Cisco Catalyst SD-WAN and Cloud Security Integration

Today we will be discussing the Cisco SD WAN and cloud security integration with the architecture of Cisco Secure Access Service Edge sassy solution. Specifically we.00:10We will be focusing on how we can leverage the automated tunnels to simplify the deployments. My name is Shatish Kumar. I'll be guiding you through this overview session and I have my colleague which will from secure access team to co deliver the session and we have a panelist to support you in case if you have any questions in the chat window.00:20So before I start the presentation, let me cover a few logistics items. During today's session, you will have the opportunity to ask any questions you might have about Cisco SD WAN and cloud security solution, Cisco secure access solution. Just type your question into Q and A.00:40Panel which you can find in three.menu on the right side of the screen. You can also use the hand icon to raise your hand and our panelists will respond. Please lower your hand when you, when your question has been answered. For any unanswered question, there will be a Q and A session with our expert following today's presentation. If you have.01:00Any audio issue, please use the chat panel and one of our panelists will assist you. And with that, we will start our session.01:20Here is the agenda of today's session. We will start with high level overview of sassy and the shift in IT landscapes. Then we will deep in deep dive into the solution architecture followed by deep dives into secure internet use case and secure private use case.01:29Finally, we will wrap up with look at what is unified management with Cisco security cloud control for the SASE solution.01:49So let's start with why the IT landscape has fundamentally shifted. So the traditional corporate perimeter has dissolved today and today users, devices, and application are everywhere from remote workers and IoT devices to hybrid cloud infrastructures. We can NO longer rely on a single.02:00Physical checkpoint for any kind of security policies.02:20So in past, networks were simple. You had local on premises resources accessed by local users. In addition, you had potential branch users accessing the resources through private connections such as leaseline or MPLS. Overall, you had a.02:27Very clear perimeter where security services were deployed, whether it has internet edge or a data center. But today businesses are using the SaaS application hosted in cloud and are migrating their application to a private or public clouds, often using multi multiple cloud providers while still some.02:47The application are hosted on the local data center.03:07Users are accessing the application from home or even at the road and employees are using their own devices at work. Businesses are must now provide access to their resources from anywhere at any time while still enforcing the same security and compliance requirement.03:10Because of this shift, our traffic model has inverted. Historically 80 percentage traffic was internal and now 80 percentage traffic is destinated to internet or any cloud services. Backhauling this 80 percentage of traffic through MPL.03:30Or VPN to a central head HQ creates a massive bottlenecks. This degrades application performance.03:48And the user experience while also it can complicate the security integration. Let us look how the SASE solution is architected. So this solution is.03:56To this inverted traffic model like and the solution is called a sassy. Cisco brings together industry leading SD WAN networking with Talos powered secure access solution. So the key focus of our session today is resilience piece, specifically how to.04:13Perform an automated integration between your SD WAN fabric and the secure access cloud.04:33So this diagram illustrates the global cloud architecture of secure access component in sassy. Users and branches connect to the nearest secure access point of presence, and from there traffic is splitted into two main categories. One is the secure internet.04:41Get access basically for your public web or SAS traffic, and the other one is secure private access for your internal or private application traffic hosted on your public or private data center.05:00Both of the solution uses automated IPsec tunnels for the seamless connectivity. So from SD WAN architecture, the secure internet access.05:15Automation is supported from 1713 and twenty.thirteen version on vmanage. It relies on the IPsec and NAT. Instead of BGP, it uses a static routing or you can leverage the data policy of SD WAN for doing the ECMP or traffic redirection.05:30It also uses a multiple service side VPNs per policy making it very highly flexible for your internet.05:50You can specify your, the, the outbound VPN which has to be diverted to the secure internet access tunnels. Let's break down the secure private access automation.06:00So it is supported from 2018 two and 1718 two SD WAN version. This SPA uses IPsec, but it combines with BGP for the dynamic routing. It is supported with ECMP for high availability and it uses the BGP for the routing.06:16Tracking. The key features here is the integration of your security group tags, which is SGT that allows the administrators to enforce any identity based access rules for your private application on your secure access solution.06:36Why use automated tunnels instead creating manually with the configuration? So this table highlights the difference. Manual templates require high operational complexity. You have to create manually, you have to define the parameters like IKE, IPsec, DPDR.06:57And routing parameters, Whereas automated tunnels are API driven.07:17They automate, negotiate the parameter and automatically handles the multi region redundancy, and it can scale up to eight to ten active or backup tunnels with minimal manual input. And the foundational concept here is the network tunnel.07:22Group NTG.07:42So an NTG groups all your tunnels together for the high availability within specific secure access region. Your traffic is prioritized and the primary hub uses you used to send the traffic and and also it can use the secondary for any.07:44Kind of a failover mechanism with full ECMP support.08:04Depending on whether you use the NAT, a hub can support up to a hundred tunnels from ten tunnels. So visually this is how an NTG operates. Your customer equipment CPE establishes the tunnels to both active.08:08Primary hub and passive