappedtoanydestinationSGT.Here,the
ANYSGTcannotbemodifiedanditisnotlistedinanysourceordestinationSGTs.TheANYSGTcanonly
bepairedwithANYSGT.ItcannotbepairedwithanyotherSGTs.ATrustSecnetworkdeviceattachesthe
defaultpolicytotheendofthespecificcellpolicy.
•Ifacellisempty,thatmeansitcontainsthedefaultpolicyalone.
•Ifacellcontainssomepolicy,theresultingpolicyisacombinationofthecellspecificpolicyfollowed
bythedefaultpolicy....

Configure NDAC Authorization
Before You Begin
•Ensurethatyoucreatethesecuritygroupsforuseinthepolicy.
•Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step 1ChoosePolicy>TrustSec>NetworkDeviceAuthorization.
Step 2ClicktheActioniconontheright-handsideoftheDefaultRulerow,andclickInsertNewRowAbove.
Step 3Enterthenameforthisrule.
Step 4Clicktheplussign(+)nexttoConditionstoaddapolicycondition.
Step 5YoucanclickCreateNewCondition(AdvanceOption)andcreateanewcondition.
Step...

Procedure
Step 1ChoosePolicy>Authorization.
Step 2Createanewauthorizationpolicy.
Step 3Selectasecuritygroup,forPermissions.
Iftheconditionsspecifiedinthisauthorizationpolicyistrueforauserorendpoint,thenthissecuritygroup
willbeassignedtothatuserorendpointandalldatapacketsthataresentbythisuserorendpointwillbe
taggedwiththisparticularSGT.
Add Single IP-to-SGT Mappings
Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step...

Procedure
Step 1ChoosePolicy>PolicyElements>Results>TrustSec>SecurityGroupMappings>Groups.
Step 2ClickAddtoaddanewgroupIP-SGTmapping.
Step 3EnteraNameandaDescriptionforthenewgroup.
Step 4EntertheSecurityGroupTagtowhichthisgroupwillbemappedto.
Step 5Choosethedestinationnetworkdeviceonwhichyouwanttodeploythismapping.Youcandeploythe
mappingsonalltrustsecdevices,onselectednetworkdevicegroups,oronselectednetworkdevices.
Step 6ClickSubmit.
Import Security Group Mappings Hosts...

Procedure
Step 1ChoosePolicy>PolicyElements>Results>TrustSec>SecurityGroupMappings>Hosts.
Step 2ClickExport.
Step 3Toexportsecuritygroupmappingshosts,youcandooneofthefollowing:
•Checkthecheckboxesnexttothehoststhatyouwanttoexport,andchooseExport>ExportSelected.
•ChooseExport>ExportAlltoexportallthesecuritygroupmappingshoststhataredefined.
Step 4Savetheexport.csvfiletoyourlocalharddisk.
Deploy IP-to-SGT Mappings
AfteryouaddIP-to-SGTmappingstoCiscoISEyoumustdeploythesetothetargetnetworkdevice.You...

TrustSec Configuration and Policy Push
CiscoISEsupportsChangeofAuthorization(CoA)whichallowsCiscoISEtonotifyTrustSecdevicesabout
TrustSecconfigurationandpolicychanges,sothatthedevicescanreplywithrequeststogettherelevantdata.
ACoAnotificationcantriggeraTrustSecnetworkdevicetosendeitheranEnvironmentCoAoraPolicy
CoA.
YoucanalsopushaconfigurationchangetodevicesthatdonotintrinsicallysupporttheTrustSecCoAfeature.
CoA Supported Network Devices
CiscoISEsendsCoAnotificationstothefollowingnetworkdevices:...

Step 3ScrolldowntoAdvancedTrustSecSettings,andintheTrustSecNotificationsandUpdatessection,check
theSendconfigurationchangestodevicecheckbox,andclicktheCLI(SSH)radiobutton.
Step 4(Optional)ProvideanSSHkey.
Step 5ChecktheIncludethisdevicewhendeployingSecurityGroupTagMappingUpdatescheckbox,forthis
SGAdevicetoobtaintheIP-SGTmappingsusingdeviceinterfacecredentials.
Step 6EntertheusernameandpasswordoftheuserhavingprivilegestoeditthedeviceconfigurationintheExec
mode.
Step...

b)ScrolldowntoAdvancedTrustSecSettings,andintheTrustSecNotificationsandUpdatessection,
checktheSendconfigurationchangestodevicecheckbox,andclicktheCLI(SSH)radiobutton.
c)IntheSSHKeyfield,pastetheSSHkeyretrievedpreviouslyfromthenetworkdevice.
d)ClickSubmitatthebottomofthepage.
ThenetworkdeviceisnowcommunicatingwiththeCiscoISEusingSSHkeyvalidation.
Environment CoA Notification Flow
ThefollowingfiguredepictstheEnvironmentCoAnotificationflow.
Figure 36: Environment CoA Notification Flow...