Skip to content
Log in Sign up My account

5.4 Network Security Design

Blueprint 5.4: Describe the components of network security design

  • 5.4.a Threat defense
  • 5.4.b Endpoint security (including 802.1X, MAB and WebAuth network access control)
  • 5.4.c Next-generation firewall
  • 5.4.d TrustSec and MACsec

This is a describe objective with a lot of product names. Expect "match the product to its function", "which feature solves this problem" and "put the 802.1X exchange in order" questions. You do not need to configure a firewall, but you should recognise switch-side 802.1X and MAB configuration and know what TrustSec and MACsec add.

No single product secures a network. The design idea is defence in depth: several independent layers, so an attacker who gets past one still meets the next, and visibility in every layer so you can see what got through.

graph LR
  INT["Internet"] --> DNS["DNS-layer security<br/>Umbrella"]
  DNS --> FW["Edge NGFW and IPS<br/>Secure Firewall"]
  FW --> WEB["Web and email gateways"]
  WEB --> NET["Campus network<br/>802.1X, TrustSec, MACsec"]
  NET --> EP["Endpoint<br/>Secure Endpoint, posture"]
  NA["Secure Network Analytics<br/>NetFlow behaviour"] -.-> NET
  TAL["Talos threat intelligence"] -.-> DNS & FW & WEB & EP
  ISE["ISE: identity and policy"] -.-> NET

5.4.a Threat defense

Cisco describes threat defense across an attack continuum:

Phase Goal Examples
Before Discover assets, enforce policy, harden ISE access control, firewall policy, segmentation, vulnerability management
During Detect and block attacks in progress NGFW with IPS, DNS-layer blocking, email and web filtering, anti-malware
After Scope, contain and remediate what got through Network behaviour analytics, retrospective malware detection, XDR investigation

Cisco threat defense portfolio

Current names, with the older names you may still see in questions and documentation:

Product Former name What it does
Cisco Secure Firewall (Threat Defense software) Firepower NGFW, FTD Stateful firewall, application control, Snort IPS, URL filtering, VPN
Secure Firewall Management Center Firepower Management Center (FMC) Central manager for Secure Firewall
Cisco Umbrella OpenDNS DNS-layer security: blocks requests to malicious domains before a connection is made, plus secure web gateway and cloud firewall functions
Cisco Secure Endpoint AMP for Endpoints Endpoint protection and response: malware blocking, file reputation, retrospective detection (a file later found malicious is flagged everywhere it was seen)
Cisco Secure Malware Analytics Threat Grid Sandbox that detonates suspicious files and reports their behaviour
Cisco Secure Email Email Security Appliance (ESA) Anti-spam, anti-phishing, malware filtering for mail
Cisco Secure Web Appliance Web Security Appliance (WSA) Web proxy with URL filtering and malware scanning
Cisco Secure Network Analytics Stealthwatch Uses NetFlow and other telemetry to baseline behaviour and detect anomalies such as data exfiltration or command-and-control traffic, including inside encrypted flows
Cisco ISE Identity Services Engine: AAA, 802.1X, profiling, posture, guest, TrustSec policy
Cisco Duo Multi-factor authentication and device trust
Cisco XDR SecureX (earlier platform) Correlates detections from several products for investigation and response
Cisco Talos Threat intelligence research group whose data feeds all of the above

Exam trap

Talos is not a product you deploy. It is the research organisation that produces the threat intelligence used by Umbrella, Secure Firewall, Secure Endpoint, Secure Email and others. If an answer says "deploy Talos on the edge", it is wrong.

IDS versus IPS

IDS IPS
Placement Out of band, receives a copy (SPAN or TAP) Inline in the traffic path
Can block? No, alerts only (can sometimes reset connections) Yes, drops malicious packets
Failure impact None on traffic Can affect traffic, so needs fail-open or high availability
Detection Signatures, anomalies, policy Same

5.4.b Endpoint security

Endpoint security has two halves: protecting the device itself (anti-malware, EDR, disk encryption, patching), and controlling which devices may join the network and what they may reach (network access control). The second half is where the switch comes in.

