Cisco Umbrella SIG to Cisco Secure Access: Migration overview

Alright, well welcome everybody. Thank you all for joining today's Cisco umbrella SIG to Cisco Secure Access.00:10Migration overview. We have definitely a lot of content to come today from the our call. Want to make sure you guys have all of the information. If you guys have questions or things of that nature, definitely will be opportunities for you guys to ask those questions. We will get started shortly and if you have a.00:16On the right hand side, you're gonna see an option for a Slido. There will be a Q and A option there, and that's where you can place all of your questions and that you have. And we have a group of panelists here that will be able to help assist with those questions and be able to provide you some answers for those. If we do not answer those, we will follow back up with you guys, make sure you.00:33You guys have the information and that's gonna be on the three dots located in the lower right hand side. So please let me know if there's anything else that you guys need. The today's webinar will be recorded.00:52I mean at the end of the presentation, if there is time we will answer those questions, but like I said, if there's NO time, we will definitely follow back up with those answers. Alright, so let's get started. Joshua, I wanna go ahead and 1st have you kick this off and let's get going.01:04Absolutely. Chris, can you share your, your screen so you can see the, the deck? Absolutely. Next slide, please.01:21Okay, well, 1st of all, thanks for the introduction Chris, and hi everyone. Thank you for joining us today. We want to make the transition from to secure access as clear and practical as possible for you. So we will begin this webinar with.01:38What the transition, what the transition means for you?01:58And what to expect. Then Estra from the product team will walk us through the life cycle timeline, the umbrella life cycle timeline, migration readiness, and what you should prepare. I will come back to connect that plan into the migration journey.02:01The available guidance and support that we have for you and a migration walkthrough as well. But we'll finish with key takeaways, next steps, and Q and A So the goal here is to help you understand what to expect.02:19Prepare correctly for this transition and move with confidence. Next slide please. Okay, so I would like to start by.02:35Addressing some of the most common questions we hear from customers preparing for this transition. Questions like what will change in my current environment or will I need to redeploy anything I already have running in umbrella?02:50How much work this will require from my team or, you know, when does production traffic actually move, right? These are fair and realistic questions and the answer really comes down to these three ideas.03:06Keep what works, move with control and build for what is next. 1st, let's cover, keep what works, right? One of the biggest concerns we hear is, again, do I have to redeploy everything I already have running today? And.03:23The answer, the insurance is NO, right? It's system virtual appliances, secure client deployments, mobile devices, and even certificate, you don't need to redeploy certificates, right? They can continue to be used, provided that they are up and running and they are current running the the latest version of the software.03:43The security protections we rely on today like DNS, SWG, Caspi, Firewall as a service, DLP, and RBI will continue forward and secure access. And Asra will expand more on this, but the upgrade manager, which is a key component helps to.04:04Automate much of the transition by bringing the supported umbrella policies and configurations.04:24Into secure access, so not not every environment's identical, but, you know, some of the items might require some review or manual adjustment, right? But the goal here is you're gonna preserve what is already working.04:31We are going to automate what can be automated by using the migration manager, the upgrade manager, and address only what actually needs attention. Now let's move to move with control, right?04:48The main concern here is usually disruption or the level of effort and timing. So the key point is, 1st of all that your remain in control throughout the whole migration, right? The activation of the secure access.05:03Description and upgrade manager does not mean that, you know, that will be an automated cover. So NO production traffic moves just because you activated or this this this upgrade manager tool. So you will have time to prepare your environment.05:23You will have time to review what it was moved, test with a limited group of users or locations, validate the spective behavior and then you can expand when you are ready. And the immigration does not need to happen all once, right? That's what I wanted to say here. If anything needs attention during device.05:42You can address it before you expand it, right? And if you run into any technical issue.06:02Tech is always there to help. All right, so and next one build for what is next, you know, customers often ask this question. Why make this transition if umbrella sick is working for me or for us today?06:08Again, that's the fair question. This is the answer. The way people work has changed. Users are now more