Cisco Umbrella to Secure Access migration overview webinar

You welcome everybody today's Cisco umbrella Secure Access migration overview. We will get started shortly. A couple of housekeeping items if you have any questions during the webinar.00:10Please be sure to submit your questions via the chat option in the lower right hand corner, you'll be able to see a little icon. If you do not see that, please let us know, and we can definitely make sure you have that. We will also be adding a few questions via Slido as well. So you'll also see those come through as, and if there's any questions, please let us know.00:20And I will also be adding a few additional, you know, kind of re regular housekeeping and questions that we have for this webinar and in there throughout the call today. Today's webinar is being recorded and the link will be available after the session via email.00:39At the end of the presentation, if the time permits, we will take some time questions and say take some time to answer those. If we run out of time, we will provide all answers to those questions that are submitted. Now to introduce you to our presenter, Juan Cortez, he is one of our senior technical customer success specialists that supports umbrella.00:57And secure access. We also have some technical customer success panelists and tmes that can assist with any questions that come to mind during the webinar. I'll turn it over to you Juan. Thank you so much Chris. Thank you everybody for being here today. My name is Juan. I'm a technical CSS.01:16Thank you for coming to this presentation. We're gonna go through some crucial steps and validation process that will help you during your migration from Umbrella to secure access. I'd like to encourage you to use the chat option or the Slido option to send all your questions.01:35We don't have a dedicated Q and A section. If you have a time at the end of the presentation will take some time to answer questions, but throughout the presentation, if you have any questions, don't wait until the end, just send it right away. Your question might be someone else's question.01:53So yeah, I just encourage you to make use of the tools as much as possible. This is the agenda for today. We're gonna I'm gonna do a quick introduction about the presentation, then we're gonna jump straight ahead to the.02:0814 steps migration journey. These are split among the next few bullets, validate eligibility and activate secure access. Complete technical prerequisites, migrate and validate policies. This is a policy translation piece.02:24Conduct a pilot, how to conduct a pilot and test actually secure access, adopt and expand value and finally some additional resources, some useful links and you guys should keep handy. So what's the purpose of this presentation? The scope of the presentation.02:43Is to review both technical and also administrative aspects of the products before starting the migration process.03:03We also aim to reduce the amount of, of cases that are brought to cisco tech, things that are simple to check beforehand and the additional purposes to help you have a seamless experience.03:10And avoid delays by waiting for Cisco tech to cancel maybe something that is very simple to face. This is the upgrade journey, it's divided in five phases. The 1st one is validate eligibility and activate your product.03:27Couple of bullets here are confirmed that you have purchased or acquired a secure access subscription, validate your current umbrella dashboard that is eligible for the migration tool, invitation in creation of a security cloud control dashboard, attach umbrella.03:43The security cloud control dashboard.04:03And finally use the claim code. All this is just the 1st initial piece of the migration. Then we'll jump to technical prerequisites, how to avoid admins being locked out, upgrade your connectors, Chromebooks or mobile devices, your active Directory integration in umbrella, if you have any.04:05Should be up to date.04:25And all the components should look green. Then in the middle, we have the actual policy migration. This is when we grab your umbrella policies and the tool that we're going to use will translate those to secure access rules and then those will be pasted into secure access. So.04:27All your current config, everything you do put so much time configuring into umbrella, like your destination list, your content settings, your application settings, everything, we can just convert it to secure access and paste it in secure access for you. That's the one of the benefits of the migration tool.04:47The fact that your policies show up in secure access does not mean we're actually using secure access yet. This is when the pilot validating cut over section comes in. We have a way to redirect traffic to secure access so you can test it out.05:05Look at the logs, make sure the users don't report any issues and once you're ok with the 1st batch of users, you can rain some repeat until we achieve a hundred percent of traffic redirection. There's a rollback procedure that I'll showcase later.05:22Finally, when you're ready to say goodbye to umbrella, we can just close to umbrella, we can get ready to continue secure access adoption and maybe try out additional features. Alright, so this is the format of the slides going forward.05:38This is a step number one. At the very top we have a header. This is what the slide is about. The next slide is the actual idea of the slide. This is something we have to question ourselves. Confirm purchase, provisioning contact.05:55And a start date and welcome email. Buy in secure access is a necessary step, it's actually a requirement, and I know some of you guys are going to your umbrella dashboard, you go to admin licensing and you see a request invitation button. If you click on it, you will receive an email as.06:11Continue to start a migration process. However, if your license is compatible, you will see the button there. It is necessary as the initial step to also buy secure access. So what to verify that secure access subscription has been purchased?06:31In our records, we have your company profile. We need to make sure that the contact person in this company profile is accurate and is up to date. Maybe you've been using