Cisco Secure Access Secure Private Access

I thank you everybody for joining today. My name is Juan. I'm going to be your host during the presentation.00:01Today we're going to cover Cisco secure access, secure private access focus on ZTNA. Just to confirm, you are seeing my yeah ok perfect. So a little bit of housekeeping before going into the actual presentation.00:20You can go ahead and send your questions in the, in the Q and A section in the chat. There's ellipses on the bottom right. If you click on it, you should find the Q and A section. If it's not present, you can use the regular chat. I have a team of colleagues eager to.00:41Answer all your questions. This session is being recorded. It will be sent out to you afterwards. This is the agenda for today. Have a quick introduction, comparison between packages.00:56We're gonna look at where is where secure access fit in your organization, a quick comparison between secure internet access and secure private access overview of zero trust network access module, comparison between traditional ZTNA and universal ZTNA.01:11An overview of quick and mask protocols, secure private access rule components, and a demo. Security Services is a key key enabler for any organization's hybrid work strategy.01:30Whether your sessions involve applications in private data centers, SaaS locations, peer to peer traffic, anywhere really, we act as a security intermediary to identify and prevent multiple types of malicious activity. We allow you to get to your applications in a secure manner.01:45This is a chart, it's actually very long. It has a list of all the features that are included in all the packages. We include umbrella. So if you're transitioning from Umbrella to secure access, you'll have a better idea of what to expect. And the far right side, there are three secure access licenses.02:05DNS defense, secure internet access and secure private access. Now this link will be provided to you. If you though google Cisco secure access packages comparison, this is one of the 1st results. It's really easy to find it. Where do we fit in your organization?02:24We are a converge of our cloud security solution. We're based on zero trust, and the idea is to provide a seamless, transparent, and secure access from any device to any of your private applications. The mix of the technologies that are in the cloud would include.02:44SWG or Secure Web gateway. If you're familiar with umbrella, this is inherited from umbrella. This CASB, zero Trust Network Access, Firewall as a services, remote access VPN, and among other technologies.03:03Our scope is to help you protect your public and private traffic. Although this session focuses on secure private access, here's a very quick comparison between secure internet access and secure private access. If you're completely new to secure access.03:18These are the two type of rules that you can enforce. Secure internet access is the equivalent of what you could do with umbrella. Secure internet access is Cisco secure access capability to protect your web and internet access. The services in the cloud include DNS layer security, protection, cloud deliver.03:36Firewall, IPS, it's WG CASB, threat intelligence, remote browser isolation, cloud malware protection, DLP among other technologies. Secure internet access routes all your traffic through our data centers.03:57And that's when we enforced all these technologies and policies to your traffic. Once the traffic is sanitized and reviewed, we sent you out to the internet through our data centers. For secure private access, we provide secure access to private applications.04:13In data centers private cloud or infrastructure as a service without exposing your private network. The client based secure private access uses micro tunnels per application instead of a broad full layer three tunnel.04:32Authentication is mandatory required and optional features as posturing can also be enforced. All this traffic, when it hits the cloud, it backhauled through your private applications using either an IPsec capable device or resource connectors.04:49We'll learn more about those in the demo. Once the traffic hits the cloud, we can enforce policies because SPA is application centric, the users only see authorized applications reducing lateral movement risks.05:05And the ability to scan your network or expose it essentially reducing the attack surface. Let's talk about the ZTNA module. What is it? Is one additional component of the Cisco secure client.05:21Family of products. Zero trust network access is a security service that verifies users and grants access to specific applications based on identity and context policies. What does it do actually? Zero trust application hides services.05:37And applications from discovery and authorize access to only specific applications. By not allowing access to the entire network, ZTNA lowers the impact of a bridge, reduces business ability.05:55On the public internet and minimizes security risks. How does it work? Setting perimeters around assets and control workflows, it hides applications from the public internet and the traffic is still or redirected.06:11To a private application and resources to the cloud for policy enforcement. What are the benefits of using a zero trust approach for your private access? It helps protect the data, reduces the risks, and builds resiliency.06:26It provides adaptive context awareness access policies. These are enforced in the cloud. Continuous user and behavior monitoring of devices, fast secure access to cloud and network applications, unified management.06:43You configure all these applications and technologies from one single dashboard in the cloud. It is scalable and also simple to adopt. Just install the client in one more PC and it's already inside zero trust. How do you deploy it? We're gonna review these again more in detail in the demo.06:58This is one additional MSI that you would push regularly through your software manager solution. And once the client is sent out or installed, you would enroll it via multi factor authentication or certificates. Do you still need the VPN?07:16Is this a replacement for it? Not necessarily. Is that TNA can replace the ability to access applications. The VPN is for remote in person and hybrid work environments. VPN provide a broad network protection, but zero trust network access is a comprehensive.07:35Solution that empowers organizations with more restrictive and granular control. This last piece is essential. VPN allows bi directional communication between on prem and the users connected to a VPN out there in the internet. Zero trust only allows.07:55Inbound connections from on prem perspective. So if you're out there on the internet, you have the zero trust client, you can only initiate connections from your computer, go into your private resources. That TNA does not allow for on prem to initiate a communication to the clients. So though.08:13Their goal is very similar. It works quite differently. Now stepping into universal ZTNA, the traditional ZTNA is designed to allow remote users to access private apps.08:31Through traffic redirection, authentication and policy enforcement. Other ZTNA benefits sees when the user is on prem. So the user steps on corporate footprint redirecting the traffic to the cloud for policy enforcement.08:47It can be configured to back off with universal ZDNA, we can still stay in the corporate footprint and make your rules in the cloud still apply for the traffic. This is a modern approach that handles hybrid work scenarios.09:05Universal ZTNA integrates with your Cisco firepower threat defense for a cohesive approach ensuring consistent policy enforcement through security cloud control. So once you're out there, ZTNA gets your covered, but if you're in corporate footprint.09:21We can still enforce your rules in secure access