Explore Cisco Secure Firewall Identity, VPN and Zero Trust Network Access (ZTNA)

I Hello, welcome everyone. We are very happy to have you here. Today we are exploring the topics of identity, VPN and CTNA on CC.00:01And we hope that this is going to be an interesting session for you.00:21In case you have any questions during the presentation, please use the question and answer panel on Webex. We will answer there and if necessary, we will provide further answers offline offline. These are the presenters and the panelists of the day. There is me as presenter Lou.00:27And David and we have Christophe Costantinos panelists. We are invited from yesterday as the presentation.00:46Oh. Just a quick slide to remind again what we do as customer success specialist, the task that we usually handle. We do adoption consultation in case you have a solution and you would like to go further in its usage or you have some goals and you want to raise.00:55Review if it's possible to use your devices to reach them, we can help you to analyze and other concern barriers.01:15We do adoption session one on one in case you want to understand or learn better a feature or a use case of one of your solution. And we do health check to recommend best practices and assess of your deployment and finally, we deliver content like the expert invite series you're attending today.01:23This is the agenda of the day. We are going to see the Cisco secured firewall, and identity. We are going to see the remote tax VPN and the TNA and we are going to give a look at side to side VPN side. I'll be presenting a session regarding identity on the firewall.01:44It will touch most of the content and the ways to do identity on the Cisco secure firewall.02:04Since they are many, it will be not super deep, but it will give you an overall idea and we'll go through some of the challenges and caveats for some use cases. We have a lot to talk about and a very short time, so I will go fast, I'm sorry.02:10There are two short demos that I have tried to squeeze enough to be included here to give you a practical idea of what we'll discuss. Now, when you build security for location, you usually need to set up barriers, protection like fences cameras and things like both.02:26But you also need something to let the people are entering out like the gates and possibly something that can make decisions about who can enter and who can't.02:46A traditional very effective way to control a little with quick and automated system is a control that treats the license plate of a car and has a list of allowed license plates. However, identifying the cards doesn't really tell you who is driving it because the car might be in stolen or might be in.02:58You are not really sure who you are letting in.03:18It is like the space vessel in Star Wars Center that start with the simple outdated code of the ship. It was naively not secured. Why do you need that entity? Well, you need that entity, you need an access control that is granular to reduce the.03:21Office, you want to know and manage who access your network and where it goes and it would be definitely best practice to follow the principle of least privilege, your users should be allowed to use and reach only the resources that they need.03:41Then you might want an answered security because when you have an information about the user, you can rely on new security solutions like Cisco identity intelligence to determine if a user behavior is weird or is fishing and you can use the info to block those compromised accounts.03:57And, today with the remote user multiple possible media devices SDN integration between different environments, you could have several dynamic objects and blooded boundaries and static policy might not be enough anymore to give you a consistent protection.04:17I have worked in TAC, I put my hands on a lot of firewalls, but in a very large number of cases that I've seen in real life, there was NO identity policy on the firewall. So the question is, why don't we all have already identity policy on the firewall?04:37Well, there are many reasons but if you want to summarize the main ones, it is complex. Today more than yesterday, it required tests defining precise policing, applying them, track them, keep them updated.04:53It requires integration with other platforms and may they might not they might be very different and all that effort need resources and they need to have the expertise and the time to work on those resources regularly. It has performance and scalability's issues that might work.05:09Person user experience and we don't want that, and moreover, it will use more hardware resources with the feature you're using. So that has to be taken into account and it's not always possible. And as time passes and we bring in new things like the dynamic object attributes, integration, you might.05:28You have entities that are defined on platform and environments that are outside your control. So you install connectors, container, and then something else is then updating or making changes on those things based on the integration that you configured. So you are not totally in charge anymore of your own.05:48Policy you are losing control.06:08And you might not be sure anymore of the details of your policy and it's not so easy to track it. If you check the slide, you will see that there are really a lot of ways to feed identity into your firewall. You can integrate the firewall will with a lot of identity sources.06:10With a lot of different protocols and method, it is easy to lose track of some or to remember them all.06:30Not all of them would work together really well. Each one have different requirements and limitation because it's built on different concepts and interact with different platforms. So we are going to pass through them all so you will have a map with the base factor knowledge to make better decision in the future if you decide.06:37Try to implement identity policy in your environment, you should be able to know what are the options that you have available, what are the requirements and limitation, and what might be the common problems.06:57Oh, let's start with the 1st source of authentication of user that is the passive authentication. Passive means that there are other devices and solution on the network that can identify a user and the firewall takes the info from them instead of taking directly from the user.07:10We have four possible main sources of information in this case and we can describe it like the entrance at club for an event. And let's say that you have a co registration office where you go, one user go and register. So somewhere it is recorded.07:30Who is the guy driving a card that has a license plate? And the core registration office sends the info to the ingress control system.07:49And the user goes and reaches the gate and there is also an organizing team for the event that has compiled the list of people that is invited. So the gate will receive the info regarding the license plate and the driver and the list to check if that specific user on that specific.07:59Specific car is allowed to enter.08:19And if we go in real detail, the real life detail, there is a manner there is a realm, there is a management center, the real is configured on the management center, so the management center is downloading the map of users and group from active Directory.08:22And then there are rules that enforce a policy with IP addresses, pools a user part of a certain active directory group and there is another source of information other than that, I don't know like eyes that is providing the information about the IP that the user has at a certain moment.08:41Pointing time. So in short FMC received e.g. that Omary is on 172-16-1010 from ice. So.09:01It has a user binding with an IP and it has also a guest list with the roles from Active Directory and the policy. So it can send the info and configuration to the firewall so that that when I, that IP arrives to the firewall, he can enforce the policy with the user.09:10If we look at passive authentication sources, we are getting the identity info from the system that are actually doing the authentication and share the info via integration. And we have eyes, we have passive identity agent and we have terminal server agent. They all have their own way to authenticate.09:31The user and provide you the information and eventually the attributes of the user.09:50And as I said earlier, you get the user IP mapping from the sources, but you need the guest list. You need the mean to determine the user and the relations of users, so the groups of the user that are interesting for your policy, and for that one we've got integration with.09:55On the FMC.10:15Regarding the passive authentication, if we go one on one, the 1st one that we are going to see is the passive identity agent and we are going step the step on how it works. It is a software, so it is a service that you install on a server that is part of your domain and it reads out.10:18The events and extract the info regarding the user that has logged in from the log and after that it sends the info to the management center.10:38So it is pretty much a simple concept and a quick simple way to provide identity to the firewall. It has a few possible ways of deployment from a design perspective. You can introduce redundancy, you can integrate with different domains.10:48Every agent can collect from 50 different domain controllers or other directories while the number of simultaneous passive agents you can install on FMC is ten as limit.11:08Now, there are a few considerations that you need to take into account when you go for a passive identity agent. 1st for this to really work, a workstation needs to be able to log in into the domain, so you need to allow that kind of traffic if you want the system to work. The authentication.11:24This case is.11:43And once a user has logged in, you will have this identity collected by the agent and sent to the FMC and then the FMC will update the firewall with the info and allow organized traffic. This is a step by step world.11:46Through of how the whole authentication work, and the 1st thing is that of course you need to download the users and the group from Active directory. So the FMC does this operation periodically once you have configured the realm and it will do with let's say the timing that you decide one per day, 1 /h.12:06So it's configurable.12:262nd step is the user now connect to the active directory and you have a login event. And this is like the registration office in the analogy we spoke about earlier. After you have the login, the passive agent is reading it and now there is one.12:29One thing that is quite important regarding this kind of authentication and is that.12:49Through herbrous, we can pretty much know the authentication event and the authentication renewed event. So we can see when a ticket is granted, but both are the only log that we can read in Active directory.12:55And those event happens when the user logs in and when the authentication is renewed after a configured amount of time, that is usually eight or more hours. And that means if e.g., the user disconnect from the network and reconnects without a login event. Example is.13:10He's connected he he logged in on a table connection and he moves to Wi Fi. He disconnect the cable and just goes and Wi Fi is already active. There will be not a login, but his IP address will change.13:30It changed NO, it changes NO update on Active directory. So you will actually are not going to match the correct rule anymore. You are not the updated identity of the user, the updated IP address of the user. So passive identity agent is an easy solution to configure and install in general.13:46But it's not really suited for all those environments where users move around a lot.14:06Now, the passive agent has the event and send the input to the firewall management center and the firewall management center will cross check this user with the structure that he downloaded from the active directory as a realm. So it will verify the user and what are his groups. And if the user was not downloaded from the directory.14:14E.g., if it was just created then the FMC still didn't synchronize the mapping won't really be useful, so you need to have a corresponding match in the data that FMC has collected to really use the information, the IP being.14:34And once this is done, the FMC will send the mapping and