Umbrella for a while, somebody set it up or purchased it a couple of years ago and this person is NO longer in the company.06:51And when you buy secure access, we still have that person's email address as the main contact for your company, so things that are important like the welcome email and your claim code are sent to this person. So always make sure that all this information is updated during the secure access acquisition or the purchasing time.07:08Risks, what happens if this is not checked? Well, what I just described, we can send the crucial information like the claim code or the invitation link to the wrong person, and this is more to cause delays in your migration experience.07:31Confirm your contacts, request this your request start date should be also on point. And then we go to the last box which is the secure access purchase, that is the deciding question, whether we move on to the next section or not.07:47If yes, if it is, then the next step is environmental eligibility and validation. If you are unsure if secure access was purchased, the recommended step is talk to your seller or your account manager.08:06For a quote so you can acquire the product. Oops I went back one slide. There you go, we're in step number two now. The next step is making sure your umbrella dashboard is also active.08:22We need to verify, your package, the expiration date. It is required to keep your umbrella subscription active during the migration process. We go to admin licensing, you can check your package name and also the license, sorry, the expiration date.08:39If necessary validate renewal and subscription status, make sure we're not close to the expiration date. What is the risk? An expire suspended or inactive umbrella subscription can block or complicate the upgrade path. So just make sure your umbrella.08:59Dashboard is also up and running and we're not too close to the actual expiration date. The last step is decide whether to go to the next phase or not. Is your umbrella active? Yes. Okay, then we can click on request invite or request to migrate in your dashboard.09:16If your umbrella is not active, we recommend working with your account manager or your seller to get a renewal or maybe a service extension just for us to help you with the with the migration. Next is how the migration actually begins.09:36If you're navigating your dashboard to admin and then licensing, you're going to find this button, this is request invitation. If your dashboard has a license that is compatible with the migration tool.09:56Whether you buy or not secure access, you will see this button over here at the bottom. We hope, we want you guys to buy the product and upgrade, but the bottom will be there regardless. The only requirement is that your dashboard is compatible with the upgrade.10:11We need to look for this button there. We click on request invitation if available. Confirm you are in the correct umbrella org. If you have multiple orgs, you need to confirm that you are sitting in the right org that you want to migrate.10:31If the request button invitation is grayed out, I have an example of what it looks like. I'll show it to you later. It means the one administrator already clicked on it. That's what it means. You can only click on it once and if you have 20 admins in your umbrella tenant.10:46If one of them clicks on it, it's gonna be grayed out for everybody else. What is the risk? If the option is missing, the subscription organization or eligibility path might be, might need some validation before proceeding.11:02Most likely the package that you have is not compatible with the migration tool, that could be there. If the request micro button is there, all you have to do is just click on it, you're gonna receive an email to move on to the next process.11:20If the button is not there, then a recommendation is work with your account manager, seller to confirm eligibility. Make sure your umbrella tenant is compatible with the migration process or the migration tool. Coming up next, this is still on step number three.11:37These are a couple of screenshots that will showcase what the clicking on request invitation experience is like. You navigate to admin in your dashboard and then licensing, you'll find the request invitation button. Once you click on it, you get this pop up.11:54That you need to acknowledge. Some of the steps that we already covered are listed here, secure access subscription must be purchased before going forward. This step is very important. The administrator used to purchase the order must match the email on the admin.12:11Request of the invitation. This is exactly the the problem that if your company profile is not updated, we might send the invitation to the wrong person. The claim code. Once you acknowledge that we also present to you a couple of videos with instructions and.12:31Just useful information, you know, to have that you can bookmark, you probably need later. Once you go through these pop UPS, you click on request invitation and then we move on to the next step. You're going to receive an email asking you to sign up for something that's called security.12:49Cloud control. I'm gonna keep referring to this as SEC or security cloud control going forward.13:09After you click on request invitation in umbrella, you're going to receive an email with the phone subject, attach your product to Cisco security cloud control. I have a screenshot of what that looks like. I'll show you in the next slide. For now.13:17Couple of key things, the request invitation from the umbrella dashboard, you'll find the email, you need to find it. It could be on your spam folder or junk. The administrator who clicked on request migrate is the only person that is going to receive this email.13:32So in other words, whoever started the process has to now continue it. This is a task that unfortunately cannot be leveraged to someone else. If I click on the link, I received the email, I have to continue the process. This email provides steps that are required to attach your.13:52For existing umbrella tenant to secure cloud control.14:12This is required for, the migration process and to activate the migration tool. On the last box we have the decision path. Do you, did you receive the