distributed applications and data live in the cloud and the security teams need better visibility, right? With simpler operations.06:26So secure access is the evolution of the umbrella SIG into a more modern platform that has been designed for that environment. So a transition is is not simple about replacing web product with another is about carrying forward the security outcomes that you rely on today.06:46While moving to a platform that can support your not only your current needs, but it gives you more options as those needs evolve, right? Of course, you don't need to adopt every capability on one on day one, but you know the value is that those capabilities are available when you and your organization needs.07:06Next slide, please. Okay, now that good, thank you. Now that we covered what carries forward and how the migration stays under your control, let's look at what changes for the better, right? What do you actually gain by moving to secure access? So the.07:27There are four areas that stands out, right? 1st, I'm gonna start with unified policy. The unified policy is one of the biggest changes that insecured access, right? So instead of you managing DNS, web, and firewall policies in separate places.07:46Secure access will bring them together into a more consistent policy experience, right? So you will be able to assign these policies to your identities. For your team, that means fewer disconnected workflows.08:05Less complexity, of course, and a simpler way you can apply security controls across your, your environment. In terms of scale and resiliency, this this is important here, migrating to securex is.08:20SIA delivers a substantial uplift and a scale and flexibility and in resiliency specifically for, you know, large and high throughput environments and and the way this is achieved by.08:37Secure accesses by using BGP for dynamic and, and also resilient routing. ECMP for bandwidth aggregation and failover, we also have high tunnel capacity for throughput of scaling and automa automated failover and and of course health monitoring monitoring.08:54For continuous uptime. Another 3rd one here, faster troubleshooting and with thousand eyes digital experience monitor and DM, you gain more visibility across the path from the user to the application, so.09:13This makes it easier to understand whether the issue is related if it is related to policy, to the network, to the internet path, to the SAS or the application itself. So you will see now less guessword faster resolution here. And finally room to grow, right? One.09:31As you are in secure access?09:50You have the environment, the platform and the tools in place to adopt additional capabilities over time. Of course, this includes CTNA enhanced DLP CAS PA, the governance VPN as a service, and also broader down to base controls. So important point here is that you don't need to enable all this.09:53As part of the migration, right? You can plan incremental adoption of these capabilities as your organization needs to evolve as I mentioned before.10:12So, the, the takeaway here is simpler to operate, easy to troubleshoot, more scalable and ready for what is for what is next.10:20Okay, now that we have addressed those concerns, Ezra from the product team will walk us through the life cycle timeline migration readiness and what you should prepare for before you begin with this migration. Ezra over to you.10:36Thank you. Thank you so much and thank you for the intro. Hi everyone. Good morning, good afternoon. I am Estra. I am the go to market product manager and what I would like to review with you today, I'm assuming you all receive the end of sale timeline for umbrella safe.10:53And DNS, so wanted to run few things by you important dates and what you should be doing and what does this EOL message mean. Now, as I said, we've done, we've sent our external communications for end of life and end of sale beginning of September. We are looking to.11:13You have end of sale by January end of Q2 05:27 at the end of January 2027. Now, what does that mean? That means that after January 2027, the product cannot be sold to new customers and the PIDs will be removed from CC.11:33CW.11:53To, you know, place it as a new order. Now, the reason why I'm emphasizing this is because I want to be very clear, we will be, for another year, we will be accepting renewal and a renewal and also expansion from the existing.11:55Customers, till January 2028. No new net, NO net new orders of umbrella can be accepted after end of Q2 FY 27, but if you are an existing umbrella customer and you want to exp.12:15And, then you will have, you know, time till January 2028. Now, we are going to pull the plug on Umbrella support and the support and service in January 2029. The product will become obsolete at that time.12:35And then, you know, we won't be doing any bug fixes pretty much.12:55We're gonna be pulling the plug on umbrella product. Next slide please. Alright, so what I wanna actually make sure that we you you understand what what this is, this means. We've called it, you know.13:01DNS and SIG EOL readiness. There are exceptions in this EOL notice. We didn't cover the government customers, FedRAMP customers umbrella for government. We have total of 25 customers. We didn't cover the MS.13:21MLA customers because we need to still embed our