in the cloud with the assistance of your firewall. We'll see more of these in the demo. Now, how does that DNA work? In terms of the redirection, we rely on quick.09:38Quick was developed by Google in 2012 and it was standardized by EIF EFT on 2021 under the RFC 9000. The connection establishment, it uses UDP 443.09:54It's faster because it consolidates handshake and encryption into one single step, one single packet, quicker data transmission and improve responsiveness. Security, all the connections the quickests are encrypted by default using TLS 1.3 semantics.10:11The cryptographic teams become available early to encrypt the data. This is again because it consolidates all the handshake and encryption into a single packet. It also does multiplexing. It supports multiple data streams within a single connection.10:29This results in faster and more reliable data delivery. If you lose one stream, it does not interrupt the other streams. Another key benefit is migration and recovery. Built in connection identifiers allows seamless migration across IP or port.10:46Changes. So if you're on an airport, if you have a bad signal or if you switch from one network to another, quick as you covered it is smart enough to resume a session. Has a robust performance for low connectivity areas or uses our mobile networks.11:06Now let's talk about mask. Stands for multiplex application substrate of a quick. Mask is a framework that leverages quick for proxying traffic to our data centers. It runs on top of quick.11:23It's faster than TCP over UDP. This let bullet refers to how DTLS work. Although DTLS also transport traffic using UDP 443, it is a technique where TCP packets get encapsulated inside.11:38A UDP packet. The mechanisms for mask runs on top of quick, once again, going back to the previous slide, it consolidates handshake and encryption into one single packet, so it's faster.11:53Yeah, quicker data transmission and improve responsiveness. When it comes to tunneling, it uses quick to encapsulate IP traffic. Multiplexing allows multiple flows through one single connection. There are two modes for tunneling.12:08Datagram mode. This is unreliable, there are NO retransmissions. And the stream mode is a reliable method of delivery, is used when traffic requires order of delivery. This is to prevent out of order packets. Performance reduced latency and overhead.12:24Since it works faster than traditional UDP, eliminates the need for multiple TCP connections. It is not traversal, it reports not traversal uses standard HTTP three, which makes it.12:42Not compatible here we can see the components of a secure private access rule. In order to create a secure private access rule, these are the only three requirements that we need.12:57When it comes to the sources, this is where the traffic would come from. It could be an IPsec tunnel, Active directory user or group roaming computer, ZDA client, network object or a security tag. When it comes to the destinations.13:15You must have previously registered some of these private resources or private resource groups, network objects or security group tags. These are the two basic components for any rules. On the 3rd box we have suggested advanced features such as posturing, step up authentication.13:32IPS file inspection, decryption, files held block in malware analytics in the cloud. Let's go ahead and show you the actual secure private access demo.13:51For being here today. My name is Juan. Thank you for coming to our secure private access webinar. The agenda for today consists of the following items. 1st, we're going to set up an FTD from scratch. After that, we're going to review the zero trust network access.14:25This flow, and then we're going to configure zero trust network access with a couple of enhancements. Once this is understood, we will dive into universal TNA. The flow will review the main differences.14:43And then we're going to configure it and see it in action. After that, we'll jump into remote access VPN, and last but not least, connectivity between sites using IPsec. I hope you enjoy, and let's get started.14:56Alright, for this demo I'm going to use GNS three because it's open source and it's really easy to use. This is a topology we are going to use for today's demo. These three clouds connect every section of the topology to the internet.15:17This switch right here has the role of the ISP. This is my corporate network, 18216822. I'm gonna call it the network 22 going forward. This is my core switch with the.two 54 management SVI. My firewall has the 20 two.one on the inside interface domain controller.15:36And a resource connector. In the middle we have the branch office. This is the 86 network.15:55We have Gordon Freeman also working from home. I'm going to showcase remote access VPN, and this is the VPN pool going to turn on the ISP 1st, that is going to boot fairly quickly.16:40We're going to set up an FTD from scratch. This FTD basically has NO configuration, it's brand new. One of the requirements for universal ZTNA is that your FTD has to have 32 gigs of RAM in 16 cores.17:01The initial boot up is gonna take a few minutes, so I'm going to fast forward. I'll see you shortly Okay the firewall installation is completed. Let's go ahead and do the initial setup.17:22We're going to log in with the admin user and the password is admin 123 capital A Let's accept the end user license agreement. Let's set up a new password for the device.17:40I only want to do IPv four, NO IPv six for this lab. This cloud right here runs a DHCP service for this segment of the network. I will configure my management interface to obtain an IP address via DHCP.18:00I'm going to manage this device from CLOUDFMC. I'm gonna do yes to locally manage, but I'll change that later.18:27Okay, the initial setup is completed. This is what the network interface looks like. Let's make sure I do have internet connectivity.18:36And I do. Okay, the FTD is fully set up right now. The next thing we're gonna do is add a manager to it.18:54For that, I'm gonna open a browser and navigate to security.cisco.com.19:10Okay, the configuration of security cloud control is outside of the scope of the demo, under products, we need to head over to firewall.19:50And then security devices. Click on this plus sign, let's click on FTD. And the registration method that we're going to use is the CLI registration key.19:59Step number one, provide a name for your FT. I'm gonna go with firepower. Under policy assignment, you should assign a default policy. The performance tier.20:20I am going to go with a variable, click on next, and security cloud control is going to give me the key that I need to use to add a manager to my firewall. If you're going to migrate your firewall from on premise.20:36FMC management to the cloud. I strongly suggest you engage Cisco tag, there is a procedure to get the firewall migrated.20:56We'll definitely help you out with that. Since this is a new firewall, I don't need to worry about losing any features or configuration. Just going to answer yes and continue. Let's go back to security cloud control and finish the wizard.21:04Right now the FTD has been discovered by the cloud. And after a couple minutes it's going to be ready to continue with the configuration. Okay, this is also going to take a couple of minutes, so I'm going to fast forward and see you on a little bit.21:22Okay, when you change the status to synced, it's fully onboarded.22:00Okay, let's go to policies and then firewall threat defense. This is what the Cloud delivery firewall Management Center looks like. It's the same experience as on prem, you don't have to maintain a local appliance. You can manage it from the cloud. Now we need to add basic configuration.22:06To the firewall.22:26This is what the Cloud Delivery Firewall management center looks like. It's the same experience as on