invitation to claim a dashboard and security cloud control?14:16If so, then we're gonna check what's next in 2nd. It's just actually claiming the dashboard. If you did not receive it, check your spam folders, have all the administrators check if they receive the code. Very frequently happens that one clicks on it and they forget.14:34And when you send instructions, have everybody check and then someone finds it and we move on with the process. This is a copy of what the invitation email looks like. This is inviting you to attach your umbrella tenant to security cloud control, and these are the steps to follow.14:49Number one, claim a dashboard and security cloud control, just follow the on screen instructions and then after your inside security cloud control, there's gonna be an action item for the person that click on request invitation to accept, attach an umbrella to security cloud control.15:09Next, security cloud control dashboard or org ID. If you already have a security cloud control instance, we need to make sure we're working on the correct instance because this is what we're going to attach umbrella.15:31What to verify? Activating upgrade manager uses the same email in security cloud control. The same admin email account for umbrella and security cloud control. We have to basically go apples to apples here. If you have 20 admin users in umbrella.15:46You suggested that once the security cloud control dashboard is up and running, the person that's on security cloud control.16:06Should add the rest of the administrators that are present in umbrella. It is required to configure a multi factor authentication with the acquisition of security cloud control. We give you like a lightweight instance of duo. That's what we recommend using.16:14I have some screenshots of what the process looks like when you're claiming the dashboard later, you'll end up with two install on your phone and two factor every time you log in to security cloud control. This is something very important. If you have roles in umbrella for administrators, these are NO longer managed inside your.16:33Secure access dashboard instead this process is managed by.16:52Security Cloud control. What are the risks? Well, the main risk is that administrator lockout. Whoever claims the security cloud control dashboard has to make sure all the other admins are added.16:57Every time an admin is added, they receive an email asking you to complete your account for security cloud control. The process includes downloading dual and setting up to a factory. That way you have redundant access multiple administrators to your security cloud control tenant.17:13Both Umbrella and secure access use the authentication configure and security cloud control. So after you attach Umbrella to security cloud control, one of the steps of the migration is.17:33That this multi factor authentication process that you just created in security cloud control takes over the authentication procedure in umbrella with process umbrella. For as long as the migration tool is enabled.17:45You get to umbrella using SSO as well. All right, so once you're ok claiming your security cloud control dashboard, the next step is attach an umbrella to security cloud control. If you still need to decide if you have multiple security cloud controls.18:02You need to decide which one is the one that you're going to use to attach umbrella.18:23If you're on the plane with one dashboard, then this isn't going to be a major problem. This is after you click on the link on the email that you receive asking you to go to security cloud control, this is what the process looks like.18:28You'll be, you'll land on our SSO page. If you don't have a dashboard yet, a security cloud control dashboard, just click on sign up fill the form, and then the next step will take you to download Duo and do a quick scan the QR code and synchronize the application and send a push after everything is completed.18:45This is the internal view of security cloud controls. As you can see we are already inside the dashboard here. You come up with your organization name and the region for your deployment. After you're done with this process, you have a functional.19:04Security Cloud control tenant. Do you want to use another IDP? If you already, if you are using another provider such as Okta or the authenticator, can you guys continue using that? Yes, absolutely. There is a wizard that you need to perform, you need to claim a domain.19:23And there's a little bit of an administrative task to do to remove Duo from the whole equation and continue using your own IDP. However, for simplicity, we recommend using dual during the migration process.19:43And once the migration is completed, then you can remove Duo and bring your own IDP. We'll, we'll give you support for that. It's recommended, however, just to process the whole migration using Duo for simplicity.19:58All right, so now that we are in security cloud control, it's up and running and we have SSO also up and running with duo. It's time to attach your umbrella tenant to security cloud control. All you need to make, all you need to make sure is that your instance ID is actually your umbrella org ID. I'll show you where it.20:15Where to find this in a minute. What to verify? The invitation email to attach umbrella to security cloud control, you need to make sure you receive that claim the dashboard. The email has the.20:36Instance ID that should match your umbrella org ID. This is the 1st time you're gonna see your umbrella org ID. I'm gonna go back a few slides and show you the invitation email. Here it is on the invitation email you should see your umbrella org ID right here.20:51And this is what we're aiming to attach to security cloud control. I'm gonna go back to the slide where I was ok what are the risks if you, if the number doesn't match, it may fail to enable.21:10The migration tool and where we now might we might not might not be able to connect your security cloud control with umbrella. If the attachment is successful, we move on to the next step, which is claiming your secure access license or subscription.21:30If the attach is not successful, there are multiple things to check. If you receive an attachment error or if you don't