Configure the Panorama Plugin for Cisco TrustSec

1. (Optional) Bypass proxy server settings, configured on Panorama under PanoramaSetupServicesProxy Server, for communication between Panorama and Cisco TrustSec. This command allows Panorama to communicate directly with Cisco TrustSec by bypassing the Panorama proxy configuration while maintaining proxied communication for other services.

   1. Log in to the Panorama CLI.
   2. Execute the following command to enable or disable proxy bypass.

      admin@Panorama> set plugins cisco_trustsec bypass-proxy {yes|no}

      Select yes to enable proxy bypass and no to disable proxy bypass. This is set to no by default.
2. Configure the full-sync interval if you want to change it from the default 600 seconds (10 minutes).

   1. Log in to the Panorama CLI.
   2. Enter configure mode.

      admin@Panorama> configure
   3. Use the following command to set the full-sync interval. The range is 600 seconds to 86,400 seconds (one day).

      admin@Panorama# set plugins cisco_trustsec full-sync-interval <interval-in-seconds>
3. Log in to the Panorama web interface.
4. You must add the firewalls as managed devices on Panorama and create Device Groups so that you can configure Panorama to notify these groups with the VM information it retrieves. Device groups can include VM-Series firewalls or virtual systems on the hardware firewalls.
5. Configure Cisco TrustSec monitoring.

   1. Select PanoramaCisco TrustSecSetupGeneral.

      Enable Cisco TrustSec Monitoring is enabled by default. This enables monitoring for all clusters in your deployment.

      The user interface selects the PubSub monitoring mode if the Panorama plugin for Cisco TrustSec is 1.0.2 or later is installed on Panorama 10.0.0 or later:

      The plugin selects Bulk Sync mode when it is installed on a Panorama version earlier than 10.0.0:

   2. Click the gear to edit the setup parameters.

      • Push Interval (PubSub only)—Minimum 0, maximum 60 seconds, default is 0 (100 milliseconds).
      • Enable Full Sync (PubSub only, optional)—Select this optional to enable a full sync. Default is no.
      • Full Sync Interval.
        • PubSub—If Enable Full Sync is selected, you can set the full sync interval in seconds. Range is 600 seconds to 86400 seconds (one day), and the default value is 600
        • Bulk Sync—Enabled by default in Bulk Sync mode. Range is 600 seconds to 86400 seconds (one day), and the default value is 600.
      • Monitoring Interval (Bulk Sync only)—10 to 86400 seconds, default is 60—Set the polling interval at which Panorama queries the pxGrid server for endpoint address information. This is the time period between the end of a monitoring event and the start of the next event.
6. Create a notify group.

   1. Select PanoramaCisco TrustSecSetupNotify Groups.
   2. Click Add.
   3. Enter a descriptive Name for your notify group.
   4. Select the device groups you created in previously.

7. (Optional) If enabling server identity verification of the pxGrid server, configure a certificate profile on Panorama.
8. Create, activate, and approve the pxGrid client name and client password.

   1. Log in to the Panorama CLI.
   2. Execute the following command to create the client name.

      • If you have a certificate profile, create the client name as follows:
        admin@Panorama> request plugins cisco_trustsec create-account client-name <client-name> host <ise-server-ip>
      • If you skipped Step 6 and you do not have a certificate, enter:
        request plugins cisco_trustsec create-account server-cert-verification-enabled no client-name <client-name>host <host-name>
   3. Execute the following command to create the client name.

      admin@Panorama> request plugins cisco_trustsec create-account client-name test host 10.10.10.15
      
      AccountCreate in progress...
      AccountCreate successful.
        client nodename: test
        client password: <xxxxxxxx>
      
      AccountActivate in progress...
      AccountActivate successful.
      
      Please approve the account on the server.

   4. Log in to your Cisco ISE server to approve the account.
   5. Select AdministrationpxGrid ServicesAll Clients.
   6. Select the client name you create on Panorama.
   7. Click Approve.

9. Add pxGrid server information. The Panorama plugin for Cisco TrustSec supports up to 16 pxGrid (Cisco ISE) servers.

   1. Select PanoramaCisco TrustSecSetuppxGrid Server.
   2. Enter a descriptive Name for your pxGrid server.
   3. In the Host field, enter the IP address or FQDN for your pxGrid server.
   4. Enter the client name you created in the previous step.
   5. Enter and confirm the client password you generated in the previous step.
   6. Verify the pxGrid server identity.

      1. Select Verify server certificate.
      2. Select your certificate profile from the Cert Profile drop-down.
   7. Click OK.

10. Configure the Monitoring Definition.

    1. Select PanoramaCisco TrustSecMonitoring Definition and click Add.
    2. Enter a descriptive Name and optionally a Description to identify the monitoring definition.
    3. Select the pxGrid Server.
    4. (Optional) Set Panorama to Monitor pxGrid sessions in AUTHENTICATED state. By default, Panorama retrieves IP-Tag mappings from sessions in the “STARTED” state. ISE sessions have the “STARTED” state when there is a corresponding accounting start packet. If no accounting start packet is present for the session, then the session state is “AUTHENTICATED”.
    5. Select the Notify Group.
    6. Click OK.

11. Commit your changes.
12. Create active ISE sessions so that Panorama can learn SGT tags for dynamic or static address group definition. To create active sessions, use ISE to authenticate devices.

    Panorama does not collect default SGT tags on ISE.
13. Create dynamic or static address groups and verify that addresses are added.

    1. Select ObjectsAddress Groups.
    2. Select the Device Group you created for monitoring endpoints in your Cisco TrustSec environment from the Device Group drop-down.
    3. Click Add and enter a Name and Description for the address group.

       The dynamic address group naming convention is: cts.svr_<server-name>.sgt_<SGT-name>

       The static group naming convention is:

       cts.svr_<server-name>.sgt_<SGT-decimal number>
    4. Select Type as Dynamic or Static.
    5. Click Add Match Criteria.
    6. Select the And or Or operator and click the plus (+) icon next to the security group name to add it to the dynamic address group.

       Panorama can only display security group tags it has learned from active sessions. Security group tags in live sessions appear in the match criteria list.
    7. Select PanoramaObjectsAddress Groups.
    8. Click More in the Addresses column of a dynamic address group.

       Panorama displays a list of IP addresses added to that dynamic address groups based on the match criteria you specified.

14. Use dynamic address groups in policy.

    Dynamic address groups are empty until you attach them to a policy. You won’t see any IP addresses in your dynamic address group unless a policy is using it.

    1. Select PoliciesSecurity.
    2. Click Add and enter a Name and a Description for the policy.
    3. Add the Source Zone to specify the zone from which the traffic originates.
    4. Add the Destination Zone at which the traffic is terminating.
    5. For the Destination Address, select the dynamic address group you just created.
    6. Specify the action— Allow or Deny—for the traffic, and optionally attach the default security profiles to the rule.
    7. Repeats Steps 1 through 6 to create another policy rule.
    8. Click Commit.
15. (Optional) Update the objects from the pxGrid server at any time by synchronizing objects. Synchronizing objects enables you to maintain context on changes in the virtual environment and allows you to enable applications by automatically updating the address groups used in policy rules.

    1. Select PanoramaCisco TrustSecMonitoring Definition.
    2. Click Synchronize Dynamic Objects.