secondary hub. Remember the thumb rule, a SIA use case which is secure internet use case that uses a static routing, whereas SPA uses dynamic routing via BGP without NAT.08:28Okay, so with that we will move to the next slide. So let's take a deeper dive into configuring on verifying the secure access. So before that, let's see what is secure access in deep dive.08:50So there are two types of traffic in an SD WAN environment. One is if you are familiar with SD WAN, you will know the SD WAN overlay traffic, basically the IPsec tunnels between the SD WAN router that is called as SD WAN overlay traffic for your internet application resources.09:07Which is hosted on the data center. The other traffic is a DAA traffic, so any traffic that you want to send it to the internet, you can have a local breakout on your SD WAN router and you can send it on the internet. So we are going to introduce the 3rd type of traffic.09:26Which is for your internet, which is called an SIA traffic. So your SD WAN router is going to form an IPsec tunnel with Cisco secure access and with the help of the data policy or a static route, you should be able to bifurcate the traffic from the DIA traffic and you can send the.09:41Internet traffic to your secure access for your security policy enforcement. So, whereas if you have any kind of a corporate like traffic, you can send it to the internet traffic into into secure access, whereas the normal internet traffic you can use the DAF to directly send it to the internet.10:01Now let's take a deeper dive into the configuration and verification of secure internet access or use case. Starting with unified release 20 six.one, we have an API integration streamlined this process. DNS traffic is used or secured at the.10:22Nearest pop. For web and non web traffic, the router utilizes the active ECMP behavior to load balance across multiple tunnels to primary hub one and the passive tunnel is created to hub two for the immediate failover.10:42And with that, we will see what, how to configure this SIA tunnel on the SD WAN policy. So before that we will see what are all the tunnel capabilities. So each and every SIA IPsec tunnel provides roughly 1 gb of capacity. So the system automatically selects the best.11:02And provisions the primary and secondary data center. If the primary DC fails, the IKE that peer detection identifies the failure at the tunnel level and seamlessly.11:22Your traffic is shifted to the secondary DC. So to achieve the higher throughput, Cisco catalyst SD WAN manager aggregates multiple tunnels. You can up deploy up to eight active and eight backup tunnels to secure access because we support NAT traversal, all of.11:34All these tunnels can be established from a single public IP address at the branch level.11:54Load balancing across these tunnel is highly intelligent. We support both ECMP for equal bandwidth links and if you have a different unequal bandwidth link, we support UCMP for mismatched ISP links as well. To ensure packets arrive in order on the day.12:01Destination and don't break.12:19The load balancing uses the flow pinning based on four triple hash, source and destination IP address and the port numbers. Basic up down tracking is not enough for modern networks today. We use layer seven health check to detect the brownoutes.12:21The router sends the HTTP pings to the secure access services API to measure the latency loss and jitter. If the tunnel violates the configured SLA, it is marked as down and the traffic is dynamically rerouted to the secondary tunnel.12:41Which is a healthy tunnel, ok? So the traffic steering is highly flexible. You can use this deep packet inspection and classify the specific application like Dropbox or GitHub for an example, and route them.12:59Through the SIA tunnels. If the tunnel goes down, you can configure the fallback to if like let's say for all the primary and secondary tunnel goes down, you have an option to configure a fallback to standard direct internet access routing.13:15Let's see how we can configure the SIA configuration right now. So configuring SIA is a straightforward seven step process. Note that this requires the graphical user interface beyond two twenty.ten.13:311st, you generate the API keys in the secure access dashboard and you can input them into the SD WAN manager. Next, you can create a secure access policy and define your layer seven tracker and configure your primary and secondary tunnels. And finally you can create a route or a.13:50Data policy in order to divert the traffic to the SIA tunnel and the traffic reaches the secure access. So before configuration, let's see what are the prerequisites in order to do the SIA tunnels. So your SD WAN managers should be twenty.thirteen seventeen.thirteen, and we support this workflow only.14:09For UX two.zero with the help of policy group.14:29And your SD WAN managers should have the internet access to reach the security in order to access the API and your VPN zero should have the DNS configured and you need to enable the IP domain lookup before configuration. So that can be done on the system profile.14:33And that should be enabled on the T lock interfaces and SS SSE API credentials should have the right access. So these are the primary prerequisites before configuring the SIA tunnel.14:53So the 1st step is to onboard the secure access, API credentials and once the API is generated you can append that API on the SD WAN manager in order to create the SSE policy. You have an option to create the multiple IPsec tunnels and create a high availability. We will see that.15:08In deep dive on our demo session. So the 1st step is go to the secure access admin API keys and fetch the API key and make sure as I said, the API key should have the read and write access for the network tunnel group tunnels and the regions.15:28And then go to the SD WAN manager administrator settings under cloud credential you have to paste the API key over here and go to the policy group and create a secure secure internet gateway policy group.15:47And here you can configure your tracker interfaces also. You can specify the source IP address of the tracking interfaces and the threshold and probe intervals as well. And this is where you can configure your IPsec tunnels.16:06You can configure the primary and secondary IPsec tunnels and specify what will be the source interface of the IPsec tunnels, and you can add the trackers that you configured on the previous steps. So