Cisco SASE Explained: Secure Access from Anywhere to Everywhere

Oh, Hello everyone. Thank you for joining us today and we will go through explanation and secure access from anywhere to everywhere.00:00Some homeworks before we begin, we will introduce Slido question and answer for only reason that we can track your questions and the conversation after the webinar is closed and we can reach out to you guys later. If you don't feel comfortable with Slido.00:21You can still continue using chat or question and answer from the webinar itself. So it's up to you, but if you decide to use Slido, you can scan the barcode or go to slido.com and enter the passcode and the.00:40The code of the meeting. So I see it's 1203 central time. I will begin the meet the webinar is being recorded so for anyone that will join a little bit later, they can catch up through the record.00:58Recording. Today's speakers, I have to Shar joined me and we will go through the presentation and demos and we have Charitha and Edgar as our panelists that will help us with your questions or chat.01:18That you may have re related this topic or probably other questions as well. Agenda for today we will briefly kind of to go through the workflow, we will see what are some challenges that the organization are facing. What is Cisco unified sassy management?01:37Some role based and you introduced on this unified sassy management, a demo, how we do things under the unified sassy and more specific about catalyst SD WAN, some use cases and secure access itself, and another demo how to.01:56To do the onboarding and configuration that.02:16Portion. So it's not a surprise or new new news that endpoints, users and applications are everywhere on today's networking, right? They are on public cloud, private cloud.02:21On board users are traveling. They are not static anymore, could be on the same region when the one user is different regions and they need to have access to the data organization, application, internet and so on. All this flexibility.02:37He's putting like pressure on us as a networking and security community to make the secure connection safe, but this is adding complexibility.02:57So for an organization to kind of reach their goals, the basic thing that they need, it's to have users and devices be able to access internet applications, SASE application, on prem and non standard application data in general. So.03:11This is coming with some risk because we have seen users and devices in some cases on multiple locations, they are not able to access what they need to access to do their task, their job and some other locations and situation they are accessing what they are not supposed to access.03:29So policies are in place but because they live on multiple places or one rule is overwriting the other rule, a user or device can access something that is not supposed to access.03:49So to fix all of this, we as a community networking security came up with this zero trust, right? So zero trust will do checks all the time. What is this device, what is this user? Does this belong to this organization? Is this the right profile and so on and will.04:06Put the right rules as well.04:25On Cisco perspective we are offering Cisco secure access. So this is easy for for IT is better for users and safer for everyone. So we have a single agent, a console, and subscription, one in one place and.04:28We can do, domain name, security, we can do web gateway security, zone zero trust access network, remote VPN, and so many other things related with the security.04:47And the main goal will be that users and devices will go through the secure access, implementing that zero trust that we just spoke about and they will be able to access the data whatever they are in internet, data center on prem, SASE, et cetera, right?05:02So this is cool, but still we have some challenges with this implementation as well, right? Because we have networking team doing what the networking team will do, right? Operation day to day pushing templates, pushing policies, monitoring and so on. And on the other side we have.05:21The security team do what security team does, right? Implementation firewall rules, IPS IDS, web filtering and so on. In some cases, right, we have seen that these two teams are not kind of.05:41Collaboration on the perfect way. So some policies that may exist on the networking side, they don't exist on the security side and on the other, some users that for the networking perspective needs to have admin role or a specific access to the security side that doesn't.05:58Like too much sense. So we see some lack of end to end correlation, we see some.06:17Fragmentation between the access roles and some policies may exist on SD WAN and they don't exist on the secure access. So to kind of get read or make this challenge kind of less painful for our customers, Cisco introducing unified.06:24Management. So what is this one? This is a security.06:45Cloud control and basically what he's doing is taking the Cisco SD WAN and is taking secure access and is taking the the smart or the identify 1st like dual or ICE combine all three together to offer one, one console.06:48That will be very easy for everybody to kind of maintain their day to day tasks, so you have one console to do management of your operations. This increased the advanced security, meaning that there will be one place for the entire policy, so you have this.07:08Same policy, the same rule, the, the same common object, and this will give you end to end visibility thanks to ARR, AI powered now.07:27So, what we have done if we zoom out a little bit, we took the networking portion of operation things and we did we took the security operation and we combined all together, so now what do we.07:39We can do on SD WAN or what we can do on secure access side, like all these options, right? Deep analyzing AI predictive network, one optimization firewall as a service or you name it, right? They are combined in one place and this is kind of improving that.07:55Management and improving end to end visibility, better experience on for the monitoring.08:15And of course optimization, so we know what we have on our network, what type of users, what type of device, what they cannot do and logs and everything that we need to see for related with the security. This is just a journey. So we, what we have today, we still have a multi consolidation.08:21Experience