Cisco Secure Firewall: Master Day-2 Operations

Oh, so I think we are good to start. Good morning, everyone. Welcome back to the Cisco secure Firewall Expert insight series.00:00I'm Luca from the Cisco adoption team. I will be your host for today and today's day two, we will discuss how to master secure firewall day two operations. As yesterday, we are recording, so you will receive the, the, the, the records by email.00:20And a quick reminder on what expert inside series are, those are webinars run by Cisco customer success engineers, who are engineers working with these technologies every day with our customer.00:39The idea is to keep you guys updated on the latest Cisco technology trends, strategies, and best practices, and also to provide content to, for you to understand features and solutions.00:57Those webinars are interactive in the sense that you will have access to a Slido Q and A panel by which you can ask any questions to our experts. You just need to open it from the Slido menu on the three.menu on the right panel of your Webex webinar and someone will pick up the question.01:15And an answer for you for you.01:33And a quick reminder of a new initiative we already shared yesterday, the experts hands on series. You told us you want to try yourself new features, so not just use the look at them in slides and demos. And that's why we are launching a new.01:39Initiative and we are organizing a onsite lab day with Cisco experts where you will get your own lab and pod assigned and you have the opportunity to work on real use cases and features adoption. If you joined us only today.01:59And you did not do it yesterday, you can open the slido poll and answer the question by time being your information such as the email, the, your name, the email, the company name, the country.02:20And also fill the list of topics that you would like to gain more experience on. But if you already did it yesterday, there is NO need to do it again. This is just a form to collect your interest in the initiative, but of course you need to expect an email with more details and with an official invite.02:31I'm gonna give you a few seconds for the ones of you who did not fill in the form yesterday, and then we will move forward.02:52The form will be available throughout the session and you will find it in the Slido menu.03:12Okay, let's move on. And let me introduce today's team. So on the left side, you can see today's presenter. We have Tiago, Juan and Bruno and on the right side our panelists who will take care of your questions in the Q and A panel throughout the session.03:24Oh, last thing before moving to the agenda, as soon as the webinar will close, you will get, you will be redirected to a short survey, in your browser. It takes 30 s, but it is important and crucial for us to receive your feedback.03:42Feedbacks from yesterday were quite positive, so we hope we can keep on providing value even with today's content. And with that being said, let's take a look at the agenda for today. 1st, we will start with firewall administration and AI ops.04:00My colleague Tiago will go through all the best practices required for the platform, including health monitoring, alerts configuration and syslog, and he will also show the cloud AI ops how it adds value by using by leveraging the security cloud control.04:19Then operational life cycle, meaning how do we keep our deployment up to date, stable, and reliable? So we will look at these kind of operations. And finally firewall migration. Bruno will showcase how to migrate the Cisco secure firewall from an on prem.04:38FMC to a cloud delivery FMC and also he will cover.04:57How to perform the ASA to FTD migration. With that being said, over to you. Thank you so much Luca for the great introduction. Let me then to just share my screen.05:02Oh Hope that everyone can see it. Okay, so hello everyone, my name is. I'm a security customer success specialist at Cisco, and I will start this today with the.05:20Firewall administration and cloud AI ops topic from on prem health to cloud insights, what you can gain from, from that.05:40The agenda that we have for today, will start with the health policy and its components. So the very structure that allows you to monitor your devices and the management center to make sure that everything is according to plan.05:49We'll then jump to the platform settings with a few with a few different settings but still valuable to manage your devices. And we'll also discuss alerting and logging. From there we'll transition to a demo where we'll have a tour of the health dashboard.06:04With the components that, that you'll find there to provide visibility on your deployment, but also how to configure syslog as a destination.06:24Through here, we'll jump back to the slide deck where we will briefly discuss what Cloud AI OPs is, how you can leverage it, what licensing do you require, and then go back to the demo as it's where we'll better see how you can get value from those features. But to.06:35Parts will also see how to integrate or onboard an on prem FMC to.06:55Your security cloud control tenant. So if that sounds good, let's jump into our very 1st topic, the health policy and its components. To set the scene, you have your deployment, you have your management center, and your devices and the and the traffic is flowing now.07:02But today with all the the security landscape and the requirements that we have for compliance and all, is that all that we actually need to know? I would say that there's much much more that we need to keep track on. And here are three things that the platform can tell you beyond that. So you have.07:22You have, you can have an understanding of if there if there was some policy changes that haven't been deployed for a certain amount of dates, days that you can configure. You can also have an understanding if some events stopped reaching your security information and event management platform, not allowing your NOC or SOC team to have.07:42An up to date information of or or notion of the events that are going on.08:02Or, also very importantly if your threat intelligence is three weeks time. These are just a few examples of the the our monitoring capabilities can give you and that are very important to keep track.08:08From these devices, as you might be aware, the FMC manages our the ftds through what we call the SF tunnel, which is basically an encrypted management channel over TCP 8305.08:26These, these three components basically include two planes, ok? It's a data plane and the management plane. If the data plane fails, that is loud and self reporting. You don't need any help from me for those. While the management plane.08:40Those failures are, are more quiet, which is exactly why the platform gives us the dedicated monitoring, ok? The management plane supports the control and administration. So the traffic, if, if it fails, the traffic will continue flowing as it did before the issue.09:00But management functions will stop working as expected, ok? And it, this may take a while to discover the issue. As many teams have several several solutions that they have to manage, the next time they they reach out or they connect to the FMC might be when they actually noticed that something was wrong.09:18Okay, and to keep our deployment healthy, the we need to pay attention to these components to the FMC, which serves as the policy authority and supports the event storage and so on. The DSF tunnel, which enables the policy deployment, event communication, and intelligence updates.09:38But and also device management processes that include snort reconfiguration, identity functions, and high availability coordination. So healthy traffic alone doesn't confirm that the management plane is healthy. We need visibility into both planes.09:58So the way that we do it, it's by starting with the health policy. The health policy is not other than a named set of tests that you choose to apply to your devices, ok? These tests are what we call the health, health module, which is basically an individual test to a certain aspect that you want to to monitor.10:19These health modules are of two types. Alert modules and metrics metrics modules. The 1st will, will allow you to report on a certain health status and will give you the capability to raise alerts. While the metrics modules will collect time series for the dashboards. It will allow you to establish a baseline.10:39And based on that information to.10:59And to also raise some alerts, ok? Not all of these generate alerts, but they they can also do that. And if you take anything from this health policy and these concepts that we'll talk about, there are three principles that I want you to be, that you build want to that I want you to be mindful of. The 1st is that every.11:02Three appliance must have one health policy, ok? 2nd is that new devices when they are onboarded to your, be it on prem FMC or cloud delivered FMC, they get the default policy automatically, which might not be the adjusted to your needs.11:22Okay, so, and we'll discuss a few call to actions later on. But this is this is already a starting point to review what you actually need to monitor on your on your deployment and adjust the the policy to it.11:40And finally, that the metrics modules will let you turn off alerting while keeping data collection. This last point is the difference between a tune system and a suppressed one. So when the module is noisy, you disable the alerts, not the module.11:56With that, you'll be able to keep the, the, the baseline, the graph you'll need for, e.g., the following incident. The implementation of of the health policy is actually quite straightforward. There are just one or two caveats. So let's go through it.12:131st, we plan, ok? We, we take a look at the, the health policy, the available modules, and decide what matches our monitoring goals. Then we create the policy, which is the models, we tune the, we tune the thresholds, and we deploy the policy. That that's very important because.12:33The monitoring only begins after that successful deployment.12:53Once we deploy those changes, the enabled modules will run according to configured tools, which are also identified in the settings of your health policy. With that, the FMC will display the health statuses and metric data in its health monitor dashboards, which will also take a look in.12:58In the demonstration.13:18From there, when the alerts are, when alerts are generated, they will be visible in the notification center, which you'll find in your FMC on the top right corner of your dashboard. When the modules result meets the conditions for the event generation, that's when the FMC will log.13:19Of event. But be mindful that event is but a record. It does not by itself send an external notification.13:39So finally, the FMC will check, will check the event against the configured health monitor alerts, and we'll, we'll use it to send the notification. These alert responses, these are configured separately from the health policy, but more but more on this on the following on the following slides and demos.13:47Don't worry, we'll cover all of this. With an understanding of the general process on how to create the health policy, it's important to understand how these tests generate alerts.14:08And they basically do it through different, different possible statuses or severities. Some of some of these might already be very familiar to you like critical or warning or normal. These are the expected.14:26But there are two that I want to focus on as these might not mean exactly what you think, ok? So starting with error. Error isn't a verdict on the device. It's the system telling you that the test didn't complete, which is genuinely useful once you read it that way.14:41And disable, that describes the monitoring, not the device. The FMC gives us a capability which is the exclusion list that allows you to disable and exclude a device from monitoring. So that firewall maybe live and passing through. But being on that status, it.14:59Will not generate any alerts. This is quite important because if you ever reach a situation where you need to place that, that firewall offline, do a migration or something like that, once you re register it, it will continue on the disabled state. Okay, so another recommendation is to raise to raise a ticket.15:19Make sure that this exclusion list is viewed and and and monitored time to time.15:39So what, if, if anything I want you to take from this slide is that the platform will, will give you a distinction between I checked and it's fine and I couldn't checked or I couldn't check.15:47Most monitoring doesn't, so our job is to treat these two very differently. So as we, as we discussed on the health policy.16:03There are several tests that run in in that in that same policy that we call the health modules, and the FMC gives us a lot of modules, ok? And the number is always increasing with new releases releases, which is good.16:20But I would say that the skill isn't enabling all of it. It's more about knowing which ones support your use case. So here are some examples categorized by the use case. 1st, are the devices communicating? Modules check items such as appliance sending a heartbeat to the FMC, event event backlog.16:38In the FMC and FTD high availability statuses.16:58Another is the platform healthy checks like database and disk status that which are things that could block an upgrade or unfortunately on the upgrading process we already have a readiness check to make sure that that is verified before we prove we progress the upgrade.17:01More things like process status, critical process statistics, and more. Another use case is, are the security controls current? Modules also monitor items such as threat data updates on devices, Talos connectivity, certificate monitoring, and your smart license status.17:19And finally, is the detection running? The intrusion and file event rate module helps track detection activity. This is very important. Something like this will will will give us an understanding if, e.g..17:39If this if the snort, or if Snort is generating zero events, that's, that means something is wrong. So we need to, we need to take a look and understand what's happening. Again, the goal is to choose the modules that match what you need to monitor and then use their results to build a clearer picture of overall health.17:54With all the configurations that we've discussed, as you saw some come as default, ok? And in this case, the FMC or the platform gives you three decisions that you that you need to answer.18:22Okay, the 1st is that upgrades add modules. So when we upgrade, new health modules arrive in every policy, but they don't start monitoring until we reapply that policy, ok? So Cisco won't change what your estate monitors without your consent.18:372nd decision is that is regarding that the exclusions are persistent by design. As I briefly mentioned in a few slides back, if you exclude the device, delete it, re register it months later, the exclusion is still honored.18:54So if you have a branch firewall that is, that is excluded for a planned cut over, that reads as not deployed yet. It's live and passing production traffic, but with monitoring still paused. So I would say that every exclusion should carry an expiration date and a ticket, and the list should be checked regularly.19:09The 3rd decision that I want you to be particularly mindful of is the memory thresholds, ok? These, these thresholds should be read as a sensitivity dial, not a percentage, and that is deliberately.19:30So take two of our firewalls, one with 4 gb of RAM and another with 408I typed 50 into both, same field, same number. The 1st box will alert at 50 %, exactly what I asked for warned with half.19:47The memory is still free while the larger box will alert at 90 % because the platform accounts for total memory to include both total physical memory and total swap memory, and large systems are built to use most of their memory and keep the the rest for supplementary actions.20:02So the recommendation is always look up to look up the on our documentation, the, the resources of your machine and adjust the thresholds accordingly. What.20:23This will.20:43Transition to our second topic, which is platform settings alerts, and logging. So everything so far has been the health policy, what the platform watches, but there's also there's a second policy and it decides how to define.20:45This behaves in where the telemetry goes. That is the platform settings.21:04It's the same kind of object, ok, a shared set of parameters that you apply to many firewalls at once, ok? When it's configured is you'll find it under devices and there's the option of platform settings. You create a policy, you choose the settings, configure it, and assign to the devices and deploy it.21:09Very similar. The beauty is that you change the policy in every device using your changes. If anything there are four settings that I want you to to have in consideration because it has, it has many more options, but for this talk.21:27The four that I want to highlight, are the following. 