Good morning, everyone. In this video, I will show you that zero trust access in the Cisco secure Firewall threat defense. My name is Luca Chicarrello and I am a security customer success specialist with Cisco.00:05In this session, I will cover the zero Trust clientless access with a final demo. Starting from seven.four release of threat defense software, you can now provide a zero trust clientless access with Cisco secure firewall.00:21Now your users on the internet or campus network can use a browser to securely access the web applications behind your firewall. The zero trust access follows the CTNA principles, providing access with strong multi factor user authentication.00:40Granting a per application access and evaluating the posture of the endpoint. On top of that, the client application traffic is fully decrypted and subject to intrusion and malware protections and at the same time, providing a seamless user.01:01Experience with SAML authentication flow and single sign on. Let's now have a look at how it works. Once your client types in the URL of the application in the browser, the request is directed by the DNS resolution.01:20To the firewall's interface. The firewall redirects the user to the SAML identity provider for authentication and authorization. The SAML provider requests user credentials and may impose multi factor authentication and perform posture assessment.01:40Upon success, the client redirects back to the firewall with a message holding the SAML assertion. The firewall verifies the SAML response provided by the client.02:02And if accepted, will responds with a ZTA cookie which allows the client to access the protected application. The firewall also decrypts the client packets and protects your internal application with snort. With that being said, let's now have a look.02:14Look at how to configure the zero trust access in the secure firewall. You can find the clientless ZTNA under policies and zero trust application. Let me create a new policy and walk you through the configuration process.02:34In this initial setup page, you configure the global setting of your CTA policy. At the top of the page, you can see a nice reference diagram with the key elements of the ZTA setup. Let's see how these elements make up the zero trust application policy.02:56We will start with the name and then we need to use a domain name. The domain name you configure here is required by the firewall to construct an URL based used by the clients during the authentication flow.03:14In my case, I will use look at AU. Whenever you configure a new app in the TTA setup, you need to ensure the DNS is configured to resolve to the correct element of the solution. In this case, the domain name must resolve to the IP address of the firewalls.03:35This Interface process to the end user. In my lab setup, I use this domain name which I already pre configured on my DNS server. So let me switch over to the firewall console and in my test PC to confirm if the domain name results correctly. I will so open the CL.03:55Eye of my firewall, and this is my client computer.04:15From my firewall CLI, I can see that the gigabyte zero zero byte zero interface, it is named as outside interface and it's actually the outside interface of my firewall. Now I need to be sure that my client on my remote client will be able to.04:22Being the URL which I have configured in my policy. In this case, I can see how I can resolve the fully qualified domain name to the IP address, which is the same used by the outside interface of my.04:42Firewall. Let me come back on the FMC, and here we have the most important configuration element which is the firewall's identity certificate. This is the certificate that represents.05:02All your protected applications during the zero trust authentication. The firewall performs the full TLS decryption of the client session and therefore must present a certificate that is trusted by the client and valid for any ZTA application.05:22In my case, I will use the object, which is named wildcard my domain.au. I already created this object. This is a wildcard certificate which I already installed and enrolled onto my FTD.05:42Device. If I go under devices and certificates I can see that the certificates is attached to the FTD, which is running the policy. It's mandatory to use a certificate which has the subject alternative name which.06:02Match the FQDN or the private application or it can be a wildcard certificate. If I open the certificate, I can see that in the sun I have configured a wildcard certificate for my domain.06:22Which is enough. Then we have the security zone. We specify the client side security zones, which will accept the CTA clientless connection. In my example, I will configure the.06:36Outside zone, and I will leave the default port range which will be used by the client to reach the protected application. I also have the option to put the security controls such as the malware and file policy and the inclusion policy. So for the goal of this.06:56Demo of this demo, I will use the balanced security and connectivity. Now, with all this being said, we can proceed to configure the application access. I will then click on save. Okay, so now we have the options to configure an.07:16Application group or an individual application. The application groups allow you to club multiple apps together providing single sign on and protection settings.07:36So e.g., if you can see if you configure two applications in the same group, the clientless user has to authenticate once to any of the applications to get access to the whole group. If you prefer a more granular control, you can configure the application in.07:50Individually. For the purpose of this demonstration, I'm going to configure a group containing two applications. My 1st application is going to be the admin user interface of a standalone ICE instance, and 2nd application is going to be the graphical user interface.08:10Of a custom web app. I will add an application group. I will provide the name. In this second step, the firewall provides its SAML integrations.08:30Details.08:50In my case, I'm using a Cisco Duo as a SAML identity provider, so the entity ID you see here lets the SAML identity provider understand what application the client is trying to access. The assertion comes.08:52The consumer services URL is