have the correct org ID, if you're an incorrect security cloud control tenant can find an action item to attach is a very common procedure. The reason why you sometimes cannot find.21:48The action item to confirm adding umbrella to security cloud control is because you have multiple administrators in your umbrella organization or tenant. John Doe clicked on it and someone else is trying to finish the process. Unfortunately, like I said before, the person that clicks on it is the one that will see the.22:08Action items security cloud control, so the person that starts the process has to move along.22:28All the way to the end. So let's move on to the next step. This is what the action item looks like once you're inside security cloud control. It's just a confirmation that you want to attach your umbrella org ID to security cloud control.22:34A more zoomed out view of what's happening is in this screenshot. Here we're inside security cloud control. We need to go to platform management and a menu comes up here and we need to go to subscriptions and this is what subscriptions look like.22:53The request invitation button triggers this thing right here. You need to make sure that your, I know this org ID doesn't match the previous screenshot, but that's fine. This should be your umbrella org ID right here.23:13And then you just need to click on attached product. A small wizard will pop up. Are you sure you want to touch the product? You click on yes and then confirm, and that's it. Now, security cloud control understands or the SSE dashboard identifies which umbrella.23:27Tenant will require to enable the migration tool. So this is where we start connecting the dots here. Step number seven. Train your secure access subscription.23:47Now when you buy secure access, we send you a claim code. The email that comes to your inbox has this subject cisco secure access welcome email, and this email is very similar to the email that you receive when you click on.24:05For attaching your umbrella product, security cloud control it has a similar format, but the content the body of the email is different. One is to invite you to claim a security cloud control dashboard. These other one you get as soon as you buy secure access and it contains your claim code. This isn't necessary.24:27Step to enable the migration wizard. We need to make sure you have the welcome email, we need to make sure you have access to your claim code. We need to claim your subscription using the claim code. This is a small wizard, we're doing security cloud control.24:45During the wizard, you're going to be asked if you want to activate secure access on top of your existing tenant or on a new tenant. We'll go more in detail on this step, which is crucial in the next few slides.25:05Request invitation does not generate the claim code. These are separate procedures. The code is provided after secure access order is completed and they arrive, and arrive at the request start date, sorry.25:21So once you buy secure access, you get the claim code. What are the risks? Creating a new security cloud control instance in using the claim code in the incorrect instance does not enable the upgrade manager. We need to use your claim code.25:37In the security cloud control instance where umbrella was attached, right? So responding security cloud control would bring umbrella over and now we're bringing secure access through the claim code over. I'll show the process in this few slides.25:55Once you claim your subscription, this is going to enable the upgrade manager. If you don't have the claim code, check your spam folder, contact the seller, account manager or engage Cisco tag.26:12Most likely, very frequently, the contact email that we have on records for your company is outdated. So we just sent it to someone that's NO longer with your company. Very frequently that's the case. So again during the acquisition of the product, make sure your contact email is updated.26:25Now this is a copy of what the email looks like. It's a very similar format though the content is different and this is the format of the claim code, this is what it looks like. Now here we move to.26:45Security cloud control. We navigate to the platform and then subscriptions. I'm gonna go back a few slides so you can see what triggered this wizard here in security cloud control, we go to platform management and in subscriptions, there is this claim subscription button.27:00At the bottom of the page, once you click on it, you are sent to this wizard, Right here is the three steps process. You paste your claim code here and then you click on next. There's a next button here. It's not on the screenshot of there is a next button.27:20This is step number two and this is crucial. You have a dropdown menu and the dropdown menu is asking you, where do you want to throw secure access on? Do you want to create a new secure access instance or do you wanna throw secure access on top of umbrella? This is basically.27:40Do what this question means.27:58If you want to turn on the migration tool on your umbrella tenant, 2nd option is the correct option. This is the one we have to go for. If you wish not to use the migration tool and just start fresh or you don't see any value in transferring all your umbrella config over to secure access, then you go for.28:01Creating a new instance. If what you have in mind is using the migration tool, then sitting your secure access subscription on top of your umbrella tenant is the right choice. You get this message subscription successfully claimed.28:21You're gonna get an action item just like the one you saw for attaching the umbrella product and you click on it. This is just a confirmation that your secure access product is going to use your umbrella org ID. Again, this doesn't match this org id.28:39ID, but you get the point. You should confirm that we're going to enable secure access inside secure cloud control and secure access will use your umbrella org ID. They should be the same. And once you're done, you get this confirmation.28:59Then this enables the upgrade manager and umbrella. So as the next step, we're gonna review that your umbrella tenant indeed get the upgrade manager enabled. I have some screenshots of what it looks like. I'll