here I have configured the secondary IPsec tunnels.16:22And it can choose either I can choose the automated IPsec tunnel, automated data center, which will choose automatically the nearest secure access data center or you have an option to choose the region also manually. Yeah, so this is the way of, this is the one that I was explaining, either you can choose auto or.16:40You can select the regions and under the high availability, you can specify whether both the tunnels IPsec one and two should have the same weight or it should have the different weight. So this defines how the load balancing can be performed while sending the traffic.17:00And finally, you have an option to, you, you have to write the redirection traffic redirection rules. You have two ways to do it, either on the option one, you can configure the service route, you can go to the VPN service VPN and you can configure the default.17:18Out pointing to the secure access.17:37That's the 1st one. So here every every every route that's not matching the routing table that will follow this default route and send that those traffic will be sent to the secure access or else if you need more customization, you can create the data policy, and you can.17:40Specify the source destination traffic or even the applications as you see here Microsoft Apps is selected as an application and you can select the secure access as a destination. Okay.18:00And in order to verify if the tunnels are up, on the SD WAN manager you can go to the tunnel section, you can see if the tunnels are up, and on the logs you can see if once the integration is done, it can tell you whether the, whether it fetched the SSC region successfully and.18:13Whether the tunnel is created from the edge that you have configured with the policy group.18:33So on the secure access side, similarly you can go to the network tunnel groups and you can see if both the primary and security tunnels are up. So let's see quickly on a live demo how this can be configured.18:39Here, ok so let let me start the demo. Yeah, so as a 1st step, you have to go to admin API keys on the secure access.18:56And you have to generate the secure access API key with read write access, which I have mentioned. So once the API key is generated, so this is the API key. So you have to copy this API key and come back to the administration and settings page of SD WAN manager.19:14And go to the cloud credentials and under the cloud credential you have an option to paste this API key and the secret key. So optionally, you can also configure what context that needs to be shared to the secure access.19:34Yeah, that that will be configured during the policy group. So here I have selected secure access and I have configured the API key and the context sharing is enabled over here. So after that you can go to the configuration group.19:54And enable the IP domain lookup under the system profile. So this is very, very much mandatory before configuring the SIA policy under the policy group. So here you can go ahead and enable the domain lookup.20:10So I, once the IP domain lookup is configured, then you can go to the configuration and policy groups. This is where the ISA policy is created and you have to go to the secure internet gateway, secure service edge here. So right now it is not configured.20:28So you go to the secure internet gateway, secure edge, and add the sec secure access policy. So I have named the policy as a SIA, and this is where you can enable what context it needs to be shared. So I have selected both VPNs and HGT. So both the VPN IDs and hgts will be shared to the secure.20:44Access which can be used for the policy construct.21:04And here you can configure the tracker configuration oh sorry yeah so IP domain lookup is enabled.21:07Under the policy group, I have created a SIA policy and I have enabled VPN and SGT, so I am configuring the tracking group over here. So the tracker IP address can be configured and once the tracker is configured, then you can configure the.21:27The IPsec tunnel parameters. So this is the URL for the tracking parameters. So here I have configured the IPsec tunnel parameters.21:47I specify what should be the source interface for my IPsec tunnel one and two. So in advanced option, either I can choose the data center as automatic where the nearest data center will be selected or else I can go with the manual selection of data center also.21:56So these are all the IKE parameters which you can have an option to customize it. So I have selected Europe, the manual one. So similarly, you can configure the next type is it tunnels also.22:13IPsec two. So once both the IPsec tunnel is configured, this is IPsec two also it will be following the same process, the high availability can be configured. So IPsec one and IPsec two, I'm configuring the weight as one. So you.22:30Means the equal cost load balancing will happen here. So then I can go to the policy group and map this SIA policy into it and associate that policy to the devices. Okay, sorry.22:48Yeah, so following that, all I have to do is, I have to create a traffic redirection policy, so that either you can do it as a service route or the default route or you can configure that as a data policy here.23:13So in this demo I'm going to show how with the help of data policy.23:29So, so the policy is pushed to the devices and now you can see the tunnels are up. So, so once the tunnels are up, then I can see, I can configure the data policies.23:36So the tunnel are looking up ok so to create a data policy, yeah, the tunnels are up on the secure access side also. So under the configuration, I can see what are the 1st I can show you what are the custom application I have, the proxy secure.23:51Access and umbrella, which I don't want to send to the SIA rest of the traffic I wanted to send to the SIA tunnel.24:11So under policy group I'm creating a new data policy. Here I can write what are the traffic that needs to be sent to the overlay tunnel. I'll specify just as an accept. So finally, so I'll just mention the secure access for proxy and the umbrella DNS, basically the DNS traffic.24:23Also needs to be sent on the DIA, so those will be following the normal route.24:43Finally I'll have a SIA route and in order to send the traffic to the SIA tunnel, I just need to do base action as accept and then action should be selected to secure internet gateway and I have to select as secure services.24:48Which so here secure access