so still you can do SD WAN configuration operation. You still can do secure access.08:41And now, it is kind of available as well unified sassy management, so when you can do all this combined together and more features will be added on the newer releases as well.08:50So from the GUI perspective, right, when you log in on a secure cloud control, you will have an organization depend on your company, you may have one organization multiple organizations but the rule of thumb.09:05Will be that you will have the products so firewalls will give you your on prem firewalls FTD, Meraki or ASA firewalls, and you will have a secure access that is under SASE management. Here you will see your SD WAN and you can see more like what are the tunnels, what.09:22Are the devices. So basically it's what we are talking about, the unified management across catalyst, SD WAN policies and secure access in one place.09:42And, to kind of summarize and recap what this will do, we'll offer you a better administration management, so you can use SSO or RBAC in a single interface.09:54This will have been on a one platform will accelerate the onboarding and traffic steering based on using this new workflow on the fabric and as we were repeating over and over the policy.10:12Now will be the same across the board.10:31And the monitoring again will be under one centralized place. So will allow us to kind of find the issue and resolve the issue faster across the platforms. And again, visually we have SD WAN and the secure access like a VPN.10:35Zero trust network access.10:56That we can do all these things, the DNS security, we can do AI and now we can do using AI for systematic security and so on. And the main goal is like better security, easy to use end to end visibility.10:59And so on.11:19So if we see how the architecture will look like, SD WAN will do the same concept like the Cisco hosted or on prem will form the tunnel with secure access and now with the secure cloud control, they will start exchanging the.11:21Common object ssos and on top on the other side the ICE or dual or whatever you are using for that security enforcement right will start.11:41Exchanging the the SGT name spaces and everything will be under this platform so we can see the common services, we can see the workflows and so on. On the other side between the V manage and secure access we will exchange the VPN I.11:53The Namespace and tunnel configuration, health checks and everything. And if we go down to the routers that where the the data plane leaves, right? They still will do the same process. They will exchange inline SGT and VPNs.12:13Between routers and the secure access so this will allow the traffic end to end to be monitored better to be the policy that needs to be enforced to be enforced based on VPN IDs and all the other things that needs to be taken care of.12:31And with this new introduction we have some new rules as well. So if we go under the administration access, now we have a networking rules, these rules will be, think this as a SD WAN.12:51Rules. So so on network administration or whatever role operation.13:10These users will have access to the routers as the WAN portion of a fabric or a tenant, and we have SSE roles. These roles are more thinking as a secure access role so on the cloud, basically.13:17And the new role introduces the SASE roles, so this is kind of the top roles. A user, let's say if you have a user under sassy administration, this specific user will be able to do everything between networking, SSE and SASE itself.13:37Off.13:57And you can go through the description for more details what each role and group of roles will do. And this screenshot here for guys who are working with SD WAN day to day.13:57Maybe look very familiar right here is when we create the the new policy groups, the policy, application policies and our tunnels, but the difference is that this is coming from the cloud, a secure cloud control now. It's not from the V manage and this is to show.14:18How we are kind of, putting things on one place from different perspectives of SD WAN and secure access just to keep and maintain that similarity on unified across the board. And on the.14:38If you have a Cisco secure access, this policy will be called secure access policy and on the cloud perspective, it's been renamed to cloud access policy, but it's the same concept. Here we have all the.14:58Firewall rules that we can apply for the internet access or the private access depend on the the task and the situation that we need to take care of. And some common objects as well so those objects can be part of a specific group and could be compatible.15:13For a specific like a secure access or could be more like different type networking and that will be compatibility for the SD WAN and secure access.15:33And could be a host as well and doing the same compatibility, we still have the same concept, we need the source and destination for access policy, and we need the source and destination to steering the traffic based on that profile, so.15:44Maybe an example.16:04Some compatibility for the networking object SD WAN supports IPv four and IPV six is not supporting ranges or fqdns. On the other side secure access supports all subtypes like CIDR, host range, FQDN IPV.16:07Four and IPV six.16:26Network groups, SD WAN only accepts omgenous group. SD WAN does not support again like inline ranges FQDN and secure access supports all the group combines, including mixed subtitles and nested groups.16:29So, my co worker Lars, he couldn't join us today, but he sent it a video to show us a demo how we use unified sassy to do an onboarding and configuration from the secure cloud. So I, I will.16:48Play the video for you and we will come back on the next part of the presentation.17:07Consists of Cisco secure SD WAN and Cisco Secure Access. All manages from the common platform Cisco Security Cloud Control, SCC. SCC is the platform that can manage all Cisco security solutions. So as you can see here.17:16On the dashboard, we have all the different products on the left side, AI defense, firewall, high ratio, multi cloud defense, secure access and secure workload.17:33So this how it looks like when we have everything enabled. What we are going to introduce in this demo is the new Cisco sassy solution where everything comes together both from a security perspective and the networking