Hello everyone and thank you for watching. My name is Mohammed Zamzam, a customer success specialist at Cisco. In this cyber capsule video, we're diving into a critical resource optimization feature in Cisco secure Firewall elephant flow mitigation. Today I'll show you how we intelligently identify these.00:02Heavy flows to protect your snort processing cores, ensuring your high risk traffic always gets inspected without delay. Here's a quick look at our agenda for today. We'll start by unpacking the problem with elephant flows, how we define them.00:22And how the system evaluates drews. From there, we'll weigh the pros and cons of bypass versus throttling before wrapping things up with a live demo. When managing a network, one of your biggest challenges is protecting firewall resources from resource heavy to.00:38Traffic.00:58We call these elephant flows those massive long running data transfers that honestly don't offer much in terms of security. Yet they have a habit of consuming your snort processing cores. When one of these giants monopolizes a CPU thread, the result is pretty predictable.00:59The engine starts dropping packets, and that's a real issue because it starves the deep packet inspection you need to catch the smaller, faster mice traffic, the kind that's often hiding malicious activity.01:19Our goal is simple. Let's reclaim those processing cycles so your firewall stays focused on what actually matters, catching real threats in real time. Now that we know why large data streams are an issue, let's talk about how we actually define an elephant flow within the system.01:341st, a volume threshold, the flow size must exceed ten to 24 mb or 1 gb. Second, a time threshold, the duration of the data transfer must last longer than 10 s. When a network flow crosses both of these markers simultaneously, it lands squared.01:53Really in the elephant zone.02:13Any data stream sitting outside this quadrant, whether it's short and heavy or long and light, is treated normally, but inside this zone, that's our target. Keep in mind a few deployment requirements for this feature. It requires systems snort three on release 7.2 or.02:16Or later.02:35Also note that it is not supported on the firepower 2100 series hardware. It's important to understand that simply detecting an elephant flow triggers NO automated action on its own. Remediation is strictly reserved for actual durress conditions which are.02:37Defined by three concurrent metrics working together. 1st, we look at CPU utilization. The system monitors the snort engine and this metric is triggered only when snort CPU utilization exceeds 40 % and pushes into the danger zone.02:57Second, high CPU must correlate with an impact on traffic. We measure this through packet drops, specifically requiring packet drops to exceed 5 %. Finally, we factor in time. This isn't triggered by brief spikes. Both the high CPU and the packet drops must be.03:13Stained concurrently over a fixed 32nd time window, only when all three conditions are met does the system classify the state as true system durress. Once the system identifies true durress, we have two different mechanisms to handle the traffic and decrease the load.03:34Bypass and throttling. Each comes with its own set of trade offs across CPU relief, security, and application performance. Let's start with bypass. When a flow is bypassed, it skips the Snort IPS inspection module completely.03:53This provides instantaneous maximum relief to your CPU and processing course, and the application suffers zero performance hit. The flow maintains its full native speed, but the trade off here is that you must accept a blind spot for those specific applications while bypassed. On the other side we have throttling.04:10Think of this like a fluid valve that slows down traffic dynamically in 10 % increments. Because it steps down the traffic incrementally, CPU relief is gradual and iterative rather than instant. Causing artificial latency to the application which can result in noticeable backup or data.04:30Transfer delays, but the massive advantage here is security continuity.04:51It maintains full deep packet inspection throughout the entire process, NO blind spots are introduced. Ultimately choosing between bypass and throttling depends entirely on your organizational priorities. Do you need immediate CPU recovery at the cost of visibility?04:55Or can you tolerate intentional latency to keep your deep packet inspection fully intact? The best part for administrators is incredibly easy to turn it on. Let's see the demo how to configure and monitor it, so let's start our demo.05:14Starting from our FMC dashboard, we can go to policy and choose access control. From access control list, we can choose the list which we need and open the editor, then go directly to advanced settings from more and locate elephant flow settings and open.05:31It's editor and we need to ensure that the elephant flow detection is enabled. Next, let's define an elephant flow. By default, this is set to 1 gb lasting for 10 s, but you can easily customize these thresholds to align with your organization's specific requirements.05:51From here, you can navigate to the elephant flow remediation settings and toggle the feature on. This allows you to define your custom remediation criteria. E.g., the default policy triggers when CPU.06:16New utilization exceeds 40 % for at least 30 min, causing a traffic drop of more than 5 %. We can select the option that best aligns with our requirements, either prioritize good transfer performance while accepting a lack of visibility or maintain full visit.06:32Visibility at the expense of transfer performance. After making our choice.06:52We will proceed to click save. Now let's take a look at how to monitor these flows. Navigate to the analysis tab and select unified events. To view historical data, we can expand our time range, e.g..06:57Let's adjust the duration to look back at the last two weeks. Now, you're all set to filter by reason. Simply select elephant flow as your reason and click apply to filter. You will see a complete list of events.07:13Related to elephant flow. If you would like to explore further, simply click here for a deep dive. You will find comprehensive session details and statistics including the applied policy, initiator and responder information, the threat score, and everything else.07:33You need to know about that specific flow. That brings us to the end of this video. Thank you so much for watching, and I hope you.07:53You found these insights valuable for your workflow. If you found this session useful, please feel free to explore our other resources for more deep dives and guides.08:13