not able to the firewall so you can enforce the policy. The firewall has the correct data to apply the policy and this is an example of how this data was decorated, so you have a mapping around was decorated with the user.14:50Attribute group membership etc. As you have seen, this operation relies on the firewall management center to work. So if your FMC is down or if there is a temporary problem of connection with the FMC, it is not going to be possible to update and modify the user attributes. So.15:10The FMC becomes a single point of failure if you don't have HA.15:30There is one very important thing you need to remember, and it is that you need to think about how long does this mapping remains on the firewall? Can I remove it? There is a configurable timeout, so you can have some kind of control on it.15:38But you cannot remove it earlier than the time out. So the user might have left the network already, but the mapping is still there. And these kind of issues are a problem for every IP based identity method. Later we will have a summary.15:57Of everything with a table comparing the use cases of identity mapping regarding exactly the specific matter and these are the takeaways of the passive identity agent. There is one thing that is important and it is that this is mutually a.16:15Exclusive with ICE, you cannot tell them both. If you want the passive agent capabilities and ICE, you have to rely on ICE passive agent and then integrate ICE and FMC.16:35Now there is a very short demo on how the passive agent looks like and as I said in the beginning, it's a service installed on a server. It's not necessarily the domain controller. It's a program that is running and talks to the.16:50Active directory to the domain controller and to the FMC and it has a user from them both. And you need to remember to set right privileges.17:09As I said, it is mutually exclusive with ICE so you can have one, only one of them in this screen you can see that the the status of the agent and the user. And at the start of the demo, we have NO identity on the firewall so there is NO one connected.17:20There is in the active session only one login that has been an internal user an internal login on the domain controller but NO laptop connected.17:40What we are going to do is we are using a laptop and a domain user to log in and we are going to to enter with this one. As we log in, there is the login and we are already recognized, so we are eating a rule of traffic permitted.17:50For any users and I can navigate around and we can check the IP address that is, in this case is it ends with.twenty one.18:10And it's the actual building of the binding of this IP right now, and if we refresh on the FMC we can see that there is an active session for a certain the user that I used to log in and its IP address.18:20Now, as I said earlier, there are use cases where, e.g., logging in, in Wi Fi or moving from cable to Wi Fi or from Wi Fi to cables where you can have two different.18:37Network interfaces and you are switching IP address. I am simulating these with the secondary network interface with the different static IP address, so it will be pretty much the same as disconnecting the cable and connecting to the Wi Fi and moving and.18:54And pretty much I'll do just disabling the old network interface and enabling the other network interface, you will see that right after I have enabled the new network interface, my IP address has been changed will change. I am in this case, still.19:14A Bola.19:34To navigate but just because below the active directory rule, I have a catch all rule that is allowing my traffic, but in general, if in your environment you're really using identity for real enforcement, now your user is going to not match anymore the.19:35Previous rule, he will have problems to be recognized. So right now I'm going, it's going to work properly and my address has been changed in something that ends with 23, but in the active session, if we refresh the active session on the FMC, there is not race of the change. The FMC still think that I'm 21.19:55And, this is because if we go to the active directory, security events, we can see that there is only one events and it was my previous login on from another that was.twenty one and that gave.20:15Give me the ticket and unless the user logs out and logs in again, there won't be another ticket. So I will still have the the old address.20:35And pretty much this is an idea of why it is a problem and we are passing to 2nd authentication method, and 2nd one is we're going to see is the terminal agent and the terminal agent can be explained like boss. You have.20:47The old users that are running on the same IP address and the problem is to distinguish between the various users and.21:07Your authentication is pretty much similar to do the assignment of seat on the bus so that you know who is that is sitting at a certain seat. The terminal agent is working at kernel level and it is assigning range of ports to user on the server.21:16So the ports are actually the seats assigned in the analogy and once they are assigned actually the terminal agent has the mappings and send the mapping to the FMC, whether it is the on premises FMC or CDFMC, it's supported on both and that info can be.21:36Used together with the IP address to determine who is the owner of the traffic and the FMC has that information now and it's shared with the firewall with the firewalls and for the firewall it is really simple to enforce policy because you just need to check IP address and ports.21:55In short, it is a very straightforward configuration, very easy. The things to remember are that you can have up to 200 users on a single terminal server that there is a limit of 50 terminal server agent in absolute supported on the FMC, and that is because having more is going.22:17To impact FMC performances. I've seen these ignored a couple of times and if you go up to 100 200, the problem is that the FMC still works but managing the FMC becomes a nightmare because it takes couple of minutes to to to move between pages cause it's overloaded from the traffic from the terminal server.22:36And we support only this terminal server solution at the moment. Now, integration with ICE, this is the biggest and most comprehensive integration that we have.22:56It gives you the most complete visibility on the network because ICE monitors the network in real time. Whenever you are using guys that does active authentication, you won't have problems with timeouts because disconnected users will be removed as ICE knows and update the info.23:14With ICE, you are having information from all network devices and collecting a lot of data regarding the points and the user connected. ICE shares that info with the FMC over and that is the only way we can learn mapping from ICE on the FMC. So.23:33And then the firewall management center shared the information with the firewall and policies. Traditionally, you would integrate directly the on premise FMC with the on premise fire eyes as big screen subscriber. We simplified the work configuration for the integration in the newer.23:51Version so you have there are two possible ways of integrate now you will see on the the on the FMC page that you have old and new configuration for this one. The benefit of doing it directly is that all the session remains on premises. You are in total.24:11Control of the info. You can use session directory topic, you can use a 60 topic, session directory is the place on eyes where all the info regarding session are stored. So the status, the type, the posture status etc. But you have a limitation. You can only have one cluster of eyes.24:31With the FMC, NO more than that. There is a new possibility and it is that the FMC joins grid cloud that is pretty much a Cisco catalytic center living in the cloud. And the benefit is that you can actually have multiple ICE clusters talking to the FMC and not only you have.24:51The feature with the session directory topic and topics, but you can also filter in the session directory using the CS doc, the dynamic attribute connector inside the FMC and decide what you can do with those info directly in the policy, so you have more flexibility.25:11The downside now is that you are literally sending all your information regarding session to the cloud. So it is something that needs to be evaluated. Eyes has different variants of identity and they are not all the same for the FMC and the firewalls. If you check.25:29In the session directory you can see different flavors of authentications. From second firewall perspective, we are interested in these four flavors and.25:49Pretty much show lies authentication will almost allies authentication will be in one of these categories. Depending on the category, you will have different attributes available. You might need or not realm, the mapping will have a different lifetime and or update capabilities. There might be intent.26:00Action between the authentication methods and there might be caveats that is important to know about. Okay.26:20Let's give, let's give them a look. The 1st one is the authentication with two.1x. The user has to exist in Active Directory or entry ID in the real on the FMC. If the user is there, you can really use without the group on the firewalls if it's.26:28It's not there as I said earlier, you will, you will not be able to use the information. You can get AST a location, a profile that you can all use in your ICP policy. The location will only be the IP of the switch or the WLC or remote access VPN ingress.26:48But it can still give you the possibility to have different policies depending if the user is connected to the main office or the branch office, e.g.. And 2nd category is the machine authentication cause the machine is also an accounting Active directory.27:07And the FMC has an issue with this one cause it cannot really resolve and parse groups on it, so you won't be able to match it to an active directory group to make policy. This is a limitation on the FMC. But you cannot use groups, but you can still use attributes.27:26Like SGT profile and location to make your policies.27:46We come then to the Mac authentication bypass, the so called map, and this is a kind of a special identity. You cannot really do anything with others with it because well, you really haven't a Mac address there to compare, but you can still use a.27:53SGT profile and location in your SAP if you want.28:12And for these three types of authentication, so for user authentication machine authentication and Mac authentication bypass, ICE will know when something is disconnected from network, so it will let the FMC know and the FMC will remove the user session by.28:18From the database, so these will update very quickly the correct enforcement of the rules.28:38There is also another consideration to do and it is that also the FMC has its own absolute and configurable timeout for a session. If that timeouts happened before a user really disconnect from the network, its binding binding will be removed and.28:45And the user won't match the correct policy anymore. So in these cases you need to be careful tweaking and setting the timeouts and configuring reauthentication on eyes to minimize the possibility of this event.29:04And the last one that we are going to check and the last bucket is the passive identity on ICE, you might remember that it was ice peak and it was sold previously. Icek as a standalone solution.29:20Is in end of sale, that means that we don't sell it anymore as ICE use case, but as a module, the, the passive agent is still part of ice, so the possibility is still part of ice. So if you have ice, you can configure and use it and you can use it to import the identity from.29:35API so you can actually code directly ICE to update an entity and you can use the passive agent to bring information to ICE. The FMC passive identity agent that we have seen earlier is pretty much the same code of the passive identity on on ICE. It pretty much just changes the.29:57Location where the guy will twise to that he's reporting to.30:15There is the same catch of everything and it is again that the user must exist on the FMC. The FMC must have synchronized with the realm cause if that user doesn't exist, the bind won't be really usable in rules. And again.30:23There will be the timeout issue cause it's possible the entity so the removal of the user IP mining is going to be timeout based. One