1st of all, time synchronization. This is very important because it's what ensures that your, your source for NTP is the same for the devices and the management center. This ensures that every correlated time stamp.21:43Match for all devices. 2nd is syslog. Okay, so this is where you can figure the logging. It's where you, where you define your syslog destinations, the, how you categorize the events that go there and also.22:04What, what, service you use. The 3rd is SNMP. SNMP is worth knowing because it's 2nd independent alarm system that we provide here, ok? And 4th, the SNTP. This is also where you basically have the configurations that make the email.22:20Dollars deliverable rather than merely generated.22:40Because, what's very important to understand is that even if you enable logging without specifying a destination, the device will generate messages, but it doesn't say them anywhere you can view. So the system is working, but producing nothing you can use.22:45So after configuring these, these possible, these possible destinations, let's discuss alerting, ok? Because again, the events might be generated, but they need to go somewhere. And the health alert basically is, is three choices bound together.23:07Okay, we have the severity of of the of the event that it's occurring, the health modules that are testing certain aspects of of your environment and the alert response.23:28These three together will will give you a notification. Okay, so remember those alert statuses, they come in here. Five of those generate an alert, the disabled status naturally won't, ok? And the options that we have, that we have for generating those same.23:39Alerts are the four that we see listed here. We have email that basically needs a mail relay host as the FMC must reverse resolve its own IP because mail servers check. We have syslog that give you the capability to export those those those logs and events somewhere else.23:59We have the SNM SNMP trap where here the V the version three is the recommended choice as it gives you encryption capabilities. And then we have the web hook. This was added on version seven.seven and gives you the capability to test the connection.24:19But again, this is quite important. This test connectivity proves that the, the, the, the service is reachable, but it doesn't ensure delivery. So always test with the real alert.24:37Okay, so alerting pushes one event to a person. Logging is responsible to keep the actual record.24:51And when we discuss logging, there are a few considerations that we must, that we must make, ok? The 1st is will you use local or remote storage? Locally, the management center will hold each event type in its own database, and it will prune the oldest when one will.25:08When when it's filled.25:27That's good for working, but it isn't a retention guarantee. And for system events, there's one argument that sells it, ok? If a management center becomes inaccessible, its audit log goes with it. And that's exactly the moment you want it. High availability protects the appliance.25:29What storage protects the record.25:482nd consideration is, will you use syslog or e streamer? Estreamer, if you don't know, is a Cisco proprietary path. It's easy to set up and it's richer for intrusion data. But this is currently being deprioritized. It's still available. You can still configure it, but.25:52This log is where.26:11It's where the roadmap is going, ok? So it's where the improvements will will come. It also performs performs better in scaling, and it's easy to configure as well. So if you decide to follow the follow the path of syslog.26:14There are six crucial configurations that we need to be mindful, ok? The 1st that we need to understand is that it's two configurations, not one. So device events come from the platform settings, ok, and are sent to the syslog server, right? But the management center's own audit log.26:34That is set up separately under system configuration. So miss 2nd and NO administrative record ever leaves the box.26:54Second configuration is, will you use TCP or UDP? UDP on, on 514 is the common default, but TCP is what gives you the encrypted syslog.27:04The other configuration that I would also like to specifically highlight is to turn on the device ID, ok? Without this messages arrive at your syslog server collector anonymous. And correlating them back to a firewall becomes a guesswork.27:18Same reason we put the devices and the management center at the same time sources. Again similar to what we have with the test connectivity for, for the webhook configuration on the alert response, the, the alerts response.27:35The connectivity is also testable when configuring a syslog server. The SMC uses ICMP and TCP sends to test that communication. But again, the all is the recommendation is to test with the real message.27:56And remember, with audits, with audit logging self documenting and non repediation is built in because an admin can delete an audit event, but doing so writes a new audit event naming the user and the action.28:11So we went through the health policy, we went through its components, how to, to configure health alerts, the platform settings, we discussed logging as well. So I would say that now it's time to take a look at this, how this actually works, and looks on the, on the FMC.28:33So this, give me just a moment to switch to my, to my FMC, make sure that I'm still connected and here we are. Hopefully you can see my screen. Let me just zoom in a bit. Hopefully this makes it easier to see.28:53So the 1st place that we will start is the troubleshooting menu. This is where you'll find all the components for the health policy and related aspects. Where I'd like to start is the monitor option.29:11This is where you'll, you'll see all of the, all of the alerts that are, that are basically being generated by the health modules, ok? It's where you can, you can, where you can have an overview of the devices that you have and the.29:27The tests and alerts that that were generated. You can see them by statuses, ok? And you can also filter filter them right here. By expanding one of the devices, you can see that were performed at what time and prompt them to run all at at this this specific moment.29:45If we click on the actual device, we'll be sent to to the to a more in, to, to more detailed dashboard. This is where you already see by default created tabs with with different information that you can start. These widgets will give you all the information that you.30:06We need two.30:23Understand how your, your devices are doing in terms of health and also in terms of connections. Some will give you different, different aspects and give you different, different features, ok? So e.g. on this one I can change what I want to see or.30:25And by interface or an average.30:44And for the processes I can select it in critical and all processes, expand this information and quickly start it by memory used and understand what's consuming most. From here I can also create new dashboards. I can add new metrics, choose them.30:47And select the metrics that I want to see to compose my dashboard. Multiple ones can be aggregated together. From here, you can also generate a PDF report to share with other people or manually auto refresh.31:06The the dashboard that you are seeing. One very important detail is that from it's also from here that you can not only consult information like the version, the model and the the version that you are running for things like your vulnerability database, snort rules, and so on.31:22It's also where you can generate troubleshooting files perform advanced troubleshooting or jump directly to your health policy. And that's what we're, where we are going right now. By clicking here or going to troubleshooting and policies, you will see the, you will see the health policy for the device that you were, but actually.31:43Allow me to go back to this menu and access it from here because you will see that there's a health policy for the firewall management center and for the, for the FTD devices that they are very similar, but this one will give us more options as the ftds have more things to evaluate.32:03And here we can see the modules that are available. Some are enabled by default, others will will will be disabled and will depend on what you actually want want to achieve with your monitoring. We have different, different thresholds here, be it in percentage by minutes.32:21The Greece or something else?32:41But all give you the flexibility to choose what you want to monitor and how, and what is your limit for each of those tests. As you can see we have a lot of options, ok? And once you've you've selected all, all of the modules where.32:43We go next is to the to the exclude list. This is where you can add a device and remove it from monitoring. It's as simple as.33:03Selecting it here and clicking to exclude. This will will update the list and once you apply it, it will change, it will change the monitoring. Also under troubleshooting is where you'll find the monitor alerts.33:12Okay, so this pertains to the health alerts. The FMC gives you capabilities to generate alerts for other topics, and we'll go there in a few seconds. But specifically to the health alerts, this is where you do it by clicking on add.33:29You'll be asked to fill in a few a few details, the name of the health alert naturally, the severity level that triggers the alert, the alert already configured in this case, we, we need to do this this before configuring the health alert, and we'll go there in a few seconds.33:45And then the health modules that you want to monitor. So you can group these tests together to compose a health alert depending on the, the conditions that you want to match. So those choices that we, that we discussed in the slides a bit ago, this is where they all meet.34:04But as I mentioned an alert response needs to be configured, so I can jump right from here and be sent to the alert configuration page. Okay, as I mentioned, you can configure different types of alerts.34:24In this case, this is the general page. And it's where the destinations that we discussed, the four, the four core ones appear. In this case, if you want to configure a syslog alert to then be leveraged on on the health alerts, you need to give it a name, a host, the port that it uses.34:44The severity and the facility. The facility, it's just a categorization on the syslog server where these events will be placed. So by filling in all of these, we can now complete our health alerts.35:03It's as simple as this. Regarding the platform settings, this will be will be found in the devices under platform settings. This is where you'll find all, all, all of the aspects that we were that we were describing.35:18And particularly the syslog. As I mentioned, you'll find many features here, important settings like the logging of of the device. If you want to enable it, if you wanted to to also be enabled for lower standby unit. If you want to send debug messages, if you want to.35:36Log to the secure firewall management center, what kind of logs, which, from which severity and so on. A lot of information is found here, including the logging destinations. This will give you the capability to choose what is.35:56What, what is logged where? So e.g., I can choose to log certain events depending on the event list and the severity on the internal buffer, meaning the locally. And I can choose some other types of events.36:14To be sent to my syslog servers starting on a certain severity. The event list can be configured in many ways. It can be by associating to these destinations by choosing an event class.36:31Okay, and the syslog severity. Another way that we can do this is by going through the event list itself. This will give you the the ability to choose a specific a specific event list, define it by.36:46A severity in the event class or message ID. If you ever wonder what these classes are, my recommendation is to resort to the documentation that is associated with the FMC, and by clicking on the question mark, it will send you to the, to the page on the documentation pertaining to this topic.37:03And as soon as this loads, you will see that you'll you have a link that talks about the message classes. This will give you all the information that you need to know of what each class is, the definition, and the associated message ID numbers if that's the way that you want to go through.37:22Finally, we also have the syslog settings. This is again where you'll define in a general configuration of the, of syslog, the facility, again, the categorization of the events on the syslog server.37:43To where you enable the timestamp very important as we define as well as the syslog device ID and how you want it to be identified by. You can also through this syslog settings define if the logging level is for all messages starting from from a certain severity or you can choose.37:59Those individual syslog messages.38:18So we have a lot of a lot of flexibility in this, in this configuration. Last but not the least is the syslog servers tab. This is where you I where you add your syslog servers by providing an IP address deciding if this will be secure syslog or not through the use of TCP or.38:21If you're going to use UDP.38:41And finally, where the communication will happen. If it's, if this server will be reachable by a certain security zone that you've configured or interface or through the device management interface. I hope this clarifies a bit on how the configuration of syslog occurs in the FMC.38:43And the steps that you need to go through. With this, let's jump briefly back to the, to the presentation. We're we're discussing, we'll discuss just a few more things bec before jumping into cloud AI ops.39:03After discussing all the, all of these topics, I want you to take a few recommendations, ok? Again, these are recommendations. It's not the finished plan, but look at the middle column. Every one of them closes a gap you've already seen in this, in this presentation. I'm not introducing anything new in the last, in these last few 5 min.39:22But the order matters. Baselining is number one, not number four, ok? A threshold set without knowing what normal looks like gives you one or two outcomes. Constant noise or complete silence, and both end in the same way.39:42People stopped stopped trusting the alerts. And at the right hand column, the most valuable item on this list is number four. Reapplying the health policy after an upgrade. 