© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2 How do I classify so many devices coming onto my network? How do I allow suppliers and contractors to collaborate securely? Do we have control over devices connecting to our applications & data in the DC? Virtual Machine Sprawl! How should I manage security for all of those VMs we are being asked to provision everyday? My critical services are still running on physical servers. Do I maintain separate policies?

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3 Simplifying network security and engineering Secure Embeds security within the infrastructure Enforcement based on rich contextual identify of users and systems Solution simplicity enables end-to-end approach Efficient Simplifies implementation of security policy Highly scalable & Inline rate Simplifies Data Center network design Demonstrable ROI Reduces ACL and VLAN complexity & maintenance Can automate Firewall policy administration Can improve both performance & availability

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4 Translating Business Policy to the Network TrustSec lets you define policy in meaningful business terms Business Policy Source Destination Exec PC Prod HRMS HR Database Prod HRMS Storage Exec BYOD XXXX XXXX XX XX Distributed Enforcement throughout Network SwitchRouterDC FWDC Switch

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5 WLC CAPWAP Tunnel Access Points Internet VLAN ACL  Securing BYOD becomes critical after On-boarding process.  VLAN Segmentation and static ACL are common implementation  Current solution relies on named ACLs (64 ACL max) or static policy (ACL) on other network devices ACL DC-PCI-DB DC-PCI-Web Local PCI Server

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6 Segmentation using Security Group, independent from topology Offload filtering to ASA for rich and scalable policy rule automation Simplified network design, lowering operational cost WLC CAPWAP Tunnel Internet VLAN BYOD Tag POS Tag Audit Tag SGACL/FW Device ISE BYOD Device Audit DC-PCI-DB DC-PCI-Web Local PCI Server Payment System Single VLAN

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7 Legacy Emerging  Data Center and Server Consolidation  Server Virtualization  “Any workload on any server”  Unpredictable traffic flows as workloads migrate  Accidental Architectures  Applications deployed in fixed positions (ex. multi-tier deployment)  Predictable traffic flows  Security often deployed to each pod or silo

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8 DEPLOYMENT USE CASES. Healthcare: Ensure Privacy of Patient Data by Enforcing Roles Based Access and Segmentation Across the Network Retail: Intra Store Communication for Networked Devices While Ensuring That Only Authorized Users and Devices Have Access to PCI Data Technology: Allowing Approved Employee-Owned Tablets Access to Internal Portals and Corporate App Store Manufacturing: Marking Extranet Traffic to Allow PLC Vendor Remote Access to Specific Manufacturing Zone Only, and Offshore Development Partners Access to Development Servers Only

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9 SecureEfficient Demonstrable ROI Embed security within the infra Enforcement based on rich context Solution simplicity enables end-to-end approach Simplifies implementation of security policy Highly scalable & Inline rate Simplifies Data Center network design Reduces ACL and VLAN complexity & maintenance Automates FW policy Improve both performance & availability

© 2012 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10 Thank you.