is selected. So, so with this policy, if you see, the, the, the 1st rule says that the destination IP address, 17216 will follow the normal rule base action is accept. It will follow the overlay rule.25:08And the next two traffic also it will follow the normal routing table, whereas rest of the traffic, the base action is offset the 4th rule and the traffic will be diverted to the SSE solution. So with this, I'll be able to send my traffic to the SSE cloud for my secure internet use case.25:27So next I wanted to talk about the SPA use case. So users in the SD WAN will be sitting behind the spokes and the resources will be sitting behind the hub devices. So normally the hub router advertises the resources or subnets to the spoke and routers.25:48With the help of OMP protocol and the users behind the spokes can access it through the SD WAN overlay tunnel. But whether SPA defines how the remote user is access the same resources that is sitting behind the SD WAN hub router. Here hub should advertise those router to the secure access with the help of BGP protocol.26:07And the remote users connecting to the secure access should be able to access those subnets securely. So this is where the SPA use case fits into the solution.26:27SPA is designed to protect your private access, the internal application. So it uses a resource connector or SD WAN box in this case deployed near to your application. The critical design notice, the traffic from the CG net must be allowed and not inspected on your firewall.26:37False.26:56So let's quickly see what are the IPsec tunnel parameters for SPA use case. So this diagram shows that SPA traffic flow, unlike the SIA, SPA relies on the BGP to dynamically advertise the private subnet to the secure access.27:02Cloud. It also leverages the modern protocols like mask or HTTP three for the highly efficient security connection.27:22So SPA tunnels are robust. You can deploy up to ten active and ten backup tunnels to the devices. Load balance load balancing is completely handled by our BGP multi path and same four tuple hashing we discussed earlier.27:33Will be used for the high throughput and session stability for your private app traffic. So this increases the throughput capabilities as well and it performs the load balancing over multiple tunnels based on the four tables value.27:49So the BGP is the protocol that is used as the engine for the SPA, so your SD WAN edge routers now automatically share the private resource that it learns on the VPN routing table with the secure access via the BGP. This dynamic advertisement ensures that.28:07The remote users always known the optimal path to reach the internal data center and the branch resources. So SPA configuration is very similar to SIA, but with few routing specific addition, it requires 2018 to 1718 to SD WAN version.28:25And after setting up your APA credential and SSE policy, all you need to do different from this is configure your BGP parameters. So your BGP ASN number and the BGP parameters needs to be configured on the policy group.28:43So the prerequisites are very similar what we seen on the SIA tunnel. Just the differences is this device version should be 2018 two and 1718 two, whereas SIA is supported from 2012 itself. So onboarding step is also similar to the SIA tunnel.29:01Just that, the step number six is different.29:21So once you configure the primary and secondary tunnels, you have to configure the BGP ASN numbers and the routing policy names because your SD WAN router is not only going to form the IPsec tunnel to the secure access, it also forms the BGP neighborship, so whatever the routes that it learns on the.29:25Service VPN. It's going to advertise those routes to the secure access. So the remote users that are connected to the secure access to the JTNA solution, they will be able to access those routes that are sitting behind the SD WAN routers.29:45So the steps are similar, the same API keys has to be fetched from the secure access and that needs to be pasted around the Cisco's SD WAN manager, and you have to create the policy group, the secure private access policy group. So previously we were creating secure.30:02Internet access policy group. Here from twenty.eighteen you will get the option of secure private access policy group.30:22So you will, so additionally you will specify what, what is the service VPN segment that you wanted to form the BGP neighborship. So here I have selected the VPN corporate users, so those routes in this VPNs will be advertised to the secure access.30:29And IPsec tunnel is similar. You have you have to create two IPsec tunnels as a primary and secondary tunnel. And additionally, you have to configure this BGP routing. So ASN number and BGP in and out route map will be configured in order to.30:45Contain the the limit the routes that needs to be advertised from the SD WAN router to the secure access. And let's say if you wanted to do any kind of a customization on the route maps, you can leverage the CLI template on the SD WAN manager and you can do it.31:03So how to verify it? Again, if you go to the SD WAN tunnel section in the SD WAN manager, you can see all the SSC private access tunnels. And similarly on the secure access, you can go to the network tunnel groups and you can see the SPA tunnels active status. So one step that you have to additionally check is.31:20Since the BGP is involved, whether the bg secure access is the learning the routes from the BGP neighborship or not. So if you go to the tunnels and you can see the client subnets. So if you see the subnets here, these are all the subnets that are advertised from your SD WAN manager to the secure access.31:40Yeah, also you can see the routes learnt and are received on the SD WAN manager as well. So we'll quickly see the demo of SPA access before going into the next topic which is sassy. So most of the workflow it is going to be very similar.32:03So here it's twenty.eighteen.two as I mentioned. So the 1st step is, to paste the API keys on the cloud credentials section.32:23So this is already done because you have created an SIA tunnel, so that's the 1st step. And after that, you can go to the Yeah so this is the AP access.32:39Generated the page where the APs are generated on the secure access. Then I am going to the secure internet gateway, policy group and I'm creating a secure private application access policy group over here. Naming it as a SPA.32:55So here 1st step is to create 1st