perspective with SD WAN.17:42As you can see here, we have SASE management, catalyst enabler on our SCC. The role based access control has been involved with the introduction of sassy. So we have now three new types of roles across the SCC. As you can see here on the screen, I'll show you the admin roles now.17:59We have network administrators and networking roles that are giving users access to the SD WAN manager side through SCC. We have the SSE roles that gives the users access to the cloud part of the secure access so rules and policies for that part.18:16And then we have the new combined roles sassy administrator of SASE roles that will give the users access across both types of products. Let's move on and go over to the SASE management dashboard. Now we're loading the SASE management dashboard and we will start by onboarding a new branch.18:35The devices previously been onboarded to the SD WAN fabric and is now ready to become part of the sassy solution. So we click configure for sassy and then we will start collecting the internet. Have two main use cases that we can run on sassy. Either protect the internet bound traffic from branch to internet or secure a private application.18:54In this case we chose the SIA workflow.19:16We start by selecting either to reuse the existing tunnel configuration we have building advanced or create a new tongue config. I'll just show you how a new song configuration will look like. We start by giving you the name SIA demo, then we choose if you want to share the context from the SD WAN fabric. It's always good to do that so you can actually create.19:19It rules in the cloud based on the VRF segment or the STT tech inside the SD WAN fabric.19:39We provide a tracker IP address for our tunnels and then we start adding tunnels. In the desktop here we will have two tunnels. We'll use the same source interface on both. After selecting the interface, we will select if the tunnel is a primary tunnel or a backup tunnel.19:46Then we need to create 2nd tunnel, which we will then choose the same interface as before, and then choose the secondary in this case, which means that the tunnel will now be configured as a backup tunnel. Next step is to choose the Cisco secure access region we want to connect to.20:03In our case here you can see we have a lot of different data centers, but I will choose the US Virginia one for this example. Next thing is to configure the high availability, so we will add the primary tunnel as the access and the backup tunnels as the backup. We can also adjust weights if that's needed.20:21Let me just take a step back and choose a policy that is already prepaid for us. So here I choose the two tunnels for Americas, and then we need to decide how to steer the traffic. We have three options here. Either we can route all the traffic within a service VRF.20:43Towards the sassy solution or we can choose to specific applications, either our default cloud applications or use a defined list. The next though, the last option we have is the advanced option where you can build your entirely owned policy.20:59Common for all three is we have to choose which segment we want to steer the traffic based upon. So in this case here, we'll go back and choose the all internet traffic and then just choose our corporate segment and route all traffic based on that. Next step of the workflow is the security policy. As you can see here, we already have.21:16Cloud security policy where you can see which roles are applied for the traffic coming to sassy.21:36We then click next to get an overview of the intent that we want to configure. We save that and at this point in time the configuration will be built across both the CSA and the SD WAN manager. The final step is to deploy the configuration to the devices, and before doing so, as usual, we need to verify the variables and check that they are.21:43All as they should be before we click next. We have one final review step here where we can see all the intent that we have planned throughout this workflow before we click deploy. Once we click deploy, the SCC will interact with and let that know that it needs to start configuring. As you can see here in the top right corner.22:02And the device list is now empty because all the devices are now configured for and we are now waiting it for to be deployed. While the deployment is running in the background, we're now focused on the policy management part. Policies has now been joined together in SCC, so we both have policies for the SD WAN manager side, so the.22:21The policy groups that we are showing here. As you can see, we have two groups.22:41One has already been deployed for EU and then the other one Amir is the one we are now interacting with in the background. So you can see the device is not up to date yet. That's what's going on in the background. But as you can see, the policy group construct is now we moved into SCC, so we have a policy group, the application priority group, the next generation firewall for the security.22:46Features as well as the security part of it.23:06Now switching gears into the cloud access policies. This is where we are building the policies for things that are being controlled inside the secure access cloud. As you can see, the rules are the same as the ones that we saw in the workflow, so the ones that were already built. Let's move on to the common objects. One of the benefits of having a common plan.23:08Forms is that we can share objects across. So let me create a demo object for you here. We add a name, we can add a network, a host, a range of FQDN, and then we are able to use them across the the sassy solutions both the SD WAN side and the data policies, as well as in the cloud policy objects for our Cisco secure.23:28Access side.23:48But now the deployment should be finished and we should be able to see here on our monitoring tab of Cisco setting management. As you can see here on the map, we have a list of all our devices. We can see all the details of the devices, which configuration groups, how many tunnels are both from the SD WAN perspective as well as our news.23:52As you can see here.24:13All the gray downs are all the data centers and you will in the future be able to see the connection points between the sassy devices and the data centers. If I want to do more detailed troubleshooting of the device, if it's not healthy and you want to do network