Architecting Secure Web Gateway: Policy Enforcement at the Edge

Oh. Thank you everyone for joining. We've just hit 03:30, seeing who has popped on.00:01Okay, we have quite a few attendees already. So I'll just get straight into it. My name's Kazel and I'm one of our customer success specialists supporting customers with Umbrella and secure access here in APJC. And today for this webinar I'm joined by my Colleagueshawal and Anku who will be.00:18Presenting today on all things secure web gateway in secure access. So while we wait for people to hop on, I have included a Slido if you want to join, feel free. I've included a very.00:38Easy 1st question hopefully, just to get you a feel of what Slido's like. You can join it embedded into Webex or on your phone up to you. At the end of this session, we will try to test your knowledge a bit with one reference from the session in that question. So if you can get it right.00:55We'll send you some Cisco merch at the end, so keep your eyes and ears peeled during the demo time.01:15Yeah, ok, we can probably go to the next slide. So for this webinar session, if at any point you have questions, feel free to ask them in the Q and A box at any point. You don't have to wait to the end. We have some panelists who have joined to who.01:23We'll be answering them as we go and we'll make some time to go through some of the interesting questions at the end as well hopefully. So yeah, feel free to just drop those in as they come to you while we're doing the session.01:43Okay, next slide. So I'll cover what we'll be going through today. We'll start by demonstrating the role Secure Web gateway plays in that overall unified architecture of secure access followed by how you can steer your traffic to the cloud proxy. Anku will be taking you through.01:56Various connection methods. Then we'll touch on the key features and capabilities you can leverage. Section four will cover our recommendations for your secure web gateway rollout and for five, Usual will be going through how you can actually see where everything is monitor.02:16And troubleshoot things in secure access. And then like I said, we'll have a question and answer time at the end hopefully and yeah.02:36If there are any other questions or if you're having any problems with the session, just drop it into the Q and A section below. Great, so yeah, take it away Ankur. Thanks. Hi everyone, good morning and good afternoon. Thanks for joining today's webinar.02:47So the 1st topic we are going to discuss about the architecture. So, before we dive into the feature, it helps to understand why this architecture exists and how it built.03:07So, so let let's talk about the challenge many organizations face today. Traditional network security was designed for a world where everyone worked from office connected to a data center.03:23But today, people work from anywhere home, coffee shops, branch offices, and applications live everywhere too, in the cloud, in SaaS platform, and in private data centers. This creates a poor experience for users because traffic often has to.03:39Details just to get inspected. It also means IT teams end up managing a large number of separated point solution from different vendors which add cost and complexity. And when you have that many moving parts, gaps start to appear in your security post.03:58Sure Cisco Secure Access was built especially to solve this problem.04:18Okay. So this is the big picture of Cisco secure access. On the left, you can see everything that might need to connect. Users working from anywhere managed and unmanaged devices.04:24Then we have IoT devices and even AI agents. On the right, you have everywhere they need to go to the internet, SaaS and AI applications and both traditional and modern private applications.04:39In the middle sits Cisco secure access. A single cloud based hub connecting two sites two sites. This is what we call as identity 1st zero trust model. Instead of trusting a device because it's only corporate network.04:54We trust based on who the user is and what their device looks like. The same security policy applies NO matter where the connection is coming from or going to. That means IT doesn't need a separate box for every use case. One architecture protects everything and it's simpler.05:14To manage while being safer for everyone involved. So now let's zoom in a little more. This slide shows how Cisco Secure Access brings everything together in one platform.05:34On the right, you have your entry points and an endpoint like a, a laptop, a browser or a branch office. On the right, you have your destinations, the web private applications, and SaaS application. In between all the security.05:53Security capabilities run natively in the cloud. That includes multi factor authentication, device posture check, DNS security, firewall, and IPS. Our secure web gateway as well and along with that, we have data loss prevention with AI guardrail as well.06:13And it doesn't matter how you connect IPsec, SD WAN, VPN as a service or zero trust network access. The same policies applies consistently. The key take takeaway is.06:34One part in, one control plane and one consistent policy, NO matter where your user are or what they are trying to connect.06:49Now let's look at the full set of capabilities inside Cisco Secure Access. On, on one side we have Cisco secure internet access where DNS security layer three to layer seven firewall.07:05Along with IPS, our secure web gateway, multimode data loss prevention and cloud access security blocker. It also includes malware protection, sandboxing, digital experience monitoring, and remote browser isolation.07:21On the other side, we have secure private access where client based and clientless ZTN clientless zero trust network access VPN as a service, and firewall as a service for private application.07:36So what ties everything together in one consistent policy engine? End to end visibility and Cisco Talos threat intelligence fitting every single