step is to create the IPsec tunnel parameters, so I have selected the corporate users.33:12And the secure access region is selected as a Europe over here, so it is going to form the tunnel to the Europe cloud. And the tunnel parameters, you can configure the IPsec tunnel one and two. Optionally you can do the IPsec parameters also.33:29So the IPsec tunnel two is created, let us save. And the additional steps here you have to do is the BGP AS number. So I'm specifying the BGP AS number 65001. So you can fetch, get this AS number from the secure access itself.33:48It's a default AS number and specify the route map in and out that defines what routes needs to be learned from the secure access, what routes needs to be advertised to the secure access.34:08So once it is done, you can add this policy group into your policy groups and attach it to the devices. So once that it is provisioned to the devices, you will see the tunnels showing up on the SD WAN manager.34:24So I'm quickly going into the verification steps that config is pushed. Yeah, so the tunnel should be up here on the secure access, yeah, as well as on the SD WAN manager.34:44Yeah, so here the tunnels are up for a secure private access also. So then now you can validate if the routes are learned. So as I said, you can go to the tunnels and you can see if the routes are learned.35:04So before that, I can validate on the SD WAN manager also. So here you can see the BGP neighborship is up, whereas the state prefix received is showing as zero. So it is not advertising any routes but the BGP neighborship is up from the SD WAN edges. So here also you can, you don't.35:25See any subnets under the client subnet. So you have to change the route maps and add the rules also. As I said the route maps configuration can be customized to the help of the CLI templates. So the route maps are mapped, so inside the route maps, the configuration has to be allowing the access. So now there is NO.35:45No configuration on the route maps.36:05So none of the routes are allowed. So I'm just adding the CLI template in order to allow the routes in the routes map. So once it is done, then you will see the routes are advertised to the Yeah, so you can see now 21 prefixes are advertised.36:07Now you can also see the client subnets here. So these routes are learned from the SD WAN edges to the secure access. Now you can write configure the this on the secure access for your application servers.36:28For your ZTNA connections. So I'm creating a new private resource, 104. So the IP address is 17216 104.eleven, which is from the subnet that I learned.36:44And it it can be accessed from 3389 TCP RDP protocol. So I'm enabled with client based connection as well as browser based connection. So you have to append an URL for the browser's be based connection.37:00So I'll copy this URL because this is the URL that the client will be trying to access this server. So RDP is used as a protocol to access and the access rules can be configured over here. So I can validate what all the access rules can be configured for this server access.37:16So I'm not specifying much rules over here. I'm allowing it, allowing the communication of this traffic and not specifying much rules over here. You can say if in case if you want to configure any specific rules.37:39We can do it. Now I should be able to access this resource from my remote desktop, we enabled with the DNA. So once that this validity is reachability is validated.37:56Now I can go to my remote desktop and I can access this appli URL, which I have copied it from the private resource. So I'm I'm able to access this PC site 104 from my remote desktop, which is sitting behind the SD WAN router. So in order to validate my access.38:16You can go to the secure access ok sorry I'll show you the verification before I transfer. So in the secure access you have the activity search window.38:37Yeah, monitor activity search. There I can check the traffic that has been monitored on the secure access. I can filter with PC site 104 private resources.38:56I can see there is a browser that access this URL in clientless mode zero trust access clientless mode. So this URL is sitting behind the SD WAN router and this subnet is advertised to the secure access so that remote user can access this URL.39:15And this is the use case of SPA. So with this, I'll just, like I'll just hand over this to Vishwael in order to start with cloud security control, how a unified sassy solution can automate this integration.39:32SD WAN to cloud security integration.39:52Yeah, yeah. Thank you so much. Just give me a second, let me share my screen and then we'll start. Share screen let me start the.39:56Yes. Yeah. Okay perfect. So, so for the final part of this presentation, let's look at, Cisco security cloud control and how it helps bring our security and networking operation together.40:16So we have discussed the architecture and integration of secure internet access and SPA. Now the focus is on how we can manage these capabilities through a common platform, simplify operation and provide a more consistent management experience.40:33So, Cisco vision is to bring secure SD WAN, secure service edge and identity capabilities together through a common platform experience. The key point here is that we.40:52Are not simply combining product under one dashboard, but we are working towards shared platform service that simplify how teams manage access, networking and security. So this includes unified role based access control common.41:07API and logging.41:27Reusable object and an AI based policy experience. Identity intelligence also helps build a more more converged view of identity across the organization. The longer term goal is to make policy management visibility and troubleshooting more.41:29Consistent across the environment. So now let's see how this translates into the actual connectivity use case. So this slide showed two important integration scenarios which Satish already explained, like for SIA and SPA. So for.41:491st on the SIA side, we protect branch to internet traffic. The branch connect to secure access through automated tunnels to the nearest SSE point of presence. Weighted ECMP and high availability provide flexibility into traffic.42:07Distribution and resilience.42:27We can also share network and identity context including VPN or VRF information and Cisco ICE SGT security group tags. This we will cover in demo as well. And second with secure private access.42:28The focus is on remote users accessing private application. The remote user connects to Cisco secure access and connectivity to the private resource is established through the secure router using BGP and IPsec, which Satish just now showed. So the key takeaway is that secure access can support.42:47Both branch to internet security and remote users to private application connectivity.43:07While integrating with the SD WAN environment. So although these use cases are achievable, but managing the network and security components separately introduces operation challenges. So traditionally network and security team.43:14Have worked across separate management consoles and policy domains. This create three major challenges. 