pipe insights, I can directly from here, but it will cross launch us over to the SD wan.24:16Manager. The rest of the monitoring page is about connectivity, how much data has been passed through the data centers, how much, how many events do we have, and so forth. So all relevant opera operational information.24:36Let's continue our deployment with building a secure private access tunnel. We select our site in this case Oslo, we click configure for sassy, we choose secure traffic for private applications. We create a new tunnel set, we call that SPA OSL.24:49Two T the create, we choose our segment, same as previous, which is which region we want to do or choose auto. In our case here, we will choose stockhole. Because we know that's the closest one. There we go.25:06We had a tunnel pair, important to know that the number has to be a separate number from what it was in the SIA workflow. So here we have our tunnel pair. We configure our local ASN number that we need for BGP 60.25:225512 and then and route map policy for in and out. And in this case you use SPN in and SPA. We click next.25:39We can again choose our AI to build the rules if we need to. Click next, review, create tunnel configuration, check for variables, click next and review.25:55Do the configuration before clicking deployment. The system now deploys the configuration and you can see here it says not deployed, but that will change shortly. So to summarize, Cisco SASE simplifies operations by unifying catalyst SD WAN and secure access into the security cloud control. Cisco SASE truly converts cisco security with connectivity.26:14Health checks and also tunnels. Last but not least, Cisco SASE provides comprehensive visibility across the entire platform. Okay so this video was very detailed how to do the configuration of the tunnels and everything from.26:35For the unified sassy management perspective.26:54The next portion of this presentation and the demo will be for the customers that they don't have Cisco secure access, Cisco cloud control yet, but they do have SD WAN and Cisco secure access. So just a reminder or.26:58The use case is the most common use case on SD WAN, we do secure branches connectivity, zero touch automation is a whole multi cloud connectivity so we can expand our networking to the cloud provider. Use any type of transport. This is the beauty of SD WAN so you don't necessarily need an MPLS or you can use fiber.27:18For cable satellite et cetera.27:38Secure and flexibility, so you may want some specific traffic to be redirected direct to the internet from that remote site. So direct internet access built in next generation firewall, you can use Cisco or 3rd party SSE like zscaler.27:41One of them, umbrella and secure access as well and some features extra features like voice, L two VPN optimization and much more. And before we see those use cases for the sassy on SD WAN.28:01Let's kind of review a little bit what is the network tunnel groups. So this is a pair of IPsec tunnels used as a primary secondary. This will allow us to have.28:22Like HA pair and allow us to kind of predefine data center location or if we are not sure which one is the best location, we can choose the auto and the closer location with our router will be chosen.28:34Will give us a routing option like outbound NAP static or BGP failover. On the trucker perspective, we keep detection for IKE and BGP keep alive all downtimers as well and these have been used for the failover as well. We can build.28:54Up to ten tunnels if we use a loopback interface and these loop interfaces are not configured as NAT interfaces. So.29:14And if, as I mentioned, right, you have, if you use a loopback interface, you can build multiple tunnels and this is how the system will keep the tunnel. So if it's an interface itself, we just build the tunnel ID, your org name, and, and.29:24A portion of that to to make the the tunnel ID in general, but if you have a loopback, then we'll use some tags so the maximum is ten, right? So it will be extra added here will be tunnel ID plus the tag and the rest is the same. And when it.29:43It's going to the other side of the secure access head end will strip the tunnel tag. So this is how we maintain that.30:02Multiple tunnels for the same tunnel kind of situation and we will see on the demo more specific though. So, to maintain everything as I mentioned earlier, right, once we have the the tunnel built SD WAN and the secure access.30:11Will consistently exchange the VPN ID and that will allow us and the sgts as well that will allow us to have a better operation of our traffic. So in this case, right? So the corporate user will be a different VPN ID.30:31And IoT devices would be a different.30:51VPN ID or whatever will be the situation, right? A guest Wi Fi network or something going through the tunnel when it's reaching the secure access based on the policy secure access will filter, ok, I have this VPN ID to allow going out or to this specific rule and I have the.30:55IoT VPN ID not to be allowed. So that that is important when we say share content.31:14To be enabled and allow the VPN ID and SGT. So here is coming in the picture again. And now we will see in more details that are two use cases secure internet access, benefits for that is kind of supporting multiple service VPN.31:22Up to eight active and backup if you are using loopback interface again shared VPN ID and SGT. And on the automation part all the interfaces or all the internet traffic could be routed to the secure access, not necessary.31:42Side because you may have a specific traffic you don't want to send there, but the option is there. So if you want all the traffic, you can share all the traffic similar to what Lars was showing on that demo as well. Some other extra feature like 1 gb throughput per tunnel and.32:02Overlapping ahead with automated NAT as well. So it's important to note that AD for direct internet access is six just in case you have a direct internet access without the policy in place. And if you're introducing a.32:23AD for that ACC route will be two. So this will take over all all all of your DIA.32:43But if you are using any type of policy to kind of do that DIA traffic, then that will override the routing AD, so just keep that on top of your mind when you are start building this type of the use case.32:51So if you zoom up a little bit how the the things or how the