Agenda Cisco One C 1 Appendix 2017 Cisco

無線セキュリティの基礎 Agenda 今後のセキュリティ Cisco One (C 1) まとめ Appendix © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 2

Wi-Fi Alliance の対応 • Wi-Fi Alliance はWEPとTKIPの使用を避け、WPA 2に移行することを推 奨しています。 • また、 Wi-Fi 認定された端末に於いてプライマリー インターフェイスへ “TKIP-only” の設定を推奨とすることを禁止しています。 • Wi-Fi Alliance : Security • • http: //www. wi-fi. org/ja/discover-wi-fi/security Technical Note Removal of TKIP from Wi-Fi Devices (2015年 3月) • https: //www. wi-fi. org/download. php? file=/sites/default/files/private/Wi. Fi_Alliance_Technical_Note_TKIP_v 1. 0. pdf (要アクセス権) © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 9

WPA 2 -Enterprise と WPA 2 -Personal Wi-Fi Alliance による認定 WEP 脆弱 WPA Enterprise WEP 必須 暗 脆弱 号 TKIP 化 AES 認証 オープン/ 共通鍵 802. 1 X WPA 2 Personal Enterprise Personal アルゴリズ ム 完全性保証 - - RC 4 CRC 32 必須 任意 RC 4 Michael 任意 必須 AES CCM PSK 802. 1 X PSK 参考：WPA 2は、WPAと違い事前認証、PMKキャッシュが行えます。 WEP、TKIP、AES+TKIPは、11 n/ac では本来の通信速度が出ず、速度劣化が起きます。 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 10

Cisco PI クライアントの検索 検索結果一覧から、さらにフィルタで絞り込み © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 38

Cisco ISE 2. 2 Wireless ウィザード 3ステップでADを 利用した認証設 定が終了!! © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 42

Cisco CMX Connected Mobile Experiences : 位置情報 Connected Mobile Experiences (CMX) は無線機器の位置を計算・履歴保存とその 情報を基に傾向分析、ユーザ アプリとの連携ができます。 移動 ダッシュボード 平均滞在時間 マップ 訪問者 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 46

Cisco ISEエントリー モデル : Cisco ISE Express 簡単、お手頃なゲスト サービス 内容: One (1) ISE VM に 150 Endpointの ISE Base が同梱 (for Single Site Deployment (non-distributed, no HA)) 機能: Guest, RADIUS/AAA, Unlimited Custom Portals with ISE Portal Builder 型番: R-ISE-GST-BUN-K 9= © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 48

Cisco ISE Base vs. Cisco ISE Express 機能 Cisco ISE Base Cisco ISE Express Guest Access; RADIUS/AAA プラットフォームにラ いいえ イセンスが付いている ライセンスとハードウェアもしくは VM版を購入 か 特徴 今後の機能や端末数の 拡張が可能 はい 1 ISE VM + 150 Licensesがバンドル 同じライセンス数なら かなりお得 * NOTE: ATP certification or partner involvement is needed for additional ISE license sales © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 49

参考 Cisco ISE License Comparison Chart Cisco ISE Feature or Service Basic RADIUS Authentication, Authorization, and Accounting, Including 802. 1 x, MAC Authentication Bypass Web Authentication (Local, Central, Device Registration) MACsec (All) Guest Portal and Sponsor Services Representational State Transfer (Monitoring) APIs External RESTful Services (CRUD)-Capable APIs Security Group Tagging (Cisco Trust. Sec ® SGT) ISE VM License Included Maximum Nodes per Deployment Maximum Endpoints per Deployment Wireless Guest Setup Wizard ISE Portal Builder High-Availability/Distributed Deployment Device Administration (TACACS+) Cisco ISE Express Bundle Standard ISE Licenses Base Device Admin Plus Apex Mobility Yes Yes Yes 1 5000 Yes 要アップグレー ド* Yes Yes Yes Yes Yes Yes 50 500000 Yes Yes Profiling Yes Profiler Feed Service Yes Device Registration (My Devices Portal) and Provisioning (for BYOD Initiatives) Yes Context Sharing (Cisco px. Grid) Yes Endpoint Protection Services (EPS) Yes Posture (Endpoint Compliance and Remediation) Yes Enterprise Mobility Management and Mobile Device Management (EMM and MDM) Yes Integration Cisco Any. Connect Unified Agent Posture (Requires Cisco Any. Connect Apex License) Yes Wired Access Control Yes Yes * Customers who would like to expand beyond the constraints of ISE Express (say, additional ISE nodes, or go beyond 5000 endpoints), should purchase the ISE Express Upgrade, to convert their ISE Express node to a ‘normal’ ISE base license. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 50