the URL steering the client back to the firewall after the SAML successful authentication and authorization. When doing the configuration, you take the firewall's entity ID and the ACS URL to your.09:11SAML provider and in return you get the SAML identity provider's metadata describing the firewall how to reach and authenticate with the provider. In this case, I'm going to download the service provider metadata, which is an XML file, which I will be then upload into my.09:31Duo identity provider. The SAML identity provider metadata section is where we enter or import the identity provider metadata. The entity ID uniquely defin.09:52Finds your SAML identity provider. The single sign on URL is the address of the SAML provider where the firewalls redirects the clients to perform authentication. And the IDP certificate is used to verify the signature of the SAML authentication responses.10:11Many SAML identity provider allows you to download and import this information within a unique XML file. In this case, I've already downloaded it from my duo admin panel, so I'm going to click on import, select from my download folder and click on open.10:32It will be auto populated and I can click on next. Here we specify the reauthentication how often we want the users to reauthenticate.10:52I can leave the default settings here and on next, here if we want, we need to select the security zones, we want to apply this application group two, and eventually we can decide to use a different inclusion or malware and.11:03File policy. I can now click yes, next, and finish. As soon as I click finish, I can now add application to the specific group. Let's start with adding ice GUI as a.11:24Protected application. I will click on add application.11:44I will provide that application name and next we set up the external URL which will be used by the clients to access the protected application. You need to ensure that the.11:51NS on the client side resolves this you this external URL to the IP address of the firewall interface which is closest to the client. In the next field, in my case it's gonna be ICE 310 dot.12:11My domain.u. In the next field, we have the options to use a different URL for the application URL. So e.g., if the application is reachable internally by a different URL, we can go here and specify a different.12:32URL, which is not my case. The DNS used by the firewall needs to resolve this application URL to the real IP address of the protected application server. In this demonstration I will use the same as already said, ensuring.12:51That the correct DNS resolution setup will happen. I will show you how this can be configured or this can be checked. So I will open my CLI and my client. The URL I'm gonna use is the eyes.13:11310 at my domain dose. You This is result to the external interface of my firewall externally. If I try the same from my firewall.13:31I see that this got resolved by the internal private IP address of my web server, of my ice server.13:51Oh, then I need to configure I need to set up a, white certificate in the CTA flow, as I already said, the firewall performed full TLS.14:03As decryption using the known key method. If you ever configured a decryption policy on the firewall before, you might, you might be familiar with that and you know the decryption is used to decrypt traffic to the local servers knowing that the the server private keys. In this example I.14:23I have my application certificate already upload and the private key already uploaded into the FMC and it's gonna be again a wildcard certificate, which is used by the ICE and that will choose this from the dropdown menu. I will.14:43Also choose to ignore the source translation as the client IP address is routable and two and from the server network.15:03And as we configure the group before, we can add this application to the specific group. As soon as I do it and they click next, all then the next fields will be auto populated because the configurations will be deriven from application group in the CTA group.15:14Which is the name of my group. I will click on finish and this is how we added our 1st application to the GTA policy lab group. I will have 2nd application very quickly as well.15:34This is the external URL of my second web app in my protected network. I will use the same wildcare certificate. I will choose to ignore the 1st translation. Click next. Sorry.15:59Select the same group, click next and finish. Now that we have configured the application, the last step is to associate this policy with the firewall and deploy the configuration. So I will click here, I will select my firewall, I will click apply.16:15Then save and I am ready to deploy. Let's now test how and if this configuration will be working. Here we can see the desktop of a PC connected.16:35To the laboratory network, the user will open the browser and will type in the URL of the application, this is the external URL.16:54Which we have configured in the application setup, the request will hit the firewall which in turns redirect the client to the SAML identity provider. I will enter my user email and click on next.17:14I will enter my password and as soon as I user, as soon as I enter the credential.17:352nd factor authentication kicks in. So I am redirected back. I need to perform 2nd factor authentication right on my mobile phone as soon as I will get the notification.17:53I got the push, I approve, and as soon as the authentication and authorization gets allowed, I am redirected.18:13To the protected application. If you look at the address bar, you will notice that this connection goes through a high TCP port from the pool that we have configured in the cloud.18:33I can try to log in and as you notice, the experience of the user is really seamless. We can now get access to the protected application and use it as it.18:59Was as if it was located locally available. I can also try to open 2nd application by typing the URL that we have configured before. And as you will notice, I will be prompt to the same.19:13Second application without the authentications to be performed again. This is because both application belongs to the same application groups and the single sign on features provided by the SAML identity provider is taking effect.19:33This is all for the cyber caption. Thank you everybody and see you next time.19:52