traffic will flow from the branch, we'll go through the IPsec SD WAN tunnel to the secure access hub, right? And we'll go through the process of the authentication that could be option.33:10Is highly recommended to have a good authentication and of course we'll check the DNS as well and once it's doing these steps, we'll go to your service routes when your firewall rules and IPS rules will be implemented. And once this specific.33:30User or device it's going through these steps will be able to do the DLP other pieces of the process going through the NAT and be able to reach out the internet or sassy application, whatever will be the situation.33:50And there are some capability summaries, so auto tunnels for this specific use case they've been supported and since 1713, so they have been around for some time.34:06The shared content VPN ID and SGT, they have been supported since 1715 and about the encapsulation and routing for tunnels by using IPsec and not, not is on the secure access side right and again we can have.34:22ACMP, active standby up to eight and so on. So now if we have to, so comparing with the previous demo, a lot of things will be very similar, but keep in mind now we are on two different.34:42One will be SD WAN and one will be secure access, just in case for customers that don't have secure cloud control. So the 1st step that we need to do if we are building this from scratch is to come to the secure access portal under the admin AP because we need to.35:02Build an API key, and at least at the minimum we need to select deployments. If we want more option for this key to do, we can select admin in and policies et cetera. And once we click create key, if we want to kind of make this more secure, we can add.35:21A networking restriction right only this specific networking access or so on. So we click create key and we will have an API key and the key secret.35:42I'm just sharing this secret because this is not longer existing, not for demo purpose. And once we have these two, we go to SD WAN portal or console under the administration settings we look for cloud.35:52Credentials and our under cloud provide con credentials, we need to enable SSE, we put the organization ID, the easy way to find this from your dark board link, API key and the secret and as I mentioned context sharing make it enabled.36:09I recommend it.36:29Once we have that, we need to do some homeworks before we continue deeper. We have to enable domain lookup, so under the on on the configuration group under the system profile, we have we have a parcel called global. So once we find that one.36:31And we click the person and after the global we find the service and we enable the domain lookup.36:51And, another important piece of this exercise is to have at least one interface with IP not outside enabled, so otherwise the tunnels will not come up. So once we have this done, we go to policy groups under the.36:59Secure internet gateway and secure service edge. For this 1st use case, we need to select add secure internet access.37:19And once we click that one, we can start building the tunnels, we give a name and again two different screenshots showing that if I have a physical interface gig one in this case, I can build one tunnel, but if I put a loopback, I can have a maximum of eight tunnels.37:28Was for the same kind of interface.37:47And it's a specific rule, if you have more than one network one interface that is doing the NAT, right? If you leave this tunnel via route via by default, the system will pick the the 1st natting interface, but if you want to kind of force, you can choose which.37:51Interface to to be selected here for the nothing purpose, right?38:11And once we have this, we, we can build other pieces and to show we'll go through a demo in more details, right? So the rest of the steps are just to deploy these changes to that devices that are part of this policy group.38:16Now we will see a little bit about secure private access. So it's the same use case and this use case it's to protect the remote users being able to access like the corporate network or internet through the corporate networks as well.38:35The benefits are similar, we have the.38:55Automated tunnel option to select auto data center or select a specific data center. Again, ESCMP, HA support for this specific, we will need a BGP tunnel, so we will have the option to kind of.38:58Redistribute our corporate network to the secure access.39:18And by, by by default, this is something to keep in mind. By default, the BGP will create a deny all route map policy to kind of prevent any looping between the routes and we will bypass that.39:25Through a CLI add ons I will show that later. So if we zoom out, this is how the traffic will look like despite we, we may have a remote managed device or we may have unmanaged device. Both of them needs to use one of these.39:42Oh, anyconnect or ZTA clients VPNs, etc. So once they connect, they go through the authentication. Again, MFA support and give us pass throughs are optional, but they are highly recommended for a better security. And once we have.39:59Of authentication, we go through the authorization when firewalls and IPS and DLP, all these rules based on this profile will be applied. And once we have that, we will go through this.40:18Network tunnel group that we saw early and we will reach the SD WAN device and from there we will be able to access the private networks. And, so on some summary about this use case, this has been supported on 28.40:35Again, we're using IP IPsec and BGP.40:56In this situ in this case we have ten active and ten backup per device comparing with internet access that it was like eight. For the traffic redirection we need the BGP routing and.41:00So some other information that I'm leaving here to for the recording. So the steps to do the configuration for this secure private access short SPA, most of the steps are the same on the same place under the policy group.41:16We need to select now a secure private applic.41:36Application access, new thing under this menu is that we need to pick service VPN and we need to pick our region, and again, you can select a specific region or you can do auto.41:39And after that you build the tunnels and you have an option to do HA. It's important again to name of the interface not to be the same what we used on secure internet access. The reason why when