10 min and every new module the upgrade delivered starts working for us.39:58This is, this isn't like a budget conversation. It's it's just disciplined to have everything that you need to keep your deployment on track. And with this, I would like to to move us to our final topic.40:15In in at least in the slide deck to discuss the cloud AI ops. AI OPs is basically a cloud service that uses AI to automate and improve how firewalls are managed. It can correlate unusual patterns in firewall policies.40:34Answer traffic and device health metrics.40:54To allow teams to identify problems early and help them fix issues before they become serious security breaches or operational bottlenecks. You have several capabilities that you'll find in aiops. We'll review some of them in the demo. But you'll find things like policy optimization.40:57Allowing you to prevent misconfigurations and enhance security posture. It will provide you root cause analysis and allow you to forecast on patterns using predictive analytics and much, much more, ok? To use this, certain features will be unlocked with different versions.41:17Versions which we'll discuss as we go, ok? But if there's a requirement that you need to remember is that these features will be available with the integration of your firewall management center with your Cisco Security Cloud control tenant.41:37In terms of licensing, NO licensing is required. This comes as part of the security cloud control based subscription. So with that, I would like to go back to the demonstration, so as promised, this was a short transition. And for this last portion of the demo I'll do.41:53Like to show you how to onboard the non prem FMC to your security cloud controlled tenant, and also review a few of the of the capabilities that AI OPs has, has to offer. And we'll start.42:13On prem FMC integration. So right now I'm showing you my on prem FMC on version seven.six.six. And where we'll basically start is on the integration, on the integration page going to Cisco security cloud.42:30Where you will see that my integration is currently disabled and where I can choose the current cloud region that I want to integrate it with. Please disregard this this warning as it's due to my, to my licensing on the lab. With this selected, we can click on enabling the feature.42:46This will prompt the communication to the security cloud control pent. What we'll basically see is a description of the capabilities that this integration will provide and a quick warning for FedRAMP customers. From here, we can click on continue to Cisco SSO.43:03The authentication needed for the integration to happen. What will be displayed here is the option to select a tenant that already exists or for customers that don't have one to create the opportunity to create it. In this case, I'm gonna select the one that I've already configured.43:23And click to order authorize. With this, the integration process has started. At least the integration is on a good, a good path. From here we can see, we can see that.43:41The feature is already enabled, ok? But the onboarding is not available yet, but it's enabled for the, for our region. This is where you'll see the decision to send certain events to to to the Cisco security cloud. It's where you can enable your AI assistant for security too.43:57Leverage that chatbot for several, for several actions, where you enable the policy analyzer and optimizer, which we'll see in a few seconds, and where you can turn on the telemetry, leverage XDR automation to to build automated workflows or leverage ones that were already created by Cisco, and where you can enable zero.44:17No touch provisioning so that future devices in that management center are quickly provisioned.44:36In just a few steps. So with this and all of the settings chosen, let's hit save. As you can see the configuration is being applied.44:44And this will take a few seconds, but for, for this demonstration, let's just shorten that, that process and go right to the, to the end result. So as you can see, the integrations shows enabled. We see the SCC tenant.45:00Displayed and that the cloud onboarding status has now changed to onboarding. So from here, from the FMC, there's nothing more to do. So what we will do now is jump to our security cloud control tenant to do the remaining actions.45:18This is mine, ok, and the landing page where you where you'll reach. On the left side, you'll find the products list and by clicking on firewall, you'll see the dashboard of all of the insights. By clicking on administration and firewall management center.45:36You will see all of the, all of the devices that were integrated already. In this case, the integration that we just did was my FMCV two. From here we can quickly see the version, devices that it, that it's managing, the type of firewall or management center in this case, if it's synced and the.45:53Best heartbeat. All of this information is available here, ok? And by clicking on the name of the device, you'll see all of the, all of the management options that are available for this FMC from this.46:12From the SCC tenant, be it configurations for the policies, smart licensing, management or if you simply want to consult more details on the device. But before we jump into the actual features of AI ops, there are, there are not another setting that we need to review.46:31And that is found in the general settings. This is where you can leverage and and choose to enable the AI assistant so that you can use it in SCC. But also where you should enable the auto on board of these on prem on prem fmcs. So that.46:51An integration like this is as easy and quick as you just saw. So with this enabled, let's take a look at a few features of, of AI ops. The 1st that I would like to show you is health and traffic insights. So when you click on insights and reports and click on summary.47:08You'll, we will be presented an overview of, of several insights where you can check the the number of insights per per the selected time frame. In this case, this is the one by default and you have the ability to select a few others. You you can see the active and resolved ones and.47:28An over and a brief overview of their statuses. It's also where you can filter it by severity status and pivot to the settings where, where all of the all of the features of aiops can be enabled or disabled.47:47Then we have the insights separated by device and by priority, ok? In this case, we'll start by looking into a health one. We'll choose the highest north memory usage. By expanding and clicking on the the impacted resource, we are sent to a detailed page where, where we can see the.48:04Status of that insight. A quick a quick summary of what it's what it's displaying, the impacted resources and the probable causes that contributed to this insight. You'll always have a confidence level associated with that probable cause so that you can have an understanding into how.48:24How confident you can be in this in this insight, ok? To supple, to supplement this, you'll have you'll have data that contributed to this insight and also related metrics to, to support this again the insight provided.48:43So that you can you have all the all that you need to narrow the root cause. From here, I'll jump to a new to a new insight. In this case, we'll look at a traffic insight.49:02And we'll look into the one caused by elephant flows. Very similarly, we have all of the same information, but as we're talking about the different detection, we'll see in this case the network flows that contributed to identifying the elephant flow.49:18Will have an associated an associated graph, but also the network flows that identified or contributed to identify the elephant flow, the applications associated, the security risk, and all of the information that you need to better understand.49:34Which flows did it. Further than that, you'll, by scrolling down, you'll have a few suggestions of remediation, 1st of applications and risky applications. Again, the idea is to give you as much information on these insights so that you can quickly understand what's happening.49:51Happening in your deployment.50:11Apologies for, for, for the change in in color, but I wanted to use to use a demonstration that was as rich as possible. And now I'd like to show you the policy analyzer and optimizer. This feature is available from version seven.four.50:16Okay, and from version seven.six, you can, you can cross launch this to SCC, ok? What what we we see is basically an analysis that SCC does all of the rule set and the access control policy and displays anomalies that you can then evaluate.50:32Okay, from here, we can see of what those anomalies are and the and the access control policies that that we have available for each data source. In this case I'm gonna choose this one and a specific this specific access control policy.50:51And by clicking on analysis and optimize, I will be presented as this specific summary with important information like the anomalies, the rule, the rules usage history, and the hit rules and dead rules, but also.51:10Discovered applications. These anomalies are basically divided into, into five categories that, that we can, that we can see, ok? The 1st is duplicate rules.51:27This will basically show you, fully shadowed rules and fully redundant rules. The 1st are basically rules that will never evaluate network traffic because another rule that perceives it overshadows it, ok? And by expanding, you will see the details and the observations that.51:44That contributed to identify these rules. In this case, we can see that this rule.52:05Okay, and this rule are basically contributing for the shadowing. From here, you can basically select the observations that you want to act on, ok? And apply a certain remediation. The option is to either disable the rule, ok? Or delete.52:11Take the rule. All of the selections that you make at this point will be will be accumulated into the remediation menu so that when you hit apply, it will it will perform all that remediation.52:31Okay, the fully redundant rules are basically rules that are part of another or a larger rule such that removing this one will not impact network traffic. 2nd category that I would like to mention is the expired rules. So this one basically.52:45We will show you the rules that were configured with the time range and when that time range has expired, they will be displayed here.53:05Again, same options by clicking on one, you'll have more information on these rules and you can select them to be remediated. We then have mergable rules. This will basically show you which rules.53:13Can be combined combined to optimize your rule set. Then we have the f the overlapping objects. This will basically show you, give me just a second, the, these objects will basically show you objects where the IP address or port numbers are either.53:29The same or a complete subset.53:49Okay, so e.g. if a rule contains an object of 192.168.11 and another for its/twenty four network, the 1st one will be fully overlapped. While partially overlapping objects, it's where some subset of of the IP addresses are repeated but not.53:52All addresses are overlapped.54:12And finally, we have policy insights. This will show you into hit cut insights to understand how often a rules, a rules criteria match network traffic. Okay, it's where you can see the the rules that never hit and and filter them by this specific action.54:16It's also where you can see the discovered application insights and by clicking, you can see more information on it.54:35So for now, if we selected all of all of the, the observations that we want to remediate by clicking, you will be displayed an overview of what of everything that you've selected and a recommendation to basically back up the, the, the access control policy that you are acting on to make sure that if something.54:50And if the remediation was not as you were you wished it would occur.55:10You can then back up. So as we can see, this takes a bit of time. The remediations are being applied. The policy will then be locked. And finally, we'll see a message that the remediations are complete. You can download the optimization report. And if you go to your, your access control.55:15Rule policy. You will see that the rules that I either you you chose to disable, you'll see on the comments the action that they took. With this, I would just like to.55:35Of course, naturally are are there are more features that that you that you can leverage, the software upgrade planner will give you more insights into the versions that are available and how to and how to basically prepare for, for that, for that upgrade. It will show you then the CVEs and bugs that were fixed on each.55:53This Version and the golden version of the device that that you want to upgrade. And there are many more that that have been introduced. What I wanted to include in this slide is just for you to have a reference of, of the features that are available and the supporting version with it.56:13With this, I conclude my presentation. I hope that this was helpful and thank you so much for for attending. Look it back to you. Yes, thank you very much, Tiago. That was very insightful, very good. Alright, we're gonna have.56:32Have 10 min break, so I will share my screen with a timer.56:50Just give me a second. Yeah, so as you can see, we will be back at 1040 European summertime.56:56Meanwhile, if you didn't do it, you have the options to, the opportunity to show your interests in the next hands on initiative. So just use the