benefit of this integration is that you will be able to use SGT as well.30:39Cause you will receive the information from ICE.30:59Now we are with problems that you you should be aware of for the interoperability of these things. The 1st one is that you might have problem in both cases where you are doing passive ID and machine authentication because if a machine authentication.31:06Happens while the user is still connected, it could overwrite the previous authentication and the user will start matching the wrong policy suddenly.31:26What you could do to prevent these is to separate with filters the network that do eight or two.1X with the networks where you are doing passive ID. And this is a possible way of how you can have this to get along.31:362nd problem here is if you are doing eap chaining, so if you are using both user and machine authentication to allow access to your network, there will be a problem because the FMC will receive both authentications together and will fail to look up in Active directory. It will break the group lookup.31:54In such cases, the workaround suggested is to use SGT. You don't have to do inline tagging if you don't want to, but you can still share the sgts and use them to implement your policy. And as a reminder.32:14SDT for all of those is a common denominator, so it would be as much for some cases and some problems and as summary things to take away from this part is that 1st ICE is an end of sale, so you still have it configurable.32:31As part of ice, but you cannot bite anymore as a single thing, that use mapping.32:50Of network to, is like passive ID and A to do one X if you are doing them both as authentication methods, then review real support and timeout behavior when you are choosing your identity sources, and finally consider using SGT to remove the dependency to group lookup.32:57If you are using it chaining machine authentication and similar.33:17And let's move to the last one on the possible authentication that is SGT. And it was probably easy to think about creating SGT as a network company. You can think about it as assigning different colors to different group and use color coding to abstract authorization policies.33:22So the base concept is easy behind the tagging, there might be complex authorization condition. It intends to make easily understandable the outcome of the authorization. So if you look at from distance, you can get with minimum effort, even if the complexity.33:43In the condition was alleviated, and from a network perspective is very intuitive and almost a natural way of looking at traffic because your packet has a number linked to it, it's bound inside it and it tells you immediately what was the group source and you can easily use it on switches WLCM.34:02A long list of network devices. It is very similar to concept now you are allowed to pass the gate because the system is reading the IP address and something else that is inherently bound to you.34:23And when you think about it from the firewall point of view, the management center has to learn the tag from ICE, so there is NO other way that you can get the mapping from anything else. On ICE side, you can assign the tag using the session topics. You can do it that for past.34:43Just radius. You can just attach tagging using authorization results.35:05And then you can use SXP flavors where you are sharing an info of IP to SGT binding and it can come from different sources like workloads in Azure VMware or the SXP infrastructure itself.35:11And additionally, you can read it on the network if you are enforcing, so if you have enabled trustec, the firewall can read it and can use it in policy, and now it can also reinsert it based on what it learned over PX grid.35:28There is one caveat. It's a very important distinction about what the firewall learns from the session directory topic and from the SXP topic that is often overlooked. There is a distinction between the source of the info. Whatever is originated from the session directory topic on the FMC.35:46Is subject to the, to a 24 h timeout and it is the gray part in the session directory there.36:05Then there is the green part that is actually the S6P topic, and the SXP will only be removed when eyes ask for it to be removed. It will never expire on the FMC, so remember, keep this in mind when you are designing this kind of authentication and identity.36:13And as let's say takeaways of this session, SGT abstract authorization into color coding group and in this case you use them, use six P mapping when you integrate if you need more deterministic binding that should not expire.36:33As 6 billion right now blends in firewall and ecosystem so it can be extended beyond multiple boundaries and now more easily. And.36:53Plus part, be aware that if you have a lot of very granular and specific rule in SCP based on AD groups with multiple user part of the same group but also another very selective group for other rules, then there are use cases where you will need an SGT per.37:04So this will increase the number exponentially, so there might be a problem in those cases.37:24And we have a quick demo just to show how SGT is working in real life. I have in this case a realm already configured on the FMC and from this real I'll be downloading the user and group that I'm using inside my policies and I have.37:32Integration with ICE and you will see that we have integration for all the new type, they are on the same page.37:52For the new one, you need to enable the portal on ICE and give to the FMC and admin user on ICE to allow you to configure the integration directly. I'm sharing both the topic and directory topic in this case. On the FMC, we have a policy identity policy and identity.38:00Policies trying to learn every identity on the traffic on the inside interface.38:20At the beginning of the demo, there is nothing on ICE, we have NO connection, NO sessions we have literally a clean sheet and in ICE policy we have authorization rules with result for employees.38:26And contractor with NSGT assign the to the result. So if you are part of an active directory group, you will get the profile result and.38:45Also an SGT attached to your authentication so you can literally use SGT and pass them to, to the firewall. Then we have the access control policy on the FMC and right now it's out of date, so I'm going to start deployment while it is.38:57Is loading, so I have a fresh start and updated condition. I can do my test properly and meanwhile it's loading the page.39:17These are the rules and they are configured with dynamic attributes and in dynamic attributes is literally the SGT tag that comes from ICE, and I've got some rule that will allow employees to go on internet, some rule that has SGT on sorts and SGT as destination for employees and.39:27It's going to development servers. In this case, the employees are something that is dynamically given. So you connect, you have an IP address and with that IP address you will get your identity, you will get the SGT tag from ice, etc. But I have the development server and just to show that.39:46It is also possible this one on ICE, I have a static meaning of an IP address to something that is the server, and so it's just to show that there is flexibility in the, in the configuration. Now I'm on I'll jump on a laptop and the laptop has again two network interfaces, one as.40:07Dot one X enabled and is also the network interface where there is the default gateway so all the traffic except the RDP is coming out from that one. And.40:26There will be an instant authentication on ice. My IP address is now 1921681 and two 218 and there is also an immediate login shared with the FMC and it's the 1st one. So the user is Alex Morgan and that is his IP address.40:38And, if we go and check the user can navigate, I'm just doing some traffic, so going to YouTube, opening Cisco sites not very fast with the lab. It does not that.40:58Get a connection at the moment. And then I'm opening a simple CMD to literally ping the development server, so I'm going to show that we are eating two different rules and yes, I'm able to ping, so I'm eating the the correct rule as it would be denied.41:12And if we go on the FMC and we check what are.41:31The the events at the moment, we are going to filter for source IP address, but pretty much you can filter for whatever you want it just to reduce the noise in, in the logs and we apply the search and we can see that we have traffic from that IP address. It's the user is that one, it's it.41:35In the navigational rule and the rule to allow employees to go to the development server and just to show it in the specific in this one there is the in most of the rules like navigation, there is just one SGT as the source because it can go everywhere, but there is this one where the rule was written with source and destination.41:55So something like more similar to the ideal metrics that you look when we disc when we talk about the security group tagging.42:16And we have finished with passive authentication, we are now going to switch to a second form authentication. 2nd form is active authentication, and inactive authentication, the user needs to do a direct authentication.42:27To the firewall and then the firewall eventually needs to check the provided identity credentials somewhere else. So actually it's the firewall that is allowing you to enter is the firewall that do does most of the job in this case.42:47In short, the user passes on the firewall to login, then the firewall goes directly to the store with credentials for verification, e.g., to Active directory or ldapter. If the user is authenticated correctly, it goes to the FMC cause as.43:03In previous cases, we need to check if the user is in the list and the FMC, the FMC has downloaded. So the FMC does its check and decorates the entry so it is usable for the firewall and then the firewall is the one that is allowing the traffic finally.43:23There are two main flavor of active authentication. The 1st one is the captive portal and we'll give a quick look at it because with captive portal, it is the firewall that intercepts the traffic and does.43:44The active authentication on the fly, and the user attempts to connect through the firewall with HTTP or HTTPS. The firewall intercept the traffic and these now needs to get interactive. If you want to do these for HTTPS, you need to do decryption.44:02If you don't want to do decryption, then you need to ensure that the user starts with plain HTTP, else the redirection won't work.44:22The user gets redirect to a page that is the firewall itself, and it's redirect to a URL that you have to configure. So in this case it always goes to HTTPS when you are redirect to that URL, so it's secure traffic. So since it's going.44:32Going to HTTPS, you need to ensure that certificates are trusted on the client and the DNS are matching correctly if you want these to work.44:51Then you do the authentication in the signing screen that the user receives, but you need to ensure that the traffic to the portal is allowed in the network policy. This traffic needs to be explicitly allowed in the SCP. This is in.45:04Most of cases that are open, this is one of the main.45:23Cause of problems cause traffic was not allowed. The firewall checks with the identity store. To communicate with the store, it's important to remember that any we store I mean LDAP active directory, everything that is going to be used as identity store. It will.45:27Will use the interface that it uses to communicate with the FMC. So if you configure management other management interface, it will use the management interface. If you have configured a data interface for the termination of the tunnel with the FMC, then.45:47And it will use that data interface to communicate also with that entity store.46:07And then we have the success, and then the firewall has tested you and find that the user given credential and now it's checked with the FMC so the FMC can again decorate with user group and mappings. So you really need again a round trip to the FMC.46:15For real cross check and user group assignment.46:35The session are removed based on time out on the realm, so there is NO other way to remove the session, so you need to remember these when you are thinking about this kind of identity solution.46:39And as captive portal takeaways, you can redirect user HTTP request to a captive portal. If you do HTTPS, it requires TLS decryption. You