show you in a bit.29:16So what do we need to check? The invitation process completed successfully, security cloud control association with your umbrella tenant, claim code, everything completed successfully, NO errors, wanted to make sure your subscription is fully claimed.29:35After we do all that, we should say the upgrade manager. This is an additional option in your umbrella tenant. If, what are the risks? Upgrade manager confirms the activation path is ready and allows you to complete prerequisites before.29:53Starting the migration process to secure access. Do you see the upgrade manager tool in umbrella? If so, then we go ahead and use it. If you do not see it, the activation process may take a while. I would recommend waiting.30:10If you have waited a few hours and you still don't see the immigration tool in umbrella, then we need to engage Cisco tech. But what does it look like? This is what it looks like. After you do after you activate secure access and secure cloud control.30:28Next time you log in to umbrella, you're gonna be welcome with this pop up and it encourages to start a migration process. If you click on this, you're gonna land in this menu right here. This is the newest section in your dashboard. The screenshot doesn't look as good, but I'll show you what it looks like in a little bit.30:44And this is the step number one of the migration wizard. We have to take care of these three items, make sure or confirm that security cloud control has an SSO instance configured. This is a free dual instance, lightweight instance that we give you when you claim your.31:05Security cloud control license, that has to be operational and when you click on start umbrella basically talks to security cloud control to make sure SAML is enabled and then SAML takes over the authentication of umbrella. You log into both dashboards using SAML.31:25The next step is make sure your virtual appliances and active directory connectors, if you are any integrated are up and running, that all the components look green, nothing needs an update and we have connectivity with everything.31:45And last but not least, if you use Chromebooks or mobile devices, you need to make sure that the MDM solution still talks to umbrella. Everything is in sync and the policies are still being pushed to your mobile devices. These are more of a manual process. As soon as you're done, we just check the box and mark as done and then through a.32:00Next, we're gonna go a little bit more in detail on these three process in the following slides. We're gonna talk about SSO 1st. Is security cloud control SSO enabled, we need to make sure that.32:20Your security cloud control tenant still has SSO enabled and all your admins in Umbrella should be able to log in to security cloud control. This is highly suggested in to prevent administrator lockout.32:36What to verify, create or provision security cloud control accounts for all required umbrella admins. Your umbrella administrators do not show up in security cloud control automatically. This is a manual process.32:54We need to use the same email address. This is so we know you are doing the administration of both platforms, umbrella and security cloud control. So you have to use the same email address. Can you add an additional email address? Sure yeah you can do that, but it'll involve adding a new administrator and you have to.33:11To Confirm an invitation is a is a longer process. It can be long but just stick to the same email address.33:30And we recommend sticking a dual just with the migration process. If you use something else, we can definitely switch you to that after the migration is completed. Make sure you can sign in to both dashboards at least with two administrators again to prevent lockout.33:38The, the risk is just lock locking administrators out. If you're, if you're locked out, we need to engage tag it is essential that you are able to get to both places. So once you enable security sign on in umbrella.33:56We move on to the next step, which is 2nd box in step one, which is virtual appliances connectors and mobile devices. What to check here? We need to determine whether virtual appliances or active Directory connectors are used, that they're up and running, they're updated, you.34:14Baes should be at least 371 or later.34:33Your connectors should be up to date and your connectors should be talking to the cloud and your virtual appliances if necessary. What are the risks enhanced authentication requires supported and current virtual appliances and active directory connectors?34:37Something I frequently do, my clients is they've been thinking about getting rid of on prem AD integration and just bringing in intra ID. This will be a good moment to perform the small change, so we migrate the newer integration with secure access.34:54Or we just get rid of the on prem integration and once we're migrated, we bring in to ID to secure access. It is recommended to do cleanup in your umbrella tenant to make sure that all the configuration that is migrated is just configuration that you need.35:10So once all this is checked out, the next step is a policy translation. For in step number eleven, the policy translation from this happens automatically.35:28You just have to click on a button and what we're gonna do is grab your your umbrella policies. We're gonna translate them into secure access rules, and then we're gonna paste them into secure access. The policy translation procedure also enables the dual view dashboard for you.35:47For a time, you have access to both tenants, secure access and umbrella using the same org ID. I can showcase what it looks like in a bit. So after you go through.36:06The policy translation process is important check that your well beforehand you need to make sure that your policies have the correct users, groups, identities in general. Policies without identities should be reviewed to see this is another opportunity for you to do some cleanup in your dashboard. If you have too many.36:21Policies. You use the policy for a pilot some time ago and now the policy is not in use. My consider deleting that. If you have policies that are disabled, find out why the policies are disabled, can we just get rid of them just to prevent