MSLA.13:41Capabilities for secure access. Customers who have easy protect and mobile protect, those are not also included. And of, and the last one is secure connect. None of these, those four buckets, the customers, the PIDs that fall under that criterias under these criterias.13:48We're not part of the EOL notice. EOL notices specifically for umbrella DNS and sick customers. Now from the technical readiness perspective, we have the upgrade manager and we're gonna touch base on that.14:08In the upcoming slides, it supports today almost 99 % of the 99 % of the use cases that we have. We also have the kickstart migration team for, helping customers more.14:24Move manually. The also what I want to call out from the business readiness perspective, we have elevate two dotto. If you have customers that are moving from sec umbrella to secure access, we are giving.14:44When they purchase, when they purchase secure access, we are giving them umbrella for one year for free. So that is also continuing at the moment. Next slide please. We have a lot of assets that we created for customer.15:02Transition operational execution and field enablement. We do have a SharePoint hub. I know that you may not have, access to the SharePoint hub since it's internal. However, definitely, your account teams do have access and they can share with you.15:22All the needed materials. Next slide please. All right, let's talk about the technical readiness and what it means. Upgrade manager technical migration. At this point, I'm assuming you are aware that we have.15:40An upgrade manager tool that allows you to migrate from secure from umbrella to secure access. That starts the upgrade manager. You're gonna see it in your umbrella dashboard, and you'll have all the prompts in terms of.16:00You know what it looks like, the starting points and everything. We also have a lot of videos. Now that's one part for the technical migration. The technical migration supports the policy translation, you don't have to do a redeployment, and then there's a console.16:20Of dual view during transition, which means you're gonna have your umbrella and secure access to at the same time during the transition, and you will have to come and click on I'm done with migration into your umbrella dashboard to actually let.16:40Of your umbrella and completely transition into secure access. And at that point your umbrella org ID does become your secure access.17:00Org ID. Technical migration we talked about, there are two things. One is technical and the other one is the commercial migration. Commercial migration is we need your partner to log into CCW and do a change and modify to move.17:11The entitlements from Umbrella to secure access. Next slide please. All right, so we talked about we said 99 % we are.17:29Umbrella base 99 % of the umbrella base, can be supported by technical migration tool, upgrade manager tool. We enabled multi org multi tenant back in March 15. This was one of the bigger asks that, you know, that we need to be enabling.17:46And we did already enable that. Now, the 0.4 customers, they fall under catalyst Viptela tunnel. Umbrella Firewall has limited features.18:06And then granular bite range headers and web appliance hybrid. So we are looking into those right now investigating to see how we can enable those scenarios as part of the upgrade manager tool. But I also want to call out.18:17About that. Specifically for catalyst Viptela tunnels. If you have any of those tunnels, if you have any of those customers, we do have a kick start team.18:37Who are providing hands on support. We are, you know, they can definitely you know help your customers move from, from, support them to move to secure access with the catalyst Viptela tunnels. So that's definitely.18:49Only supported manually and it's under investigation. We are looking to see how we can close the gap there. Next slide please.19:08Josh, I'm handing it back to you. Thank you so much Israel. Sure. Okay, so.19:19Okay, so what happened next? And the journey, the migration journey can be broken into a few simple steps. 1st 1st step is, is confirm your path and.19:33Asra covers some of this, right? You need to make sure you understand, you know, the subscription you want to move to the timing and the recommend recommend the migration path. Those should be clear.19:48Next is activate secure access, right? Once you purchase secure access and you receive an activate the entitlement, an entitlement so that migration path is available to you, you need to do some steps in the umbrella environment in order to activate this upgrade manager.20:04We covered in the previous slides and, and then prepare your environment, right?20:24So, review the guidance that we have for you, go to review the prerequisites, confirm administrator access, and identif identify any, anything that may need additional attention, right? From there you can move into the migration.20:30And the validation. So use the applicant manager for.20:50Supporting migration task. Of course, take the time, review what was moved, test with a smaller group, as I mentioned before, this is key and confirm that things behave as expected alright? If something needs attention, then you can address it before you expand.20:54Only then do you move more users or traffic, right? Once you, you confirm, so then you can complete the transition here. So the journey here is confirm, activate, prepare validate, expand.21:14And complete, right? So you will have time to prepare your own timeline. Validate, take time to validate your environment and, and control over when you move. All right, next slide.21:30Okay, how the migration works, before we jump into the demo, I just want to give you a simple structure for how the migration works end to end along with a few best practices to keep in mind, you know, at a high level.21:52The process follows five stages, if you will. And I mentioned some of this in the previous slide, prepare, translate, validated spend, and complete. 