you try to push and you have the same name.41:58The IQV two profile will comply saying I am using this profile to a different interface. And the rest of that is is similar, so you pick data center if this interface will be primary or secondary.42:18And the last portion is when you build the BGP routing and you pick your local ASN and you give the name of the in route policy outbound route policy as well. So about the BGP, it's worth to note that.42:35The 64512 is being reserved for the secure access.42:55So don't use this specific number to your SD WAN site. As I mentioned in route, inbound and outbound route policy will be auto generated and will deny all statement. So to allow our preferred routes, we need to have a.42:59CLI add ons templates and this is a very basic one as a starter when you can create a prefix list with all the routes that you want to allow. In my case is everything since this is a lab, but on your case may look different.43:19And you can see the inbound deny and outbound denied auto generated and what I'm just doing here is I'm permitting all the routes in and out. And then the last step of this BGP configuration, I have.43:35My network that I want to distribute on the secure access side as well. This is very, very basic and could could be more complex if needed to. And after we have all these pieces together, so we have the Cia auto and.43:52These are just the names and you go under the policy group, basically you select your.44:12Two type of tunnels and you click deployed and at this moment is everything is done correctly on the secure access side, we will see the tunnels coming up and in my case I have four active and four standby. And once we have the tunnels up.44:19We can go and implement the CLI add on templates that I mentioned. So in that case I will have everything end to end once I have all my arrowser that I want to exchange.44:39And, this is not required, but just if you want to have a policy to bypass some type of FQDN or application, you can do so. 1st you need to create your application catalog, customer applications. In my case I'm just decide to.44:56Bypass the SSE proxy itself and I just give you the name and these are the URLs in your case you may need your organization ID for Cisco secure access and another.45:15The Custom application that I did was just an umbrella DNS that I don't want to send that to the secure access. So on the same portion custom application, you give a name in this case instead of picking the FQDN I'm just giving the.45:33IPV four and this is the same you can build similar like application family or groups and et cetera, right? If you have a specific, some customer they may have in house specific application that they don't want to send to the secure access. They can bypass on the similar way.45:51So once we build our applications and the group of interests that I want to bypass on the policy itself, I will create the rules, right? And on top of that I just decided to keep this specific.46:12The networks like not to go to the secure access and bypassing those proxy and the DNS. And I'm saying everything else coming from this specific network or I don't need to match anything. So if I don't match anything will be any any.46:28Sending to secure Cisco secure access. So that means the entire traffic will go to the secure access.46:48Except only these three rules. And to kind of, it's recommended when we build the policies for the 1st time to be sure that we are not breaking anything, we keep the default access except and we can change later once we see that the rules have been applied correctly.46:57As a summary, right? The 1st Cisco internet access, think this as a protection of the branch traffic going to the internet and these are some benefits of the automated tunnel close to.47:18Secure access data center, flexible load sharing under router policy based traffic into SSE context sharing as we mentioned, right? The other policy or the use case should say a security private access, think this as a.47:34Protection of the remote user and traffic going to on prem.47:53Are going to the private traffic as well. So the same benefits on top of that is the BGP connectivity between remote users and the private resources, right?47:58And I put in some references links here if you want to learn more about unified sassy or just sassy in general and I will pass the ball to to go through the demo what we saw right now.48:14Thank you. Alright, thank you for all the information that is about how do we integrate a Cisco secure access with SD WAN, right? I'll be walking through those 2 s you use cases SP.48:32Internet exit rate and private access. So for both the scenarios, initial initial prerequisites for it is to have an API key for secure access, right? Similar to Umbrella and Z Scaler.48:52For the integration to happen automatically, you will have to have the API key generated from the secure access portal. So for, for generating the API key, you can directly go into admin, API keys and you can create an API key.49:12We do have.49:32Already created API key, so I would not generate one, but this is how you would go about generating a API key depending on your user credentials and to what extent do you have to have access to that particular user, you can select the.49:34Permissions and once that is done, you can also restrict a particular IP if we do not want, API access made from those particular IPs. Once this is generated, once it's created.49:54We can basically grab that information for the API key, right? The secret and the key, and that will be added. This is our we manage going into Cisco credentials, cloud credentials.50:13This can be added in here. As, as we know like some of you might be familiar with Umbrella zetscaler. With umbrella, you may know that every customer is assigned an organization ID. With secure access also, a particular or.50:35Every customer is assigned organization ID. That particular information is needed here with addition to API key and the API secret. Also, for.50:54VPN sharing and sharing, that's where the context sharing is coming in. So once we enable it, once we save it, all of our process of automating or like the automated IPsec tunnels with secure access.51:11Is automated. So initially like the primary or the prerequisite is to have that API key already added in your V manage and to have.51:29To have domain lookup enabled. This