1st a disjoint experience. So basically it means team uses different consoles, authentication mechanism and role management model.43:32Second is inconsistent policy, through network policy, on prem firewall policy and cloud delivered security policy maybe managed separately, which can lead to creating a duplicated object and potential policy drift.43:483rd is end to end visibility when the application experience latency or in connectivity fails, the network team may not have sufficient visibility into the security side and the security team may not have enough network context. So the result is more man.44:04Annual coordination, longer troubleshooting cycle, and a greater risk for configuration inconsistency. But this is the problem unified management is designed to address. So this slide shows the evolution of Cisco.44:24Management experience. So initially we had a multi console model, SD WAN path steering, router firewall policy, our traditional firewall policy and secure access policy were managed through separate interface. The next stage introduces more unified sec secops dashboard.44:42Improving the centralized security management experience. The current stage is unified sassy management through security cloud control. The objective is to bring SD WAN path and traffic steering policies.45:03Secure access policy and supported firewall management into more unified workflow. So this slide distinguishes the capabilities available today from the capabilities marked as generally available. So additionally.45:18Capabilities are expected to be introduced to the subsequent releases. The important message is the progression from segmented management towards a more integrated SASE operating model. So.45:34Here, we can see what the unified experience look like in practice. So this screenshot show shows the security cloud control interface firewall policy management and management topology view.45:50Instead of treating the SD WAN sites and the secure access environment as a completely separate operational area or the administration or the admin can work with supported networking and security capabilities through SCC, which is security cloud control.46:06So the topology view also provide a way to review site device can they can check the device status and tunnel health. This is particularly useful when investigating connectivity problem that may involve the branch, the SSE tunnel.46:22All the security service edge. This we will show in demo as well, but the overall benefit is simpler administrator and a more consolidated operation view. The exact management capabilities depends on the supported products and integration.46:41Let's look at the architecture behind this integration. So security cloud control act as a common management layer across the SD WAN manager and secure access environment. The architecture includes the workflow application, common platform services, and.47:02Integrates with identity and network context. The key concept here is the use of common object. E.g. VPN ID or network objects or security group tags are important.47:21For maintaining consistent segmentation and policy context across the networking and security domains. This architecture also, shows the integration with Cisco eyes through PX grid.47:36Which supports the exchange of identity and group related context. The objective is to reduce the need to maintain disconnected representation of the same network or security object. So instead, the platform provides a more.47:52Coordinated management experience across the integrated environment. Quickly, this slide summarizes the major capabilities of security cloud control. The 1st area is centralized administration.48:09So the platform provides a common console streamlined of onboarding through activation code and role based access control for management. It also support federation with external identities providers.48:25Like Microsoft Andra ID, Okta and Cisco duo. 2nd area is shared platform service. This includes common object, global search, a centralized knowledge hub, and then AI assistance.48:41Indeed to help administration find information and gain contextual insight. The 3rd area is automation and governance. So rest KPI supports integration with automation workflow.48:57By centralized subscription management and common navigation simply simplifying administration across the supports portfolio. So taken together this capabilities aim to reduce operational complexity and help teams.49:14Manage networking and security through a more consistent platform. The important distinction on this slide is between solutions that are managed directly within security cloud control and ecosystem products that can be launched from the platform.49:31On the directly managed side, the highlighted or the highlights, this highlights the sassy management, secure access firewall management, AI defense, multi cloud defense and secure workload. So this capabilities provide.49:51Management or configuration workflow within the platform on the ecosystem side, products such as secure endpoint, Cisco duo, Cisco XDR and secure email threat defense are accessible through the common navigation experience. So this distinction matters.50:07By accessing a product from a common interface does not necessarily mean that all its configuration and operation functions are managed natively within security cloud console. The platform also bring together related capabilities such as.50:28Now SD WAN onboarding identity provider integration and API programmability, the goal is to make the broader Cisco security ecosystem easier to navigate and administer. So quickly moving forward.50:44This slide brings the overall sassy story together. The 1st benefit is unified administration with a common interface and role based access control for supported networking and security oppositions.51:012nd is streamlined connectivity, helping simplify side onboarding and traffic steering into the fabric. 