capabilities, so whether traffic is heading to internet or to a private application, it's protected by the same intelligence and the same policy engine.07:55Let's move to the next slide. So where exactly does secure web gateway fit into all of this? Think of DNS security as part of the 1st line of defense.08:19It blocks known.08:35Bad domains very quickly before a connection is even made. But here's the silence. Almost all web traffic today is encrypted using HTTPS and DNS security alone. DNS security alone cannot look inside the encrypted traffic.08:37So that's where the secure web gateway comes in. It complements DNS security by decrypting HTTPS traffic, inspecting it, and enforcing policy at the URL application and content level. It protects against malware, facing, zero data threats, and data loss.08:55While giving you much deeper visibility and control. As you can see in this diagram, DNS security handles the 1st week check and then secure access gateway does the full detailed inspection, including decryption, multi anti malware scanning, sandboxing, web reputation filtering, and.09:14Even remote browser isolation.09:34Before traffic reaches the internet or your SaaS applications. Now, let's move to the section two, which is traffic acquisition methods. So this is all about the different ways you can get users and branch traffic to.09:36Secure access in the 1st place. So let's start with the Cisco secure client, which is used for roaming users on Windows and Mac OS.09:56Think of secure client as the single app with different modules. You can turn on depending on depending on what you need. The anyconnect VPN module gives you a full tunnel, it forwards all IP traffic.10:12On every port and protocols through the security stack and authentication and posture checks are done at connect time. The ZTA module works differently, it checks authentication and posture on a per session basis.10:29And uses a lightweight mask proxy to carry both internet and private application traffic. And the roaming, roaming security module is the lightest option. It forwards only DNS and web traffic.10:44On port 80 and 443, which is great for simple baseline protection without needing a full tunnel. Let's move to the next slide.10:59So this diagram shows how the umbrella roaming module works in practice. So traffic traffic from the managed endpoint is sent up to the cloud where it passes through Cisco Secure Web gateway, along with CASB and DLP inspection.11:15Before going out to the internet or SaaS application through network address translation, you will also notice a excluded traffic path at the top. This lets certain destination bypass inspection entirely, which is useful for things like software updates.11:34The big advantage here is that it's lightweight, there is NO need to set up a full tunnel. It is ideal for roaming laptops, user who just need baseline web protection without the overhead of, complete VPN style connection.11:53Next, let's look at the zero trust access module, also known as trusted internet access for secure internet access. Instead of putting a user on the broad network, the way the traditional VPN would, this module uses a lightweight.12:13ZTNA proxy as per application and per session basis.12:31User only get access to the specific private application they are authorized for, nothing more. That dramatically reduced the risk of someone moving literally across your network. You can see three co color code part here.12:36Entry traffic feeding into the cloud firewall, internet and following through the secure web gateway, CASB and DLP, and private application through being routed through an.12:52Interconnected to your data center or your branch. On the internet bound side, this is what we call trusted internet access. The client validates the device security posture 1st, applies firewall and intrusion prevention rules, and then forward qualified traffic to the cloud C.13:07Secure web gateway for full content inspection combining zero trust validation with secure web gateway enforcement in a single part. So now let's see if from individual user to branch office.13:27So this slide shows how branch traffic reaches secure access using IPsec or SD WAN. E.g., Meraki SD WAN or Catalyst SD WAN. So branch site simp simply built a secure tunnel to their nearest secure access data center.13:45So you don't need to install any secure web gateway appliance on site. Just like before, we have color coded part representing entry, internet source traffic and private applic application traffic, all the branch internet bound traffic.14:04Writes the tunnel up to the cloud, where it gets decrypted, inspected, and has policy applied. Exactly the same way it would for the roaming laptop users.14:21There are two more ways to get traffic to secure access. The 1st is pack based forwarding or direct path. A pack file is basically a small configuration file that acts like a.14:40Map, it tell the browser or device to send traffic directly to secure access with NO full isn't required. This is great for quick pilot or environments where, deploying and endpoints isn't isn't practic practical yet, right? 