migrating unnecessary and used config secure access?36:42Policies with over 250 identities might need to be split. If you have a policy with a thousand users, you need to create four different policies and add NO more than 250 identities per policy.37:01The blocked bypass page and legacy API keys need to be reviewed. What are the risks? Umbrella policies are copied into secure access as rules, settings and resources. The rule order and behavior must be reviewed after the migration.37:16Unless you see this is a little bit confusing. I'll show you what the rearranging and an order looks like in a, in a little bit. So after we do the policy translation, the next step is traffic redirection. Now the policy translation, like I said, will give you a dual view. You can access both tenants with the same org ID.37:33But it doesn't actually start using secure access yet. That's what traffic redirection base is for. What are the recommended steps? Just do a little bit of clean here, review configuration umbrella that you don't need.37:55Before doing the translation process. Couple screenshots of what the translation process will look like. In this step, you will gain the dual view mode. Umbrella secure access share the same org ID. You can review how the umbrella configuration was translated in secure access.38:10Before redirecting traffic. This is a screenshot of one of the process basically tells you one DNS policy in umbrella or one policy in umbrella in this case guest Wi-Fi is gonna be translated to potentially three different policies and secure access.38:30This is because in umbrella, you can have a combination of configuration that allows some traffic and configuration that blocks some other traffic in the same policy. Such behavior is not possible in secure access.38:46Secure access rules have either an allowed behavior or a block behavior. So the way the translation works basically is we're gonna grab everything that is configured as a block in this Wi Fi policy. We're gonna put them together and we're gonna create.39:03A blocked rule. We're gonna grab everything that allows the traffic in this guest Wi Fi policy and then we're gonna create an allowed rule, right? So we'll do basically like apples to apples.39:21And a 3rd policy might be created with all the default settings that are in your in your policies. It's very frequently created. The takeaway here is, everything that blocks in a policy will go to a block rule, everything that allows, any policy will go to unallowed rule.39:38That's the way you re that's why I recommend seeing it. Now the policy migration or translation can take a while to complete the larger your umbrella config, the more time the translation is gonna take. Just be patient. If you have waited a few hours and you don't see your policy showing up in secure app.39:57Access a bit time to engage tech, but I recommend just waiting a couple hours at least.40:17This is the entire wizard, this is what it looks like. You might not be able to tell, but here is a number two, which is moved to step number two of the migration tool. You just click on start upgrade. This is the screenshot of the previous slide and.40:24This thing's going to think for a while, and once it's done, we get to this page, upgrade success, and you are invited to next or there's a shortcut here to jump to secure access to view your policies. You get to see what the result of the translation is. You just click on this button.40:41A new tab will open your browser. It's gonna take you to secure access. If you come back to the upgrade manager and you expand section number two again, the message is, is the same. It's gonna, well, it's the same thing, it's gonna look a little bit different, right? It's you still see a shortcut to jump secure access and.40:57A next button. And if you refresh you refresh your page on umbrella, not only have a shortcut to your access manager but also a shortcut to up in secure access to view your rules. This is an example of my ten.41:17If you've been using Umbrella for a while, should be somewhat familiar with this screenshot on the left side. My policy is called social media torrent. And this is the destination list section. Every policy in umbrella has the global allowed list applied to it by default.41:35In this case, I also have two policies, sorry, two destination lists applied to block traffic. One is called blocks team and torrent, and the other one is the default block list. So like I explained previously, the social media torrent.41:54Policy in umbrella is gonna output up to three. This is just any default setting that is configured in my policy and is set to allow. Most likely this social with the block action grab these two destination lists.42:11And this is the output, right, of that policy. So anything in this policy that blocks traffic will make it to a block rule and umbrella. And at the same time, the global allow list, and if I had more destination list here.42:29The translation process is going to craft a social mediatoring policy with any allow list that I have here present and it's gonna craft a new policy with the allow action. This is more or less how the migration process works.42:45The more policies you have in umbrella, the more secure internet access rules you're gonna see in secure access is always suggested to go to secure access, rearrange your rules, and make sure they work as intended.43:02The next phase, oh, this is key takeaways for the policy translation. These are questions we get frequently. Policy design and behavior, one DNS policy will produce up to three secure access policies.43:19Allows and denies in the same secure access rule is not possible. That's why we grab a policy in umbrella, we'll split it into multiple policies and we output several to secure access. That's the reason why. Policies without identities are not copied. We assume you don't need them so we don't transfer them over.43:36And disabled policies are copied as disabled in secure access. We trust that if you have a policy disabled as for a reason, you need it from time to time, so we copy for you. And this was mentioned before, you have a policy in umbrella with 250 plus identities, you split it in chunks of two fifties.43:55Identity wise, and then