Slido and we apologize for not making it work before.57:16But now everything is good. All right, welcome back everyone. Let's start with section two over to you Juan. Thank you, Luca, thank you for for the introduction.57:31Hello everyone, and welcome back to this part of the session. My name is and in this session is about keeping your firewall stayed correct. So our topic today, we have upgrades, content updates, and a scheduled tasks.57:51Yeah, could you confirm if you can hear me correctly? Yeah, can you share the screen one? Yes, so give me a sec. Thank you for, for that clarification. Perfect. Can you, can you see your screen?58:09Yes, all good. Thank you so much. So we just learned with how to see the state of our current firewall devices. So let me start what happens with everything gets alright. So we focus on firewalls managed by on premises FMC and you operate the platform.58:27Manage its software version and take backups. If you use cloud delivered management Cisco maintains the manager. If you use a local device manager on boxes that works differently, so let's chat after the webinar or in the Q and A panel if you might have questions. And if you're on prem.58:47This is FMC connects to security cloud control your life cycle task stays in the local console FNC. Three things change over the time software version age detention content needs updates and configuration drifts. You can plan these changes and put them in.59:06Your calendar and so let's begin with this the 1st item which is software updates and how to prepare for them.59:26Software upgrades are operator driven. You decide when to run them during a maintenance window eh before that window opens, answer four basic questions. What platform are you running? Which release should you pick? What is the right upgrade order? What proper.59:35Needs to happen 1st. The upgrade itself is really the hard part.59:54Preparation makes the difference. I finished this model with a demo on written a check and this HAA per upgrade. So let's begin with platform because it determines your upgrade layers and recovery options.59:58Your platform eh decides two things. How many layers you upgrade, which recovery option you have. On firewall 1021 hundreds and secure firewall 3140 200 in appliance mode, you upgrade one package. When you upgrade the FT.01:00:16The underlying firmware updates automatically. The fire power 4190 300 have two layers the FXOS chassis and the FTD software. The 3140 200 in multi instant mode also have these two layers. So the.01:00:343190 300 are now end of sales. So with the 3140 200 as a replacement, you NO longer manage a separate chassis upgrades.01:00:54If you run them today, the upgrade or there is a street. You must upgrade the chassis 1st and or the readiness check blocks you for the FTD upgrade. Recovery has three main parts eh revert, backup and chassis recovery. You can revert within 30 days.01:01:07After a major upgrade, if you have any of this space where teams get caught, revert does not work for container instances patches or hotfixes for backup.01:01:27Public cloud virtual firewalls in WS Azure GCP or OCI do not support on box FMC backups. If a cloud firewall fails, you deploy a fresh instance, reg register it and push your policy. Then consider what gets.01:01:39It's left behind FTD leaves the chassis on its newer FXOS version. So always check the compatibility matrix before you upgrade your chassis.01:01:59Here are disclaimer my laptop use virtual firewalls so I'm explaining chassis behavior without showing upgrades a good platform difference clear. The next question now is which release to choose.01:02:11Oh Release selection start in your FMC FMC on their system and then product upgrades eh this page lists available versions and highlight suggested releases with a gold start assuming your FMC has internet access. Take eligibility. You only see.01:02:31Suggested releases if your current version supports. If a release is missing, you might need an intermediate upgrade.01:02:50Then consider patches. If you run a suggested release and your patch might not show the start marker, you should still apply it for cisco guidance. Hotfixes never appear in here. You must download and upload them manually.01:02:59Do not rely only the FNC recommendation, always check the Cisco software checker for security advisory after your release. A suggested release might not include every fix you need. If a fix is only in a host fix, know that the 30 day reverse feature cannot roll it back.01:03:15In a version number the 1st two mark your release like in the seven.six eh the 3rd marks are maintenance release like the four in the seven docsies.four and the four marks are patch, so like in one, in seven.64.01:03:36That one. Always verify advisory status before you commit to a version. With the target release selected with most upgrade order and direct path eligibility before scheduling the maintenance window.01:03:54In on premises environments, upgrade your management and center 1st and then your firewalls a firewall can never run a higher major version than its FMC. Patches are the exception. A firewall can run a newer patch if Cisco.01:04:12Documented, but best practice is matching FMC and device in the patch level.01:04:30Eh, with the cloud delivered FNC Cisco maintains the manager, so you only schedule devices upgrades. The considered really roles we have version ten.one is the latest release with the newest hardware drivers and features version seven.six dots.01:04:37Six is the current suggested release Cisco recommendation for broad enterprise production and latest and suggested are not the same so and suggestion changed over the time.01:04:57In the seven.X family, seven.zero.two, the four.six are long term support releases with the standard life cycles. Version.17.three are short term releases designing for early feature access and starting with version ten ah.01:05:10Cisco moves to a single unified life cycle model. As for direct paths to seven.6a recent seven.X version can generally upgrade directly.01:05:30All the releases might need an intermediate upgrade spread across two maintenance windows. Before scheduling, always confirm order and part in the upgrade guide for your exact model and what comes before the 1st window is.01:05:42Preparation so that is where most work happens. So let me elaborate on this one. Here is the key point. Most of the real work happens before your maintenance window opens, so preparation has four steps. Help, the changes, backup and re.01:06:00Clear health alerts eh check high availability status, this space and ntp's time synced. Time read fails and upgrade, even without an active alert if this space is low, remove all backups. If an alert does not clear, we recommend.01:06:22To open a tag case earlier.01:06:40On multi instance chassis eh, check both the supervisor and the container instances. Regarding pending changes, you don't need to deploy before upgrading the FMC itself eh but you must deploy all pending changes to firewall before they upgrade. Review deployment status afterwards.01:06:42Then backups of the box. Major upgrades eh locally store backups except for hot fixes. Copy your backup archive to secure remote server and verify the transfer. After the upgrade take fresh backups eh 1st firewall and lastly the FMC.01:07:03Run written and check several days in advance. Definitely most parts is checked before you proceed. You can bypass checks on firewall, but we strongly advise against it. Never reboot a device while checks are running on a FNC high availability pair start the check from one peer.01:07:23It runs automatically on both. Eh the test for any window eh, everything healthy, deploy, back it up, and check it. I will show this preparation in the demo and then upgrade a Cisco firewall deployment.01:07:42With with that I will show this recording regarding the upgrade and I will advance in the video on those pages that will take time to, to proceed. So when upgrading the FNC and deployment and never get begin inside the group.01:08:00Without planning always start by validating the official upgrade planning table. The matrix details support business multi hop requirements across different release. In our environment, upgrading them from version seven.two to the target release seven.six is.01:08:19Fully supported as did a jump, and next we confirm a hardware architecture after this checking. Model appliances such as the firewall 12100 3100 and secure firewall 4200 package FXOS directly inside.01:08:39The FTD software image, so however, as I mentioned for like the 41 890 300 eh the chassis requires the chassis upgrades, so always consume the table to verify the required chassis bundle version. This table lists the minimum FXO required for this.01:08:57A target FTD release as is shown in the medium.01:09:17For virtual STD deployments, you only see need to verify the standard software upgrade path keep in mind that public cloud instance across vendors do not support on box local backups. Our core operational rule is that the management center must leave the.01:09:22For deployment and upgrade 1st. Managed firewall cannot run a newer software version than they're managing FMC, so before launching the manager upgrade and verify the system hell and take a fresh backup, so we should go now under system that is the icon on top.01:09:42And now we select a health and monitor and we inspect the FMC to review critical operation metrics including this capacity, memory allocation, CPU utilization. After that we navigate now to.01:10:03System ones were two backup and restore to review a system backup archives eh, we generate a fresh FMC backup by clicking firewall management backup. Once completed eh, we could select the file.01:10:23And to download after both to your local computer or verify automatic transfer to configure remote network storage for that. Before proceeding eh, let me open the deployment menu to ensure zero pending policy changes across the deployment.01:10:39If uncommitted changes are present eh, deploy them immediately. So as you see, we now which are ready for deployment. With pre checked verify and navigate now to system all days were available so west package are listed.01:10:58So to upgrade our managed center to version seven.six, select the package.01:11:18Choose the FMC appliances and execute the pre upgrade readiness check by clicking check readiness, this check is data integrity and system before we start and we click with all.01:11:25Okay to proceed.01:11:44Once the reading check finished successfully select the FNC target as you can see, we click on install. Confirm the prompt by clicking ok to initiate the upgrade and the system will now load you out of the web interface.01:11:48So we should go way for that while the system is. When we look back in, it takes us straight to the upgrade console, so we put our credential here we can monitor the installation scripts.01:12:07Immigration progress until the appliance finishes updating and reboots.01:12:27So we now reboot complete we log back into the web interface and now after putting our credential, we should accept the end user agreement that will be pop up.01:12:31Now, to confirm that our release status, we can see some insights there, you can click yes and we can also click on help in the question mark on top and select about and verify that the FMC is actually your.01:12:49Running the target seven.six software version. Now inside the upgrade FMC.01:13:07We should navigate to system, product upgrades, and in the package catalog, notice the goal star icon flagging the recommend production release, the seven.six.six as I was mentioned. And if your network require specific download the file from the system.01:13:16To software central and allow it manually by add upgrade package and we select the file from your local computer and upload it to the FMC repository.01:13:36So before starting the firewall upgrade, we make sure our firewalls are healthy, so much more under system health and monitor, we check the cluster. We should confirm that the high availability is fully synchronized. This space is clear.01:13:45And CPU levels are stable. After checking, we now encourage you to open deploy menu, and make sure all five work shows zero pending changes and with the message all devices are up to date. Upgrading with the pending policies can cause like configuration conflicts.01:14:03On their, system.01:14:24And tools and backup and restore ensure a fresh managed by backup has been generated. Verify that backup archives are download off the box and automatically restore on configure external network storage before putting it into the change window.01:14:27And finally validate that the firewall with any check. So we run the check days in advance through the threat defense upgrade wizard under system product upgrades.01:14:47Or opening the wizard, clicking resume and with that we can check on that the the workflow. Here you can check the break windows complete with resume.01:14:59Here the compatibility, the confirming, the complete readiness check.01:15:19We also checked like the up here under the system as I was mentioned, the wizard.01:15:23So this is the 1st steps like the copy upgrade packages devices and 2nd step, the compatibility readiness check and is ready for two upgrade. So we have here three steps, the upgrade failure and that will auto cancel automatically rolls back if an error.01:15:39Course, 2nd one is the troubleshooting that generates troubleshooting file and before upgraded, and we also have here the enable revert that provides the ability to revert to the previous relief with the 30 days if needed.01:15:59For high availability per se, the fency managed zero downturn orchestration, it upgraded the standby unit 1st, verify health, simply fail over the life traffic and then upgrade the proper prefaration turn a risk high change into a predictable operational runtime.01:16:19With now save to click on the button and the right at the bottom of a start upgrade to launch the process.01:16:37Yeah, by clicking here eh upgrade. In the top here click the info icon and select task to monitor the light progress. 