is also a prerequisite for enabling enabling this integration. Once these two prerequisites are done, we can go ahead and.51:45Create our secure internet gateway, policy. So I'll be going over the secure internet exit exit use case 1st. How do we go about creating that policy?52:04Yeah, as, as we can see here, right, like 1st of what is our SSC provider, is it secure access or do we wanna share VPN SGT? And do we wanna create a.52:25The tracker rate to to have availability rate all availability all the time.52:43This can be, the API URL can be any Cisco website or it can be any domain that you would like, like google.com or anything. In our case we haven't, haven't created anything here, but.52:52It depends on customer usability usability from perspective of adding a tunnel rate or creating tunnel configuration, we can, we can add tunnels here. We do have created already pre configured tunnels.53:11I'll be going over some of that configuration as that that is added in here. As had mentioned, right, these IPsec tunnels names should be unique.53:30Based on your user case user use use case let it be SPA private access or internet breakout. In this case we are, we have named this named it as IPsec one oh one and then we are giving tunnel source interface as the physical interface.53:43As mentioned, right, as has gone over the theory part of this, this tunnel source can have a loopback interface as well. Like this tunnel can be initiated from loopback interface as well. Once in that scenario rate.54:04You can have traffic for your IPsec tunnel route routed over that particular physical physical interface. If we have a tunnel configured, you can basically enable it here based on.54:24Your default or tunnel specific tracker, as shown in here right like with respect to choosing the data center, you can, this is gonna be our primary tunnel, right? That that's where we have selected primary tunnel, right?54:40And in advanced options, right? We have all the ikey, ikey exchange parameters, right? Like DH group, IKS ipher suit, ikey rekey interval.54:59And all the information related to IP, IP sec. In our scenario, by default I think you will see a 1400 as the MSS size, but, this is like 1350 and 1390 work the best. So that, that is why we have.55:15I put in those parameters.55:35In this scenario creating our primary, like we have created a primary, secondary, and primary, secondary, we have four tunnels configured here. As you can see, right? Here we are just selecting what the tunnel is, right? Is it a primary tunnel or is it a secondary tunnel? From.55:41We have two T locks here or two van interface here, gigabyte internet too, and we have another interface, and we have two tunnels initiated from it. As someone had asked right, like, can we choose, can we keep the region to auto? Yes yes.56:01You can have a auto option where this, the API call is gonna be made to Cisco secure access and with respect to the check, right? The background check, it is gonna reach out to the nearest or data center secure, Cisco secure data center device.56:20And automatically choose that endpoint.56:40Network tunnel group is basically your tunnel group name that will be seen on secure access, right? So if we leave it as default, right? What it's gonna do is similar to umbrella or Zscaler right.56:46Right, if you do not define the tunnel name or tunnel group, what it does is it basically grabs the serial number and the hardware information for your.57:06Our device. So here, I'll show in brief second, once I go to cisco secure access page, I'll show you how would would it look like if we do not select that particular information. With respect to high availability you are just mention.57:17Mentioning the created tunnels and you can put in weight for that tunnel as well.57:37This is how like this will be, this is the 1st step, right? Where you are creating the tunnel, like creating the tunnel information, which is gonna be formed between your edge device and your Cisco secure.57:46Access Cisco secure access endpoint. This is the primary thing or primary configuration that is done. Second thing is creating a policy rate or creating a rule where all the traffic for that, that is coming on that particular router.58:02Which will be forwarded to Cisco Secure Access.58:23In my case, as had mentioned, right, we had multiple rules, right? One is to bypassing the cop network, corporate network, then, proxy by bypass for SSE.58:27If I drill down in here, right, our basic action is, right? Like here, action can be going to that particular Cisco, going over that created IPsec tunnel.58:43Or going over that private edge or like the private network that has been done or fall back to our local routing, right? In our case, we wanted to bypass that proxy so we do not have that, that.58:59Action being sent, right? Set. So in in our case, let's say for all of my traffic, right? I want to send my traffic, redirect all the traffic matching based on one particular application.59:19To, Cisco secure access, right? In this case, I would match based on application, right? And selector select predefined application. We have a good list of predefined application list which is updated every.59:34Be like it's pretty updated and you can create custom applications as well. In that in that scenario, if you have a particular unique application that you want to send over.59:54Secure access that can also be done. There are some other match conditions as well based on your destination IPs, let's say sites that you wanna.01:00:08Directly forward, file forward to the site and not to not through this particular IPsec tunnel that is built over Cisco secure access. So this is how you would define or define the rule, right? So this is a application of.01:00:23The routing that needs to be in place to forward any traffic that is coming onto the router.01:00:42Once this is defined, right, the next thing is, you will assign all these particular options, right? Created Cisco secure internet gateway and application of a routing policy.01:00:49To the main policy group, right? So these are your profiles that you have created based on your IPsec tunnel configuration, your traffic engineer con configuration, and then everything is com coming along in one place here, right?01:01:08A side note, right? The Cisco secure access integration through configuration group is available like through policy