3rd, consistent policy control which helps reduce operational inconsistency by making.51:17Supported network object reusable across the integrated environment. And finally we have the centralized monitoring which helps team investigate issue across the fabric from the branch towards the cloud.51:33And the diagram highlights the breadth of capabilities involving including SD WAN VPN, ZDA, DNS security secure web, access firewalling CASB, and data protection. The overall objective is to bring networking and.51:50Security together in a more consistent operating model with improved visibility and simpler day to day management. Now let's focus on one of the most important operational area which is sassive policy management.52:08So this interface bring together device policy and cloud access policy under the common management experience. On the device policy, we can see categories such as policy group, application priorities.52:26SLA NGFW secure internet gateway or secure service edge and DNS security. On the cloud access side, the interface provides a view of access rule, their source and destination, and the security setting associated with these rules.52:42This example also distinguishes private access from internet access. The view is more consistent way to review and manage policy across different access contexts rather than navigating entirely separate workflow.53:00And we will show we will see this in our demo as well, like how we can see the different policy management from our single console. So now it's role based access control. So bringing this capabilities into a common platform.53:16Also makes role based access control particularly important. So as shown here, the platform distinguishes between network role, security role and SASE role. So network role are intended for, network admin and operations team.53:35Security role focus on security role basically focus on administrator who need to work across the integrated environment and the screenshot shows that these roles have different level of access.53:53E.g., some rules provide read only visibility while other permits consideration or border administrative operation. So this supports the principle of least privileges you users should have the permission they need for their responsibility without automatically.54:08Receiving unrestricted access to every function. So larger organization with separate netops or team, this separation is especially valuable because it supports collaboration without removing administrative boundaries.54:29So this brings to our demo, so we have covered covered the architecture and the main platform capabilities, so now let's look at how some of this workflow appearing practical or in practice. So let's start.54:47So 1st how we can claim it or how we can integrate our SCC with. So we have to once we receive a claim code, we have to log into security cloud control and get the subscription code.55:03Here we have two options either we can create a new instance or add to an existing one. We have to make sure that we enable sassy management. Once we enable it, we click on next. There's an option to claim. Once you click in claim, you have to make sure that you are adding to the correct organization.55:19So once you click on claim, it will connect to your SCC cloud, check your claim code, and then our subscription is active, then you need because integration is not configured yet. So for integrating with SD WAN, we need to activate the code so you can copy the activation code.55:38From here, we have to make sure we are in correct organization. Now we have to go to the SD WAN search for the fabric, from the fabric list where you want this subscription to be activated. There's another way you either you can enter the activation code here or you can directly.55:58Go to integration, but before activating this we have to make sure that we are going to the correct organization or into the correct organization. So once we verify that this is the correct organization.56:17We copied the activation code, we go to integration, we select the fabric where we want this to be activated. Select the fabric, enter the activation code, and click on onboard. Once we click on the onboard in the backend, SCC will connect to SD WAN.56:34And all the product or services which you have available will be integrated over here. This will take some time and once activation is completed, we can see the progress or we can see the status on the home or the dashboard.56:54So let's see so onboarding is completed. You can see tenant onboarded to say automatically is completed. So you can verify it by going to the organization, view details and you can see that it is completed.57:12Yeah. Now also we can go to our SCC and under platform management or here in under the product you can see when is available now. So from directly SCC or security cloud control you can.57:30Login or you can view the configuration of catalyst SD WAN, ok? So now going to the next part ok so this shows once integration is completed, let's see the.57:48Other thing like policy or admin. So we discussed about the admin role, so we have.58:07We discussed about different admin roles for network security and sassy. So these are the predefined admin roles. Administrator, sassy read only SASE admin network. So basically the few are for network, network administrator, network basic, network operations.58:13Network operator, we have separate rules for we have separate for security team. So all this have.58:33Their own roles defined, so you can select any as per your organization need and these admin roles will be called under the administrator. Once admin is defined, we can go to connect, let's connect to the sites.58:41So for connecting to the site, we go to connect, so this site is already active but let's configure to asset. So I say we have two options, we discuss about SIA and SPA which is secure internet access and secure private access.58:57So for secure internet access is connect branch from. So let's start by connecting one of the site. So here you have two options select an available tunnel group or create a new tunnel configuration. So for this, we will create a new tunnel.59:13So if you click on create a new tunnel, we will give any