1st keep it.01:16:51Production traffic as I was mentioned.01:17:12Needs upgrade and validation, so in device and device management, we can also monitor the upgrade progress in real time. The FMC upgrades the standby unit 1st. In our case, the primary note while the acting.01:17:16No continuous passing production traffic.01:17:35So once the 1st finished, upgrading and health check, traffic completely switched to the new seven.six unit without dropping connections. And the upgrade then begins on 2nd units as you might see.01:17:39Oh Both devices now shows it's a full package installation and under tasks you can verify that the health policy has been replied successfully and the icon and the info icon.01:17:58So we can now clear upgrade information on top and we select continue. Navigating back here in device device management confirms that the both firewalls are healthy and running version seven.six.01:18:17Notice that the failure rules have switched, so if you want to restore the previous primary eh, click the three dots. Next to the pair and select switch active pair, as you might see in this HI pair.01:18:37Let's to active peer. Finally execute a post upgrade policy deployment to comply any pending changes and leaving the entire firework cluster fully updated and.01:18:52And synchronize.01:19:12So with that, we have plan, prepare and execute a software upgrade. Now eh, we move to what happens most more often the software upgrades recurring daily and weekly that is known as content.01:19:14Updates.01:19:34So compared with software upgrades eh content updates happen most more frequently. Content is dynamic intelligence like application detectors, eh, OS fingerprints.01:19:35Vulnerability data, dress signatures and AP geolocation. This data changes continuously independent of your software version because.01:19:55Constantly, you cannot rely on manual updates. That means content runs on its own cycle and the cycle needs automated schedule. The three content stream come next their operational impact scheduling and which one required to deploy.01:20:07Oh Version seven.six EDV intrusion rules and dedicated page under system then content updates. This separates daily detention fields from software packages.01:20:26If you run seven.six or newer make sure to update your team's run books accordingly to this new part. For each stream, the question is whether it needs to deploy the changes.01:20:45So the vulnerability database BDB, it delivers application detectors, OS fingerprints and vulnerability metadata, new detectors and fingerprints require a policy deployment. Installing a BDB on the FMC is non disruptive, but the 1st policy.01:21:00The deployment afterwards restart a snort. Expect a brief inspection interruption even on clusters. The FMC wants you beforehand and you can roll back support packages.01:21:20The structure rules always require a policy or a policy deployment for the rule updates which you can automate during import before importing a check the rule update space for uncommitted policy at this.01:21:37Because import discard catching changes. Deploying only rule updates uses a dynamic reload and your location database works differently. Eh data to your firewall automatically.01:21:52Without recurring eh, this deploy.01:22:12The exception is an update that adds a new country, deploy that outdate promptly so continuing based rules match traffic correctly across the three streams, only VDB restart the snort and only GODB syncs without deploying changes.01:22:16Then the recommendation is to put all three streams on automatic handler is schedule.01:22:35Initial setups create the full schedules a daily rule updates weekly VDB downloads, weekly GODD syncs. If yours, your certificates set up also has daily CARL checks, always review.01:22:46And tune these defaults. But the default BDB task only downloads the file. It does not install or deploy it. To fully automate these BDB updates we need to create three tasks in order.01:23:041st download, then install and deploy to firewalls. Lift comfortable time booffer between them, schedule the deployed task inside a maintenance window because this 1st deployment might restart a snort. Initial setup also schedule a weekly local FNC backup.01:23:19Measure upgrades wipe all local backups, so always export them to external storage. You can automate content updates but software upgrades eh, cannot be scheduled. They must always remain operator controlled.01:23:40The FMC scheduler runs strictly in UTC. This prevents daylight saving time anomalies and keeps a scheduled globally consistent. Map your local maintenance window to UTC and let the schedule to deal with content.01:23:57And software upgrades need a person at the keyboard. The following scheduling demo showcase now how to put these tasks on the FMC schedule. So let's go now with the demo.01:24:15In the FMC, a newer content updates live on their system content updates. As I mentioned, we have three main types updates available here. 1st we have the BDB updates where installation is not the FMC, but the 1st deployment to manage firewall restart the snort. And next we.01:24:33We have rule updates usernaming reload without restarting the snort, and finally, we have your location updates sync automatically to manage devices and on installation. So under BDB updates you have two options.01:24:51You can click download updates to pull directly from Cisco Cloud or click upload updates to import a package from your local computer. Below you can review install version or click rollback to revert to previous release is needed as is shown.01:25:12Under rule updates eh, we have two update methods. You can perform one time rule update by uploading a file or downloading directly from Cisco or you can check configure recurring rule updates imports. Choose daily, weekly, monthly intervals, and we could also.01:25:36Set the execution time and then we click save.01:25:55After deciding those parameters. For geolocation updates over the same two methods you can import one time update or automate recurring geolocation updates by setting your frequency with start time and repeat the day.01:26:01As is mentioning here.01:26:20So we check and then we have here the parameter in order to choose. So which is choose the wednesday and then the time and we click on save. Out of the box FNC only downloads the BDV and to fully automate the rollback, we build three distinct.01:26:22Does download, install and deploy. So under a system.01:26:42In the year icon, we go to tools and scheduling and you can see our three tasks configured with compatible time buffers. We schedule the deployment step inside a maintenance window because that 1st push restart to a snort inspection engine.01:26:48Here a download and install run on Saturday while policy deployment is scheduled for.01:27:08Sunday as you might see. To create a task, we click on top and the bottom that it says add tasks and then after selecting that, we select your job type selecting install last update. We also have a.01:27:16Another ocean that we will discuss later on the recording. We selecting the latest update allow you to choose now recurrent, eh and we could set here your start date frequency, also execution time.01:27:36And also could be to repeat every certain amount of days hours, weeks or months or we also could repeat per eh day as it show.01:27:56Assigning a clear job name, eh we select vulnerability database on their update items and we click acknowledging the warning and then click save.01:28:11Download the latest update and deploy policy. The setup is very similar eh for downloading and we also click on add tasks and we are the same and now we select download latest update and set as well the recovery. Choose your schedule, select a vulnerability database as.01:28:27The update type and also we select safe to have this configured.01:28:45For deployment eh we select deploy policies configure your recurrencies and schedule day and choose your target firewall devices or all devices as is mentioned, and now you clicked as well to save that one.01:28:53With the save button on the bottom. Next, we automate a disaster recovery with our recurring scheduled backup. To configure a scheduled backup, we also click on add task, and now we gonna select another from the drop menu on the.01:29:10Up.01:29:30You see we have something configured there, but now with the job type we select backup. Choose recurring set the frequency to weekly and specify execution time and repeat date. Under type we select the FNC to protect our management database.01:29:32You choose your backup profile. In this case is selecting from the drop menu configuration and events.01:29:512 % both policy and audit logs and then after everything is configured we click save to add the job to our schedule. Local backups stored directly on the appliances can be pushed during major upgrades clearly margins or hardware fail failures.01:30:00So we must configure automated off the box. So we navigate for system configuration and in this new page we scroll down to look for remote storage device. FMC provides three protocol option, NFSS, SMB or SSH. The sample we select SSH.01:30:19Page we enter the server IP directory path and credential and enable the checkbox for use for backups and click on save.01:30:39With that, we have demoed or showcase with scheduled content updates and automated backups. Software and content come from Cisco and the model three covers what your team changes, the configuration.01:30:50So configuration covers your policy, objects, interfaces, platform settings. A safe change is not an active change, it becomes active only when you deploy it. So this creates a control cycle.01:31:10You preview before you deploy, check the history afterwards and keep a backup for recovery. In short, every deployment has happened before and after and a way back. This module covers each part. Let's start with the two controls that surround every change that you.01:31:26Deployed.01:31:46So let me define deployment. Deploying is the moment save changes become active on the firewall. Preview comes before this and history comes after it. Deploying itself carries the risk because compiling rules and restarting the snort can impact lot.01:31:48Like traffic eh use preview to inspect pending policy and object differences before you push them. After you add an interface platform for setting or high availability pair.01:32:08The 1st preview shows baseline system defaults, that is expected behavior, not unauthorized configuration drift. In history, definitely keeps the last ten successful deployments, five file attempts and five rollbacks. You can roll back to eligible version among those.01:32:20Then successfully deployments, ineligible version show our gray icon. So in a nutshell, preview shows.01:32:40What will change? History proves what did change, but drawback only recovers operational policy errors. For disaster recovery MMA is ammigration, we need a full backup.01:32:48That puts the focus on the backup eh, what it contains and the rules for restoring. A completed backup doesn't mean you can't cover, so we have two four questions.01:33:04To test it.01:33:241st eh, what does it capture? FMC backups captures the management database. Custom profiles can add configurations, events and thread intelligence data. Though multi domain setups require configuration in every profile.01:33:25Firewall backups contain configuration only, not event logs, eh, NO packet captures. 2nd question is what is loss or overwritten? So assuming the restore actually runs, a firewall restore wipes all local VPN certificates, then to.01:33:45Cover completely re enrolled certificates and redeploy the policies. FMC restore exclude remote storage paths, all these certificates.01:34:04AMP cloud links and historical reports is also overrides the active VDB with the backup version. Then we must ask what must match. Use the exact same chassis model.01:34:17With matching interface module, software version patch, and hotfix level must match exactly to do this. And on 4190 300 FXOS must match as well. So any mismatch fails the restored.01:34:34And the final question, how do you secure it? For the FMC, deploy a clean appliance or VM at the matching patch level, then restore from backend management in the web interface. For a managed FTD, run restore remote manager.01:34:54Backup from the device CLI.01:35:15And restore FTDHA pairs one node at the time without breaking this HI in the FMC. Afterwards, we need to force a policy deployment. Public cloud FTD virtual has not on boxed backup deploy a clean.01:35:17Yeah, and push policy from FMC. That's the way. And the final demo, to summarize this module, follows one change in the FMC and we see it, we all deter it and we undo it.01:35:37So let's go for it. So as I say, whenever you did an access policy in defense changes are safe only in the local database. They do not take a threat on your firewall until you deploy them.01:35:56Eh, we will see it, auditor it and undo it these changes. So let's navigate now to policies in the site and then access control and notice that the status indicator currently shows up to date. So confirming that NO uncommitted changes exceed before we start. So.01:36:13So we click on the pencil icon to edit our policy and then click the same icon to an existing rule. And under the application tab, and we select an application filter and we add application on here.01:36:33And then click save and in the top, we also click on save. Now we click return to access control policy managers the devices start to immediately shifts to out of date and showing the stage changes are waiting.01:36:49Before deploying. So before pushing modification to production, we always use deployment preview to verify our difference, so under deploy advanced deploy.01:37:09In here on the top, we can view all firewall devices with pending changes. Span our firewall to see which policy were modified and we could click here on preview.01:37:21This launch the diff viewer with both comparison view and advanced CLI view. The comparison view highlights added modify or remute remove elements with a clear color coding. Switching to advanced view provides the full CLI syntast allowing us.01:37:41To inspect exact underlying commands and configuration blocks being pushed to the sensor. Keeping that in mind that the preview displays based on whenever an interface platform for setting or routine policy is added to a device for the 1st time, even if you did not alter those default settings.01:38:01Similarly, high availability synchronization lines and the this complete visibility ensures NO unexpected syntast reached production. With everything verified, we click ok and we hit deploy.01:38:20You can add, change ticket ID for audit tracking and click deploy to push the configuration. Once the deployment completes eh, we can navigate to deploy deployment history to review the full audit lock eh the FMC keeps a.01:38:37Rolling a history of the last 20 deployment events per device split across ten successful pushes, five attempts and five rollbacks. Expanding any jobs allow you to build the full CLI transcript and historical preview.01:38:56If a new deploy change cause unexpected traffic drops you can revert it immediately so click ok to close this preview and after we have checked all the changes that have been.01:39:12Done. And we also click here in rollback at the top. Select the previous healthy job from the drop down, check your target firewall after selecting it. And now we can click a rollback to launch a.01:39:30The process. The rollback is reverts the file back so click proceeding the confirmation dialogue.01:39:50Definitely restore that baseline and marks the firewall out of date giving you full control to inspect the policy before redeploying it. So in the message center, eh, we should see a rollback successful, so let's take a look.01:39:59And as you might see, is this message rollback successful. And navigating back to policy access