1st, you confirm the readiness, as we discussed before.22:09Then supported policies are translated into you will see that in the, in the video. From there, one of the most important steps is validation and again so snaff that we need to validate before we can move this to production. But of course you need to review the translated policy.22:23Test with a small group of users representative users, right, or networks and confirm that everything is behaving as expected before expanding more broadly.22:44Once the validation is complete, you can move in waves and gradually expand the migration. And finally, you complete the process once traffic, integrations reporting, and operational workflows.22:54Have all been validated. So again, the key message here is translation start to moves, but validation is what it makes production ready, right? But this structure in mind, so now let's.23:09Take a look at how this works and in the upgrade managers, so next slide please. This is aa10 minute pre recorded walkthrough. Chris, can you share the screen?23:24To see the pre recorded walkthrough. So we're saying this is a 10 min pre recorded walkthrough showing the step by step process for migrating from the Cisco Umbrella to secure access.23:41And, as you watch, keep in mind the structure we just covered, right? Prepared, translate, validate, span and complete, and Chris, you can go ahead and start a video. Hey everyone, Chris here with Cisco, and today we're going to walk through the.23:57Upgrade process from Cisco Umbrella SIG to Cisco Secure Access. There's three main steps that we're going to be taking. 1st, we'll create a Cisco security cloud control account. Then we'll activate the upgrade manager in umbrella. And finally, we'll migrate our traffic from Umbrella to secure access. Along the way i'll tell.24:17Throw in some helpful tips to make the upgrade process as smooth as possible. The only thing that you'll need other than admin access to your umbrella account is a claim code. Now you can't use mine, but yours will be emailed to you on the start date chosen for your secure access subscription. And with that, let's jump in.24:37Here in the umbrella dashboard, we have an account with some devices configured and traffic going from those identities out to the internet. If we look at the network tunnels, we can see there are two active tunnels that are connected to different umbrella data centers. We're pulling in users and groups from Duo using skin, and we're using those identities and our DNS fire.24:57Firewall and web policies. So we'll be able to see how all three are translated after the upgrade.25:17Under licensing, we can see that this account has a SIG advantage license, and at the top we have the option to request an invitation to start the upgrade process. When we requested an invitation will be sent to our email. This invitation request can only be made once, so the admin that clicks it needs to complete the process of attaching the account to.25:23Security cloud control. It's also important to note that this invitation allows starting the upgrade after secure access has been purchased. You want to have your claim code available before starting this process. Looking in our inbox, there's a message with the required information, so let's go ahead and do what it says.25:42I don't already have a security cloud control tenant, so I'm gonna speed things up while I create a new one. If you already have a security cloud control tenant, that can be used as well. Security cloud control provides centralized control and AI driven insights across the security cloud for the environment.26:00It gives you a central interface to manage and integrate all of your Cisco security products, providing seamless authentication across those products. Now that we've created our account and activated MFA with duo, we can access security cloud control and create our new organization. It's important to note that the name selected here will be the name used for the secure access accounts.26:16To choose a name appropriately.26:36Since secure access is a global platform, the region deployment won't be used for this migration, but it's still a good idea to select an appropriate region since this security cloud control organization can be used to deploy other Cisco security products as well. If we look under product subscriptions, we see our invitation to attach secure access. The instance ID will.26:38Be the same as our existing umbrella organization ID and this organization ID will stay the same after the upgrade.26:58Once we finish, we can see a card for secure access in our product list. With the product attached, we can claim the