2nd and proxy chaining, so.14:56Or, or you can say it as a multi hope part. So here's the endpoint traffic 1st go to an intermediate hope, e.g., an existing local corporate proxy.15:15Which evaluate its own rules before forwarding the same traffic to Cisco cloud. This is useful if you need to keep a legacy on prem proxy in the part for now letting you migrate to secure access gradually instead of ripping out the existing infrastructure and.15:26All at once. So let's pause here and take a quick look, at the life. Let's look how we can configure a IPsec tunnel.15:45Okay. So this is my demo tenant, so I'll just I have some IPsec tunnel already configured, but the status is down, but I'll just quickly go through, I mean how we can set up our own tunnel.16:05So the 1st thing, define your group name. Give it a clear name, select you can also select the device type and choose your.16:22Reason. So in this case, Asia Pacific Singapore. So the next set up your tunnel ID and passphrase, choose the email format for your ID and create a strong passphrase Ensure it is 16 to 64 character long.16:42Including uppercase lowercase and numbers to keep your connection secure. Choosing email allow you to use a custom string as your identifier, which is often easier for management. We have another option choosing IP address.17:01Uses the device specific public IP as the identifier, which is ideal for fixed site to site connectivity. Then configure your routing settings for routing, you can use static to manually define IP ranges for your subnets.17:18Alternatively, select dynamic routing if your on premises router uses enabling automatic route access for more complex scalable network architecture. We also have a network address translation option.17:37So enable net if your internal subnet overlap with other network to avoid conflict. You can also toggle IPv six routing to run alongside your default IPv four configuration for broader connectivity. So finally.17:53So once you have configured all the settings, you can set your dashboard status. In the summary, you see two hubs primary hubs and your secondary hub. So primary tunnel hub is your main connection point.18:11The secondary tunnel hub acts as a backup, providing automatic failover to ensure your network remains connected if the primary hub primary path becomes un unavailable.18:30Now, let's look at the ZTA.18:47So you can create, you can create a new ZTA profile from, so I'm not going to, I'm not going to detail going in detail about ZTA full configuration and show you only things related to internet access.19:04Oh, Internet access. So you can see this the steering mode, it lets you control the web traffic. You can disable ZTS steering.19:22Steer all internet traffic through ZTFA for full protection or choose to steer only specific destination while excluding other, based on your policy need. Then we have trusted network mode.19:41It Defines how ZTA behaves on a known network. You can choose to skip ZTA when on a trusted network or enforce ZTA security consistently ensuring protecting against, all of your public network traffic.19:56So basically we have two options. So the 1st option it helps you to, let the traffic goes through the secure access even whenever you are in the trusted network. And 2nd one, it can, it can use to.20:14You can, it, it can, it can let it can it can allow you to use the trusted network to secure internet destination. Now, let's look at the 3rd option.20:33Which is a roaming module to steer traffic to secure access for secure internet access. So the 1st thing is deployment options. Start by selecting your OS windows, Mac, Chrome OS, Android or iOS. You.20:53You can download the file for secure secure client or use a peg file. For Android and iOS, you have two deployment parts. Use the MDM managed option to download a configuration file.21:10Which you can distribute through your MDM tool. For personnel or unmanaged device select register to manually onboard them for protection.21:30So user can scan this and they can register their unmanaged devices. Then we have deployment management. So deployment keys X is a secure identifier when onboarding new devices.21:44They authenticate the client during registration ensuring that only authorized device can connect to your specific environment. Then we have traffic strading and bypass option. In the traffic strading tab, you can add destinations to.22:00Bypass secure access, you have two more bypass secure access which avoid both proxy and DNS servers or bypass web proxy only. So DNS still follow through secure access if you chose this option.22:20Then we have DNS and web security configuration, so enable web security to steer port 80 and 443 traffic through secure access. DNS security is always enabled.22:40Then we have advanced settings. Under advanced you can enable active directory for group based policy or 3rd party VPN compatibility if needed. Then we have DNS protection and back off.22:55So, you can choose full protection for best coverage including both IPv four and IPv six. You can also enable DNS fail open for devices to maintain internet access if secure access is unreachable.23:13Then you can use backup setting to define conditions where traffic should bypass secure access. So you can customize DNS backoff example behind the virtual server or VPN to ensure traffic flows correctly in specific environment.23:32Then we have secure web gateway back offsettings, Allow you to link proxy behavior to your chosen DNS back off rule. So now let's move to the next section.23:50Which is feature and components so this slide summarized the key security features insights secure web gateway.24:08And honestly, this is the slide that I want to remember most of most from today. So the 1st feature is SSL decryption, which lets you open up HTTPS traffic to look for hidden threats.24:26Then we have content, filtering blocks or allow sites based on category, URL or reputation. Then we have file inspection and malware analysis which scan files using both known signatures.24:43And it can also provide you sandboxing. File type blocking stop traffic file extension from passing through. E.g., if you want to block certain file types like PDF or EXE files, so you can use this option to block.24:59Download and upload those files extensions. Then we have safe search, which filtered out explicit content from search result. Then we have two new capabilities ES supply chain blocking.25:19And AI semantic inspection. So AI supply chain blocking which blocks risky or unapproved AI models and AI semantic inspection which detects from injection attempts and data leaks in AI traffic.25:39Then we have advanced application control, which lets you restrict specific actions inside the application like upload or post, apprix profile scores application using Cisco Talos threat intelligence, and