prem, but you don't have to maintain a local appliance. You can manage it from the cloud. Now we need to add basic configuration to the firewall.22:42And let's configure the interfaces. The management interface. So I'm going to fast forward and see you on a little bit.23:16Okay, when you change the status to synced, it's fully onboarded.23:53Okay, let's go to policies and then firewall threat defense. This is what the Cloud delivery firewall management center looks like. It's the same experience as on prem, but you don't have to maintain a local appliance. You can manage it from the cloud. Now we need to add.23:58Basic configuration to the firewall. Let's go to devices and then device manager. Select your FTD, and let's configure the interfaces. The management interface, I don't need to configure it. If we go back to.24:18Topology, my outside interface is gig zero zero and my inside interface is gig zero one. I'm going to configure these two interfaces.24:38The inside will be 20 to the one. For the outside interface, I will use a static IP and I'm going to point to the cloud as the default gateway. This is the outside interface, name it outside. I'm gonna place this in the outside.24:46Security zone.25:07Zone turn on the interface, I'm gonna, for the outside interface I will use a static IP and I'm going to point to the cloud as the default gateway. This is the outside interface, name it outside. I'm gonna place this.25:23On the outside security zone, at the IP address 01:20 two.one 92. This is a static assignment and don't forget to enable the interface. Now let's do the inside interface.25:43Face I'm gonna call this inside, uplist this. On the inside security zone.26:03Turn on the interface and assign a static IP. 20 two.one is fine. Save the changes. I'm gonna add the default route before deploying the changes. Go to routing.26:10Static route, added route manually, call the outside interface, IP four any, and define the next hop, I can just type it 182-16-8120 two.one is the IP address of the cloud.26:25I Save the changes one more time. Let's configure a parent rule. I already have a policy in place. Let's just modify it.26:45So this is a path rule basically. He does a dynamic translation to the outside interface using the internal network as the scope. I'm gonna assign it to my firepower, save the changes.27:05Universals DNA requires a couple additional settings on your firewall. We're gonna add a D and a server, so the firewall has the ability to resolve names. We need to head over devices and then platform settings.27:21I'm going to add a new policy. I'm gonna call this platform settings, add my firewall as the scope device, and in here I'm gonna add a DNS server.27:37I don't have a DNS group, so let's just have one really quick. I'm gonna call this default DNS. The domain for my lab is sA-lap.local, like secure access-lap.local, and the IP.27:54The address is 20 two.one hundred, which is basically my own prem domain controller. Save, and now it should show up in the dropdown menu. I'll make this the default.28:12Okay I've turned this on in the inside interface. Save the changes, and we're ready to deploy the changes.28:29This is also going to take a couple of minutes, so let me speed up the process Okay it's done.28:44Let's go back to the firewall to verify the changes, change to ASA or CLI mode, right? Those are my interfaces, my default route. I should have connectivity to the internet. Okay, and I do. Perfect.29:00I'm going to turn on devices inside my network, my domain controller, and the core switch. This is the dynamic net that will provide internet connectivity to all my topology. Inside this object I have my corporate quantity network.29:16Let's go inside the core switch and ping the internet to make sure I have internet connectivity. Okay perfect. It looks like I have internet.29:33So my entire topology should be now connected to the internet through the virtual firewall. Okay, these are the basic settings of the firewall. Now let's enable universal zdna on this firewall. Let's go back to security cloud control.29:48If we click on the firewall, and on this right side pane, scroll down a little bit, we're going to find a new item, universal zero trust network access setting. Let's go right there.30:08And we're presented with this form, so let's go ahead and fill it out. For the device FQDN I'm going to add firepower plus my domain. Ideally, your firewall should have the same FQDN.30:22Inside the network and outside the network, but it should resolve to a private IP when you are on prem and to a public IP when you're not. Have prepared an identity certificate for this firewall. Certificates that are accepted should be PKCS twelve format.30:40I'll just name itself and add the passphrase and import it. Okay, after it's added, I can call it and this is what I'm going to use. And I want to turn user TNA in both inside and outside interfaces. So I'm gonna call both.30:58Okay, after the configuration is pushed, the firewall is gonna power cycle. After the power cycle, the firewall is going to be used at DNA ready.31:14And let's refresh security cloud control. The firewall should look ready now.31:41Okay, it looks synced. It's perfect. Alright, so this firewall is now ready to work for universal ZTNA. These additional configs are now available, create a policy and assign resources to the firewall.31:49Now, before we do anything, let's review how traditional ZTNA works. This is the testing PC, this is where we are sending traffic from. This is us secure access cloud. This is your firewall.32:06And behind it, your core switch and a server farm with your private resources. To begin, we need to register private resources and applications in your secure access dashboard. Next, we need to download and install the ZTNA module.32:21After the module is installed, it is required to perform a quick enrollment process. This is just a SAML challenge. After the client is functional, all your private resources are going to be published to the ZTNA client in a form of a configuration file.32:39The ZTNA module is going to actively listen for traffic going to these private destinations. Whenever it sees any traffic, it's going to steer that to the cloud. From the cloud perspective, we have two options to help you get to your resources.32:56Option A is deploying a resource connector. This is a virtual machine you deploy on prem, and then you associate it with your resources. The machine should have connectivity to all your private resources and applications because it's going to source the traffic from self.33:15When contacting the resources. Option B is configuring an IPsec tunnel on your firewall. In order to get a hold of private resources, we're going to source the traffic using an IP address of the CG net range because we are introducing a new net.33:31Work to your environment. Make sure you have firewall rules in place and also routes so the traffic can return to the firewall and then make it back through the tunnel.33:51I guess there is a 3rd option. Option C, you can actually deploy both an IPsec tunnel and a resource connector. We're going to use the resource connector as the main method, and we're going to use the IPsec tunnel as a backup mechanism in case your connector is not available.34:01Now let's go ahead and configure zero trust network access. All right, I'm going to open a browser and navigate to security.cisco.com. This takes me to security cloud control.34:24Once here, we need to go to secure access. The 1st thing we need to do is register private resources and applications. To do that, click on resources and then private resources. Click on add a private resource to begin.34:43And let's fill out the form. I'm going to register my core switch and also a few services that are running on my domain controller. Provide a name to the resource.34:57If you have registered