need to ensure that the user laptop.46:56Is trusting the captive portal certificate. You need to set the correct DNS entries for the captive portal URLs and you need to permit the traffic in the firewall policy, the traffic to the captive portal.47:122nd wave of active authentication is remote access VPN as we have a session on remote access VPN and it's a very well known case. I'm going to fly through it. This is a pretty common and well used known case.47:30The only thing that needs to be probably stated again is that there is a lookup to the FMC and the FMC must have downloaded the user in the list of user and group from Active directory. So for the authentication to success and policy enforcement, again, you need the round trip to the FMC.47:45These are the consideration for the remote access VPN I'm leaving it here as let's say something to remember when if you're going to review the session and if you need might be interesting and again 1st time user connection requires a round trip to the FMC.48:07This is the table that I have said at the beginning of the session. So you have the various identity sources, you have a table that reports what are the attributes that you can use in your policy and you have a column that is showing you what is the.48:24Removal of the session method or what are the possibility or how it will happen. You can review this table when you are designing identity policies. It's going to make it easier.48:44And all that we have discussed until now was IP based. Everything was based on a mapping between IP and user made somewhere else and the firewall was trusting the mapping. Now this is where zero trust position itself. I'm going to give a quick.48:58Idea of identity with ZTNA then you will see ZTNA in the next sessions.49:18In this one, you are not only checking the IP, you are checking the driver because you gave a cookie to the driver and you could also do some extra check on the car. So this is more interesting, it's nicer, but this comes at the cost of resources. The more.49:26Strict and granular you wanna be the more you pay in resources and complexity. So it is challenging to install and maintain.49:45And the 1st example is the clientless application zero trust. This has actually been done by Luca in his session, that is the next one. So I will just refer you to Luca presentation on the subject. I will leave the slide for let's say as a reminder or as a map, but I will just give you.49:54The takeaways of this kind of ZTNA. In this one the takeaways is something that is browser based and it allows you access to an application. So you don't need an agent and it just protects and protects an application. It reduced the attack surface by enforce.50:13Processing the bare application security control and it works on HTTPS only. You are actually leveraging on SAML SSO for application with the common IDP.50:33This traffic is not subject to access control policy. It's something that lives in a totally separated universe on the firewall, so you're actually not influenced by the access control policy, and it has a throughput that is limited by the firewall decryption capacity because actually you are decrypting all the traffic.50:452nd source of ZTNA for identity is the universal ZTNA. In this case I'll discuss a little bit more. I'll give you some more information. It leverage on secure access solution, not on the.51:06Firewalls configuration, when you have a client connecting to secure access but with universal ZTNA, you can configure a common policy between secure access and secure firewall. It is configured on secure access and.51:24Pushed to the firewall and you have two flows available when a client's connect. The 1st flow goes to your internal resource passing through the cloud and that might be optimized for performances and scalability. 2nd flow passed.51:40Is through the firewall and you might have an application or something, a resource that you don't want to expose or make it reachable to a cloud service. And for that one, you could choose to pass all through the on premise firewall, and that is the private only flow in green in the slide.52:00The connection for that one will only and always pass through your firewall, doesn't matter where it started from. In this case, there will be a micro tunnel that will be terminated and allowed on the fly on the firewall.52:21If you want to look at it from a summary slide point of view on the firewall, you have the SCP that is managed by the FMC, you got VPN, and in that case you might still also be under SCP. You got the clientless clientless security TNA.52:38That Luca will show later that is still managed and configured on the SMC, but it's not part of the SCP, and then finally we have the universal ZTNA that is totally managed from secure access on the security cloud control. It's important to understand that it's a separated.52:58Part because it will take resources on the device and you might not know it might not be really easy to, for you to understand it but consider it as the key takeaways and for the universal DTNA remember that.53:18Is the firewall is doing enforcement of a secure a secure micro tunnel. So it's a secure tunnel termination point for the private access, the TNA. It's all configured on secure access so everything will be controlled from secure access. It will.53:37To be valid for on premises and roaming user and very important thing, as I said, it's going to take resources. So when you configure on secure access, it's going to go on your firewall and take dedicated CPU cores away from your firewall for that feature. So you are actually performance.53:57It's impacted.54:17If you are close to limit of the firewall. And as a final slide, I'm going to leave you with the table that is comparing identity source from two different perspective. One is, is a deployment, 2nd is accuracy and the 3rd one, the third's key point is a scale and performance impact.54:18There is NO way that you will be able to something that is easy, accurate, very accurate, so very granular and will scale well, so choose wisely when you are designing your identity solution. And with that one, pretty much.54:38My, presentation has ended. We'll probably have a short break and then we'll go on with the next presentation. Thanks Jacob. Okay.54:57I think we are good to go. And good morning, everyone. Again, welcome to this session. My name is Luca and I'm part of the adoption team, security adoption team in Cisco, and today for this, for this session, we will discuss about.55:12Remote access VPN and the zero trust access policy. You can see the agenda in the slide, so we will start with a brief overview of comparison between the two use cases and then for each of them, we will go through a overview and some configuration steps. I have also included some.55:32Demos so during so that you will have a need for reference as everything will be shared with you like the recordings, the powerpoints, and so on.55:52All right, so let's start with the key architectural differences between the remote access VPN and the zero trust access policy. When we talk about remote access and secure firewall, there are two different approaches. The 1st is the remote access VPN, which is a network centric model.56:05This approach has been the industry standard for years.56:25And the idea is that we have a user, the user authenticates and gain access to the network, to the entire subnets and internal resources according to the assigned group policy. 2nd option is the zero trust access, which is an application centric model.56:29Rather than opening the door to the whole network, the zero trust access policy grants access only to specific application the user needs. Throughout the session I'm going to cover both the use cases and including the configuration steps which I have prepared for you.56:48Let's start with the remote access VPN. So we have a remote user working from home or any remote location and the user needs access to internal corporate resources over the public internet. The the remote user will initiate the connections to the firewall by either.57:08SLTLS or IPsec protocols.57:27The user will verify the server certificates and then the user will be prompt for authentication. Upon authentication, the user will be assigned with a group policy and it will get access to the internal applications. And the goal for this demo is to show you how this dynamic, this group policy.57:30Can be dynamically assigned depending on the user identity.57:50So very high level, we have three main components for the remote access VPN, we have the server, which is the the Cisco secure firewall, which can run either ASA or FTD code. We have the VPN client, which is the Cisco secure client and we need to plan some licenses.57:54For this use case. About the Cisco secure firewall portfolio, the hardware portfolio, and this is just the reference slides, all the platforms you can, you can see here they can run ASA or FTD, and I have highlighted here the two main metrics to look at when they signing the remote access VPN solution.58:13So the maximum number of VPN peers which can connect simultaneously.58:33And the VPN throughput, the, the, the bandwidth that can be shared between the clients. The same thing but for the virtual firewalls, the, the VMs, just keep in mind that you need to use the data sheets and you always need to double check the data sheets when doing this kind of design.58:38And this number may differ depending on the hypervisor. Second main component is the Cisco secure client. This is the, this is the software component which needs to be installed on the remote users device. And this modular.58:58It can be used for different use cases such as malware protection, posture assessment, and DNS protection. And when it comes to remote access VPN it allows the users to connect via SSL or IPsec for, for the tunnel establishments.59:18And last but not least we have licenses options here. We have three buyers available. The 1st is the VPN only licenses, which include basic connectivity, basic VPN connectivity only.59:35Those licenses are perpetual and they are ideal for organization with an unpredictable number of connected users. So e.g., if you have 1000 users in your org, but only 100 of them are connecting simultaneously, you might need to consider these VPN only licenses for, for this scenario.59:52Advantage and Premier, they include more features and they are subscriptions based and counted for unique users. If we want, e.g., the secure client to work along along with umbrella or secure endpoint, we need to purchase either advantage or premiere.01:00:12And Premier covers all advantage features plus posture SAML authentication and management for the VPN tunnel. Okay, this was a quick overview. Let's now take a look at the workflow and the protocols for the remote access VPN.01:00:29This is a step by step flow on how the, the flow, the the connectivity is performed. So the user will initiate a VPN connection. Step number two, the user will come, will select the active connections profile and will perform authentication and the authentic.01:00:47Authentication methods includes radius, LDAP, SAML.01:01:06Or identity certificate from the client, once the user authenticates, the FTD will apply a specific group policy based on the identity of the user. And it is a best practice to dynamically assign the group policy depending on the authentication result.01:01:10And once the group policy is assigned, the VPN traffic needs to be controlled either explicitly via an access control policy or bypassing this traffic, this encrypted traffic because we consider it as trust. Speeding of the of the protocols.01:01:29When we refer to SSL, we actually means TLS or dynamic TLS. When using TLS, the client and the VPN server will perform a TLS and shake establishing the secure connection, the endshake will include the certificate validation for the server, the cipher nego.01:01:50Association and the key exchange and also the the session key creation.01:02:09For for the session. For 2nd option is IPsec, which is a framework which includes Ike V two and ESP. So IP two is responsible for creating the management panel, so that means it is responsible.01:02:14For peers authentication, the negotiation of the security policy and cryptography parameters.01:02:34And for generating and exchanging the session key, so IP two does not directly encrypt the user traffic but it defines how