: Configure the Panorama Plugin for Cisco TrustSec
Focus
Focus

Configure the Panorama Plugin for Cisco TrustSec

Table of Contents

Configure the Panorama Plugin for Cisco TrustSec

After you install the plugin, you must also assign a notify group to your Cisco TrustSec plugin configuration. A notify group is a list of device groups that includes the firewalls to which Panorama should push all the tags it retrieves from the pxGrid server.
Each Panorama with the Cisco TrustSec plugin installed can support up to 16 pxGrid servers and 16 monitoring definitions. And each monitoring definition has one pxGrid server and one notify group.
The following configuration instructions cover both Bulk Sync and PubSub monitoring modes; some user interface features are enabled, or visible based on the monitoring mode.
  1. Configure the full-sync interval if you want to change it from the default 600 seconds (10 minutes).
    1. Log in to the Panorama CLI.
    2. Enter configure mode.
      admin@Panorama> configure
    3. Use the following command to set the full-sync interval. The range is 600 seconds to 86,400 seconds (one day).
      admin@Panorama# set plugins cisco_trustsec full-sync-interval <interval-in-seconds>
  2. Log in to the Panorama web interface.
  3. You must add the firewalls as managed devices on Panorama and create Device Groups so that you can configure Panorama to notify these groups with the VM information it retrieves. Device groups can include VM-Series firewalls or virtual systems on the hardware firewalls.
  4. Configure Cisco TrustSec monitoring.
    1. Select
      Panorama
      Cisco TrustSec
      Setup
      General
      .
      Enable Cisco TrustSec Monitoring
      is enabled by default. This enables monitoring for all clusters in your deployment.
      The user interface selects the PubSub monitoring mode if the Panorama plugin for Cisco TrustSec is 1.0.2 or later is installed on Panorama 10.0.0 or later:
      The plugin selects Bulk Sync mode when it is installed on a Panorama version earlier than 10.0.0:
    2. Click the gear to edit the setup parameters.
      • Push Interval
        (
        PubSub only
        )—Minimum 0, maximum 60 seconds, default is 0 (100 milliseconds).
      • Enable Full Sync
        (
        PubSub only, optional
        )—Select this optional to enable a full sync. Default is no.
      • Full Sync Interval
        .
        • PubSub—If Enable Full Sync is selected, you can set the full sync interval in seconds. Range is 600 seconds to 86400 seconds (one day), and the default value is 600
        • Bulk Sync—Enabled by default in Bulk Sync mode. Range is 600 seconds to 86400 seconds (one day), and the default value is 600.
      • Monitoring Interval
        (
        Bulk Sync only
        )—10 to 86400 seconds, default is 60—Set the polling interval at which Panorama queries the pxGrid server for endpoint address information. This is the time period between the end of a monitoring event and the start of the next event.
  5. Create a notify group.
    1. Select
      Panorama
      Cisco TrustSec
      Setup
      Notify Groups
      .
    2. Click
      Add
      .
    3. Enter a descriptive
      Name
      for your notify group.
    4. Select the device groups you created in previously.
  6. (
    Optional
    ) If enabling server identity verification of the pxGrid server, configure a certificate profile on Panorama.
  7. Create, activate, and approve the pxGrid client name and client password.
    1. Log in to the Panorama CLI.
    2. Execute the following command to create the client name.
      • If you have a certificate profile, create the client name as follows:
        admin@Panorama> request plugins cisco_trustsec create-account client-name <client-name> host <ise-server-ip>
      • If you skipped Step 6 and you do not have a certificate, enter:
        request plugins cisco_trustsec create-account server-cert-verification-enabled no client-name <client-name>host <host-name>
    3. Execute the following command to create the client name.
      admin@Panorama> request plugins cisco_trustsec create-account client-name test host 10.10.10.15 AccountCreate in progress... AccountCreate successful.   client nodename: test client password: <
      password
      > AccountActivate in progress... AccountActivate successful. Please approve the account on the server.
    4. Log in to your Cisco ISE server to approve the account.
    5. Select
      Administration
      pxGrid Services
      All Clients