a resource with an FQDN, you are required to provide a DNS server. If you have registered a resource using an IP address, the.35:19DNS is not required. I'm going to register both.35:34The IP address and the FQDN of my resources. Under the port ranges, you can specify how many ports you want to open. This is the DN server I'm going to use. If you scroll down a little bit under endpoint connection methods.35:38We need to make sure the zero trust box is checked. When this box is checked, all the clients that enrolled the zero trust module are going to get this resource published. Scroll down, click on save, and let's add another resource. I'm going to add my web server.35:58I'll act the IP address and also the FQDN. Specify the port that I want to open, Scroll down.36:17Check the box for zero trust, so the resource is published to my ZDNA clients, save, and let's start another one.36:36Select the protocol and the port.36:58Add another entry with the IP address, check the box for zero trust and then save. The last resource I'm going to add is my.37:01DNS server, just going to open the port 53, check the box for ZTNA and save it. Okay, we're done. The next step is a.37:17Associating all those private resources.37:37With the resource connector. The deployment of the connector is outside of the scope of the demo. Next we need to navigate to connect network connections, go to the connectors group tab, click on the connector group, and then go to the assigned.37:39Resources tab. On the far right side, click on assign resources, and this is where you can call all the resources that you previously registered. I'm gonna call them all and find these resources with this connector group. Alright, the next step is to.37:59Configure a secure access policy. Let's go to secure and then access policy, click on add rule, and we're gonna make a private access rule.38:19Provide a name. I'm gonna put it 1st on the list under the action, set it to allow the traffic. You can use this box as a search bar to find your identities or your sources. Optionally, you can browse.38:31Through all the identities.38:49Or you can click on this icon and expand the search so it's a little bit more comfortable browsing through the elements. It's also supported here. I'm gonna call Isaac Clienter as the source user.38:55And you can browse through the private destinations and called or your private resources here. These icons here specify the connection methods that are enabled for these resources. Click on next.39:09You can still change the rule name and sequence number if you need to. I'm not gonna make any more changes. I'm just going to save the rule. Excellent. The rule is ready. You can get the client from the dashboard. Simply navigate to the connect and the user connectivity.39:31There's a download button at the top right corner. Let's switch back to the client. I'm gonna open this computer, I already have downloaded and extracted the zip file on this computer.39:47I'm just going to install the VPN module, and after that the ZTA module. The VPN module has some dependencies that are required for ZDNA to work, so that's why I'm installing the VPN. Now that it is installed, we just need to installed ZTA.40:07We need to open it, Initially, the clients need to perform a quick enrollment process, which is just a SAML challenge.40:34So let's get the client enrolled and ready to use.40:47Okay, fantastic. The client is now fully functional. There is a button here to sync the configuration. You can see here the org ID and the statistics about the traffic that is.41:09Been steered to the cloud. If we navigate to C drive, program data, Cisco secure client, ZTA, enrollments cache configs, and open up this JSON file. Let me make it look pretty. Okay.41:28You can see the configuration file. This will include the private destinations that the ZTNA module must listen to. These are the IP addresses that I registered previously as well as the FQDN for my private resources.41:48Now let's test it out I'm going to do an SSH session to my core switch with the user Isaac.42:07Okay, you can see the counter increasing, and I am asked for the password.42:19Okay, this 20 two.two 54 is the management SVI of my core switch. If I type whole, we can see an SSH session currently connected. The user is Isaac and the source IP of the traffic is.42:3620 two.three. This is where the SSH session is coming from. Now the 22 to three is an IP address that has been leased. I have it connected in Ethernet one one. This is where my resource connector is.42:56And this is the IP address of my resource connector.43:23All the traffic going to private destinations is going to be sourced from the connector.43:31I also prepare a web server on my domain controller. It only displays this picture. You can see the self signed certificate.43:44Now let's try RDP. I'm not going to log in, but the fact that I am asked for credentials indicates I have connectivity to the resource. This is the basic functionality of ZTNA.44:03We can enhance it a little bit, configuring the back of behavior. So when the users switch from outside the network to a trusted network, the redirection or a steering mechanism ceases so the client can access resources directly.44:18Let's go ahead and configure that. We 1st need to define a trusted network. We need to navigate to connect and then end user connectivity. We are already here. Let's just go to the zero trust access tab and click on manage trusted networks.44:35Let's provide a name to the trusted network and you can configure a domain among other parameters.44:57Like a DNS server and also a trusted internal web server. You can pull the hash. It's an optional but highly suggested. For now I'm just gonna go with the domain and I'm gonna save this change. Now, before we continue, I need to talk to you about.45:15But the ZTNA profiles, every user that uses ZTNA is going to use the default profile. If you click on this right side pane is gonna come up.45:35As you can see, all your private resources are already associated with your default ZTNA profile. I'm going to create a custom profile and configure a back off behavior, and that way I don't modify the default ZTA profile. Click on add a ZTA profile on the right side.45:45Provide a name, inside the profile, we can only configure these three sections.46:05We're going to do secure private access. 1st, right here we can associate or add private resources to this profile. I'm going to call all my private resources inside this ZTI profile. And this is what the resources look like once they are.46:12Are attached to a profile. Under options, here is where I can configure the back off behavior. If the user is in a trusted network, I can configure the redirection to stop. And the user is gonna reach out to the resources directly. I need to.46:32Select 2nd option and then call a trusted network. Let's call the net 22 that I configured previously. Okay, this is all the configuration that I need for now. This is for secure private access. If I click on next, we can also configure secure.46:52Internet access settings inside the ZTNA profile. The redirection of internet traffic is turned off. The option in the middle steers all the traffic except RFC 1918 or the local domains. And the last option only steers specific destinations.47:12And under options I can also configure secure internet access redirection to turn off if the user is in a trusted network. I'm going to assign this profile to the testing user.47:31Yeah, and click on close to save the changes. Like I said, the default ZTNA profile is always associated with all the identities. If you click on the profile, you get this right side pane.47:46And you can see a brief summary of all the configuration added to the profile. Now let's go back to the topology. Let's open up the client.48:06And do a test if you scroll down, you're going