control confirm the firewall is now out of date, allowing you to verify your changes in this space and make adjustment for a new deployment.01:40:17Finally eh remember our critical disaster recovery boundaries of backup and restore, and you will notice that you can take backups and restore the FNC directly from the GUI and selecting backup checkbox immediately enable both restore and download option by inside the interface and you might.01:40:34Well, you can perform that will restore for the FNC or managed FTD, you click here in manage device backup, and here you choose whether to store backup archive centrally on the FMC or locally on the thread defense. You select your target device, configure your backup rep.01:40:54Reference and click on a star backup to generate their archive.01:41:13Remember eh, the restoring cannot be done in the GUI. It must be performed locally on the firewall CLI using the command restore remote manager backup. So in summary, deployment preview verified changes before they push.01:41:26Deployment history enables audit and rollback and off box backups protect your environment. Software content configuration, three kinds of changes, each with its own controls. The next takeaways will bring them together. So let me.01:41:41With this. Essentially, the details vary across platform, but the approach is consistent. Prepare software upgrades, a schedule content updates, and control configuration changes.01:42:02Move the word out of maintenance windows into repeatable habits. Prepare, a schedule and control. And if you ask me that will be the key takeaway from this session. So that will be all and thank you so much for your attention. If you might have some questions, please.01:42:18Drop in the Q and A panel.01:42:38Thank you very much, Juan. Thank you. Just great, very detailed. All right, so we will have ten more minutes break, gonna share my screen with the timer.01:42:43So as you can see in the top right corner of the slide, we will be back at 1136 European summertime.01:43:03Okay, so we are good to go with the last part.01:43:22Bruno, whenever you're ready, the floor is yours. Yes. Let me just, if of course you're able to hear me well and then now if you're also able to see my screen. Both yes.01:43:31Okay, that's great. All right. Thank you so much. Yes, hello everyone. So my name is Brune Miranda and I will walk you through the last topic of today's session, which is the firewall migration. Before we dive in.01:43:47Here's where we are at it today. So this session is split into three parts. 1st, we'll look at the firewall migration manager, which is the cisco's brand new product for migrating from ASA to firewall threat defense. We'll start with the why and why that move matters, then cover what the tool is, how it works.01:44:05What's forced today, then in 2nd part, we'll shift to a different day two scenario, which is the migrating an existing firewall threat defense from on premises firewall management center.01:44:25Over to the cloud delivered firewall management center in Cisco Secure Cloud control. Again, we will start with the why it's worth doing and to close also we'll take a look at the how the firewall help desk team is able to support in your hands on computer.01:44:37Migrations and migrations in case you request our assistance.01:44:57Before we start getting into the details, I want to set the scene so when it comes to migrating, you have two ways to go and Cisco supports you on both of these ways. On the left, you have to do it yourself path with Cisco tooling, the firewall migration manager takes your ASA.01:45:05Allow to checkpoint or Fortinet configuration over to the fence and the migration wizard in security cloud control moves your existing prep defense devices from on prem firewall management center to the cloud delivered FMC.01:45:25Both come with built in guardrails like validation, pre and post migration reports and a 14 day window to commit or revert on the security cloud control migration wizard as well. On the right is the assistant path, the firewall help desk, which is a remote assistance migration.01:45:39Service available 2047 globally. It covers ASA, competitive firewalls, harder refreshes, and moves to the cloud delivered FMC with hands on configuration review, validation and maintenance windows support.01:45:59Most of today is about the tooling and we'll come back to the help desk in more detail at the end of the session. Firewall migration manager. For today we will focus mainly on the ASA to FTD. So.01:46:12Let's start with the Why move from ASA to all. I summarized it in four points. 1st, life cycle. Many ASA 5500 X models have already reached end of sale and end of support and staying on unsupported hardware means NO more fixes or security updates.01:46:29Second, protection. Threat defense is the true next generation firewall with snort three intrusion prevention, application visibility and control, URL filtering, malware defense, TLS decryption, and this is all powered by Cisco Talos threat intelligence. And 3rd.01:46:49Management, you want to to manage everything centrally with consistent policy and visibility across your estate. Finally, 4th, it is this innovation, new capabilities like encrypted visibility engine and AI assistant operations. These are being built by for practice.01:47:06The challenge of course has always been the migration itself, and that's exactly what the firewall migration manager is designed to solve. So what exactly is firewall migration Manager? FMM is cisco's brand new product built to simplify and.01:47:27Streamline your migrations to Cisco secure firewall threat defense or short FTD. If you've done firewall migrations before, you know they can be complex manual and honestly a little nerve wracking. SMM is designed to change that. It gives you a modern guided and efficient experience for moving your security infrastructure over to.01:47:46Defense.01:48:06Think of it as the on ramp that takes the guesswork out of the migration, so instead of worrying about the mechanics of the move, you can focus on getting your firewalls onto a more capable next generation platform and over this next several slides, I will walk you through why it exists, how it works and what what it supports today.01:48:07So why should you use firewall migration manager? It comes down to three things. Confidence, speed, and also reduced risk. FMM automates the configuration conversion and validation for you.01:48:29Which dramatically cuts down on the manual errors and the operational downtime that so often comes with migrations. On top of that, it accelerates your timelines because you're not translating configurations by hand. And it gives you confidence because before anything is committed, you get a detailed preview and the ability to customize.01:48:44Your source configuration so there are NO surprises. The result is a smoother transition with minimal disruption. And if you're operating at scale, there's a big one. You can run up to ten migrations in parallel. A question I get a lot is.01:49:04How is firewall migration Manager different from the firewall migration tool, the SMT, which maybe some of you have used before. So let's put them side by side. On the left, we have SMM. This is the brand new product and it's where all the active development is happening with new features and updates being.01:49:23Being added continuously.01:49:43As of release of ten.one.zero, it supports ASA to FTD migrations as well as 3rd party firewalls from Palo Alto Networks, checkpoint, and Fortinet with more platforms also in the roadmap. It's built for speed with accelerated parsing performance and reliability improvement.01:49:45FMM performs point in time migrations and you can run up to ten of them in parallel. On the right is FMT, the tool you may already know and FMT is now in maintenance mode. It's still supported, but the focus there is on essential fixes only.01:50:05Its strengths is breadth. It still covers some sources FMM doesn't yet like ASM firepower, FDM and Azure. It supports parallel migrations, so the simple takeaway here is FM FMT is the mature broad tool in maintenance mode.01:50:23While FMM is the future, the platform we are actively investing, and if you're starting an ASA to FTD migration today, FMM is where you want to be. Now let's talk about the actual journey.01:50:40One of the things I really like about FMM is that it takes what used to feel like an overwhelming project and turns it into a clear five step journey. Each step builds on the last and at every stage, the goal is the same. Maintaining security continuity as you move from one source or from your source environment to your target environment.01:50:57So you are never flying blind and you're never leaving a gap. Over the next slides, I will break down the key features that power each part of this journey, starting with mapping and moving to review, validation and then reporting.01:51:17The 1st key is mapping. This is where the migration really starts to take shape. SMM lets you map your interfaces and your security zones from source device to targets, and it also handles ASA multi context migration.01:51:36Why does this matter? Because getting the mapping right up front is what ensures your configuration lights up seamlessly on the side. Instead of manually matching every interface and zone, FMM guides you through it so the alignment is accurate before you move any further.01:51:51Also, with the auto map feature, which we will see in the demo later on, also allows you to do this very, in a very fast way. 2nd feature is review and optimize. This is where you get real control over the.01:52:09Migration rather than a blind all or nothing moved.01:52:29FMM lets you select exactly which configurations you want to migrate. And if the tool detects issues, it doesn't just flag them and walk away, it will suggest actions you can take to remediate them right there. So you get to clean up and optimize your configurations as a part of the process.01:52:34Which means what lands on your threat defense device is accurate and efficient.01:52:54Not just a copy of everything you had before. Next up is validation. This is your safety net. Before anything is finalized FMM actively detects invalid configurations overlaps, and conflicts in your source configuration.01:52:59And importantly, it doesn't just point out the problems, it helps you resolve them.01:53:19E.g., it will help you by adding suffixes or applying other corrective measures to clear up con conflicts. This step is a big part of why FMM reduces risk because you are catching and fixing issues before they even reach.01:53:24Production. The 4th measure is reporting. Visibility is everything in a migration and FMM gives you detailed pre and post migration reports. Before you migrate, you can.01:53:41See what's going to happen after you migrate you can confirm exactly what did happen. And beyond just the start and then you get summaries at each step along the way. That gives you comprehensive tracking and just this important link and all the trail you can share with your team or use to validate the migration you want.01:53:59As planned.01:54:18Object side, you've got network hosts, sorry, you've got network hosts port and service time based objects and IPV four IPv six, FQDN objects and groups. For rules, it handles access control rules, including rules optimization.01:54:31Us both auto and manual not rules.01:54:51On the interface and routing front, it supports physical and logical interfaces, port channels, and a wide range of BGP, ERGRP, ECMP, and policy based routing. And for VPN it covers site to site VPN tunnels as well as remote access VPN. This is.01:54:54Includes any connect packages and profiles and also trust points.01:55:14So this is generally covering the configuration that matters in a real world ASA deployment. Let's quickly cover licensing because this is a common question. I can answer the questions at this moment, I can already ensure or can be sure that you are asking.01:55:181st, the good news, the firewall migration manager itself is three. You do not need a license just use the tool. That said, there are licensing requirements on the destination side. Your threat defense devices need the right entitlements for whatever features you plan to use.01:55:36Those feature licenses can be essential, malware, intrusion prevention system, carrier, URL filtering or secure client licenses depending on what you need. And if you're running a virtual firewall management center, some C, you'll need a license for firewall management center.01:55:55Virtual, with the number of licenses depending on how many devices it manages. So the tool is free, but make sure your target environment is properly licensed.01:56:15Before you migrate, there are some FCD prerequisites to be aware of at the target site. A helpful starting point, you don't actually need to add a target threat defense device to the management center before migrating.01:56:32And you will see this because I will use this example in the demo as well. The policies can be migrated to the management center to the FMC now and deployed to a device later. This is great also because in the events that you might want to see it up or.01:56:47You may want to already perform some actions already today during your production time and then later on during a maintenance window, only deploy those changes, you are saving a lot of time. If the device is already added though, it must be registered with the management.01:57:07Center. So this is in the case you want to migrate directly into a device. The target device can be configured for high availability and can be standalone or a container instance, but it cannot belong to a cluster.01:57:27One key requirement around interfaces. You need at least as many used physical data and port channel interfaces on the FTD side as you have on the ASA. This is excluding management only interfaces and sub interfaces.01:57:44For container instances, the same idea applies across physical interfaces, sub interfaces, and port channels. So the rule of thumb is make sure your target has enough interfaces to receive everything coming from the ASA and add any that are missing before you start.01:58:01Now let's cover the requirements on the targets FMC itself. There are three things to check. 