you can take action.25:59Trade categories block domain known for facing malware or botnet activities. And then finally we have data loss prevention which help you to inspect and control sensitive data leaving the organization.26:19So we are going to spend the next several slides on taking each of these one at a time. So let's move to the next slide. Now let's look at this building block you can use to configure this feature.26:37And it's worth showing down here because getting this building blocks right is what makes secure access gateway policy actually work well in production. So the 1st thing is SSL certificate manages how decryption and inspection works for internet destination.26:55Destination lists are simply list of URL or domains you want to block or allow, application list, group and control access to specific application. Content category list, group web content into two categories like gambling or.27:13Social media for filtering.27:33Tenant control manages access to specific cloud app like Microsoft 3605 slack. Do not decrypt list, exclude certain destination from decryption useful for privacy or compliance reason.27:36Then we have security profile, which bundle all of this protection engine together into one policy object. You can apply to rule. This is the piece where, that ties everything on the previous slide into something you will actually configure day to day.27:54Then we have notification pages where the custom pages, you can, you can create your own custom page to users see when something is blocked or restricted. And finally, for organization that.28:14Need a reverse reserve IP address. So there's an option to apply for a reverse IP address and it gives you a static egress IP, so destination can allow traffic from a specific source address.28:35But this is an optional and subject to Cisco's approval So this is one of the most important slide in the whole deck because it shows exactly how the secure web gateway full proxy works step.28:53By step.29:12And understanding this flow in is generally the key to understanding everything else we have talked about today. So as you can see step one, redirect traffic, here you can, I mean use umbrella roaming module ZTA.29:13A module or IPsec VPN to redirect traffic to secure access.29:33So instead of going straight to internet, the user traffic is sent to the clouds secure web gateway. Step two applies policy rule. The gateway check the request against your policy and.29:42Decide what to do, block it, isolate it one the user or allow it too.29:57Step three proxy control for traffic that allowed secure access gateway open a brand new secure connection to the destination on the user on behalf of the user. Then step four, sorry.30:17Then step four decrypt and inspect. The encrypted traffic is unlocked and scanned for malware or other risky content. Then step five enforcement.30:34If something bad is found, the connection is blocked immediately. And if the user sees a clear notifi And and the user sees a clear notification explaining why their traffic is blocked. And finally.30:50If it is, if there is NO any malicious content found, then it will allow the traffic to go. And finally, the traffic will be reencrypted and the log will be generated.31:06So let's talk about a remote browser isolation or RBI. So one of the more advanced secure web gateway capabilities and a great example of how far this feature set goes beyond simple URL blocking.31:23So when traffic matches an isolate rule instead of loading the pace directly on the user's device, we did redirect it to the disposable browser running in the cloud. Only a safe video or pixel stream of that pace is sent back to the user.31:38No active content like scripts or downloads even actually reaches their devices. Once the session ends, the remote browser is destroyed completely, leaving NO trace behind. The benefit here are significant. Zero tests and malware.31:58Simply cannot reach the endpoint. It reduces your attack surface for risky or uncategorized websites. And based off all it completely transparent to the user. No special plugin or client needed.32:17So the next feature is advanced application control. So advanced application control let you get very specific about what user can do inside an application. Instead of.32:36Just blocking the whole application entirely. This granularity is one of the thing customer tell us why, why they value most about secure web gateway. E.g., you could allow access to Dropbox for viewing files but block uploads.32:51Downloads to prevent data from leaving the company.33:11The granular action you can control are blocking all content, blocking uploads, post or sharing, blocking downloads, and blocking deletion. Some real use case includes allowing browser on social media, e.g., site like Facebook.33:15On LinkedIn, you can allow for, user to access, but you can block posting to avoid leaks, allowing read only access to unmanaged slack or teamwork workspace.33:32But blocking file sharing into them and allowing user to view media or document while blocking download to stop unauthorized copies. Next feature of secure web gateway is file inspection and analysis.33:48So every file downloaded through secure access goes through two stages for scanning before it reaches the user. This is a core secure web gateway protection layer, so let's walk through it carefully. The 1st phase is file inspection.34:07Which use Cisco AMP advanced Malware protection to check the file has against a reputation database powered by Cisco Talos Trade intelligence. Plus a built in antiviruse scanner. If a file isn't recognized as good.34:24Or bad, it can send to 2nd stage which is secure malware analysis, where it detonates safely inside the sandbox to observe its real behavior if that sandbox finds the file malicious.34:41That information feeds straight back to AMP, so any future attempt to download the same file is blocked instantly. For every user in your organization, that productive protection is a