to see the trusted network already added.48:23It's currently unmatched since I'm not on prem. Let's make sure I still have connectivity to the private resources.48:43Okay perfect. The session is coming from 22 to three, which is my resource connector IP address. Excellent. I'm gonna close the session and I'm going to switch the user to on prem. I'm going to disconnect this cable.49:03And Connect isocliner to my core switch. Let me make this bigger again.49:22The only parameter that I have to match a trusted network is the domain. So let's see what IP address I have now. I have the 20 two.four.49:31I'm in the 22 network now. Additionally, please notice how the domain is present in the network adapter. This made me match the net 22. And now the private access redirection is paused by trusted network detection.49:47I can still access my core switch and private resources. Let's see.50:07Okay, my local IP is 20 two.four. The SSH session shows the source IP as 20 two.four, which is my DHCP provided IP.50:27Okay, I'm going to exit, and this is basically how traditional ZTNA works.50:43Now let's go back to the whiteboard and let's go over the universal ZDNA flow. We're going to use the same topology as before, and we're going to review the traffic flow when you are off prem.50:59When you produce traffic to private resources, the session data goes to the cloud. The session data includes the source of the traffic or the user, the destination or the private resource among other things. Your session data is run through a secure access policy, and if you're trying.51:13Traffic is allowed.51:33The cloud is going to return the FQDN of the firewall that is going to help me get to my private resources. Subsequent data plane packets goes straight to the FDD bypassing the cloud. This results in potentially better performance since the traffic has to be manipulated less.51:35The FTD is gonna take over the role of the connector and is going to source the traffic from itself when contacting resources on behalf of the ZDNA client. Now what happens when you are on prem? Initially the same thing. When you produce traffic to your private resources.51:55The session data goes to the cloud. We run your traffic through a secure access policy and if your traffic is allowed, the ZTNA is going to steer the traffic to the FTD and the FTD is going to source the traffic from self when contacting the private resource. This is useful because you can maintain.52:14Mean one single set of rules in the cloud to police your traffic, whether you're on prem or off prem.52:34Let's go back to topology. All right, let's figure universal ZTNA now. Let's go back to security cloud control and then to secure access.52:41The 1st thing we need to do is prevent zdna from pausing. Let's modify the profile we created.52:57We are in secure private access. You can still see here all my private resources. I'm just going to turn off the back off. This change is gonna keep the redirection always enabled. Now we need to associate all our private resources with the FTD that is.53:12It's gonna help us get to our resources. Let's go to connect network connections, and let's switch to the FTD tab. 1st list associate the trusted network with our FTD.53:32Like some and then we need to associate all the private resources with our FTD. We have two options here. The upper dropdown menu works like this. If the user is not in a corporate network, we're going to use the cloud as the enforcement.53:50Endpoint.54:10And ZTNA will redirect, the traffic will get to the cloud, and then we're gonna use a connector or an IPsec tunnel to get to our private resources. The bottom piece of the pop up describes how the redirection is going to occur if the client is on corporate footprint or if it's on prem.54:10The ZTNA client is going to steer traffic through the firewall and the firewall will contact the resource on behalf of the client. This is half of what I want. If you're outside, you use the cloud. If you're inside, you use the firewall, I want to always use the firewall.54:30So let's see how the flows are going to work in 2nd dropdown menu. The upper part describes how the traffic will be redirected if the user is not on prem, the ZTNA client is going to redirect the traffic to the firewall. The firewall is gonna help me get to my private resources.54:49And if I am on prem, which is the bottom part, the same thing's gonna happen. The ZDNA client is going to redirect to the firewall and the firewall is gonna help me get to the private resources. So I'm gonna click on a dropdown menu at the bottom and call all my private resources.55:08And save the changes. Let's go to resources and then private resources. I'm gonna edit one of these and scroll down just a little bit.55:26Under the zero trust box, we have these three flavors. The cloud only is the traditional ZTNA redirection. Whether you are on the network or not, ZTNA will redirect to the cloud and from the cloud.55:42We're gonna either use the connector or the IPsec tunnel to get a hold of the resources. The option in the middle is have what I want. At the top is how the redirection will work if the user is off the network, the traffic will be redirected to the cloud and from the cloud to the private resources. If the user.55:58This on prem, we're going to use the firewall as the enforcement point to get a hold of the resources.56:18The last option is what's ideal for me. You're only going to use the firewall to get a hold of your resources. Let's go back to connect the network connections. Let's see the status of the FTD.56:25I can see four resources associated with the FTD as well as two roles. All right? Let's go back to the client.56:45When I am outside of the network, the cloud is going to give me the firewall FQDN, so my ZTNA client can steer traffic to it when searching for my private resources.56:59So if you go to, C drive windows, system 32, at C.57:18Hosts here because the cloud is going to give me this FQDN. I have created a host entry to contact the firewall that is going to help me get a hold of my private resources. I need to connect my testing computer to.57:32This ISP switch. So let's go ahead and disconnect this from the home router and just connect it anywhere in the ISP switch. Now let's open up the client.57:51Let's task connectivity to my core switch.58:17I'm inside the switch now. Let's type who ok the traffic was redirected successfully. We can see the username is Isaac and the source IP of this SSH session is that of the firewall, the inside interface.58:24So I'm effectively using the firewall as my enforcement point is helping me get to my private resources.58:50Let's try another resource. Let's try RDP. Okay, I get the login prompt. I'm not gonna log in, but this indicates I have connectivity.59:02And finally, let's visit the web server that I have on my domain controller, ok? This is also going through the firewall. Now, I'm going to disconnect this cable.59:15And put the client on prem. I should match the 22 network, but I should still use the firewall as the enforcement point. Let's see.59:31I need to remove the entry on my host file because the cloud will still give me the same firewall FQDN to get a hold of my resources. If I don't remove this, I will still resolve to its public IP.59:52And I'm not gonna be able to reach out to the firewall. So I just commented this line and let's test.01:00:05Okay, it looks like the previous session is still there.01:00:35Let me try a new session. This is the new session and the traffic is sourced from 20 two.one.01:00:39I am on prem now. I am in a trusted network now. My IP is 20 two.four. However, my SSH session is used on the firewall as the source of the traffic. So that indicates I'm getting a hold of private resources using the firewall as the enforcement.01:00:54Point even though I'm on prem. Now let's review activity search, click