Adaptive Policy for MX/Z Platforms

Overview 

This document will cover only the WAN Appliance aspects of the feature enablement process. For more details on the Adaptive Policy feature and its supportability with other platforms, please review this documentation article.

Companies are looking for more granular security and control over segmentation across their network infrastructure. The most challenging part when it comes to network administration and compliance management is monitoring, scaling, and proper security policy of a user/device regardless of where and how the device connects. A security breach can occur with any organization that has to manage many different security policies that are not using the same policy constructs and allow for the same controls.

Traditional segmentation is based on subnets, VLANs and ACL rules. The rule sets are limited to the network which it resides in and is not meant to be globally scalable. Moreover, maintaining ACL based rules can become an operation challenge in sizable deployments with thousands of rules to maintain. Modification of any rule set requires removal/addition/resequencing which brings administrative overhead and complexity. This is a big operational challenge and oftentimes, administrators prefer to add more rules instead of optimizing existing ones. 

Cisco’s solution to this challenging problem is Cisco TrustSec (CTS). CTS simplifies policy management by segregating endpoint traffic into groups. Each group is assigned to a Security Group Tag (SGT) and all user traffic associated with the group inherits the tag and its associated enforcement policy (decentralized policy enforcement). The policy should be applied locally and across infrastructures for better security and administration. When a user connects to the network, the assigned tag to the user becomes the identity, and the networking devices use this tag to enforce policies and to make forwarding decisions regardless of where and how the end device connects to the network. In addition, policies can be managed centrally using Cisco ISE and are provisioned dynamically on demand.

Adaptive Policy Architecture 

Adaptive Policy has three key components: 

• Identity classification and propagation 

  •  A tag that is applied to frames from a source device and acts as an identity or grouping for a user/device

• Security policy definition 

  • A policy comprised of a source tag, destination tag, and the permissions between them

• Policy deployment and orchestration

  • An engine that implements the policy on supported network devices 

  • Enforcement is done on the destination networking device for scalability

  • Destination networking device will deny or allow the flow on the egress based on the policy rules

Functionality Breakdown

To enable Adaptive Policy on a MX/Z network the following conditions must be met:

Supported models include all Models that can upgrade to firmware 18.1, except MX84. 

Prerequisites  

1. Verify the MX/Z is running the latest MX18.x and above firmware
2. Verify the minimum license support
   • SGT Transport requires an Advanced Security license
   • SGT Assignment and Transport requires the Secure SD-WAN Plus license
   • SGT Enforcement, Assignment, and Transport requires the Secure SD-WAN Plus license
   • For license details, please refer to the MX licensing page. 

Configuration

Compatibility With Other Cisco Technologies 

With adaptive policy utilizing Cisco’s inline SGT functionality the feature is compatible across a number of solutions including but not limited to:

• Catalyst switching and routing (3k, 4k, 6k, 9k, ISR)

• ASR and CSR

• Sourcefire Next Generation Firewalls (FTD)

• Adaptive Security Appliances (ASA)

• Application Centric Infrastructure (ACI)

• Datacenter switching (Nexus)

• Software Defined Access (SD-Access)

For more information on which Cisco platforms support inline SGTs please see: Cisco Trustsec Compatibility Matrix

For Documentation on interoperability with Catalyst please see: Adaptive Policy and Catalyst Interoperability

For Documentation on interoperability with Cisco Identity Services Engine please see: Adaptive Policy and Cisco ISE