big deal. It means.34:57The whole customer base gets smarter every time one file gets caught everywhere anywhere. The next feature is AI supply chain blocking and AI semantic inspection.35:13As more organizations start using AI, Cisco has built two features specifically for this, and given how quickly this space is moving. It's one of the newest and most talk about additions to secure or secure web gateway.35:33AI supplies in blocking controls which AI model files users are allowed to download. You can block models from prohibited suppliers, models under copyright license or models capable of executing arbitrary codes.35:51AI semantic semantic inspection works differently. It inspects the model contracts protocol or MCP traffic that flow between AI ascense and MCP server. Using Cisco Foundation AI, it looks at each message and decides whether to allow or block it.36:09Watching for four specific threats, data exfiltration, prompt injection, tool poisoning, and tool shadowing. Both features require decryption to be turned on. Common use cases include blocking risky model downloads.36:28Stopping from injection attacks and getting malicious MCP server trying to, impersonate legitimate tools. So the next important feature of secure web gateway is data loss prevention.36:45Data loss prevention protects sensitive data leaving the organization and this closes out our tool of secure web gateway features. So let's make sure this one lands. It covers an upload, it covers an.37:06Upload to the web, it transfer to USB, Bluetooth or network shares or even local and network printing as well. It can also discover and protect sensitive data already stored and shared inside sanctioned cloud applications like.37:23Microsoft 3605, google Drive or Slack. The DLP policy is built from five rule types working together. The 1st one is a real time rule, which inspects our web traffic and file transfer instantly. E.g..37:41Blocking a credit card number from being uploaded to a unsanctioned websites. Then 2nd type is SAS API rules uses the cloud application owned API to audit file already stored there.38:01The 3rd one is AI guardrail rule, which can monitor prompts and responses with Gen AI applications like gopilot and et cetera.38:18The email rules pair with Cisco secure, email threat defense to scan outgoing emails messages. And then finally, the endpoint DLP is enforced directly on the device through Cisco secure access client software blocking USB transfer.38:36Or printing even when the laptop is completely offline, between file inspection, application control, AI protection and DLP, that's the full rate of what secure web gateway can do for you.38:55Now let's see some of the feature life. I will, I will show you how to create a security profile and turn on decryption. So I will quickly show you how to create a security profile.39:17So to create a security profile, you need to go to secure, then security profile, you can add profile.39:33Internet access profile, you can name your profile and optionally set it to default Enable SSO to ensure user and group based access for, for the network and tunnels configured as source.39:49But note that it requires decryption to be active to enforce policy effectively. Then we have decryption settings. You have three choices. Enable decryption to inspect encrypted traffic.40:09End user notification only decrypts only for blocks warning or disabled decryption. If you enable decryption, you also get the option to select your own do not decrypt list, where you can add all those websites.40:27That you don't want to decrypt. Then we have all the security controls, including file inspection, Cisco secure malware analysis.40:44File type blocking, safe search, all the options like AI supply chain blocking, AI semantic inspection, whatever we have discussed in our previous slides, all the security options are here. Now.41:00Let's go to the threat categories. So this is again one of the important security settings of secure web gateway. So you can enable malware.41:16Command and control facing, so which blocks known threats and prevents infected device from calling home. Then we have potential harmful domains, newly seen domains, so block suspicious or untrusted websites domains.41:35Then we have dynamic DNS, DNS tunneling, crypto mining which prevents policy bypass through hidden tunnels or or illicit crypto mining activities. Then one of the other key key component.41:52Is the certificate. So this screen let you download the Cisco root certificate or configure your own CA certificate. The root certificate is required for SSL decryption and displaying block warning pages. Install it on all devices.42:13You can also upload your own custom CA signed certificate for specific instructure infrastructure need to ensure trusted authentication. Then finally, we have access policy. So this is the final segment.42:31The golden rule here is the order Cisco secure access process rule from top to bottom and and the very 1st match it finds is the one that execute. That is why you should always place your most specific granular rule at the top.42:50So if a request doesn't match any of your custom rules, it falls to the default rule. Typically the, so default rule, these are the two default rule. So typically the default default for private access is set to block.43:09For zero trust connectivity while internet access is set to allow always. So remember, manage your rule order carefully to ensure security and connectivity stay perfectly aligned.43:30So with that, I'm handing over to my colleague Ujol. He will walk you through the remaining section, deployment best practices and visibility monitoring and troubleshooting. Over to Youl. Thank you so much for this great session and presentation as well.43:50So, let me quickly share my screen. Yep, hope you all can see my screen. So, let's start with deployment best practices. So just give me a second.44:09Just making sure that I'm able to slide. Yeah, perfect. So we have already