on monitor and then activity search.01:01:14Change the ZTA client based activity, and I'm going to hide the filters because I don't need them click on the ellipses for details.01:01:33As you can see, the enforcement point shows the firewall. Let's see another entry. Okay, this is also enforced by the firewall.01:01:48Oh, ok, this one was enforced by the connector. This is before I had made those changes. This is a connection to the core switch.01:02:08As you can see, the trusted network is not matched, and also the enforcement point is the cloud. And the cloud sent the connection to the connector so I could get a hold of the Resource you another one.01:02:23Okay, the same. Enforcement is a secure access cloud. And again, this is what it looks like when the firewall is the enforcement point.01:02:39Now coming up next is trusted internet access. The ZTNA module can also be used to steer traffic to the internet by making a few changes on the ZTNA profile. I'm going to return to topology and connect ISO Clienter back to this home browser.01:02:56Okay, hover over connect and then end user connectivity, go to the zero trust tab, Edit the profile.01:03:15All the changes we've made are in the secure private access section. Now we're gonna go to the secure internet access section. Internet traffic steering is turned off by default and you have two options to enable it.01:03:32The option in the middle steers all the traffic to the internet except private IPs and local domains. And the last option steers only specific destinations. I'm gonna go with the option in the middle. I want all the traffic.01:03:49That is going to the internet to go through ZTNA. Under options, if I match a trusted network, I can have the internet redirection to be turned off. I'm not gonna do that. I want the internet redirection to always be enabled.01:04:06Let's click on next and then close. Okay, since we're about to redirect internet traffic, let's go ahead and configure a rule.01:04:26To perform SSL decryption. We need to 1st configure a security profile. Let's go to secure and then profiles, and let's click on add profile and create an internet access security profile.01:04:39Provide a name. I'm gonna call this SSL decryption, and I'm going to save it. The only option that I need to change is at the very top, this is SL decryption. This is going to turn on SL decryption for everything, and you can.01:05:01Exclude categories, domains or applications from the decryption process by creating a do not decrypt list. I'm going to turn it on without any exceptions for now, so I'm just gonna click on save.01:05:19And then click on close at the bottom. Now we need to add this profile inside a secure internet access rule. So let's go to secure and then access policy, click on add rule on the far right side.01:05:32Internet access, and let's create the role. Let's add a name. I'm gonna put it 1st at the top of the list. The action is set to allow.01:05:48I'm going to call the source of my traffic, and under destinations, I'm not gonna call anything on 2nd part of the rule, I need to expand this security profile section.01:06:05And in this dropdown menu, I call the security profile that I created previously. You have a summary here of, of all the settings that are enabled in the profile. SSL decryption is the only one enabled, ok? The rule is created now.01:06:21Let's go back to the client and test. I'm gonna open up a computer. Let me make this a little bit bigger. Okay, let's open up the client, click on the gear, zero trust access. Okay, as you can see under traffic, we have secure private access active.01:06:38For private destinations and secure internet access active for all.01:06:57Internet destinations. Let's go to IP chicken and this is a secure access IP.01:07:02If I click on the pathlock, it says verified by Cisco, and if I show you the certificate, this is using the secure access root certificate. So this traffic is being decrypted in the cloud.01:07:20Okay, let's go back to the dashboard. If one of your devices is compromised, you can go to connect.01:07:37Users and groups. You can click on the user in this right side panel, you can expand devices and connectivity, expand further, scroll down.01:07:53And you can remotely unenroll the device. If you ever need to, turn off ZTNA on a computer, you can do it remotely from the dashboard itself.01:08:08The next feature we are going to cover is remote access VPN. We need to navigate to connect and user connectivity, we are already here. Now let's just switch to the VPN tab.01:08:23On the right side, we need to configure an IP pool 1st, click on manage, click on add. Select your region. I'm gonna go with Canada, provide a name for your pool. And if you need to, you can add more DNS servers here.01:08:39The system IP pool is not going to be used to enable the network adapter of anyconnect, but this is still required. The purpose of the system pool is outside of the scope of the demo. But again, we still need to provide one. So I'm gonna go with this range.01:08:58And then scrolling down under IP pools, the pool assigned here is what will be used to enable any connect.01:09:14Okay, let's click on save. And let's go back to end user connectivity.01:09:32From here you can import an ASA profile, you can configure a machine tunnel, manage the computer remotely. Let's go ahead and create manually a VPN profile. Let's 1st provide a VPN profile name. This is the name of the configuration.01:09:47And the display name is what anyconnect is going to show in the dropdown menu. So this is visible to the users. That's your default domain, call the pool you created previously in this dropdown menu. I'm only going to use IPsec.01:10:05Click on next, then we move on to 2nd part of the profile, which is the authentication. I'm going to jump to my intra ID instance to configure SAML. Let's create an enterprise app.01:10:21For the SAML integration, there isn't an application in the gallery, so we have to create our own application, going to copy the org ID and make it part of the name of my enterprise app.01:10:37And then create. We just need to add configuration in two different sections. We need to assign users and groups.01:10:52Okay, these users are good for now. The other section we need to configure is single sign on.01:11:18Click on SAML. Let's go back to secure access and download the metadata XML. Let's click on upload metadata. Let's find the file.01:11:26Oh, and then save the changes. As soon as everything is configured, I can download the federation metadata XML.01:11:43From Azure, and I need to upload it to my remote access VPN profile. Okay, now I'm going to add it to the remote access VPN profile.01:11:59On the next section, we're going to configure split tunneling. By default is configured to tunnel all the traffic to secure access. I'm going to change it to split tunnel, and I'm going to define one network only, the 20 two.zero.01:12:16Then we're ready to go to the last section. The only change I'm gonna make here is under client settings, I'm going to disable star before login, and then save the profile.01:12:36Okay, great. Now, any connect is just half of the flow that is required to use the feature. We need to configure an IPsec tunnel. So let's head over to connect and the network connections.01:12:51Let's go to the network tunnel groups tab, and we're going to add an IPsec tunnel here. I apologize for the quick interruption. We realized we're 3 min.01:13:09From ending the session or at least the time that we booked with you guys, we are going to continue playing a demo and we're gonna do the session all the way to the end and the recording will be provided to you afterwards. So.01:13:26This is just that we acknowledge that due to the technical difficulties that we have, we didn't have enough time to play the full demo. However, we will continue. If