1st, software version. Make sure your management center is running a version that's supported for migration and you can confirm that in the supported software versions documentation.01:58:25Second smart licensing. Obtain and install the smart licenses for the that cover all the features you plan to migrate from the ASA. And 3rd, this one is easy to forget. The rest API must be enabled.01:58:42In the FMC. You go to system, then configuration, then REST API preferences and check the enable REST API box. Note that you will need an administrative role to do this. Get those three three things in place and your management center is ready to receive the.01:58:58Before we look at what's next, here's what's just shipped. Release ten.one.zero of the firewall migration manager came out on 15 October, so around less than a week ago.01:59:22And it's a big one. 1st, two new migration sources. You can now migrate checkpoints and Fortinet firewalls to the FTD. So FMM now covers ASA, Palo Alto Networks, checkpoint, and Fortinet in a single tool.01:59:35Second improvements, second improvements to the migration itself. This includes better side to side VPN migration and not zone mapping that uses route lookup to place your NAT rules in the right zones.01:59:523rd, for Palo Alto networks, you can now migrate external dynamic lists as well as policy hierarchies coming from panorama. And for Fortinet virtual IP groups are migrated to if you downloaded FMM earlier, make sure you are on the latest release to take advantage of all of this.02:00:08I want to close out this section by looking ahead at the roadmap because FMM is very much a platform on the move. Phase one which is our foundation is focused on the core architecture, the user experience, and ASA support. Things like.02:00:30The workflow orchestrator and the persistence layer. Phase two was about maturity, enhanced reporting migration traceability, and also the that's when we added Palo Alto migration support along with our cloud focus. Phase three expanded.02:00:50The, the vendor breadth and feature that bringing in Fortinet and checkpoint migration support. And that one is already here. Both are shipped in the release ten.one.zero and phase four and beyond is where it gets really exciting because we will have continuous improve.02:01:09And agent migration, including Juniper, Meraki support, configure configuration optimization, AI assistance pre migration checks, a troubleshooting agents, a migration agent that can actually perform migrations for you and post migration configuration validation.02:01:29So the direction here is clear, broader platform supports and increasingly intelligent automated migrations over the next several quarters. So now let's have a look at the demo for the firewall migration manager.02:01:47So 1st thing you wanna do is you wanna go into the software downloads page and you want to go into downloads home, security firewalls, firewall migration manager, and then select firewall migration manager ten.one.zero. You will have an option to download for Mac and also for windows. The download button is.02:02:07This button with the pointing down.02:02:27I have already installed and therefore I'm just already opening the application for you to show. So one thing to keep in mind is you will need to log in with using your Cisco ID.02:02:30This is what I have done already, as you can see. And this is important because otherwise you will not be able to use the tool, ok? So keep that in mind. You have this main dashboard page which shows you a lot of new things, so basically you have quick links that you can check and we will have a look into the prerequisite.02:02:49So for the prerequisites you have, as you can see.02:03:09The ability to choose to select sorry to choose the source platform, which is now it's updated to the all the platform versions that I have mentioned. And if you select each one of them, you will be able to see all the prerequisites that are needed that you need to have in order to be able to migrate or use the platform correctly.02:03:12So you also have the basically new updates also in this page and the dashboard that you can quickly check. Once you have done migrations, this page will also show some dashboards in sense of some metrics statistics on the migrations that have been done as well.02:03:37Well, so that you can also generate reports and send to your colleagues or upper management.02:03:56So let's begin. So these are the five step journey that I have already explained. So 1st thing we wanna do is we will select the source configuration. As I mentioned for this use this demo I will just simply showcase the Cisco ASA to FTD migration.02:04:04So I will select the 1st one. And as you can see also from the versions, this is possible starting from the eight.four version for ASA. You are able to have to manually upload by either dragging the file or by.02:04:22Selecting which file to upload. You also have live connect and this is where the tool will basically connect to ASTM platform in order to extract the configuration directly from Cisco ASTM, which is the platform managing your Cisco ASA.02:04:38You only need to input the credentials and that's ensure of course connectivity from your machine to the Cisco ASTN. So let's proceed with the uploaded file. You have two options.02:04:58So you can migrate to the on prem firewall management center if you have one or you can also migrate to the cloud delivered firewall management, which is on the security cloud control FCC. For this demo I will showcase the on prem firewall management center so.02:05:14So I will select that one. So you need to input, of course, the, the IP addressing or host name or FQDN for this device. Afterwards you will need to input also administrative access. So.02:05:34In my lab environments I I don't I have the predefaulted certificate so therefore it's going to show you the warning, but that's not a problem. So now it's loading the devices that this FMC supports.02:06:01You then you have these two options as I mentioned earlier. You are able to select the FTD directly and therefore you will be able to to migrate directly from the ASA to one of the ftds that are already managed by your FMC or and which I will showcase on this.02:06:15This demo is I will migrate the shared configuration only. So this means that this configuration will be pushed to FMC and then.02:06:35Once you are comfortable perhaps during a maintenance window, you are able to push this configuration into the. This means again just to repeat, you are able to do this migration to FMC during, e.g., business hours without any impact in your environments and then during a maintenance wi.02:06:45Window.02:07:05You are able to do them this push of the configuration to the FTEs and able to then have the migration completed so security.02:07:06Zones. These are all the security zones that my ASA has.02:07:26I clicked on the order of the recording and essentially here, what we want to do is we want to either create the FMC security zones or we want to use the automatic feature.02:07:34So, yes, this list this dropdown list will showcase the already existing zones that you have in the FMC. You may want to assign already a specific one if you want to, but let's imagine we need to create one. So we want to actually create an outside or.02:07:49Transit so you want to match these zones. You can do it manually.02:08:09So you can go here, add zone, and then you can click on adds. I will not do this, so afterwards you would be able to do it from the dropdown menu. Let's use the auto map feature, so with automatic feature, it will basically auto map the current existing ASA interfaces.02:08:14Zones into the security SMC security zones already existed. So if NO match is found, which is in the case because I showed you the list, then the the tool will create new ones matching the name.02:08:34So as you can see, this was done automatically if you have many zones as this example has a few. This is, this is quite fast. Right, so this is the review part and on the review part, you were able to basically say.02:08:48Select which features exactly of the configuration parts you want to migrate, ok? So.02:09:08I will select all these options which have been predefault assigns. You can download a pre migration report which I will do it and then I will show you and this is essentially showing you basically what can be migrated and how it's going to be migrated.02:09:16This is the report that you have. So it will show you a collection of data, it will show you unsupported configurations. It will show you ignored configurations as well. It gives you a reason for why these configurations are either unsupported or ignored.02:09:35Yes and also it will show you, we keep going down yes any unreferenced configuration or unreferenced network objects. So e.g. rules that are just not being used anywhere.02:09:53And this is where kind of the optimization can be done.02:10:11So you can, e.g., not migrate these because they're not being used anywhere. Right, so.02:10:15We can see that we have an issue already. This is very simple and easy to explain. This is for shared secret for the AAA server, and because the ASA configuration has the user's passwords encrypted.02:10:32You are not able to therefore, know the clear the clear passwords and therefore you need to recreate this, ok? So this is a very straightforward thing that you need to, to do.02:10:49It has some limits, so it needs to be between eight and 64 characters once that is done, so it will automatically pop out of the view.02:11:05Yeah, and now we are ready to do a, so everything else is is ok for the moment, at least.02:11:21In terms of checking, we need to validate, so these are the things that you are able to see that basically will be tried to be migrated as well.02:11:40But we need to do the 1st validation, and this is exactly what we're going to do right now. So we will validate, we will try to, Yeah basically selected all the configuration parameters or options that we need to migrate. Now we will validate to understand there's other issues besides the, e.g., shared secret keys for the server.02:11:48It has identified a few issues, and we can have a look into all of them to see why. So this is also helping you in understanding if you were to do this manually, you would you would need to check these prerequisites and these validations yourself manually. Right here the tool is.02:12:11This for you for you. So in this case, it says that service objects with the same name exists in FMC uses suffix to remediate and this next release because I I have done previous tests and therefore these service objects have been already recreated on a previous migration they have done and therefore now.02:12:30Now, it's being identified as duplicates. So this is actually a really good case scenario to show you as well that if you have duplicate service objects with the same name, the tool will flag it for you and will adjust also accordingly. So the same thing for VPN objects with the same name.02:12:50It allows you to add a suffix to this name and therefore moving forward without any issues. Remote access you can get objects already also the same name will add a suffix as well and then that's it.02:13:09So now we go back and it will validate again. So this validation is happening in steps. In the background, the tool is validating a few parameters of the configuration and along the way it will show you if it's identified any issues or not. So it found another issue as well.02:13:25This time for access lists and again.02:13:45Same issue, some access lists already exist with the same name, have this and therefore you're able to also add a suffix. New validation and I believe this one it will show that there's NO other issues and device is ready to start the migration.02:13:49Right, so before we begin, it opens up this window in order to just to show you what has been done, it will or which will be be doing sorry and also it shows you.02:14:07How many objects it can reduce by the FMC and therefore it will not recreate them. Once you are ok with this, you confirm and then you begin the migration.02:14:23So for the case that I've shown you I'm just not going to speed up because you see it's it's quite fast. It's this ASA device has quite a huge number of ACLs, it has over 600 ACLs as well. And you will see just how.02:14:38Quick it's the tool is able to migrate this where if you were to do this manually, you would need to recreate every single ACL in the FMC inside an access control policy by yourselves which would take.02:14:58A lot of them. So all 649 access rules have been created, all 46 NAT rules have been created and all the eleven objects as well, same with the VPN that has been created.02:15:14Right, so migration is done. Now, next step is obviously to have a look into the post migration reports, which will have a detail a detailed summary, so that's exactly what we will do. All right, so.02:15:32So now it will show you all the successful migrations, partially migrations and any kind of migration errors you may have. It shows shared configuration as well, any kind of unsupported any things that have been done, objects handling.02:15:52So why these objects have already been created, e.g., so and it gives a reason as well into all of that. So now we go into the FMC just to validate that these changes have been done.02:16:11We go into policy, access control, and we will see that the new access control policy has been created, which is this one which has this automatically generated name with the date and time. So if you have a look inside this access control policy to have a look into all the rules.02:16:32You will see that you have all the 649 rules been created. The warning that you are seeing, it's because NO FTD has been assigned to this and therefore NO FTD contains the interfaces sorry the zones for both zone and destination zones installed on the devices yet, and this is.02:16:52Just a normal warning that you would get. So as soon as you assign to an FCD.02:17:11Recreate you create this zones in the FTD this warning will disappear. So let's look into the NAT rules that also has been created automatically by the tool and as you can see, all the NAT rules have been are existing in here.02:17:16Right, so moving on to 2nd topic of today which is migrating FTD from on prem FMC to cloud delivered FMC.02:17:35Let's start again with the why. So 1st there's less to operate. Cisco hosts and maintains the management center for you. So there's NO FMC hardware to refresh and NO virtual machines to size.02:17:52Second, it's always current. Cisco keeps cloud delivered management center up to date, so you get new features without planning FMC upgrade projects. 3rd, you can manage from anywhere. It's a one cloud console in security cloud control alongside your other Cisco security product.02:18:07And 4th, it's a low risk move. You can keep your on premises FMC for analytics and also you get a 14 day evaluation window with the option to revert. All your licenses will be moved automatically. This is a topic I will mention later as well.02:18:28One practical tip before you start confirm that the features you rely on are supported in the cloud delivered FMC so that there are NO surprises after the move. But in, in short this should be in short.02:18:46So now that we have covered a while, let me walk you through how this migration actually works under the hood. Security cloud control performs the migration in a defined sequence. 