Integration · Topic 6 of 8
Rapid Threat Containment
Learn how Rapid Threat Containment links FMC correlation rules to ISE adaptive network control so that an infected endpoint is quarantined automatically.
- 4 min
- Includes a diagram
- RTC contains a threat automatically by restricting the endpoint through ISE.
- The FMC uses a correlation rule, a policy and a remediation response.
- The remediation talks to ISE using pxGrid.
What it is
Rapid Threat Containment (RTC) is the idea of reacting to a threat automatically, so that an infected endpoint loses network access quickly.
The firewall detects the threat. The Secure Firewall Management Center (FMC) decides it matters, and it tells Cisco Identity Services Engine (ISE) to restrict the endpoint. ISE then enforces the restriction on the network.
This turns detection into containment without a person having to act in the first minutes.
How it works
RTC uses a chain of features that you have already seen, joined together.
The parts
| Part | Role |
|---|---|
| Detection | An intrusion, malware or other event on the firewall |
| Correlation rule | Decides which events are serious enough to act on |
| Correlation policy | Ties the rule to a response and must be activated |
| Remediation module | The response that talks to ISE through pxGrid |
| ISE adaptive network control (ANC) | Applies a policy to the endpoint |
| Network device | Enforces what ISE decides, such as a switch or a wireless controller |
The flow in order
First, the firewall logs an event, for example an intrusion event with a high impact. The correlation rule matches that event and the policy runs the response.
The response is a remediation that sends a mitigation action to ISE through pxGrid. The action names the endpoint, usually by its IP address, and the ANC policy to apply.
ISE finds the session for that address and applies the ANC policy to the endpoint. The network then enforces the change, so the endpoint is quarantined or restricted.
ANC policies
An ANC policy in ISE is a named action. Common actions are to quarantine an endpoint, to shut down its port and to bounce its port. Quarantine is the most common choice.
The ANC policy only has an effect if ISE has an authorisation rule that reacts to it. That rule gives the quarantined endpoint limited access, such as a remediation VLAN or a restrictive access list.
So the work is on both sides. You set up the response in the FMC, and you set up the matching enforcement in ISE.
Setting it up
- Connect the FMC to ISE through pxGrid, as in the previous page.
- Create the ANC policies in ISE and the authorisation rules that use them.
- In the FMC, create a remediation instance that uses the ISE pxGrid mitigation module and the ANC policy.
- Build a correlation rule for the events you care about.
- Put the rule and the response in a correlation policy and activate it.
Undoing it
Plan how an endpoint comes back, for example after it is cleaned. A quarantined endpoint stays isolated until someone clears the ANC policy in ISE.
Choosing what triggers it
Choose triggers with care. High impact intrusion events or confirmed malware are good choices. Low priority events can cause false quarantines, which stop users from working.
Test with a lab host, and check that ISE shows the policy applied to the right endpoint.
What to remember for the exam
Seven facts cover the usual questions.
- RTC contains a threat automatically by restricting the endpoint through ISE.
- The FMC uses a correlation rule, a policy and a remediation response.
- The remediation talks to ISE using pxGrid.
- ISE applies an ANC policy, such as quarantine, to the endpoint.
- ISE needs an authorisation rule that reacts to the ANC policy.
- The correlation policy has to be activated.
- Triggers should be serious events, to avoid false quarantines.
When a question asks how the firewall can cause an endpoint to be quarantined automatically, think of correlation plus the ISE remediation over pxGrid.
Common mistakes
These four mistakes are common with RTC.
Setting up the FMC side only. ISE also needs an authorisation rule for the ANC policy.
Forgetting to activate the policy. An inactive correlation policy does nothing.
Using weak triggers. Low priority events can quarantine good endpoints.
Having no way back. Plan how an endpoint is released.
An automatic quarantine can disconnect real users. Start with a narrow trigger and a test group.
Check yourself
Work through these three questions.
Which features does the FMC use to start a containment action?
A correlation rule and policy that run a remediation response, which sends the action to ISE through pxGrid.
What does ISE need besides the ANC policy?
An authorisation rule that reacts to the ANC policy and gives the endpoint limited access.
Why choose triggers with care?
Weak triggers can quarantine good endpoints and stop users from working.
Topic 6 of 8 in Integration
Test yourself on Integration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.