you're able to stay, you're welcome to do so. If you're not, that's fine. We will still continue and we'll provide the session.01:13:41Later. Thank you for your patience here. Click on add on the far right side and let's fill the blanks. I'm gonna call this FTD. The region's going to be.01:14:00Canada device type is an FTD, this is the tunnel identity and let's create the passphrase, type it twice, and then next.01:14:15Under the routing, we're going to configure static routing and I need to write down in this box the network or networks that are behind my FTD or behind my IPsec device.01:14:37I'm just going to specify the network 22 and then save the changes. If I click on this help article, our documentation will detail the steps for configuring a tunnel in multiple devices. Just expand this network tunnel.01:14:49Configuration section and you'll find guides for several Cisco products. Okay, this is the summary of the config. And when I click on the FTD tunnel, I can see the primary hub on the left side and the secondary hub on the right side.01:15:08As well as the tunnel group identity for each tunnel. Okay, now let me open a new security cloud control tab, click on firewall, and I need to open up the cloud FMC so I can configure the tunnel.01:15:27In the firewall. This is what the Cloud Deliver firewall Management Center looks like. Let's go to secure connections and side to side.01:15:45I need to configure two VPN topologies. Let's create the 1st one. I'm gonna name this SA zero one secure access zero one. I'm gonna go with the route based tunnel.01:16:05With the hub and spoke option. I'm going to register secure access as a hub and my firewall will be the spoke for this connection. Let me copy the public IP address of secure access 1st.01:16:17I'm gonna call this secure access zero one and paste the public IP and then ok. And now I'm going to add my device. Select the fire power.01:16:40I need a virtual tunnel interface. I don't have one, so I'm gonna click on the plus sign to add one. The name of the interface will be secure access 01I have created a security zone for secure access. I'm going to place this interface on the secure access outside zone.01:16:59The IP address I'm going to use is 9991 on a/thirty network. These are all the settings of the tunnel interface. Let's click on add and it is automatically selected. Go back to the secure access dashboard and copy the tunnel group ID.01:17:17We don't need to specify anything under advanced settings. Check the box for send local identity to peers. Select email address from the dropdown menu, and then ok and we are done with the 1st step.01:17:38Now let's move to 2nd tab, ikee. Ikev one is not supported, so let's change the policies for IQV two. There is an umbrella template created, and that is what I'm going to use.01:17:52Under authentication type, change to pressure key, and I'm going to type my pressure key twice. The next tab is the IPsec tab. Click on the pen under IQ to proposal.01:18:10And again, there is an umbrella proposal already created. I'm going to use it. And under the last step, let's make some final adjustments.01:18:27And then save the changes. And this is our 1st secure access VPN tunnel. Let's add a second 1 s topology will be named secure access zero two, route based hub and spoke, everything is the same.01:18:36Secure access will be the hub. I'm going to copy the IP address for the secondary hub, click on the plus sign. This is on the extranet, provide a name, at the IP address.01:18:56Then add my own device. This is my firepower at a VTI interface. This is going to be called secure access zero two. I'll put this on the same security zone, secure access outside.01:19:15And the tunnel interface IP address 9995/thirty. Click on ok. Again, it's automatically selected. I'm gonna go back to the secure access dashboard and copy the tunnel group ID.01:19:31The identity. Check the box for local identity that appears, email address, paste it. I don't need to configure anything under advanced settings. And then, ok, let's on to the next tab, ikey.01:19:48Click on the pen, under I keep the policy, let's find the umbrella policy and use that. Scroll down, authentication type, change the pressure key, and let's enter the key twice.01:20:06Let's go to the next tab, IPsec, click on the pen under IPsec proposal. Let's use the umbrella proposal and the last tab configure accordingly and then save.01:20:25Okay, at this point we are ready to push the changes, so let's deploy this. We're not done yet, however. We need to configure the policy based routing. So let's go to device, device management.01:20:40Click on the firewall that you want to configure and let's go to the routing tab. Let's click on policy based routing, and we need to add a policy.01:20:58I will stick this route map on the inside interface. I'm going to create an access list. I'm gonna name it secure access. I have a network object created for my 22 network.01:21:14Let me find it. I'm gonna add this as the source of the traffic, and I need to add a few destinations. I'm going to add the branch office. I will test that later.01:21:30This is gonna go as a destination. Also the remote access VPN pool is here. When you hover over, you can see the network inside the object. This is also gonna go as a destination.01:21:48Yeah. And if my connector goes down, I need to use that DNA using the CGNF range. So I have an object created for that and this is also gonna go under destination networks. Click on add, and save.01:22:04Next, under send to select IP address and I need to call the IP addresses that are adjacent to my tunnel interfaces. In this case 99929996.01:22:29I'll show you how this looks like in the CLI later.01:22:43Okay, let's click on save. Save the changes and let's deploy the changes one more time.01:22:46I'm gonna switch back to the FTD. Okay, the previous deployment for the tunnels already completed, and as you can see the tunnels are now up and active. This is the main tunnel.01:23:04Our primary tunnel to secure access, it's been up for 97 s, and this is the secondary tunnel. It's also been up for 97 s. These are my btis. The roadmap hasn't been pushed yet.01:23:20I'm going to speed up things a little bit. Okay excellent. Let's go back to FTD and this is the route map. My local tunnel IP.01:23:35For tunnel one is 9991 and the 1st hop on the route map is 9992. So I'm making my firewall believe 9992 is directly connected and the 9996 is the adjacent IP to the IP address of my tunnel interface.01:23:52The access list looks like this and we're done with the config. Now let's get this computer ready for testing.01:24:15Let's go back to the dashboard copy the profile URL, paste it here.01:24:43Click on connect, and the account I'm going to use is in this notepad. I've connected before, so it automatically connect. Okay, I am connected.01:24:49Click on the gear, go to anyconnect tab. The only routes that are going through the tunnel is my 22 network, the management pool, and a single entry for what is my DNS server under statistics.01:25:05You can see information about the session, including the source IP address. Okay, let's close that and now let's do some testing. I'm gonna try SSH to my core switch with the user Cisco.01:25:21This didn't work because I don't have a policy to handle my traffic yet. Let's go back to secure access.01:25:46The resources are not enabled for remote access VPN under connection methods. So let's go ahead and change that. Let's edit this resource.01:25:58Scroll down under endpoint connection methods, the box for zero trust is already enabled, but we also want to make the resource available for remote access users. So we need to check the box for VPN connections. Let's do the same with all the other resources.01:26:15Okay, so all my resources are good for ZDNA as well as remote access VPN.01:26:41Now let's