subscription using our claim code. As a reminder, this claim code will be emailed to you on the start date of the subscription. During this process, it's important to select attach existing instance since we are migrating an existing umbrella instance.27:05Selecting create new instance will create a new secure access account that will need to be deactivated from the subscriptions page before you can apply the license to the correct account. After claiming the subscription, we can apply it to the secure access product instance, and we're all set to migrate our umbrella configuration.27:24If create new instance was accidentally selected, this is where the new instance can be deactivated. The view details option shows the organization ID for verification. In a moment, we'll configure Umbrella to use security cloud control for admin authentication. If you currently use SAML for admin authentication, you can configure your IDP.27:46Under platform management and identity providers. This will require domain verification with a DNS text record.28:06On the umbrella dashboard, I'm going to refresh the page and a pop up will appear with the option to take us to the upgrade manager in addition to a new link being available in the menu bar. We have four steps we need to take care of before starting the upgrade. The 1st one is to configure security cloud control authentication as we mentioned. Since this is what secure access uses, we need.28:13They have Umbrella use it as well.28:33We select configure SAML, and when we test the configuration since we're already logged into security cloud control, we don't have to log in again. If we weren't already authenticated, we would just log in using our security cloud control credentials. To finish the configuration, we verify the conditions and click save and notify users.28:37Remember that after this step admins will need to use accounts created through security cloud control to access the umbrella dashboard. Back at the upgrade manager, the next two prerequisites are to upgrade some of our connectors and devices. Clicking start will walk you through that process, but since I know all of mine are already on the latest versions, I'm gonna mark.28:56Is done. Finally, if we have SAML configured for end users, we need to update our IDP to include additional information for secure access. There's a new metadata XML file that needs to be uploaded to the IDP. Since updating the metadata can cause a brief outage, we recommend doing this step during an outage window.29:17Now we're ready to start the upgrade process that will migrate our configuration to secure access. But before we do, it's important to review the information about policy translation. Secure access has a unified policy that simplifies configuration across DNS, firewall, and web.29:37Because of that, there might be multiple rules per migrated policy, and while the upgrade manager does its best to match in ten, it's important to review the translated rules for accuracy. We'll take a deeper look at this in just a moment. Once clicking upgrade, it can take a bit to complete, so now's a good time to stand up and stretch.29:53If an upgrade is being done as part of a renewal, this great step is what needs to be completed for the new license to be fully applied. The important thing to note is that we've only migrated our configuration. All of our traffic is still being routed through umbrella.30:12We can verify this by opening activity search and selecting Cisco secure access as the point of enforcement. No traffic is found confirming umbrella is still being used. With the upgrade complete, we can view the access policy and secure access and see the translated firewall rules are listed 1st, then web.30:27And finally DNS. Although the rules are labeled with where they were translated from, every rule in secure access can apply DNS, web or firewall security controls. This allows admins to focus on the intent of the rule and not what security engine is best to enforce that intent.30:47Each rule also has a single action and both source and destination are evaluated. Making it easier to know when a rule will or will not match. To migrate traffic will return to the upgrade manager and click start on the redirect traffic step. From here we can freely move individual identities to and from secure access so.31:05That we can migrate and test at whatever pace we need to.31:25There's NO rush to move on from the step until we're comfortable with the upgrade. For now I'm gonna redirect my roaming computers. DNS traffic will redirect within a few minutes and web traffic will redirect the next time the client syncs its configuration. We can see that there is an alert about.31:28Pack files. The hosted packed file URL is different between Umbrella and secure access. To migrate networks to use pack files, we need to copy the new URL from the secure access dashboard and update the devices using it.31:48Because our organization is the same in Umbrella and secure access, the org info file for secure client is the same and roaming computers will automatically redirect their traffic to secure access or umbrella based on the settings in the upgrade manager. Finally, we can see the umbrella root certificate was imported into our secure access account. If we have.32:02A custom root certificate that would