seen what secure web gateway can do, but when you are actually deploying full proxy in a production environment, the way you roll it out is just as important as the feature themselves. So 1st one is to.44:25Plan ahead. So before enabling anything, understand your current traffic flow, identify your users and location and align with the security and network teams on what you want to achieve. So once this is done.44:45Next is to understand the controls. So before changing the policy, understand what secure access is already doing by default and what controls you need to explicitly enable. Once we understand the control, next is to choose the right activation method. So depending on the environment.45:01You can use secure client tunnel or back file or any supporting method which Anku has shared as well. So, for endpoint users, secure client is typically the approach we see.45:21Is used most often. Next is tasks start small. So don't enable full proxy for the entire organization on day one, start with a small pilot group of users, validate the traffic flow.45:35Understand the policy behavior and user experience 1st. And once all is done, expand it gradually. So once the pilot is stable, expand department by department, user group by user group or location by location.45:51And then finally optimize continuously. So once you are in production, the deployment don't stop. So keep looking at the logs, understand what user accessing, review expectation and continuously fine tune the policy. So overall message here is.46:07Don't treat SWG deployment as a single switch that you turn on, treat this as a phase five adoption journey, ok? So moving forward, next is to understand default rule behavior.46:25So before we start designing our own policy, there's one important thing we need to understand like what happens by default. So default policy is allowed, and that's important because it means traffic isn't automatically blocked just because we enable the proxy.46:42At the same time, secure access already gives us some baseline security protection through our default security profile, which also has shared and I will also try to cover this in my demo part as well. So e.g., malware command and control.47:00And phishing file inspection. So all these are already available through the default set the profile. But there are also capabilities which are not enabled by default. E.g., HTTPS decryption, sandboxing through secure malware analytics, file type blocking, safe search enforcement.47:20And AI supply chain blocking.47:39So if I enable full proxy today, I should not assume that every advanced security capabilities is automatically active. Some of this control require additional consideration. So my recommendation is before changing the policy, understand the baseline 1st, then.47:41Decide which additional control you want to enable based on your security requirement.48:01Next, again, important topic is policy design and zoal ordering. So, and this is very important concept here rule ordering, so secure access evaluate this rules from top to bottom. So the 1st rule.48:09That matches the traffic is the rule that gets applied. E.g., imagine I have a general policy that allows web traffic, but I also have a specific policy that need to block a particular application or destination.48:25So, in my specific block rule is below the general allows rule, so the traffic may match the allowed rule 1st. So that's why we normally want our most specific and important rule towards the top followed by the broader policy.48:412nd policy, I mean 2nd point is around exception, so keep your do not decrypt and allow list exception as narrow as possible. And finally, review your policy regularly as the environment change, some rule may NO longer be required, so it is recommended by.48:59Best practice, it is advisable to give you your policy on a periodic interval and a good policy should not only work today, it should also be easy for another administrator to understand six months from now like what you we have created and was the purpose of creating the policy. So.49:19This is what we have to take from this slide. Next, again, this is again one of the most important part of secure web gateway, which is SSL or TSL TLS decryption.49:38So today, most web traffic is encrypted. So if we are not decrypting that traffic, our ability to inspect the actual content is limited. So for general web and the recommended approach is to decrypt and inspect.49:54Especially when we need malware inspection, file inspection, and deeper security control. But we also have destination where decryption may not be appropriate for banking and financial website.50:13Healthcare or regulated destination, also certain OS update services and government destination. So we have to use do not decrypt there. And this one very important deployment dependency here.50:29So, before enabling decryption broadly, make sure the secure access root certificate is deployed and tested on the endpoint. So which Anku has also shared how you can download the root certificate. Otherwise user will start seeing certificate warning messages.50:43In many decryption deployment, the technology itself is working perfectly. The, but the problem is simply that the endpoint don't trust the certificate. So once we have planned the rollout, understand the default behavior, design the policy.51:03And prepare the certificate. So we are ready to then move ahead. So next is visibility monitoring and our troubleshooting. So because our deploying, we are deploying secure web gateway.51:20It's one half of the story. But once it is live, we need to know what's happening in the environment and understand why a request was allowed or blocked and how we can troubleshoot this quickly, ok? So now.51:39Let's start with, probably one of the most useful tool when you are troubleshooting a specific user or transaction that is activity search. So think of activity search as our transaction level investigation tool.51:54Now here we can