Secure Firewall Network Discovery

Hello, welcome to this cyber capsule. In this video, we will talk about the network discovery policy and its configuration.00:06We will talk about the definition of network discovery policy, also about host profiles, and we will see a quick demo of this configuration. Network discovery policy is the process of gathering information about the nodes on the network.00:18As well as users and applications in your network environment. The firewall can gather information passively.00:35By observing traffic flows. This policy provides deeper visibility into the network environment and allows the firewall administrator to take advantage of the FMC, which is the firewall management console automatically optimizing, e.g..00:42The intrusion policy, and I can use it as a reference for adjustments. It's also useful to keep the network discovery policy up to date for whenever you need to investigate any IP address in the environment.00:59FMC builds host profiles based on the network discovery policy you define, and it's important to note that the system does not automatically create host profiles by default. We need to enable and configure the network discovery policy.01:18Host profiles provide basic information about detected hosts or devices and depending on the system's licenses and configuration, host profiles can offer you information. E.g., the operating system running on some host.01:33The running servers, the web clients and applications, the running protocols, the indicators of compromise, the VIALAN headers, the last 24 h of user activity.01:50The most recent malware events and vulnerabilities associated with a host. As best practices, the configuration of the network discovery policy should initially cover two criteria. 1st, monitor a specific network segment. By default, you will find a rule with.02:05All zeros 0000.02:25Which is only discovering applications. This needs to be changed and refined. Next, discover both hosts and applications. Also adjust the policy to reflect your internal networks as the source instead of having network not in as either the source or destination.02:29If the configuration remains at default, you might obtain profiles of hosts and networks external to your organization. You should avoid duplicating network segments or nodes within the policy whenever possible, and also avoid overlapping networks with any host.02:47Finally, exclude load balancers and NAT devices from the network discovery policy. Let's take a quick look at a demo of the network discovery configuration. Inside FMC.03:05I'll go to policies and then click on network discovery. There appears a rule with the default settings, discovering only applications. I'm going to fine tune it.03:22I wanted to discover not everything that communicates with the firewall, but only to uncover these segments or sub networks that I am protecting. I will delete the default configuration, and at the top.03:37I will choose hosts and users so that they are also added as part of the database of this host. I am going to click save. I have the 1st rule ready, and I am going to add an additional rule in the option add rule to exclude a load balancer that I have.03:53On the network.04:13Since the object is not on the list on the left, I am going to introduce it in the network address space. I click on the add option for it to be included and finally click on save. Alright, my network discovery policy is complete.04:16Now, to monitor the policy, I'm going to analysis and note all the information available about the environment. I'm going to focus on network map, to show you what is indexed.04:34The network information shows up in the 1st few objects, and from there I can find the IP address I'm interested in. Specifically, I want to investigate this IP address because I received an alert, and the IT team wants to know who or what it belongs to. By clicking on the IP, I discover.04:51That there are indicators of compromise related to this IP address.05:11And I see that the firewall already includes information about the operating system present, applications, and ports being utilized within the host. Alright, below, I see the vulnerabilities associated with this host and.05:15Well, from here, I can take more targeted action regarding this device. Back to the presentation, let's talk about the key points to remember. Network discovery automates the creation of host or device profiles.05:32We need to follow the best practices we discussed earlier, then access the analysis section and under network map, see all the options we have to understand what is in our environment. Finally, keep the database with vulnerabilities up to date.05:48Thanks for watching this video.06:05