group is available. It is not available through templates. Manual tunnel building, right? Manual IPsec tunnel or GRE tunnel.01:01:26Can be built through templates, but.01:01:46There is NO integration possible with secure access through, our legacy legacy templates. So once we select created profiles, right? You basically have to deploy those to our intended sites.01:01:50In our case, we did have already deployed this, right? Once this is deployed.01:02:10If we go to monitoring and overview, going into tunnels, as we can see here, yeah, as, as I can, as I can see here, right, I have.01:02:16These tunnels to Cisco secure access up and running, right? So, now going back to secure access, right? How do you monitor how do you look at what was configured and what is present, right?01:02:34As we had, as I had mentioned before, right, network tunnel groups, right? We have to put in a particular name or it will grab the hardware number for your device and then the serial number, right? We have like.01:02:53Multiple tunnels here which are down.01:03:11But if you see, it grabbed the hardware number and the serial number for that device. This was when we had, we had that particular setting in policy group and secure internet gateway set to default. In our case, I'll just come back in here.01:03:14I just wanted to show you that.01:03:34Oh, right here, network tunnel or tunnel name. In our case, we had put in the name as like right here, this was a custom name that we put in, and here, right, we can.01:03:36See that we have two primary tunnels.01:03:56Or two are active tunnels and two secondary tunnels that are active, right? We can go into monitor and network connectivity and see what's going on for that particular tunnel, right? It gives us information about that particular tunnel that is present. In case.01:03:59This off.01:04:19What kind of traffic that is being sent over that particular tunnel, right? In activity search, you can search based on your tunnel or let's say your your traffic to a particular site and it will show you information about what is being.01:04:21Linking to that particular traffic, right? Is it blocked? Is it allowed?01:04:41Right, what particular category category category it is coming under, all of that information is present. So you have one place to monitor what is happening to your traffic, right? Alright, this is the 1st way how like the 1st use case that was discussed.01:04:46By a secure internet exit for.01:05:07Any traffic that is coming to our branch router or any router, right? Now, going to the secondary use case, which is secure secure private access for any client which is trying to remotely access.01:05:11Remotely access any private private application that is hosted in data center for any enterprise. All right.01:05:30I'm waiting for it to pop up. It's kind of similar, right? All that information that it needs is what kind of, 1st it asks us what is your VPN, right? The Cisco secure access region. Here also, you can have auto.01:05:46So right?01:06:06Or, yeah, you can have that like once you enable this, right, you are adding in all the tunnel information, right? Similar to what we had, right? When we are doing for internet exit. Similar to that, you're putting in.01:06:07Information for your IPsec tunnel. Here in my other use case, right? We had 101 and 102. In that, in this scenario we are putting in as 103. If we have conflicting names for the tunnels, that won't.01:06:27Similar to that, we are giving an information about ikey, IPsec information, and once that is done, in addition to, in addition to.01:06:48The IPsec tunnel itself, right? Or the tunnel that that is gonna be spun up, right? We are giving in information about BGP, right? And the route policy as mentioned by or like as explained by that is needed for private access.01:07:00In addition to this right, what you would see in my policy group is, yeah, like here, right?01:07:21What we have selected is SI auto and SPA auto. So this is my.01:07:40SPA auto which is for private access. And in addition to that, right, what we see is, you would see that SPA auto route map that is coming.01:07:46In here, right? And let's say in our case we wanted to advertise this network in BGP.01:08:06Right, so we have added customized network in here, right? And it's it's a basic prefix list and a route Mac that is present here. Once this is added, and attached to a particular policy group and being deployed.01:08:14You would see in secure access right? In network tunnels, it takes a minute or so to load up.01:08:36I I can see those that particular tunnels come up here, right? I had, in total eight tunnels, four, four active tunnels and four backup tunnels, right?01:09:01Yeah, like here we can see that particular information for that particular tunnels, from perspective of network connectivity and also, yeah. So if you look at the.01:09:20Information here, right? When I look at the tunnel that is being formed, you could see the BGP information as well, right? And also the client subnet that we had.01:09:41Added into, added into our CLI add on template, right? That is being reflected here. Yeah, so this is the SPA SPA demo. In, in this case also going into my.01:09:54Monitoring and activ activity search and events rate you can find additional information about what is happening to your tunnel or so.01:10:13Right yeah and what rules are being added in here. In addition to that, right, from Cisco secure access also, you could have different rules that are being built.01:10:22Build built, built for dropping, like similar to what we did from, we managed, right? You can have a rule that is added for a particular traffic, right? Similar to what we do in umbrella.01:10:42You can have a security rule here, as we can see, we have gambling list that is being added and traffic is being dropped for it. So you can have a custom access control access policy list defined from.01:11:01Cisco secure access. That was it from my side. Thank you so much. Does anyone have any questions?01:11:18If not, thank you so much. We appreciate your time and attendance. Thank you for joining in today. We would really appreciate if you would take the survey and let us know how we did.01:11:36And what other topics you would like to learn about that way we can come up and come up and present the, those sessions in upcoming EI session. Thank you so much team. Have a good day.01:11:50