Network access control methods

Method Identity used Needs Good for
802.1X User or machine credentials or certificate (EAP) A supplicant on the endpoint and a RADIUS server Managed laptops and phones
MAB (MAC Authentication Bypass) The endpoint's MAC address Nothing on the endpoint Printers, cameras, IoT, anything without a supplicant
WebAuth A user typing credentials into a web portal A browser Guests, contractors

802.1X roles and flow

Role Device Talks
Supplicant Endpoint (laptop, phone) EAP over LAN (EAPoL, EtherType 0x888E) to the switch
Authenticator Access switch or wireless controller Relays EAP inside RADIUS to the server, then opens or keeps the port closed
Authentication server Cisco ISE (RADIUS) Validates credentials, returns the authorization result

Until authentication succeeds, an 802.1X port only accepts EAPoL frames (plus CDP and STP). After an Access-Accept, the port opens and the RADIUS response can assign a VLAN, a downloadable ACL or a Security Group Tag (SGT).

sequenceDiagram
  participant S as Supplicant
  participant A as Switch (authenticator)
  participant R as ISE (RADIUS)
  Note over A: Link up, port unauthorized
  A->>S: EAPoL EAP-Request Identity
  S->>A: EAP-Response Identity
  A->>R: RADIUS Access-Request (EAP inside)
  R->>A: Access-Challenge (start EAP method, e.g. PEAP or EAP-TLS)
  A->>S: EAP method exchange in EAPoL
  S->>A: EAP method exchange
  A->>R: Access-Request
  R->>A: Access-Accept with VLAN, dACL or SGT
  A->>S: EAP-Success
  Note over A: Port authorized

Common EAP methods:

Method Client proves identity with Server certificate Notes
EAP-TLS Client certificate Yes Strongest, needs a PKI for clients
PEAP (MSCHAPv2 inside) Username and password Yes Common in Windows domains
EAP-FAST Credentials, with a PAC instead of a certificate Optional Cisco-developed
EAP-TTLS Various inner methods Yes Common with non-Windows supplicants

MAB and fallback timing

With MAB, the switch learns the endpoint's MAC address from its first frame and sends it to RADIUS as both username and password. ISE decides whether that MAC is known (often after profiling has identified it as a printer or a camera).

A port configured for both 802.1X and MAB tries 802.1X first by default. The switch sends EAP-Request Identity every tx-period (30 seconds by default) and gives up after max-reauth-req retries (2 by default). With the defaults, a device with no supplicant waits about 90 seconds before MAB starts. Lowering dot1x timeout tx-period (for example to 10 seconds) shortens the wait.

Exam trap

MAB is not strong authentication: MAC addresses are easy to spoof. It is a way to bring devices without a supplicant under central policy, usually combined with profiling and a restrictive authorization (a dACL that allows only what a printer needs).

WebAuth

Type Where the portal lives How it works
Local WebAuth (LWA) On the switch or WLC The network device intercepts HTTP and serves its own login page, then checks the credentials with RADIUS
Central WebAuth (CWA) On ISE MAB runs first; ISE returns a URL redirect and a redirect ACL. The user logs in on the ISE portal, and ISE sends a RADIUS Change of Authorization (CoA) to re-authorize the session with full access

CoA is how ISE changes an existing session (after a guest login, a posture result or a profiling change) without waiting for re-authentication. Cisco devices listen for CoA on UDP 1700 by default; RFC 5176 specifies UDP 3799.

Host modes

Host mode Behaviour
single-host One endpoint authenticates; a second MAC triggers a violation
multi-host First endpoint authenticates and opens the port for everyone behind it
multi-domain One device in the data VLAN plus one IP phone in the voice VLAN
multi-auth Every MAC authenticates separately (one in the voice domain, many in data)

Switch configuration (recognise, not memorise)

aaa new-model
radius server ISE-1
 address ipv4 192.168.100.20 auth-port 1812 acct-port 1813
 key ENCOR-RAD
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa accounting dot1x default start-stop group radius
dot1x system-auth-control
!
interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 10
 authentication host-mode multi-auth
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 10
 spanning-tree portfast

! Current IOS XE releases use Identity-Based Networking Services 2.0.
! Legacy commands are accepted and converted; 'authentication display
! new-style' shows the equivalent policy-map type control subscriber.
Switch# show access-session interface GigabitEthernet1/0/10 details
            Interface:  GigabitEthernet1/0/10
          MAC Address:  5254.0012.3456
         IPv4 Address:  10.10.10.25
            User-Name:  jdoe
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
            Vlan Group:  Vlan: 10
      Method status list:
               Method           State
               dot1x            Authc Success

Key commands: dot1x system-auth-control turns 802.1X on globally; authentication port-control auto makes the port actually enforce it (without it the port stays open). aaa authorization network is needed for the switch to apply a VLAN, dACL or SGT returned by ISE. Verify with show access-session (or show authentication sessions on older releases) and show dot1x interface.