1st, it onboards your on premises management center to security cloud control. This was already also showcased.02:19:03My Colleague Ariel.02:19:23Then it exports the configuration from that on premises center, then it imports your shared policies, objects and device specific configurations into the cloud delivered management center. It then registers your threat defense devices with the cloud delivered FMC and it starts that for.02:19:25Team day evaluation window where you can commit or revert.02:19:45After the cloud delivered FMC takes over managing your devices and their configuration, your events and analytics can either be handled by the on premises FMC in the analytics only mode or by security cloud control.02:19:49And after this, your devices will show on the security devices page, which I will also show. So before we get into the step by step, this slide gives you the high level end to end workflow for migrating a firewall.02:20:05Defense to the CDFMC.02:20:26It breaks down into three phases. 1st to prepare, this is where you validate the prerequisites which we'll cover in detail next and onboard your own premises FMC to security cloud control. It registers the devices that are the onboarding along with it.02:20:28And second is the mitigate the for the migrate. This will run the migration wizard where you select the on premises management FMC management center and the devices you want to move and you will be able to choose whether to keep analytics on the on premise FMC or remove the devices.02:20:47Then you start the migration job if something fails, the job shows you exactly which step failed so you can fix it and retry. 3rd, evaluate and commit. You get a 14 day window to validate everything and revert if needed, as I mentioned earlier.02:21:08Commit manually once you are confident. Otherwise the changes are committed automatically when the window ends, so after these 14 days if NO change or NO commit commit has been done, it will be committed automatically.02:21:27Then you deploy to the migrated devices from the CDFMC and after the migration, the cloud delivered FMC, your devices and their configuration events and analytics stay on the on prem FMC in analytics mode or move to the cloud. And your devices will then show up.02:21:44In the security devices.02:22:03Keep keep this mental model in mind as we go through the next two slides because everything we cover maps back to these stages. So before you begin it's, it's really important to make sure the prerequisites are in place because.02:22:06Post migration problems respect to something you missed here.02:22:25Usually connectivity. Let's go through them. 1st DNS, your FTD devices must have the correct DNS server configuration so that they can resolve the CDFMC host names. Second, network access. The devices also need to reach the CDFMC over TCP port.02:22:2980 305 and network connectivity from the devices is sufficient. Along the same lines, your FTD devices must be able to reach port 443 and 8305 of the cloud delivered FMC.02:22:49On the FMC side, your on premises FMC needs to out, needs outbound ports 443 open to reach the star.CDO.cisco.com domain. And finally, that on premises center must be onboarded to security cloud control.02:23:08Onboarding it also onboards all the ftds registered to it as I explained before. Nail this down 1st and the rest of migration goes much, much more smoother. Since connectivity is so critical. Let's actually verify it before you migrate it. There are two checks. 1st.02:23:28Just Confirm the device has internet connectivity.02:23:48This can be done by connected to the CLI device, either from the console port or over SSH, login with the admin credentials and run ping system followed by the DNS IP address. If the packets transmitted match the packets received you've got internet and connectivity.02:23:51E.02:24:11And that's issues. Second, confirm that the devices can reach the CDFMC. To do that, route the hostname, which is in security cloud control. You go you you get this by going to administration, then integrations, then firewall management center, you choose cloud FMC.02:24:11I'll deliver an FMC.02:24:31And copy the host name. Then go back to the device CLI, run ping system followed by that hostname. And one important thing to point out in the example on screen, even though you may see a hundred percent packet loss message, the fact that the host name results.02:24:33So an IP address means your connection is successful, so you can safely ignore that packet loss line.02:24:53This point is important and I have already mentioned it, but I want to go over it again. So, the 14 day evaluation period, as soon as your migration completes successfully, the clock starts on a 14 day window. During that time, you're in the driver's seat in sense that if.02:25:03Everything looks good. You either commit the changes to the CDFMC.02:25:22Or if something isn't right, you can undo and go straight back to managing the device with your on prem FMC, NO harm done. Now, what if you do nothing? As I mentioned before, after the 14 days, the changes are automatically committed, and once that happens revert is NO longer an option.02:25:26So my recommendation here is simple. Don't wait for the cart to run out once you validated the migration you're confident, you meet it manually or revert. A few cautions during that window, avoid advanced high availability or cluster operations since those can cause the commit to fail.02:25:46You are not able to delete devices also so and be careful with domains. Don't create or modify domain that includes a migrated device until you are, you have committed or reverted or your deployments can fail.02:26:05An actual question during migration is what happens to my licenses? The good news is that this is handled for you automatically. When the threat defense is migrated to the cloud, all the feature licenses associated with that device are transferred to the security cloud control and released from the on prem SM.02:26:25See back into the smart license pool.02:26:44Then as the devices registered with security cloud control, it reclaims those device specific licenses, so you do not need to reapply licenses on the device. And one more note, if you're keeping devices in the FMC only for analytics for the on prem FMC, this the device specific.02:26:47If licenses are not required for that.02:27:07So now it's going to have a look into a demo to do this migration from FTD from on prem FMC to CDFMC. So here I am still on my on prem FMC and I will show you that I have a FTD.02:27:13Onboarded already working. We need to ensure that on the Cisco security cloud integration is is done once more, you need to log in with your Cisco security, Cisco account in order to connect it to your CDO.02:27:33In this case the SCC tenant.02:27:52Now we go into the security cloud control view, and we go into the security devices and this is where I can see my FMC which has already been onboarded on security cloud control, also showcased earlier by my colleague.02:27:55So after this we want to migrate, go to administration, select the migrate FTD to CDFMC, and we NO migration's been done, we can begin a new migration. So again, these prerequisites will show to you, you should read all of them.02:28:14In in light and once you ensure that everything is done, you are able to proceed there then after then with the migration. We will select which on prem FMC we want to use. So I will use the one that.02:28:33I've just showed you, it will basically now fetch the list of the ftds that it has. And then with the commit action, this is what I mentioned. So you can retain the on prem FMC simply for analytics at NO extra licensing costs.02:28:53Or you can completely remove the FTD from the on prem FMC, migrate it entirely to the cloud delivered FMC, which is what I'm going to do on this lab demo.02:29:12I will also try to auto deploy to ftds after successful migration.02:29:32And now we will start. So once we click on this button, migration is running. And after this, you are able to also see the migration to cloud progress, so that's what we're going to see. Along the way you will always have visibility into which step and what the.02:29:36It's currently doing in the in terms of actions, and everything that has been done. So you will see that the status will continuously change along the way.02:29:55And, it says this usually takes around from my use case with a very simple FTD, it took less than 10 min. So.02:30:15And, yeah. So you can see the connectivity, so it's trying to reach out to the device, also the device trying to reach out to the SCC security cloud control.02:30:32As you can see, the migration status is changing along the way, just to show you all the steps that it takes from the beginning to the end.02:30:50So now it's trying to do discovery also on the FCV.02:31:32It's now trying to connect to the SF tunnel, importing the configuration as well because remember we have selected the option to immediately commit the changes. It's registering the device, as I mentioned licenses are migrated also from the on prem FMC to the cloud delivered FMC.02:31:37See now migration is successful, it's just applying some cleanups and after this right so now we are able to proceed with the commit for the entire policy package to be installed as well.02:31:57Oh, so this is the topic that I mentioned earlier regarding the 14 days, so, this is where I recommend you to do tests.02:32:15Validate everything is ok. Once you validate that everything is ok or not ok, then you will proceed either with delete the FTD from the on prem FMC or revert. Because this is the demo I will simply select the option to delete FTD from the on prem FMC.02:32:32And if you do not do anything after 14 days, the commit will be done automatically for you. Right, so it's done. Next thing we want to do is just validate, right? So now I'm going into the on prem FMC I'm.02:32:50Going to validate that.02:33:10There is NO device anymore zero devices on the on prem FMC. So now as I mentioned, now the FTD is on the security devices in security cloud control and this is where you from now on you will do the administration on the device. And this.02:33:11User interface which you will see in 2nd as soon as I enter any of the menus is exactly the same as you have on the on prem, ok? So, as you can see, this is exactly the same view as if you had on the on prem FMC, so it's the view that you are already used.02:33:31Two.02:33:51And now we can see that the device is onboarded on the SCC and ready to be managed through it. Right, so last topic for today and this is to talk a little bit in terms of the migration support from from the firewall hub.02:33:51This team.02:34:11Not every customer, and we are where wants to run a migration entirely on their own, and that's exactly where the firewall migration team comes in. This team provides migration support into flavors. Remote assistance or on site. Using Cisco migration capabilities, FMT and FMM, the team will review your.02:34:14Source configuration and run the migration in our lab environment.02:34:34Providing best practice guidance and validate the resulting configuration. They'll also assist you during your maintenance window, either remotely or on site. One thing to be clear about is that the support level you qualify for or choose changes how the maintenance window work is performed, and in the event.02:34:39Of an issue, a re image or a break that needs fixed during a maintenance window that gets directed to TAC.02:34:58For escalation. So think of this team as an extension of your own. They are there to de risk this migration. Let's look at the specifics of the firewall help desk offering for this fiscal year.02:35:06So this is the remote assistance migration service and here are the highlights. It's available 2047 globally. It supports competitive migrations from Palo Alto, Fortinet Chuckpoint and Juniper as well as ASA migrations and moving old FMC or FTD hardware to new hardware or.02:35:21Go to the cloud delivered FMC.02:35:41It also supports multi instance. And the note here, this support will keep expanding to include new technologies as they become available. Now, a few important operational details, the help desk engineer manages up to the scope level limits and then provides guidance for any remaining cut over window.02:35:43On timing, weekly engagements need at least four business days notice and weekends need at least eight. And critically a preemptive tag case must be open in case of a breakfast, a break fix event.02:36:03The request devices need an active tack contract and for any type escalation, the account team needs to be available to support the customer. So how does a customer actually engage with this program?02:36:20Let me walk you through the process and the service levels so it starts on day one with your submission. Your Cisco account team submits a request and uploads the supporting documentation to the case. Between day one and day five the request is reviewed against the program's scope criteria and was accepted an engineer is assigned.02:36:38Between day five and day eight, we prepare basically assign engineer reviews the requests and aligns with your accounting to finalize the scope and overall approach. From day eight onwards, we are in the engagement phase.02:36:58Where the project manager and engineer provides hands on support and guidance throughout, including that preemptive tag case for any break fix during maintenance window. Finally, we closed the case is closed, you confirm completion, followed by a handoff to the customer success team, our team that is delivering this.02:37:13Question today.02:37:33For any adoption support. So it's a clear stage process to defined SLAs from a pipeline all the way to completion. So this is now your call to action and it's a very simple one, whether you're planning an ASA to threat defense migration or move to cloud delivered sa.02:37:34The next step is very easy. Just ask your account representative to submit a request to the help desk team.02:37:55And that's really all it takes to get the ball going. Thank you. This was the end of my presentation and I hope it was helpful for you. Thank you Runo. It really was.02:38:00Alright, so we are in the top of the hour. I think we have one question missing. So Bruno, if you can take a look, because the question is about the firewall migration manager.02:38:18Is there a possibility to migrate objects in a special domain instead of global? If we do have an answer or otherwise we can reach afterwards? Yeah, I think I will have to reach out. I don't.02:38:40Let me understand if we can have the.02:38:57Also it would be good to later contact afterwards. All right, so the question is asked by anonymous, so if can this person please give us a name in the chat or anything he also wrote a 1st in the chat so we know it's Stefan.02:39:00Alright, that's good. Let's wrap up the session very quickly. So again, the last ask from our side is for you to fill up the survey.02:39:19Yeah, you will be redirected automatically and we will appreciate your feedback. We highly encouraged you to enroll for the next and upcoming expert insight series, so as usual, you're going to receive an email with an official invite for that. And thank you for showing their interest.02:39:37In the next initiative. I wish you everyone a great rest of the day.02:39:57