the traffic will be protected. ESP is the encapsulation method and it's actually the it is actually responsible for protecting the data traffic.01:02:42These services, the DSP services include the encryption and confidentiality and also data authentication. So the logic here is that with two, we negotiate the tunnel parameters and then with ESP, we apply the protections for the data traffic.01:03:05All right, so let's jump into the configuration. The remote access configuration can be quite challenging and there are some, there are many steps involved. So, in these slides I have prepared I have included some prerequisites that we need to take off before actually performing the, the.01:03:21Set up wizard.01:03:41And specifically we need to generate an identity certificate for the VPN gateway for for the firewall, create a user database for the authentication on the FMC, upload the Cisco secure client packages on the VPN gateway and create a pool of IP addresses to.01:03:42To used for the remote clients. Now I'm going to show you now some demo on how to perform some of these prerequisites and the 1st one is going to be the FTD identity certificate enrollment. So let me switch to my player.01:04:02And this is it. So this is my FMC and we want to create an identity certificate for, for the VPN. This identity certificate for, for the firewall, this identity certificate will be validated by the remote users connecting to the remote access VPN services. I will navigate to the certificates.01:04:22And I will go and add a new object. Select the device and choose a certificate enrollment method. We have different option. For this demo, I will choose the manual.01:04:40Enrollment type and when choosing manual we have the options to customize the certificate parameters which the identity certificate will include.01:04:57For my example, I have my common name being a VPN.my domain and I will have to go.01:05:15And past here the root CA certificate from my CA, right? So I have an internal active directory having the certificate services. I will go and download the root CA and this root CA certificate.01:05:31That will copy and paste directly into the configuration.01:05:51So I will copy and paste it here and click on save. So doing that will not create the identity certificate. It will rather create a trust point on the FMC.01:05:57And once the trust point creation is done, we have the options to go and import an MC certificate. Specifically we have the options to generate a certificate signing request directly from the FMC. So we click on yes.01:06:13And I will copy and paste the CSR into my Active Directory certificate services. So I will go request a new certificate. Choose a web server certificate template.01:06:31For the FTD, copy the CSR and click on submit. I will download the certificate and upload the file.01:06:51Into the into the wizard, right? And this will allow me to perform the the FTD identity certificate enrollment. Okay, as you can see here, I have all my details and this certificate will be later be used during the remote access VPN configuration.01:07:06Now 2nd demo, the the for 2nd demo, I told you how it is important to have a user repository configured on the FMC. Yakab already introduced about the real. So in this video I'm going to show you how to configure an active directory integration between the secure firewall.01:07:26And my AD. So I will click on realm in the integration and add a new realm. So provide the name, the domain, and a user which will be used to retrieve the users and the groups from my.01:07:44Directory. Now from the base DN and the group distinguished name, I will navigate to my active directory and in my root domain object, I will click on properties, go to the attribute editor and copy and paste the.01:08:04Distinguished name for my root domain, ok? I have in my lab cisco.com as a domain and copy and paste this value here at this point.01:08:20I need connectivity to my AD server, so I will put the IP address, the protocol LDAP, and the interface which needs to be communicating with, with the active directory.01:08:37I already have this object configured, so once we have it, we just need to go and download the users synchronize the users and the groups into the FMC, ok? So really straightforward. And once we have.01:08:54We will have all the users synchronized. That's perfect. Let's resume now the presentation. By the way, all these videos will be available for you later on, and connection profiles and group.01:09:10Policy, this is the next the next topics. So we have configured the prerequisites and now there are two concepts to understand connections profiles and group policy. The connections profiles, they define how to connect and authenticate to the VPN.01:09:30So they include information such as the authentication method, the the group policy and the default IP address pool. The group policy on the other hand, they define the specific access and the authorization for each group or for each user or group of users.01:09:50The recommendation here is to dynamically assign the group policy as part of the authentication methods response, ok? So if we are using LDAP radius or SAML, we will get a response from the server and some attributes included in this response.01:10:05And these attributes will need to be used to dynamically assign the group policy. Let's say we have a user belonging to the contractor group. We want the user to authenticate and then we want the user to have the contractor group policy assigned to it because we want the user only to have access to specific resource.01:10:25Also starting from version seven.seven, we introduced a native geolocation based restriction features for the remote access VPN, which allows administrators to block or allow VPN connections attempts by country or.01:10:45Region. This is simple but powerful and it's a way to reduce the attack service and meet the compliance requirements. Okay so we say how important is to dynamically enforce the group policy. So let's start to see how we.01:11:02It works when we have LDAP authentication methods so active directory. At a very egg level, step number one, the user will authenticate, will start the the connection. Step number two, the FTD will select the active connections profile. Now step number three.01:11:22Depending on the authentication method, the FTD will apply will will apply specific group policy depending on the identity. So there is a feature called LDAP attribute match in the remote access VPN configuration, which will allow us to map the LDAP response attributes to the Cisco group policy.01:11:41Okay and this is what I'm going to show you in the next demo.01:12:01And number four, step number four, we also need to control the traffic. All right, so configuration demo, I will share and start again, ok? This is my demo demo number three and let's now go and do a remote access VPN setup wizard. Let's create and add a new.01:12:05New one?01:12:25I will name it remote access VPN LDAP dynamic. Select the device and here I can select the VPN protocols. I will leave both SSL and IPsec. Now, this is the connections profile I already discussed with you. Authentication methods we will choose active directory.01:12:29And the configurable map is the blue options you see on the screen, and we'll talk about it in a while. I will choose a default address pool for my user and group policy. Now we already said the group policy are important. They define how and which resources the.01:12:48The the the users will will be ready to access. For this demo specifically.01:13:08And this is the best practice. I'm going to create three different group policy. The 1st group policy I will name it access denied. Why? Because I want by default, my users not to have access if they are not part of specific active directory groups.01:13:13So by default, the access denies group policy will be applied to any remote access VPN connection, and I will do that by put the timers to the simultaneously login per user parameters to zero. Then I'm going to create two group policy.01:13:32One for my TAC group in Active directory. I will name it TAC group policy, assign an IP address pool for the TAC users, a banner, so welcome to the TAC group policy.01:13:47A DNS server configuration for the connected users and the split tunneling policy. The split tunneling policy will decide which traffic will be going through the tunnel, and this is managed by ACLs. So what I'm saying here is that I want my TAC users.01:14:07To be able to access my ICE instance, which I have in my data center and regarding the DNS request, I want to send through the tunnel only the DNS request for my, for my domain.01:14:26So this is the group policy for the users. 2nd one is going to be for the contractors, very similar contractor group policy. They will have a different address pool, different configuration, but the interesting part is about the split tunneling here. Now I want my contractor users to have a.01:14:37Access to a custom application named application one app one.01:14:57Okay, so by default, again, I will choose access denied as the group policy for this connections profile, and now it's time to configure the LDAP attribute map. So I choose LDAP active Directory as the user repository. So now what I'm saying here is that.01:15:08I want the, LDAP attribute member off to dynamically be mapped to the Cisco group policy, ok? And specifically I need to put here the value. So here is my active directory where I have two different user.01:15:28One user, the user Luca is member of the tag group. So for this specific active directory tag group, I will go and pick the distinguished name and copy this distinguished name within.01:15:48The FMC. So, as soon as the FM as soon as the firewall will see this attribute value from LDAP response of tag group, it needs to be mapped to Cisco attribute value of tag group policy.01:16:05Same I will do for contractors. I have a second user, which is part Lorenza is part, is a member of the contractor group in Active directory.01:16:22So I will go and copy.01:16:41The attributes value for a lot and map it to the Cisco contractor group policy group policy which I have created, ok? And I will click on next. I will select the secure client image, the interface or security zone.01:16:43Where I want to enable the service. The identity certificate, this is the certificate I have created before, the identity certificate for the the for the FTD, for the gateway, and I will choose to bypass the the the traffic, ok? The the decrypted traffic.01:17:03All right, so I have now, my wizard configured, I will deploy, and just to repeat what we, what we did.01:17:20We have created a LDAP attribute map saying that every time a LDAP attribute name member off is part of the response. We want to match this value to a specific Cisco group policy, ok?01:17:36So the deployment is completed and now it's time to test. I will connect to the FTD CLI as well, switch to the system support diagnostic CLI, and this is my remote user, ok? So the remote user will.01:18:02Start the Cisco secure client package.01:18:23Point to the SQDN of my VPN gateway, click on connect, and here we select the connections profile and we insert the username and the password. This is an active Directory username. So Luca, if you remember, he was part of the tag group and this is why we get.01:18:25The banner, welcome to the tag group policy.01:18:45And the connections will be established for the user Luca, ok? Now, if you remember the user Luca had access to ICE, and this is why if I try to access my eyes.01:18:53I do have access, but if I try to access the application, the custom application named app one, this is not part of this policy for TAC users, and this is why we don't get any access. In the FDD CLI, we can also type the command show VPN session.01:19:11DB, any connect and see that for the user named Luca, we have the tag group policy which was dynamically assigned, ok? The same thing we.01:19:29Can do with the user Lorenzo just to show you how this is done dynamically. So Lorenzo will try to authenticate.01:19:49Very quickly, it will get a different banner because it's part of the different group policy and it will be authenticated. Lorenzo did not have access because she's part of the contractor group. She does not have access to ICE. Rather she have access to the custom application named up one.01:19:56Okay? And from the FTD CLI, again, I