they will be migrated with our products. Components and configurations, your application settings become application list. Your block page bypasscode does not migrate to secure access.44:15Part of this is because the users, right? You use SAML to get in. You don't have static users anymore. So if you don't have static users, you don't have bypass codes. That's the reason why. Another very important feature that some of our clients use in umbrella.44:32Tags for roaming computers. These do not exist in secure access. There's nothing like it, so something you need to consider. You might need to create an active directory group and add users to it and reconfigure your.44:51Policies before doing the policy translation. Tags do not exist in secure access. Another important change is the policy tester. We don't have a policy tester in secure access.45:05Admin roles in Umbrella are handled different in secure access. The roles are assigned or specified in security cloud control, not inside secure access. I guess I can show you where this is in a little bit.45:21Finally, the selective decryption list is called do not decrypt list. This is a change that is confusing. Why would a decryption bypass list is called selective decryption list? I don't know, we may change the name finally.45:37And so general recommendation, just verify all your config Upgrade controls. This is also very important when you have the migration tool enabled, you must avoid modifying and deleting your policies, application settings or just.45:52Change your configuration too much in umbrella. The translation process occurs once only. So if you have five policies in umbrella, and you execute the policy translation process, we're gonna translate those five policies. If you add another one.46:12We cannot re enable or rerun the policy translation. Changes made in umbrella are not synced to secure access post policy translation. There are some configs that are synced.46:29But policies do not get resynced. The synchronization is only a one time process, the translation. You can access secure access through umbrella or through security cloud control. You can use the shortcut from Umbrella to jump to your secure access or you can just.46:45Access secure access inside your security cloud control tenant. Traffic and rule validation testing are required before before the cut over. So let's go to the next section. Now we have all your policies show up in umbrella.47:01We get to the redirection phase. This is the POC basically or the pilot. This is when we start testing all the config that was sent to your secure access tenant. It is recommended to.47:18Select the group of users very frequently folks in IT volunteered to test secure access. You select the users, you'll find the users you're gonna use for the pilot.47:33The more components you can send to secure access, the more your the more solid your testing phase will be. We recommend using a network, a roaming computer.47:49Users, groups, active directory, identities, there's also a rollback option that you have if you redirect traffic from a few identities and you'll see traffic being blocked that wasn't blocked before or the other way around if they can get to websites that were not able to.48:05Get to before, then there is a rollback option. And this is a formality, you know, communicate that users are gonna go through POC. The, what are the risks with direct identities in one shot?48:23Could lead to potential service outage or impacting services that are crucial for production. So that's why the pilot is recommended, just select a few users, send them over to secure access, look at the logs, make sure the traffic works as expected, that corporate tools are still.48:39Usable, if the 1st batch of users is fine, what's next? Well I guess you can repeat the steps number twelve. Select another batch of users, send them over to secure access, that's fine. Just repeat stuff step twelve is many times as necessary.48:59Until we get to a hundred percent redirection. Once everything is transferred over to secure access, we'll be ready to close to umbrella. If you have issues with the pilot, we can do a rollback, check the policy, make sure you check the head counts of your policies and secure access. Policies with NO head counts.49:15We recommend deleting them after the policy translation occurs, you're going to see some policies are duplicated, so with the same purpose, we may just go ahead and delete if necessary. Or for the time, yeah, just rearrange them and send them to the bottom one.49:35Once we're done with the actual migration, we can just delete our news policies. This is what the traffic redirection looks like in the migration wizard. As you can see, we're in step number three now, you click on start, then you're gonna be presented with.49:55You can barely see the screenshot represented with the list of things that you can send to secure access. 1st, we have your networks, your public IPs, and then network devices, if you have a network device integrated with umbrella. The 3rd one is roaming computers, mobile devices, Chromebooks.50:15Sites and funnel groups. If you click on roaming computers, e.g., here you will see the list of all your roaming computers, just check the box for a few computers and then send them over to umbrella, and click on redirect traffic.50:34This pop up is going to show up, check the box, I understand I wish to proceed redirect, and then you get a confirmation. Now, all the identities that are in secure access will show up on the right side here on this side of the box.50:51If you need to roll back, it's very easy. The same way you check the box and send the traffic through secure access. You can just check the box again and return the traffic to umbrella. Should you check something?51:06Once you redirect the traffic, it is always a good idea to check policy hits, make sure your policies are being used or did they get hit counts. And if you go to the logs under the traffic redirection, notice this is secure access, right? We're inside secure access.51:23Right now, we go to monitor and then activity search. If you have used to use a activity search in umbrella, this is gonna be very refreshing for you was exactly the same model for the