create a secure private access rule to handle this traffic. I'm going to call this rule Gordon. Action is set to allow.01:26:48Under the front box, I'm going to find the account, ok? And under destination, I can call all my private resources.01:27:03Which are now reachable via remote access VPN. Excellent. No additional settings are required here. And 2nd part, again, I can still change the name if necessary under. I'm going to save the changes.01:27:19Okay perfect. Now let's go back to the testing computer and let's test again.01:27:34Okay, excellent. This time it worked If I type who the SSH session is coming from this IP, which is that of the VPN. 32.01:27:55That one on one and that's how you can tell the traffic is coming from remote access VPN. So you can see that that 02:54 is the management SBI of my core switch.01:28:10Okay, I'm going to close this. Let's try the web server.01:28:29Looks like I don't have the root certificate on this computer of my private lab, but this is a website that is running on my domain controller. I also have connectivity to it. The last test is RDP.01:28:52I can just get to the server via its name. I got prompted for credentials. That means I have connectivity, but I'm not going to log in. Okay, let's go back to the dashboards and review activity.01:29:09Search. Let's click on monitor and then activity search. The filter is set to ZTI client, so I'm going to change that to view firewall logs.01:29:29You can see the source and the destination of the traffic, the action is allowed and the rule that is handling all the traffic. We go to 2nd page. You click on the ellipses and full details on any of these entries.01:29:49You can have more granular view of the logs. You can see the source and destination ports, everything you need about the connection.01:30:10Okay, for the last section of this demo, I'm going to showcase side to side between the branch office and HQ. We don't need the home router anymore, so I'm going to turn off these devices and I'm going to power on the branch router. I'll turn on the computer later.01:30:29Let's go ahead and register an IPsec tunnel for my branch router, and then we'll configure the tunnel. Click on the secure access.01:30:49Head over to connect and then network connections, go to network tunnel groups, and let's add one more tunnel for the branch office. Let's click on add. We're gonna name this branch.01:30:56This is gonna go in Virginia, the type of device is an ISR, and then click on next. The identity is branch 8686 is my corporate network there.01:31:16And then the pre shared key, I'm just gonna copy and paste it on 2nd box, click on next. I need to specify the.01:31:36Subnet or subnets that are behind my IPsec device. Behind the branch router, there is the 86 network, so this is what I'm going to use. Okay, click on add and then save.01:31:46The final stage is the summary of the configuration one more time. I'm going to copy some of these configuration elements and have it not tied on my other screen when I transferred everything to it.01:32:01And the pre share key perfect. The branch router looks down at the moment. If I go inside, I can see the primary and the secondary hops. Now let's go ahead and configure this tunnel in the router.01:32:16This is all the IPsec or IT V two config, and now the tunnel interfaces.01:32:43There you go. Okay, looks like both interfaces or tunnels already came up. Let's see do show crypto session shows tunnel one app and active perfect and tunnel two also app and active. Great.01:32:52Now in order to route the traffic between branch and HQ, I need to configure a route map or a policy based routing. I need to make sure the 86 network travels through the tunnel when I need to contact the 22 network. This access list is going to be the traffic selector, the local 86, and remote 22.01:33:09And then the route map, and I'm using the same technique as I used on my FTD.01:33:28Yeah. This is that access list. The next hop IPs 9992, which is adjacent to my 1st tunnel interface 9991. And then 9996 is the adjacent IP to my tunnel interface.01:33:449995. Now I need to put this PBR on the inside interface or in this case gig two. Let's do that.01:34:03Let's close the router and now we can turn on the PC. There is one more change we need to make before we test. It looks like the branch tunnel group shows one of the two tunnels already up and running. Eventually both tunnels are going to show up and running.01:34:21Now in order to create the rule, I'm going to configure a couple network objects. Let's go to resources and then network and service objects. I'm going to add a network object, one for each office.01:34:44HQ 1st, I'm gonna call this FTD, and this is the 20 network. Okay, now I'm gonna add another object for the branch office. And this is going to be the 86 network. Oops. There you go.01:34:58Okay, now these objects can be referenced in the secure access policy. Now let's go to secure.01:35:18My bad. Secure and then access policy, and let's create a new policy here. Let's go to add rule and select private access. I'm going to name this policy branch to HQ. I'll make it.01:35:29I'll put it on the top of the list. The action is set to allow, under the from box, I'm going to call my tunnel groups, 1st the FTD and also the branch office.01:35:46And under destinations, I can browse and find the network objects I created previously. I'm also going to call the branch and the FTD. This is going to guarantee the traffic could be initiated from either location. The rule is basically bi directional. I don't need to change anything on the.01:36:012nd part of the rule, so I'm just going to save the changes. Okay, great. And now have a rule.01:36:21That is going to allow the traffic between sites. Let's go back to the topology. Okay, let's open up the computer, make this a little bit bigger.01:36:27I'm gonna log in with the user cisco. Okay, as you can see, the SSH session is coming from the 80 six.two, which is the IP address of this computer in the branch office.01:36:48Okay, close in the PC. Let's go back to the dashboard and see the logs. We can monitor and then activity search. We should see the events from the branch office going to HQ. Okay, there you go.01:37:08You can see the source and the destination of the traffic, the rule that handles all the traffic, the type of connection and the port in use. If you click anywhere in the log, you get the full details panel on the right side.01:37:25Okay, these are some of the things that secure access can do for you to secure your network and help you get to your resources in a safely manner. Thank you very much for spending time with us today. We appreciate you being here. Hope to see you in the next webinar. Take care.01:37:42Alright, thank you everybody for hanging around with us until the end. That is the end of the demo. This will be provided to you after the session ends.01:38:04So I have a few more slides to go through. These are some additional secure access resources. All of our documentation is in security dots, security docs.cisco.com secure access at a glance.01:38:20You can have a glimpse of secure access and what it includes for more in depth analysis of all the features and everything secure access can offer, we have the secure access data sheet. All the updates we make to the product are posted on the release notes.01:38:36And finally, the service status portal in case we're undergoing maintenance, you can be, you can find information there. This is all we had planned for today. Want to thank you so much for staying until the end.01:38:54Apologize one more time for all the technical difficulties that we faced. Hopefully you learn a lot from this presentation we put together for you. Stay tuned for future sessions.01:39:12Focus on secure internet access. Thank you again for your time and enjoy the rest of your day.01:39:27