search for a specific user, destination category, response, rules, IP address, and or timely, there are many filtering options are there. But if I have to give you example, imagine a user tells you.52:12That I cannot access this website. So instead of guessing what is happening, I can come here, search for the user traffic, that specific user traffic and immediately see the transaction. I when I say transaction I mean the logs or activity search here.52:28I can see whether the request was allowed or blocked, which rule made the decision, who the source identity was, the source and external IP address, the destination category, application, basically there are many things and timestamp as well. So instead of asking the users for screenshot and.52:47I'm trying to reproduce the issue 1st, activity search gave us a actual transaction and the decision the securex has made.53:06But, activity search is more about live or the troubleshooting part. What if we want to understand the health of overall deployment? So for that we have a dashboard for the overview dashboard.53:15So overview dashboard gave us a bigger picture. So instead of looking at a one transaction in activity search, we can look at the overall environment. At the top, we can understand overall traffic and the usage.53:32Here where we can see the overall usage part. We can also look at the traffic through different acquisition method and understand how adoption is progressing. Then we have a network tunnel group as well, which can be used to, which can be useful for understanding.53:51Sending traffic volume and capacity.54:10Another important area is connectivity health. So it will show you, quick status of if tunnel is connected, disconnected, warning tunnels and connected groups, everything. So we also have a security posture information.54:13Yeah, security posture information which it which can show you access and IPS event. So the dashboard is really our operational starting point. It tells us when we when we should start looking.54:32If there's any something changed in the environment. So think of it like a transaction is for activity search, for one specific user, but if you want to get an overview understanding, then go for this overview dashboard. Okay.54:48Next, we have a security insight as well. So, this take us from operational health into the security perspective. So here we have five keys area, data security, AI governance, applications.55:04Users and threats. So data security helps us understand DLP related activity and potential data loss event. AI governance give us a visibility into how users are interacting with.55:21Gen AI application and whether those activities are violuting our defined guardrails, application give us visibility into what application are being used, including sanctioned unsanctioned and potentially other applications as well.55:37Then user helps identify higher risk users so we can investigate or apply more targeted control for their specific users. And finally threat, gives us a view of what have been blocked and how the threat.55:58Which is sending.56:17So there's also a security traffic flow which is useful when explaining the incident. It help us to understand the journey of the traffic, where it comes from, what the security outcome was and which security control actually enforces the decision.56:18So activity search overall help us investigate one transaction. The overview dashboard help us understand the environment and security inside help us understand the security posture. So now comes to common issues and troubleshooting.56:37So the 1st one is certificate warning. So if users suddenly start getting certificate error after we enable decryption, the 1st thing I would check is whether the secure access root certificate is trusted.56:55On the endpoint. If it's not deployed correctly, the browser won't touch the certificate generated during inspection. 2nd issue is traffic not reaching the proxy at all. So here I would check the traffic acquisition method. So if you're using a pack file.57:11Check the back consideration. If you are using IPsec tunnel, check the tunnel status. If you are using the roaming services, make sure the services is running.57:31And if we are using trusted internet access verify that the device is actually enrolled for zero trust. The 3rd common issue is a legitimate website being blocked. In this situation, I would 1st look at activity search and identify exactly.57:41Which policy or security control is blocking the request and if it is a categorization issue, I would submit a category dispute. And finally and application may stop working after we enable decryption, and one common reason is certificate pin or the application that doesn't support inspection.58:00In this situation we can investigate the transaction and where appropriate, we can place the destination in the do not decrypt list. So basically troubleshooting approach is quite simple. 1st understand what happened, identify where the decision was made.58:21And then determine whether the issue is traffic acquisition, policy certificate category or decrypted data. So now we covered a lot of stories, so now let's bring this all together with a quick live walkthrough. So here I have logged into my.58:39A Secure access console or dashboard you can say. So this is the landing page.58:59This is the overview page where you can see all your tunnel group. You said I don't have any tunnel group, so I, it is not showing over here, but in live environment you can see your tunnel group usage, you can see your connectivity status, you can filter with last 24 h, seven days, 30 days, so you have filtering option as well.59:05Here you can see your overall usage in terms of total traffic, how much data is sent or received. You can also see the security controls, security activity, total security categories, file reputation, again you can filter it.59:24So basically this is your dashboard or the one page where you can see your overall usage or