Cisco ONE (C 1)

Cisco ONE が提供する主要ソフトウェア Cisco ONE for Access (Wireless) HW Foundation Advanced Applications Advanced Security AP Cisco WLC APライセンス Cisco Prime PI ライセンス Cisco ISE Base Cisco MSE Base ISE Plus、ISE Apex CMX/w. IPS © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 54

Appendix

Cisco ONE for EN の種類 Access WAN Cisco ONE for Access Cisco ONE for WAN ワイヤレス スイッチ ルータ EN (Enterprise Networking) ：ルータ、スイッチ、ワイヤレス製品の総称 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 60

Cisco ONE Software 詳細 Cisco ONE for Access Advanced Security Cisco ONE for WAN Policy & Threat Defense for Access Threat Defense for WAN ISE Plus, ISE Apex Any. Connect Apex AMP for Endpoint Fire. POWER Services on ASA Security Context, Security Plus Cisco Security Manager Cisco ASA® 5506, 5508, 5512, 5515, 5525, 5545, 5555 Advanced Applications Foundation Campus Fabric Advanced Mobility Services IP Services CMX WIPS Full L 3 Routing, Virtualization (VRF, EVN) IS-IS, WCCP, Multicast Foundation for Switching Foundation for Wireless IP Base WLC AP MSE Base PI Lifecycle PI Assurance ISE Base Trust. Sec, Media. Net, Stub. Routing, Converged Access, FNF, Wire. Shark, VSS, ISSU PI Lifecycle, PI Assurance ISE Base Energy Mgmt スイッチ Cisco Catalyst® 2 K, 3 K, 4 K, 6 K WAN Collaboration UC License TDM Gateway / CUBE UC Apps、CME/SRST Foundation for WAN SEC License Trust. Sec, MACSec, IOS VPN, IOS IPS, IOS ZBFW, CWS Connector, SSL VPN APP License AVC, MPLS, WAAS, FNF, etc Prime v. NAM, PI Lifecycle, PI Assurance Energy Mgmt ワイヤレス WLC, AP WAN ISR, ASR © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 63

対象製品 Category Switch Item Name C 1 FPCAT 36501 K 9 CON-PSBU-C 1 FC 3651 C 1 FPCAT 36502 K 9 CON-PSBU-C 1 FC 3652 C 1 FPCAT 38501 K 9 CON-PSBU-C 1 FPC 38 S C 1 FPCAT 38503 K 9 CON-PSBU-C 1 FC 3853 C 1 APCAT 38503 K 9 CON-PSBU-C 1 AC 3853 C 1 FPCAT 38504 K 9 CON-PSBU-C 1 FC 3854 C 1 APCAT 38504 K 9 CON-PSBU-C 1 AC 3854 C 1 FPCAT 38502 K 9 CON-PSBU-C 1 F 1 C 382 Category Wireless Router Item Name C 1 FPAIRK 9 CON-PSBU-C 1 FPAIR 500 K 9 CON-PSBU-C 1 FPAIR 5 C 1 FPAIR 1000 K 9 CON-PSBU-C 1 FPAI 1 K C 1 F 1 PISR 4400 SK 9 CON-PSBU-C 1 F 1 PISR CON-PSBU-C 1 F 4330 S C 1 F 1 PISR 4350 SK 9 CON-PSBU-C 1 F 4350 S © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 65