Exam trap

authentication order sets the sequence the switch tries methods in. authentication priority decides which method wins if more than one succeeds, for example letting a late 802.1X success override an earlier MAB session. They are different commands with different jobs.

5.4.c Next-generation firewall

A traditional stateful firewall tracks connections and filters by IP address, protocol and port. An NGFW adds context:

Capability Stateful firewall NGFW
Connection state tracking Yes Yes
ACLs by address and port Yes Yes
NAT, VPN Yes Yes
Application identification and control regardless of port (for example, allow Webex but block file sharing over 443) No Yes
Integrated IPS with signature and anomaly detection No Yes
URL filtering by category and reputation No Yes
User and group identity in rules (from ISE or a directory) No Yes
Advanced malware protection and file inspection No Yes
TLS decryption for inspection No Optional, policy-driven

Deployment choices:

  • Routed mode: the firewall is a Layer 3 hop with its own addresses.
  • Transparent mode: the firewall acts like a bump in the wire at Layer 2, so it can be inserted without readdressing.
  • Inline versus passive: inline interfaces can block, passive (tap) interfaces only detect.
  • High availability: active/standby failover pairs or clusters.

On Cisco Secure Firewall, the policy is managed from Secure Firewall Management Center, the on-box Device Manager, or Cisco's cloud management service.

5.4.d TrustSec and MACsec

TrustSec

Traditional segmentation ties policy to IP addresses and VLANs. That breaks when users move or addresses change, and ACLs grow with every new subnet. Cisco TrustSec assigns each endpoint a Security Group Tag (SGT) based on its identity (for example Employees, Contractors, Printers, PCI Servers) and writes policy between groups instead of between subnets.

TrustSec has three functions:

Function How
Classification Assign an SGT. Dynamic: ISE returns it in the 802.1X or MAB Access-Accept. Static: map an IP, subnet, VLAN or port to an SGT (typical for servers)
Propagation Inline tagging: the SGT rides in the Cisco Meta Data (CMD) header in the Ethernet frame (EtherType 0x8909), hop by hop between capable devices. SXP (SGT Exchange Protocol, TCP 64999): a speaker sends IP-to-SGT bindings to a listener over a TCP session, for hardware that cannot tag inline
Enforcement SGACLs on switches and routers, or SGT-based rules on a firewall. Usually done at egress, near the destination, where both the source tag and the destination group are known 
graph LR
  U["Contractor laptop"] -- "802.1X, ISE assigns SGT 20" --> AS["Access switch<br/>classify"]
  AS -- "inline tag SGT 20" --> DS["Distribution<br/>propagate"]
  OLD["Legacy access switch<br/>no inline tagging"] -- "SXP TCP 64999<br/>IP-to-SGT bindings" --> DS
  DS -- "inline tag SGT 20" --> DC["DC switch<br/>enforce SGACL"]
  DC -. "SGT 20 to SGT 50 denied" .-> PCI["PCI server SGT 50"]

ISE holds the policy matrix (source SGT by destination SGT, with an SGACL in each cell) and pushes the relevant cells to enforcement devices. Adding a new contractor subnet needs no ACL changes, because the contractor still gets SGT 20.

Useful verification commands on a TrustSec switch: show cts role-based sgt-map all (IP-to-SGT bindings), show cts role-based permissions (downloaded SGACLs), show cts sxp connections (SXP peers) and show cts interface (inline tagging state).

TrustSec is also the policy model inside SD-Access, where the SGT is carried in the VXLAN header (see SD-Access).

MACsec

MACsec (IEEE 802.1AE) encrypts and integrity-protects Ethernet frames on a link. Each MACsec-capable device decrypts arriving frames, processes them (switching, QoS, ACLs, inline SGT), and encrypts them again on the next MACsec link. That is hop-by-hop protection.

MACsec IPsec
Layer 2 (Ethernet frame) 3 (IP packet)
Scope One link, hop by hop End to end between tunnel endpoints, across routed hops
Encryption AES-GCM, 128 or 256 bit Several options, commonly AES-GCM or AES-CBC
Key agreement MKA (MACsec Key Agreement, IEEE 802.1X-2010) IKEv1 or IKEv2
Typical use Campus links, host-to-switch, data centre interconnect Site-to-site VPN over the internet
Throughput Line rate in switch hardware Depends on crypto hardware

MACsec use cases:

  • Host to switch (downlink): keys are derived from an 802.1X EAP session (EAP-TLS, for example) and MKA runs between the supplicant and the switch.
  • Switch to switch (uplink): MKA with a pre-shared key from a key chain, or Cisco's TrustSec NDAC with SAP on supporting platforms.