be imported as well, so NO certificate changes are needed to complete the upgrade.32:22Similar to pack files, the settings and secure access for tunnels are different than those in Umbrella and need manual configuration to redirect their traffic. On the network tunnel groups page, we can see our tunnels are listed as needs review and clicking on the HQ tunnel, it takes us through a wizard to complete the necessary steps.32:28A secure access region has been selected based on the last umbrella data center this tunnel was connected to, but can be changed if needed. For security purposes, a new passphrase needs to be set and on the routing page we can see that NAT has been selected.32:47This is how umbrella tunnels work, but it's worth noting that secure access has full BGP support for dynamic routing. For now, I'll leave NAT enabled. On the last page, we see the information needed to reconfigure our tunnels. Note that every secure access network tunnel group has both a primary and a secondary data center. It's recommended to establish.33:03Tunnels to both for resiliency. Each NAT enabled secure access tunnel group can support 100 tunnels per data center with 1 gbps of throughput per tunnel.33:23If you're using multiple tunnels in Umbrella for capacity, I recommend consolidating them to a single secure access tunnel group to simplify management. Now we can reconfigure our network device to use the new secure access tunnel group and generate some traffic from our roaming clients.33:34Back on the network tunnel page in umbrella, we see the HQ tunnel shows inactive. This is because I've updated the router to use secure access and in secure access we can see the reverse. Our HQ tunnel shows as active, but branch one is still pointing to umbrella, so it shows disconnected.33:51When we go to activity search, we can select secure access as our point of enforcement and see the traffic using secure access in addition to our other identities that are still using umbrella. Once we've migrated all of our traffic to secure access, the last step is to close the umbrella account.34:09This is a one way action, so we want customers to migrate at their own pace. There's NO rush to complete this step. Make sure you're comfortable with the upgrade, click close umbrella, and that's it. We've successfully upgraded from umbrella SIG to secure access.34:28And just as a reference, the video we just watched is the Cisco official migration tutorial, so you can also find it in the official migration guides so you can come back to it later and follow the processes step by step.34:44We'll be sharing the recording of this video along with the link so you can access this information. And that brings us to the next important piece, right? The resources available to help you plan, execute, and troubleshoot the immigration along the way because you are not expected to, to figure.35:00Share this out on your own. But before you begin.35:20Use the migration documentation and the walkthroughs to understand what you need and what may require extra attention, right? Once the migrations start, you can use the migration manner, the upgrade manner as you saw on the video, it will help you guide you with.35:25Instructions, you will find not only instructions but also links to documentation that you can review if you want to learn more about that particular step of the point. They will have some checkpoints and you will be able to validate all your your your migration. And some things something need attention, you can use the app.35:44Copy a support path, just rather than trying to, you know, solve everything along, we have support for you.36:04Along the way. Next slide, please. So where to get help, right? It's, it's very important to know where to go when you need help but for technical issues, you can engage that that will include.36:11You know, issues with.36:31The operating manager, the security cloud control. If you have issues with the the DNS or tunnels integrations or even policy behavior, you can engage that. For subscription licensing or commercial question, you can work with your.36:33A Cisco account team, account team or partner, so they can help you to with those with those matters and once the migration is complete, we have the customer success team that can help with the post migration validation so we can go through all the components that have been migrated to secure access, we can.36:52Review that with you and we can provide some adoption guidance, you know, dashboard, walkthroughs, of course, discussing the next steps and the plans to use those more advanced features. The message here is, you know, if something.37:13Needs attention, you know where to go, right? So again, technical blocker tag, commercial questions that will be your account team or partner, and migration. Once the migration is complete, you can reach out to customer success team for a validation call.37:31All right, next slide, please. Five things to remember, right? And I know we have covered a lot and so I would like to leave you with five simple messages. Very important here. 1st of all, you don't have to review everything.37:50From scratch, right? You can build on what you already have, right? If you are using virtual appliances, if you have the Cisco client.38:10If you have mobile devices, you can just move this