can see that for the user Lorenza, the group policy contractor group policy was dynamically assigned. Okay, in the FMC GUI.01:20:15I also have the options to go to the remote access VPN dashboard, and from here I can see all the authenticated user and the informations about the connections profile and the group policy assigned to them. Okay, jump back to the slide.01:20:30And now, this use case was for I I just showed you was for Active directory. I just want to show you now how to do the same thing but using SAML as the authentication method.01:20:47So step one and step two, the user authenticate to the to the user will initiate the connection. Step two, the user this time it will be redirected to the configured SAML identity provider. In the later demo, I'm going to use Duo as the SAML identity provider, and once authenticated.01:21:07Duo will response with a signed SAML security assertion to the FTD containing the authentication results and the authentication attributes. Now, the FTD will then apply a specific group policy dynamically again depending on the.01:21:28The Dynamic access policy. So the dynamic access policy is a policy configurable in the FMC, which allows us to map the attributes from the summary response to Cisco specific attributes, ok? And this can be done dynamically. And then of course we need to control the traffic.01:21:47Let's jump again to the demo demo number four and this time I want to show you how to perform the dynamic group policy assignment for the remote access VPN by using SAML as the as the authentication methods.01:22:08Okay, this is demo number three demo number four. Okay, so again I will go and create a new remote access VPN policy wizards. I will provide the name. This time we will use SAML, select the device.01:22:24Click next and select SAML as the authentication method. Now, we need to create a new object, which is the authentication server, the, the single sign on server, and as I'm using Duo as the identity SAML identity provider, I need to insert here some informations.01:22:40Which I can retrieve from my dual admin panel, ok? So this is my dual admin panel. I'm going to go and protect a new application in Duo, and these applications will be my remote access VPN.01:22:59For SAML. Performing the SAML integration means basically perform a SAML metadata exchange. So I will go and copy and paste the entity ID.01:23:15The SSO URL, the logout URL, and also put my base URL for, for, for the connection, ok? So this will be the base URL where the user will be redirected to. And then upload the identity provider's certificate.01:23:31Which again, I'm going to download from, from duo, from my identity certificate. We can also use other identity provider, 3rd party, entry ID or or or whatever. And here is where we go and upload the dual identity certificates, ok? So the FMC.01:23:49Will allow me to create a new object and click on save. Now, some login experience for the user, I will leave the default operating system browser, IP address pool assignment, and group policy.01:24:08Again, here, as I did before for Active directory, I'm going to create two group policy for my contractors and the tag users but it is important that the group policy, which I'm going to create.01:24:29They need to have the same name of the Active directory group the users are a member of, ok? So I have the GP minus tuck GP minus contractor in my example. I'm going to create two group policy GP minus stack. Before we already see.01:24:48How to create a group Policy users they have access to, I want them to have access to my ICE instance. And for contractor.01:25:04Same thing, but they want them to have access to the application name application one, app one. Okay, I will select the secure client image, click on next.01:25:20The security zone, the device certificate, the identity certificate for the FTD, and they will choose to bypass the access control policy for the decrypted traffic. Okay so so far so good.01:25:42This was the easiest part. I will click on deploy and now I need to complete the configurations from the dual side, ok? So for that, I need to retrieve from my FTD some configuration.01:26:00Questions parameters and that's why you need to go on the FTD CLI, switch to the system support diagnostic CLI and put the command show SAML metadata and the name of the two the of the tunnel group, which is my connections profile, ok? Why? As soon as I put this command and click on enter.01:26:20I will have here some, I would say configurations parameters, so the entity ID, which I need to copy from my FTD CLI and copy into the dual admin panel configuration.01:26:39Same as for the ACS assertions consumer services URL. So this step is required to complete the configurations on the duo side. Plus on the duo side, I need to go and instruct my duo.01:26:56To send the attribute member off as part of the SAML authentication response, ok? So in my door I need to say include the attribute member off as part of the response and map these attributes to a SAML response attributes. Now this response are.01:27:11Attributes, attributes, sorry, I can retrieve it from the dynamic access policy which I have discussed before. The dynamic access policy, I can click on and create a new one. And again, the idea for the dynamic access policy in the FMC is to dynamically assign.01:27:31A group policy to to the authenticated users for this scenario, right? So I will go and create a.a dynamic access policy and a new that record and specifically, but what I'm saying here is that.01:27:50Under SAML criteria, I want the attribute ID which will be part of my SAML response to be mapped to a specific value, ok? So this is the attribute I need to put into my dual admin panel.01:28:09Basically, again, what I'm saying here is that I want to match the value of the attribute member off to the Cisco group policy attribute. So I want to match their values in the response. And this is from the dual side, ok?01:28:27Oh, from the dual side I am ready to go and save, and in my FMC, once I get this attributes.01:28:46In the SAML response, I need to match this attribute, the attribute value, of course, to the group policy which I have created. So I will put two values here, the Cisco group policy equal to the the group policy named.01:29:04GP minus stock and GP minus contractor, ok? And once I do it, I will go back to remote access VPN wizard and link the dynamic access policy within the remote access VPN.01:29:23I also need to go to advanced and include under group policies, the group policy which will be dynamically assigned. This configuration can look tricky, but now we will get, now we will see how it directs and it will be more clear.01:29:42During during the test.01:30:02And of course this duo identity provider is out of the scope, I just want to include it for for you to have as a reference in case you will leave, you will have to use Duo as the SAML identity provider.01:30:05So I have my policy configured.01:30:25And what I'm saying again, just to do a summary of the configuration, I'm choosing SAML as the authentication method. I have created an authentication server and by default.01:30:31There will be my default group policy, ok? By default. Now, I also want to dynamically assign the group policy to the authenticated users. So I'm going to create a.policy and the new that record where I'm going to say.01:30:48If you see the Cisco group policy attribute as part of the summary response map the value of this attribute to a specific group policy, ok? So in my case GP minus contractor or GP minus stack.01:31:04All right, so the deployment is completed. Now it's time to test. I am a remote users. I will try with Luca 1st. I will connect to the VPN gateway. I will start the VPN connection, remote access VPN connection.01:31:28The user will be redirected to the SAML identity provider to the dual for the authentication. The user will authenticate with the username and the password, and the user will also be enforced for the two factor authentication. In my case using the.01:31:49The do a push, ok? The user will approve the push on the mobile device and as soon as the authentication is completed, you see, he will get the, the banner welcome to the tag group policy.01:32:09Click on accept and the connections will be established. So Luca which is part of the tag group dynamically was assigned to the tag group policy, and as you can see from the debug.01:32:26I have here evaluating the SAML attribute pair, so this attribute pair, Cisco group policy was part of the response, the value was GP minus stack and GP minus stuck is a valid group policy in my FMC.01:32:43Okay, this is why I can see the username Luca having access to having the assigned with the GP minus back group policy. And the user had access to ICE.01:32:59But the user does not have access to the application one because of the split tunneling policy. We can do the same for the user Lorenza, ok? So when a different user which is part of the different active directory group will try to authenticate.01:33:17She's part of the contractor, she will be enforced with the two FA and as soon as we'll be done, done the she will be assigned with the banner she will be prompt with the welcome to the contractor group policy, of course dynamically, right?01:33:39And from the log we can see that the GP minus contractor value returned by the sample response is a valid group policy, and this is because we configured a dynamic dynamic access policy in the FMC.01:33:57And also I can see that the user was dynamically assigned with the group policy. The user does not have access to ice, but this time it has access to app one.01:34:16And this is all for now, this was the last demo. Let's have the 5 min break so David, if you can put the timer and then we will go with the zero trust access policy. Alright.01:34:33So let's continue with discussing now the zero trust access policy and let's start with an overview. Starting from seven.four release of FTD software, Cisco introduced the zero trust clientless access and the idea is.01:34:53That's simple. So the remote users.01:35:13Can now access internal web applications without having a client installed on their remote device. So the zero trust access allows us to implement the least privileged model, which means that NO access to the internal resources will be granted unless it explicitly defined.01:35:16This is the idea. What are the requirements and what is the solution? Let's think about a use case. We want to enable contractors and partners to access a few web applications without requiring any additional software on their personal devices.01:35:36With ZTA we can now provide the clientless access, including pair application access, FTD advanced inspections capabilities so we can keep on enforcing intrusion prevention, file and malware prevention, everything along with TLS decryption and.01:35:54No additional network equipment is needed because the only FTD.01:36:14Is enough. This feature does not require any additional license. It only requires the smart licensing to be active. And if you want, of course, if you want to inspect the traffic for intrusion or file and malware, the threat license.01:36:18Is required.01:36:38Let's now have a look at how it works. So we have a remote user, and the user will type the URL of the application in the browser and the DNS request will need to be resolved to the firewall outside interface.01:36:41The user is connecting from an external, from a remote location.01:37:01Once the user connect to the firewall, the firewall will redirect the users to the SAML identity provider for authentication and authorization. So again, SAML is included in this in this flow. The SAML identity provider will request the user credentials perform MFA and eventually.01:37:08Actually posture assessment and if the authentications will be successful, the clients redirect back to the firewall with a message holding the SAML security assertion. The firewall will verify the SAML response provided by the client.01:37:27And if accepted, it will respond with a ZTA cookie, which allows the client to access the protected applications. We need to remember that the STD will decrypt all the packets in order to protect the internal applications along with snort. So.01:37:46TLS decryption.01:38:07It's required for this use case. Let's now take a look at the configuration demo and let's start. So I will go to policies and zero trust