name, create. So here this is context sharing like you can connect via VPN or ICE security group tagging SGT. You can add a tracker source IP address.59:30To initiate the connection. So, and then we have to add the tunnel interface, so we will create a two tunnel, you have multiple option to create a source. So for here we will select gigabyte internet. So we have to define this interface is primary or secondary.59:46So the, we have created the primary, now we will create the secondary tunnel. So we selected the interface, this is our secondary data center. So both data or the board tunnel we are defined. Now there's a list of the region.01:00:06So you can select the nearest region for this demo we will select US Virginia.01:00:26So once this is completed, you have to select the HA, so we will add both tunnel interface into an HA pair so that it will be part of the high availability. So once it is added, you can click next.01:00:31And a tunnel will be created, so we will use the existing tunnel here. So once tunnel is active, you can select the traffic steering option. Like you have an option to out all internet traffic to our cloud, you have option to out specific application as well.01:00:47In specific application you have two options, either you can use from an existing application list or you can define your own cloud application list. So application like AWS box, many options are available. It has to be tagged with an segment here. You have also advanced custom setting as well.01:01:05But for now, let's select route all internet traffic, we will select the segment we'll click next. Here is security policy, these are the policy which are available. So once you build a site, so that site will be tagged with this security policies.01:01:24These are the already created ones so once the site is active, the policy will be applied to that site. Once we click next, there's a page to review the configuration and final page to submit it.01:01:41There's a final last check before we push the configuration to the SCC. So we added the we do next. We do a final review of the configuration.01:01:56Once we are ok, we click on deploy and then tunnel should be active. We see the message in progress tunnel deployed to one site in SCC, so we can check the status over here. It is not deployed, it is in progress, so it will take some time.01:02:13For the deployment, meanwhile, it is deploying we can check the policy. So we go to secure policies, device policies. We have two options, the device policy and cloud access policy, so we applied the.01:02:31Policy now so it is showing as device up to date is zero because still configuration is in sync, it is not active, we have option of policy group, application priority and SLA, NGFW, secure internet gateway secure service DNS security so all these options are available under device.01:02:46This policy which we discussed in the work presentation as well. Now move to direct cloud access policy or also you can say secure access policy. So all this policy we have created so that will be tagged with the device policy which we have selected.01:03:05So we had two option of secure internet access and secure private access policy. We also talked about common objects, so this common object will be used in both SD WAN and secure access. So we click on add object.01:03:22We can use network host range FQDN and this will be used or this can be used on both SD WAN and secure access. We add object, it is available and you can see the compatibility for both.01:03:37We go to home, we can see the sites in our topology overview. So this page shows all the sites which we have built, it can show you all the details like which configuration group it is there, what's the status of tunnel, if it is healthy, you can also see the status.01:03:56If it is up, this shows everything all the details over here from where you build the tunnel, what's the usage, what's the uptime? You can also use the troubleshooting options over here, ping, speed test.01:04:17You can also perform trace as well. You can see site details, so everything is visible over here. You can see the connectivity status, data transfer rate, also security events can be visible from this same homepage.01:04:32Now quickly, see the secure private access as well now. So once we click on secure traffic for private application, we can click start. Here we will build we'll create a new SPA.01:04:52Tunnel, so we give the name, click on create, we select the segment assigned to region. So we'll select the nearest region for where we want our SPA traffic to go.01:05:09So we select the tunnel pair, so we will select the different interface name. So we added two tunnel primary and secondary. So it should be part of HA. We will select then BGP ASN number for our routing.01:05:25Which Satish also mentioned in that presentation. Then we have to select the route map for, in and out. So we selected the route map as well. We click on next.01:05:42There's an AI as well for creating policy or you can select from existing policy. We can then review the configuration before final pushing or finally deploying it. So this is we can add the tracker interface.01:05:57We click next, this is the final page, final check to deploy. Once we click on deploy the deployment will start and we see a message that in progress deploying one site in sassy. So this is how we can deploy and create a configuration for SIA and SPA.01:06:16Hope this was helpful. So now these are the reference resources associated with the presentation, including the secure cloud control data sheet and the interactive demonstration we just discussed, so you can use these resources for further details on the platform and it supported them.01:06:35But I will share these links in the chat window as well. We are slightly over time, but I think this session was helpful. So to conclude Cisco secure cloud control support the broader sassy vision by bringing networking and security management closer together.01:06:55To the common platform. The key benefit we discussed are simplified administration, more consistent policy management, role based access control and improved operational visibility across supported integration. The objective is to reduce the complexity of managing separate environment.01:07:14And help network and security team.01:07:34Work more effectively together. So this brings an end two of our session. Thank you so much for your time and have a great day.01:07:37