environment to securex, you continue using it. You don't have to redeploy certificates or redeploy any of these components. Second, activating secure access does not immediately move production traffic.38:19So you can go ahead, activate your license, activate your upgrade manager, and then you will have plenty of time so that you can review that you're meeting the prerequisites, you have time to prepare, you have time to migrate, time to test, and to validate before you move to production.38:383rd, you decide when to move production traffic after validation. I think we covered this before you 1st will be able to test everything before you.38:59Deployed this in your production environment. And number four, upgrade manager automates much of the work but validation still matter, right? So that's one.39:12The most important things here in terms of what tools you're going to use, but Cisco provide not only the upgrade manager, provide other tools, provide the guidance and the support that you need to migrate, right? Please use those resources and reach out to TAC if you run into any technical blockers, so we are going to, we're here to help you.39:28Across the the whole migration journey. And also very important here, start early so you don't, so you have time to plan and test, right? We, we don't have to deal with this migration all at once. We have not plenty of time to.39:49To to do it and you own the timeline and your own pace. Okay, next slide. And I think this is going to be the the last slide. So.40:06Take the next step, right? So to close this webinar, there are two next steps that I propose. One is contact your Cisco account team and partner to review your journey and, and use this form on this slide if you are ready to sto.40:24Start the conversation, right? The most important thing here is to start early as I mentioned before, and give yourself time, time to prepare. So confirm the path, start preparing and move when you are ready, right? So with that, I think we reach out to the end of the session.40:43Thank you so much for joining us and with that we will move into a Q and A Chris, if there's anything else, I don't know if you want to. I appreciate it. Thank you so much. Thank you for all that information. Ezrat, thank you so much for all that information as well for end of life.41:01I yeah, let me go ahead and see what we have on the Q and A 1 s alright.41:18Let's see what we have going. Looks like everything has replied here.41:37One of them was just sent in. We have mainly Meraki MX in 18 offices using auto VPN in a single office, with IPsec to some offices with all of the link to secure access and would we still need an office to office VPNs?41:51That's right. We like to take that one and can we can follow definitely up with you on that one, NO problem there. I'm so sorry. Yes. I I apologize.42:12I was on mute. Yeah, let's do an offline follow up on that and then we can get back to the.42:31Requester. Perfect. As I think I have one more for you though. If the Cisco umbrella license is ending in mid 2027, would that be added to the secure access license or would it just end in if secure access is purchased today? 2027, if the umbrella ends in 2027.42:37We, I mean they can either move to secure access or if they wanna expand one more year till, you know, they have till Jan 2028 to renew on umbrella. Completely up to them, but obviously we would like them to move to secure access.42:58Excellent. Thank you Escro. Of course. All right, let's see one more, we use only open DNS for umbrella, any IP changes.43:15Not that I'm aware of, but we can, we can definitely follow up on that. Okay, that works good. Alright, let's see. There is one question I see from Brendan. Any tips on purchase.43:31Thing I tried to upgrade this year, but they seem to.43:51Well, you can talk to your account team and then you can talk to your partner. Purchasing is, is very simple. It's it's a transaction that we need to do in in secure in in CCW. You can easily either change and modify your partner.43:55Easily change and modify to the exist on their existing umbrella or place a new order.44:15Of our secure access. Alright, and Trent definitely got your your question around learning more about the Meraki auto VPN, so we can definitely attach some additional information to follow as well. No problem there.44:21And let's put this next question. Is it possible to use the migrating tool after creating secure access dashboard? I think we have an answer. One of our moderators provided an answer, and that is the correct answer. No, you will need to deactivate that org because you need to.44:39Name code to activate the upgrade manager. Yes, you have to deactivate the org. We do have documentation and videos to show you how to deactivate.44:59Excellent, ok. One just came in from Brad. Let's see. What is the pricing difference from Umbrella to secure access? We only have 30 seats for umbrella. So for right now umbrella is more expensive than secure access.45:14I think we what we've done six, seven months ago, we moved the DNS 15 % and then change the prices in 06:20 percent, so basically your if you move to secure access, it's basically your old umbrella pricing. I don't.45:32Anticipate any any any price difference, but again, I don't want to be quoted on that. It's just that I want to provide