application.01:38:08We are going to cover the clientless one and remember the clientless is only valid for web applications running over HTTPS. So we have a nice reference diagram in the top of the configuration page and what we need to put is a name.01:38:30The domain name, for, for, for, for that needs to be resolved by the DNS gateway and by the DNS server, sorry, and the identity certificates for, for, for the protected applications. Now.01:38:48These identity certificates must be a wildcard or sun certificate which will includes the FQDN of all the protected applications, ok? So in the subject alternative name fields, it must includes all the protected applications or it must be a wildcard. In my.01:39:05Case I have a certificate.01:39:25Which is a wildcard certificate for my domain. So you can see in the subject in the common name I have a nasterisks as well as the subject alternative names. I have my my domain with a wildcard, and this was issued by my internal.01:39:27Certificate authority. I have the certificate and the private key. So here I'm going to click on add and add a new object. Similar as I showed you before, we will provide a name.01:39:47Choose an enrollment type. In my case is manual because I already have this option and I don't want to generate a CSR as I did before because I already have the certificate, so I will just open the certificate content, check the flag CA only and paste the CA certificates.01:40:05This is how I create an object for my wildcard certificate, which I already have it here. You can see the certificates in the certificate list.01:40:24Okay, and from the dropdown menu, I will select the certificate and move on with the configuration. The security zone, this is where I put the security zones where my clients are connecting from, in my case is the outside zone. And this is the global port pool.01:40:40So every applications, every application will be assigned to a specific port. So the FMC comes with a pre configured port range for, for each application, ok?01:41:00And for the security controls, this section is optional, but this is where I want to instruct my to use the intrusion policy or the my malware and file, e.g.. Okay, so now.01:41:12I have the options to either add an application group or a standalone application. The difference is that all the applications belonging to a group, will be authorized with single sign on. So I will connect only to one application and then if I will navigate to a different application who.01:41:28Within the same group, I will be automatically authorized.01:41:48I will go with a group because I have two applications I want to show you how to protect. So we'll give a group name and here is where I will perform the integrations with the identity provider. So as usual I have my duo here.01:41:53I'm going to protect an application. Generic AML service provider.01:42:10And here I will put the name.01:42:30And the service provider mandatory field, the entity ID and the ACS URL for my service provider, which I can retrieve from the FMC. During the configurations, I will be provided with these two piece of information.01:42:40So we'll copy and paste and click on save, and with the configuration on the FMC we'll click.01:42:58Next and do the same for the identity provider this time. So in my configured application I will need to copy paste the entity ID, the single sign on URL similar as we did before, so I will skip this part, just a matter of copy and paste.01:43:18And upload the IDP certificate into the FMC, ok? Okay, so this is how I configure the application group. Click on next. Re authentication interval is the timer.01:43:33For my users and for the security controls I can choose to inherit from the parent group policy, ok? So everything will be inherited from the previous configuration. And doing so, I have created my application group. I will click on save.01:43:50I will choose my FDD as policy assignment, and now it's time to add web applications into the group. So I will click on be before doing that.01:44:07Before doing that, now I have created a group, but I want only specific group to access these applications, ok? My dual instance here, it is integrated with my active directory and for this specific applications group, I want only the users belonging to the task.01:44:30Group in my active directory to be able to access this applications group. And this is something I.01:44:49Configure from the dual side, ok? And once I configure the dual site, I'm ready to add new applications into my, into my configuration. So 1st application is going to be ICE. The external URL is the URL that my clients will be typing to access these specific applications as well.01:44:56We already mentioned that FQDN needs to be resolved by the DNS, by the public DNS, and also the the applications will also have an internal DNS an internal URL, which means the FTD must be able to resolve.01:45:16Via the the the DNS server configured within the FTD. Now for application certificate here, this is the certificate which will be used for the TLS decryptions. I mentioned in the presentations that TLS decryptions is required for this use case.01:45:34And if you are familiar with the TLS decryptions, it's basically a way we can decrypt encrypted traffic, and for that to be performed, we need to add the certificate used by the the the applications along with the private key.01:45:51Okay, so the same certificate which is installed on my application servers, it needs to be uploaded into the FMC along with the private key, ok? So I will upload the certificate.01:46:09And the private key and this is how I create a new certificate object used for the TLS decryption.01:46:25I will select this object from the dropdown menu. I will then choose the applications group where I want to put this specific web application. I will not perform source network address translation and click on next.01:46:44And click on finish. So this is how I had my 1st web applications to the group. I will do the same for, my custom web application named.01:46:59Up one, so I will put the external URL, the application certificate is the same because this is a wildcard certificate if you remember, and click on finish.01:47:18I will save and deploy the configuration. So I have created this policy. I have created an application group and I have put two applications within this group and from the.01:47:36Dual admin panel from the IDP side, if you remember, I have said that I want only my users belonging to the tag group to be able to access these specific applications. Now, this is my contractor, ok? So I have a contractor which remotely.01:47:57Wants to access, e.g., my ICE instance.01:48:17And the resolutions if you see here for the external URL, the external SQDN, for both the application ICE and app one, the resolutions must must be resolved to the outside interface of my firewall, so the IP address you see here.01:48:21Is the same I have for my firewall outside interface and they want to show you that so outside interface I have this IP address. So that means the connections will be going to the outside interface of the FTD.01:48:39As soon as the user will try to connect. And now let's test. I am a contractor, I am connecting from a remote location and I want to access ICE and internal applications for, for the company. As soon as you click on the ICE external.01:48:58FQDN as I select, I will be prompt for the authentication. I will try to access as a user Luca, which is part of the tag group, if you remember, ok? So Luca will access via the email address.01:49:18Put the password. Luca will be asked for dual push, and Luca will be.01:49:37Authenticated to access the web applications as you can see here, I have the user accessing the web applications over the external URL and one of the, and the port number which is part of the port group ranges.01:49:54Which I choose during the configuration. Okay, this is ICE yes, and the same thing I can do.01:50:11If the user will try to access an application which is part of the same application group in the ZTA policy, with the single sign on, it will behave, the user will be able to access the the application, ok? Because they are part of the same group. So the firepower has the the the the token configured for.01:50:29Both the authentication token kept for both. Now let's try to do the same, but with a user.01:50:49Which is not part of the group of the permitted group that we selected in the in the duo. So the user Lorenza is not part of the tag group in Active directory. And as soon as the users will try to authenticate.01:50:55Duo, so the SAML identity provider will stop and deny the access to the user. That is denied. Your duo account does not have access to this application and the reason is that on the dual side.01:51:13I enabled only the application group to be accessible for the from the users from the tag group, ok? And this is why we don't have it anymore. Okay, so that's all for my part. Let's just.01:51:36Do a quick summary, a different listing the difference between the ZTA and the clients based remote access VPN. So it is worth mentioning that the clientless access supports only web applications, so HTTPS applications.01:51:52No client device posture verification is included except if there is a dual health, so a mechanism provided by the dual identity provider and NO IP address will be assigned to the client device because everything is.01:52:12Occurring in the web via the browser, ok? So this zero trust access is useful for contractors or partner which needs to have access to applications without having a software installed. And with that, I will stop sharing and we will have a 15 min break.01:52:27Hi hi everyone. So now we'll talk about site to site VPNs. So for the agenda, for the site to site topic, we'll give an overview of VPNs and when why and how.01:52:51You might use them.01:53:11There are a few different support site to site VPN types that can be configured, which each should have slightly different use cases. We'll then discuss policy based VPNs and also show a demo. We'll also discuss virtual tunnel interfaces or vtis for sure, which are an important concept, one of the other supported VPN types.01:53:12Which is route based VPNs.01:53:32We'll then dive into more detail around route based VPNs, and again, I'll show configuration demo. We'll also discuss dynamic virtual tunnel interfaces or dvtis, which are used in hub and spoke topologies. After this, we'll discuss one of the other support VPN types, SD WAN VPN.01:53:35And how we can utilize the wizard to make configuration at scale more simple and quicker. Then lastly, we finished the session with further details around other useful resources that you can use to drinken your security posture.01:53:54Okay before I start with the VPN technology overview, I've brought up a Slido which has options for future topics we're considering talking about in future sessions.01:54:12There's eight options on there, so please vote for the ones you'd like to see. There's NO limitations on the number you can select, so you can select one or select all eight or and then we'll collate them and do consider what we'll put into the future sessions.01:54:27So, with that, let's do a brief technology overview. So when we talk about VPNs, we often refer to the underlay and overlay network, and the underlay network is the network that is used as a transport for VPN packets. And typically this is over a.01:54:43Networks versus the internet. The overlay network is our private network that is built on top of the underlay and is where we want to protect the data that's sent across the underlay using confidentiality, integrity, and authentication protections. RFC 2828 further defines the VPN.01:55:04But put simply, a VPN provides secure communications over an unsecured medium such as the internet. The site to site IPsec VPN establishes a protected tunnel overlay between sites usually across public infrastructure like the internet.01:55:22This VPN tunnel protects data across the security triad of confidentiality, integrity, and authentication by encrypting traffic, providing hashing of the data set and validating the VPN points by use for pre shared key or certificates.01:55:43Compatible with both ike V one and ike V two protocols with a strong recommendation to utilize ike V two for enhanced security and performance. Site to site IPsec tunnels can be established between managed devices as well as