| Where Can I Use This? | What Do I Need? |
|---|
|
|
One of the following subscriptions:
Device Security subscription for an advanced
Device Security product (Enterprise Plus,
Industrial OT, or Medical)
Device Security X subscription
One of the following Cortex XSOAR setups:
A free, cohosted, limited-featured
Cortex XSOAR instance
AND
A free Cortex XSOAR Engine (on-premises integration)
A full-featured Cortex XSOAR server
|
In addition to identifying IoT devices for
Cisco ISE to expand access control and policy enforcement to include
IoT, Device Security can also generate access control lists (ACLs)
based on observed traffic. The ACLs provide a list of rules that
allow the traffic you want with a rule at the end to deny everything else
and thereby block all unwanted traffic.
Device Security supports
the automatic generation of ACL rule sets per device profile and
the automatic creation of authorization profiles using one of the
following three enforcement models in Cisco ISE:
The first two
types are ACLs that Cisco ISE supports, and the last type is an ACL
that Cisco WLAN controllers support. ISE applies dACLs and SG-ACLs
to IoT devices through network devices like switches when devices
join the network and go through the authentication and authorization
process. ISE downloads WLC ACLs to WLAN controllers and ISE enforces
the ACL rules on wireless clients when they join a wireless network
and go through processes like authentication, re-authentication, and
change of authorization (CoA). When a switch or WLAN controller
applies an ACL to a device, its traffic is permitted or denied as
specified in the rule set.
In slightly more detail, here’s
how Cisco ISE applies these different types of access control to
IoT devices:
When a switch or wireless controller
receives an authentication request from an IoT device, it extracts
device attributes from the request and then provides them to ISE.
ISE then checks if the attributes match a device profile. For dACLs
and WLC ACLs, it looks up the device profile in a profiling policy.
For SG-ACLs, ISE checks for it in a network device authorization policy.
If the IoT device matches a device profile, ISE next checks
its policy rule sets to see if there’s one with rule conditions
for this device profile.
If ISE finds a match, it then checks the rule results, which
indicate the action to take. For dACL and WLC ACL, the rule results
are in authorization profiles. For SG-ACL, they are in a matrix
of source and destination device profiles that are used as security
groups.
Either ISE downloads the dACL or SG-ACL rule set to a switch
or sends the WLC ACL name to a wireless controller for ACL enforcement.
Finally, either the switch or controller enforces the rules
in the dACL, WLC ACL, or SG-ACL on traffic from the IoT device.
You
can create ACL rule sets for devices at the device profile level,
not for individual devices.