MACsec adds a security tag (SecTAG) and an integrity check value (ICV) to every frame, up to 32 bytes in total, so plan the MTU on MACsec links. Verify with show macsec summary, show macsec interface and show mka sessions.

Exam trap

MACsec does not give end-to-end encryption between two hosts across a routed network. Every MACsec device in the path sees the frame in clear text internally. If a question needs encryption across an untrusted WAN or the internet, the answer is IPsec (or TLS), not MACsec.

Exam trap

TrustSec does not require MACsec. Inline SGT tags work on plain links. MACsec is optional and protects the tag (and everything else in the frame) from being read or changed on the wire.

Lab: 802.1X with MAB fallback

Topology: ACC1 access switch, a RADIUS server on an Ubuntu node at 192.168.100.20 (FreeRADIUS is enough for this lab, Cisco ISE if you have the resources), Host1 on Gi1/0 (or any free access port), and a second host on another access port acting as a "printer" with no supplicant. See Lab Setup.

Lab platform

IOSvL2 has limited 802.1X support and may reject or ignore some commands. If your image does, do this lab on a physical Catalyst switch, or treat steps 2 to 4 as a configure-and-read exercise and focus on the verification commands.

  1. On the RADIUS server, define ACC1 as a client with the shared key ENCOR-RAD. Create a user jdoe with a password for 802.1X, and a user named after the printer's MAC address (12 lowercase hex digits, no separators, which is the default MAB username format) with the same string as its password.
  2. On ACC1, configure the RADIUS server, AAA lists and dot1x system-auth-control from the legacy example on this page. Create a local break-glass user first.
  3. Configure the host port and the printer port with authentication port-control auto, mab, dot1x pae authenticator, authentication order dot1x mab and dot1x timeout tx-period 10.
  4. On Host1, configure the supplicant (for example wpa_supplicant with the wired driver and PEAP or EAP-MD5 credentials for jdoe).
  5. Verify with show access-session interface <host port> details. Expected: Status: Authorized, dot1x Authc Success, User-Name: jdoe.
  6. Watch the printer port: show access-session interface <printer port> details shows dot1x running, then after about 30 seconds with the shortened timer, mab Authc Success and User-Name equal to the MAC address.
  7. Remove dot1x timeout tx-period 10 and bounce the printer port. Time how long MAB takes now (about 90 seconds with defaults).
  8. Change the printer's RADIUS password so MAB fails. Expected: Status: Unauthorized, and the printer can not reach its gateway.
  9. Run test aaa group radius jdoe <password> legacy on ACC1 to confirm the switch can talk to the server independently of the port.

Quick check

A switch port is configured for 802.1X and MAB with default timers. An IP camera with no supplicant is plugged in. Roughly how long before MAB is tried, and how do you shorten it?

About 90 seconds: three EAP-Request Identity attempts at the 30-second tx-period. Lower dot1x timeout tx-period (for example to 10 seconds).

A legacy distribution switch cannot carry SGTs inline. How can the enforcement point still learn which SGT belongs to each IP address?

Use SXP. The device that knows the IP-to-SGT binding (or ISE itself) acts as an SXP speaker and sends the bindings over TCP 64999 to the enforcement device as listener.

Which feature identifies applications regardless of the port they use: a stateful firewall or an NGFW?

An NGFW. A stateful firewall identifies traffic by addresses, protocol and port only.

References

  • Cisco ISE Administrator Guide and the ISE Secure Wired Access Prescriptive Deployment Guide (search on cisco.com)
  • Cisco TrustSec Configuration Guide for Catalyst switches (search "TrustSec configuration guide" on cisco.com)
  • Cisco IOS XE "MACsec Encryption" configuration guide chapter for Catalyst 9000 (search on cisco.com for your release)
  • Cisco Secure Firewall Threat Defense and Management Center documentation (search "Secure Firewall Management Center configuration guide" on cisco.com)
  • IEEE 802.1X-2020 (port-based network access control) and IEEE 802.1AE (MACsec), available from IEEE
  • RFC 3748: EAP, RFC 5176: RADIUS Dynamic Authorization (CoA), RFC 5216: EAP-TLS
  • Cisco Live On-Demand Library: search "TrustSec", "MACsec" and "ISE wired 802.1X"