      .
    6. Select the client name you create on Panorama.
    7. Click
      Approve
      .
  8. Add pxGrid server information. The Panorama plugin for Cisco TrustSec supports up to 16 pxGrid (Cisco ISE) servers.
    1. Select
      Panorama
      Cisco TrustSec
      Setup
      pxGrid Server
      .
    2. Enter a descriptive
      Name
      for your pxGrid server.
    3. In the
      Host
      field, enter the IP address or FQDN for your pxGrid server.
    4. Enter the client name you created in the previous step.
    5. Enter and confirm the client password you generated in the previous step.
    6. Verify the pxGrid server identity.
      1. Select
        Verify server certificate
        .
      2. Select your certificate profile from the
        Cert Profile
        drop-down.
    7. Click
      OK
      .
  9. Configure the Monitoring Definition.
    1. Select
      Panorama
      Cisco TrustSec
      Monitoring Definition
      and click
      Add
      .
    2. Enter a descriptive
      Name
      and optionally a
      Description
      to identify the monitoring definition.
    3. Select the
      pxGrid Server
      .
    4. (
      Optional
      ) Set Panorama to
      Monitor pxGrid sessions in AUTHENTICATED state
      . By default, Panorama retrieves IP-Tag mappings from sessions in the “STARTED” state. ISE sessions have the “STARTED” state when there is a corresponding accounting start packet. If no accounting start packet is present for the session, then the session state is “AUTHENTICATED”.
    5. Select the
      Notify Group
      .
    6. Click
      OK
      .
  10. Commit
    your changes.
  11. Create active ISE sessions so that Panorama can learn SGT tags for dynamic or static address group definition. To create active sessions, use ISE to authenticate devices.
    Panorama does not collect default SGT tags on ISE.
  12. Create dynamic or static address groups and verify that addresses are added.
    1. Select
      Objects
      Address Groups
      .
    2. Select the Device Group you created for monitoring endpoints in your Cisco TrustSec environment from the
      Device Group
      drop-down.
    3. Click
      Add
      and enter a
      Name
      and
      Description
      for the address group.
      The dynamic address group naming convention is:
      cts.svr_<server-name>.sgt_<SGT-name>
      The static group naming convention is:
      cts.svr_<server-name>.sgt_<SGT-decimal number>
    4. Select
      Type
      as
      Dynamic or Static
      .
    5. Click
      Add Match Criteria
      .
    6. Select the
      And
      or
      Or
      operator and click the plus (+) icon next to the security group name to add it to the dynamic address group.
      Panorama can only display security group tags it has learned from active sessions. Security group tags in live sessions appear in the match criteria list.
    7. Select
      Panorama
      Objects
      Address Groups
      .
    8. Click
      More
      in the Addresses column of a dynamic address group.
      Panorama displays a list of IP addresses added to that dynamic address groups based on the match criteria you specified.
  13. Use dynamic address groups in policy.
    Dynamic address groups are empty until you attach them to a policy. You won’t see any IP addresses in your dynamic address group unless a policy is using it.
    1. Select
      Policies
      Security
      .
    2. Click
      Add
      and enter a
      Name
      and a
      Description
      for the policy.
    3. Add the
      Source Zone
      to specify the zone from which the traffic originates.
    4. Add the
      Destination Zone
      at which the traffic is terminating.
    5. For the
      Destination Address
      , select the dynamic address group you just created.
    6. Specify the action—
      Allow
      or
      Deny
      —for the traffic, and optionally attach the default security profiles to the rule.
    7. Repeats Steps 1 through 6 to create another policy rule.
    8. Click
      Commit
      .
  14. (
    Optional
    ) Update the objects from the pxGrid server at any time by synchronizing objects. Synchronizing objects enables you to maintain context on changes in the virtual environment and allows you to enable applications by automatically updating the address groups used in policy rules.
    1. Select
      Panorama
      Cisco TrustSec
      Monitoring Definition
      .
    2. Click
      Synchronize Dynamic Objects
      .

Recommended For You