overview of overview of the security. Now coming to policies, but before going to policy.59:40We, I wanted to show you the internet and like we have before creating policy, we have to create a source like destination list, application list, content category, tenant control. So also in the interest of time, I would like to go a bit.59:58Very short. So we have multiple options of creating the categories or creating or defining the destination. So for this demo, I would like to show you the content category part. So here we have multiple options to select the categories.01:00:15Like we can choose from shopping, social networking, ties and tobacco. There are multiple options available, so you can select from any of the destination which you want to allow or blog. You have option from application as well, destination list tenant control you have multiple options.01:00:32So once you define your actions you once you define your destination, you come to secure, come to access policy, yeah. So this is the rule order we were talking about, so it will check line by line and once it.01:00:48Do a best match, it will stop there. So we'll create a policy, create an edit. Here you have two options, you can use an internet or private resource. So for this, we are going for internet policy or internet access.01:01:07We created a policy, gave it a name, defined the rule order, like which rule you want to place, like line number 1234. Here you have four options, four actions, either you can allow the specific traffic.01:01:22Or you want to block that specific traffic, warn is nothing but it will give you a warning message. Once user accept that warning, then it will be allowed. Then we have isolate, which is nothing but RBA, so which has already discussed. So now.01:01:37We have to select the source, 1 s. Let me access policy. Yeah, for this edit. So we have selected action as blog. We can define our system or the.01:01:55The End user, so you can select from your users, groups or zooming device and point network the multiple options from where you can select the source and under destination, we will call the content category list which we have just now created also for the blocking social networking sites.01:02:13We have an option of enabling the scheduler, like if you want your policy to be enabled only for specific duration, then you can enable the scheduler. If we do next, here you can call your security profile again which Anku has already showed in his demo.01:02:32Like we can enable file type control and many other options was there. So once you save this, now go back to your test system or the end user system. This is my end user system, I would say. Here is showing us active, you can check the status as well from here.01:02:47You click on start select the status, it will show us protected. You can see your client name, license validated web web protection status is protected. Now you can try to access website like youTube.com, so it should be allowed.01:03:07How guest it is allowed.01:03:27Now try to access Facebook.com, which is a social networking website which is blocked. Try again for instagram. Again social networking website which is blocked, so it is showing you a clear warning message saying that it is blocked because of content filtering.01:03:28You can search with LinkedIn as well. So LinkedIn is allowed because this is a not social networking website, so basically you can check this. Now how to validate this? If you go back to your secure access, go to monitor and activity search, which we have just now discussed.01:03:47Like it load, you can filter from last 24 h yesterday, seven days you have multiple options. You can filter with your oil traffic DNS traffic, web traffic Za again if you have multiple options, so now this is the live logs, so this was the source. You can click on view full details.01:04:06So action was blocked. This is a timestamp. It was blocked because of this rule. This was the source, what is my internal IP address, was the external IP address, reason blocked because of the category social networking. So this is how you can.01:04:23Do the actual investigation and troubleshooting. So, and in the interest of time so this bring I will end my demo here and I hope this give you a good understanding of secure web gateway and how we can deploy and monitor and troubleshoot and troubleshoot it.01:04:40With this, I will hand over to Casil for the Q and A So Casil over to you. Yeah, thank you. Thank you, and thank you Joelle and Anku. Apologies, we have gone over time. Before you wrap up, if you do want to win some free merch, feel free to.01:05:00To hop into the Slido to answer a question. If you're keen to go further into the more or to the AI capabilities, CASB, all the permutations of DLP that were mentioned today in more detail, sign up for the webinar on 22 October advanced SSE mastery where.01:05:20You're sharing a recording of this session. This will be available on the community page if you've missed anything and just wanna rewatch it.01:05:40Oh, NO, you didn't it should be available. Let me just double check. If you go back into the Slido tab, you, I think you can still vote if you'd like to.01:05:49But yeah, otherwise, any other questions anyone has, feel free to pop it into the Q and A, sorry, the Q and A via chat box and we will try to answer them. Thank you. Oh, Since it's locked.01:06:03Sorry. Thanks. Voting is locked ok is that working now by chance? Nope. And if not, you guys can fill out our webinar survey.01:06:21And there's a good chance we'll send you some merch as well. Yeah, that would also work. So that will come up automatically when you close out the session. So, yeah, apologies for the Slido technical details. Any other questions anyone has? Otherwise, yeah, we can probably just wrap up.01:06:42Here thank you again so much for the time and yeah, feel free to join us for the next webinar we have coming up.01:07:01Great. Thank you, thank you all. Thank you all, thank you. I'm.01:07:09