you the facts that Umbrella is more expensive and secure access when you move to secure access, you're going to pretty much see the same price that you.45:52Purchase originally or original umbrella pricing. You only have 30 seats for umbrella. So secure access DNS can support as low as one, but currently SIA and SPA supports only.46:09Up to 50 users.46:29Perfect. Along that same line that the if our current umbrella contract is up for renewal in January 2029 and we go with secure access before then, will we have to pay out the rest of umbrella contracts simultaneously with the new secure access subscription? No, what happens is, and this is an existing process.46:32Process in our Cisco commerce CCW system, nothing particular to secure access. When you do a change and modify, the system automatically calculates the remainder of your contract value and applies it to secure access.46:51Again, this is an existing process. It's nothing that we introduced as part of this migration. Excellent. Thank you Ezra. Of course. All right, let's see one more just came in. Let's go with.47:11Will using a Cisco umbrella API key and secret to connect with Meraki MX still work the same way to migrate to secure access? I would say this is the one we were kind of referring to will provide some additional insight information after the call. Yes, let's let's do that. I I wanna make.47:31Sure that we are.47:51Giving the right answer. Excellent. Okay. All right, so one of the questions came in, I do not understand the seats. Currently with umbrella, we have 3000 and we have purchased a hundred secure access to, to use. So how does that work?47:53Well, if you bought only hundred seats, I'm not I'm not too clear, I'm not understanding the question. If you have 3000 seats and you have hundred secure access seats.48:13Then that's gonna be your entitlement. You're only gonna get charged for the hundred seats of secure access. But I'm not sure if that's, that's what you're looking for Charles. Well, ok, so if hundred seats just to test.48:29Did you buy an NFR? Was it a trial? What was it did we give this for free? Again we're planning Yes yes Charles yes, you can upgrade later. The.48:49With the SCC process, if you have a trial, once you purchase, well, you can definitely upgrade later. You can definitely upgrade later, but is is it a trial for a hundred seats or or was it also paid?49:07Oh, I think the what I would like to say is, if this was a paid hundred seats, you can Okay, we will ok.49:24If it's a hundred seats, then that's fine. You can always go back to CCW and do a change and modify and you can increase your seat count from.49:41Hundred to 3000. You can do that. Excellent. And maybe we'll see what we can do to get you in contact with your account team on that one as well. Let's see one other one I wanted to quickly call out.49:56Okay, so our security EA expires in March of 2028, so it sounds like they need to move to secure access in a year 2027 correct correct and NO downtime. No downtime.50:16Required I'm assuming Damon, you're asking this question in relation to migration, there shouldn't be any downtime required. It's seamless. Excellent.50:33Yeah Charles, you will have, you know, 3100 when it's over, if you are moving from hundred to 3000, so yes.50:53Yeah. And that's awesome. I'm glad to hear you talking with your account team as well. Sorry, we have one more. What's the length of the dual view program? Is it twelve months?51:06We want you to obviously technically want you to get out of dual view once you're done with your migration, once you feel comfortable, we don't really have a set date, but also keep in mind that we are eoling umbrella. So.51:25You know, if you're done, we prefer you to move to secure access. Why would you wanna, you know, stay in the dual view? Because, you know, when you're in the dual view, your traffic is still going to be directed through umbrella. And then you would prefer that to be directed.51:43Through secure access, data centers, so there's not a set time, but the minute you feel comfortable, I would say, let's have you let go of the umbrella dashboard and move into secure access.52:01Yeah Perfect yep just our larger clients have enough time to migrate. Excellent. Okay. All right.52:20Ezra, thank you so much for answering those questions on the spot. I I actually Charles, there's one more that came in. We have blue M will the secure access forwarding change? I don't know. I don't know what is.52:34Blue cat, but we can get back to you Charles on that ok one last question from Kenny. We're using secure client from VPN now through a SSL certificate. Will it need to be renewed? I don't believe.52:50So I don't think we're doing anything with the, there was a question earlier, I mean, we want you to upgrade the latest of the secure client, but I don't believe it it inc it there's anything to be renewed there.53:10Yeah, we could definitely follow back up on that one with you. Alright, well, I wanted to say thank you Ezra so much for your time today and answering those questions. Joshua, awesome job.53:26If there's any other additional questions that you guys have around this, please let us know. You guys will have access to the recording. You will have access to the documentation, and we look forward to seeing you guys on our next webinar.53:45