logs. You don't need to relearn, this is one of the sections you don't need to relearn of the dashboard. This is the same.51:41It has an additional filter here points point of enforcement, you can view logs from both tenants, umbrella and secure access. If you just want to see traffic for this by secure access, then you check the box for secure access. Anything you see here is due to traffic redirection.52:01Being handled by secure access. Alright, we made it to the last step, one of the last steps is closing umbrella. After all your identities, after all your traffic is handled by secure access.52:19And you confirm the pilot and traffic redirection, policy behavior, everything is good, up and running, double thumbs up, we can consider closing umbrella. Internal and external DNS traffic should resolve correctly. You need to make sure that critical business applications are reachable, that we didn't break.52:36Anything during the testing phase and if so, that will help you to get everything fixed. All required resources are redirected connectivity, DNS behavior, policy enforcement reporting, major apps are all validated.52:56Some of the stuff that are not manually transferred, you can double check here like legacy API dependencies or integrations you need to redo and secure access, someone needs to not get transferred over, and make sure you check your administrator's accesses.53:13The final umbrella closeout is a permanent irreversible procedure. Once you close the umbrella, we say goodbye to forever, and going forward you just use secure access. If you're ok to close the umbrella, complete the upgrade manager and close the umbrella.53:30There is something still to check, you know, go ahead and check it, go through this list. If you're, if you don't feel ready to go to close the umbrella, just say goodbye and to your old friend and adopt secure access as a newer solution is a more modern and is compatible with more features. So.53:48So let go. Then this is the last step in the migration tool. Closing umbrella. As you can see, this is the prerequisites, the policy translation or upgrade traffic redirection, and finally closing umbrella. You expand closing umbrella in.54:08You click on close and this pop up comes up, it's warning you that it's an irreversible process. Once you check the box and close the umbrella, you're locked out immediately and you can't get back to it. And this closes the umbrella permanently.54:27What to do after migration, confirm traffic redirection and policy behavior are working as expected, verify that the migration is complete. The traffic is validated correctly in secure access, the environment is stable and well at this point you'll be ready to.54:43Review the next adoption milestone. Maybe you want to use trial features like ZTNA or remote access VPN, you name it, anything that secure access offers that Umbrella doesn't. Review the next.55:02The review helps confirm included capabilities, next priorities, and the next milestones for expanding protection visibility and user access. All right, so if you're good with secure access, there is a completion survey, I understand that you can fill out.55:19If there's something wrong with the product, because NO product is perfect, that could also be the case. Just give us your feedback. Talk to your account manager. Tell us what's going on, a feature that you missed and access that was present in umbrella. Or if you need some additional guidance to learn the dashboard a little bit, just talk to your account manager, just bring us whatever.55:34The concerns you have and we'll try to make it better for you. Next is just a list of additional resources. You have a link here for secure access at a glance to get a glimpse of what secure access is and what offers our community page.55:54The user guide, this is gonna be your new docs page going forward after your docs secure access. The upgrade guide, most of the screenshots and information that are present in this PowerPoint.56:11Are are obtained from this link. So it's very useful. Secure access packages comparison metrics I'm gonna open this up and show it to you in a second. And the ordering guide. So you become familiar with the features of secure access, so when you're buying it, you know what to order, what fits you better.56:27I'm gonna switch very quickly to the dashboard here with the minutes we have left, ok, great. This timed out, I was afraid of that. I'm gonna try to let it log in and I'm gonna show you the packages.56:46Comparison and, so you see what you get when you upgrade? Get rid of the dark team. Alright, so this document is great. We'll give you this document later. It tells you what you get when upgrading from umbrella to secure.57:04Access. You have the umbrella box here, you have DNS packages or sick packages that are split into two essentials and advantage. With these dots, you're gonna just follow the dots, see what features you have and what you're gonna get with secure access. This is like a very short aid that'll help you.57:24Make a decision on on what to acquire for secure access. You can get DNS defense if you're not interested in the proxy, you get TNA on a trial base and some of the secure private access features. If you buy a secure internet access, then you can compare what you had with umbrella, what you're getting with secure access.57:43Now, this document is provided to you is the matrix is humongous as you can see just go through.58:03Aid carefully so you can determine which package is more appealing to you or work best for your company. I'm having problems with my SSO I don't think I'm gonna be able to get back left.58:09Yeah, Juan, thank you so much for this. You know, this will definitely conclude our presentation today. Thank you to all the for managing the Q and A section of today's webinar. A special thanks to each and every one of you taking the time to join today's Cisco umbrella to Cisco secure access migration overview webinar.58:26You will receive a survey at the end of the presentation. Please take a few moments to complete that and please be on the lookout for any upcoming umbrella and secure access webinars. And then as a reminder, the recording will be shared and will be available after the session.58:43