between managed devices and external Cisco.01:55:59Or 3rd party peers that support compatible feature sets.01:56:17So the business benefits, customers utilize site to site VPNs, just not for security, but also for their cost savings, scalability, and flexibility.01:56:35So as we saw earlier with Lucas slides, and I'll go over them briefly here again, but not all hardware is made equal depending on your requirements for your number of VPN peers and the traffic throughput, the model of hardware will need to be decided upon.01:56:52But as you can see, we've got the hardware which supports as little as 50 VPN peers with up to 1.2 gbps of VPN throughput all the way through to devices which support up to 60000 VPN peers with 490 gbps VPN throughput.01:57:09And the secure firewall portfolio also supports virtual instances. As we can see supporting from 250 VPN peers at 100 mb per per second through to.01:57:2810000 VPN peers at 6 gbps. But keep in mind that these numbers are dependent on the supporting hypervisor environment. So how do we deploy and use IPsec securely?01:57:42With many encryption options, hashing algorithms and authentication methods. So which ones do we use? And the answer to that is there's NO correct answer. It will depend on your company security policy as well as in any industry regulations that you adhere to. And also any 3rd party requirements. So if you're setting up a VPN to a partner like a.01:58:00Cloud service provider and also the software, hardware of the VPN endpoints that you're connecting to is also a factor. But what we've got here is a table that's from the uk's national cybersecurity center.01:58:20Is their recommendations for securing IPsec, and the NCSC, they safeguarden advise the for the uk's critical systems and online services. And the profile that we've got here is expected to provide suitable level of protection.01:58:36For official information until at least the end of 2027. So to use site to site VPNs with strong encryption on the firewalls, then the export control functionality must be selected.01:58:52When generating a registration token for the FMC. And if he's already registered for export controlled features, you can check this under system licenses on the FMC. On the license for this is perpetual.01:59:11And doesn't require a subscription. So next we'll discuss the different types of site to site VPNs which are supported through the FTD.01:59:27So as we can see, we've got four different sites to site VPNs that we can select and the support through the FTD VPN topology wizard. So these are the policy based wizard or the policy based VPN, which defines the traffic to be encrypted by the use of a policy inside a crypto map ACL.01:59:44And we look at the configuration of this.02:00:03And also a demo using a peer to peer topology in a little while. We've also got route based VPN, which encrypts the traffic by directing to a VTI, making it more scalable and easier to manage than policy based VPN. Again, we'll look at the configuration of this in the demo using a peer to peer topology.02:00:05The other option that we see is that sassy and sassy we can configure a VPN tunnel up to a Cisco umbrella SIG solution for further traffic analysis and protection. But we won't be looking at this today. And then last but not least, our SD WAN topology wizard.02:00:25Which is new from version seven.six, which greatly simplifies and automates the VPN and routing configuration in a sub and spoke topology. And we'll look at this in a demo a little later.02:00:43So, firstly let's discuss and look at the policy based site to site VPN with an overview configuration example and then we'll do a demonstration. So a policy based site to site VPN uses a crypto map ACL to define the source and destination traffic pa.02:01:02You should be encrypted across the VPN tunnel and has applied to an egress interface. This works well, as environments grow, the crypto map needs to be updated with new networks to be passed through the tunnel or removed if a network is NO longer needed. This adds to operational overhead as well as opening up the possibil.02:01:22Ability for misconfigurations on the crypto maps, which can cause issues for the tunnel.02:01:42So the policy based site to site VPN has a clear text IP packet and one of its interfaces. That packet is then processed through the routing table and sent to the appropriate interface where the crypto map.02:01:49Attached to that interface will encrypt and encapsulate the packet. So the highlighted output on the right in red is the show crypto IPsec essay output on the FTD, which shows the status and details of an IPsec VPN security association.02:02:05The things to note, and especially when we compare the same command and output of the route based VPN is the local and remote identities which require the protected networks to be explicitly configured for each tunnel.02:02:24So as I say we look at a demo shortly in the lab, but to go through the configuration for a policy based VPN, on the FMC you go to devices, site to site VPN, policy based, and select point to point. And select the version, the two is advised.02:02:40And then add the endpoints for the VPN by selecting the plus icon. And then from here you can add the device from the dropdown list, and that would be the 1st endpoint and select the interface where the VPN tunnel would terminate, and this typically is the internet facing one.02:03:00This will populate the IP address box, and if you've got more than one IP address configured on that interface, then you'll need to select the relevant IP. Connection type is bi directional by default, but you can change this to originate only or answer only.02:03:16And then we've got certificate mapping and that's used in authentication instances where certificate attributes can map VPN connections to specific connection profiles and it's typically used in complex multi site deployments. And then we've got the protected networks box.02:03:32And that contains the ftd's networks, which are to be protected and encrypted. Enable nat T is selected by default, and that allows seamless communication between the peer FTD devices when there are NAT devices between these devices.02:03:50And then we've also got exempt VPN traffic from network address translation, and that's automatically selected, and that allows the protected networks to flow through the VPN tunnel without any NAT rules applied, and this is typically enabled.02:04:07So for the ike settings, as I said earlier, it's recommended to use ike V two and then for the authentication for this there are three types. We've got pre shared automatic key and the firewalls that have been configured need to be managed by the FMC.02:04:26To use this method, so the file will automatically defines the pre shared key, the pre shared key length can be defined to be between one and 127 characters long. And then we've got the option for pre shared manual key that requires that the pre shared key for this VPN is manually assigned.02:04:44And then, the 3rd option is certificates, and these are used instead of pre shared keys to authenticate the endpoints. And although more complex to set up and pre shared keys, this is the preferred method, especially when you're operating at scale. However, as Luca showed earlier, the process for generating certificates and.02:05:02How to configure them and how to add them for these demos, these slides I'll just use the pre shared key option. So, following along for that, we've got the IPsec settings and we'll select static as the crypto map type.02:05:22An IP two mode as tunnel and IPsec transform set as ASGCM. We'll enable reverse route injection, and this populates the routing table with the remote protected networks to be available to be distributed via an internal routing protocol and particularly useful.02:05:42In networks that have got some complexity to them where there isn't just a single default gateway. We've also got PFS perfect forward secrecy enabled, and this is advised by the details that we saw from NCSE earlier.02:06:02And then for the advanced settings, we can generally speak and keep the defaults, but just to go over them, for like we generally want to enable like keep alive to detect the loss of connectivity between endpoints.02:06:25So that should there be a connectivity loss? The tunnel could be torned down, a tunnel restart initiated, so the defaults here are 10 s for appear to be idle before beginning keep alive monitoring with 2 s between keep alive retries. Then we've got identity set to peer is set to auto or DN by default.02:06:39Which draw like negotiation will send either its IP address if pre shared key is set as the authentication method or certificate DN if certificates are set as the authentication method. These can also just be hard coded to IP address or hostname if.02:06:59If required. Then we've got peer identity validation and that's set to required, then drawn the item negotiation, the peer sends its identity either as an IP address or an FQDN or distinguished name.02:07:16And the FDD validates this by the detail sent especially when certificate authentication is used. We've also got SA cookie challenge, and this is used for DOS denial of service attacks.02:07:32Then by default kicks in when 50 % of the available essays are in negotiation. Then for IPsec advanced settings enable fragmentation before encryption is selected, and this allows traffic to travel across NAP devices that don't support.02:07:47IP fragmentation. Then for advanced tunnel settings, keep alive message traversal is enabled by default and allows communication between peer FTD devices when there are NAP devices between these devices.02:08:07We've also got bypass access control policy for decrypted traffic, and by default that's disabled, but when enabled VPN traffic traffic isn't subject to access control policy.02:08:23So when it is disabled, you must ensure that the traffic is allowed in the access control policy that's gonna flow across that VPN tunnel. And then we've also got certificate map tapping settings and in complex environments, different tunnels can be determined and established.02:08:40Depending on attributes sent by the peers certificates. The defaults that we see here on the screen are in most circumstances ok to leave as is.02:08:59So next I'll show a demonstration. We've got this lab set up here, so we've got three nodes or three environments, got London Paris and Tokyo. So in this demonstration I'll do a policy based site to site.02:09:17VPN tunnel between Paris and Tokyo, so as I described earlier, if we go to devices VPN site to site and then click on VPN topology or add VPN.02:09:35The topology.02:09:55Select policy based VPN, select the peer to peer radio button, and then we need to give it a topology name. So I call this AI policy based P to P We can then click create. That'll then go away and open up these windows.02:09:57So we've then got endpoints node A, node B So for node AI click the plus button, select the device in this instance, be tokyo. I select the interface that I want to use as the outgoing interface which is outside on my FTD, and then.02:10:15Auto selects the IP address.02:10:35And then for the protected networks, I need to put in the LAN network for Tokyo. So I've got an object created already. I'll add that into the protected network box. NAT is enabled, exempt VPN traffic from NAT is also enabled.02:10:37The advanced settings for reverse route injection, they're not enabled so I'll leave those as default for this demonstration. Then need to select device B, which is Paris. Again, interface for that is outside, it auto selects the IP address.02:10:59Need to select the protected networks that are gonna be protected from the Paris land. Select those and then.02:11:18Yeah, the same details that have been set up for tokyo. So then click, click ok. The settings, save right V two, got the AS set up and then IP set ASGCM, also enabled PFS which by default isn't enabled.02:11:33So that to enable that and then select the group that you want to use in this example, you just obviously group 21 and then the advanced settings that we looked at earlier.02:11:54As I say, totally speaking, leave those as default, and again for this demonstration that's what I'll leave as the default. So once you're happy with those, click save, and then.02:12:10The deploy button needs to be hit and then send that off to the two ftds, then takes a little while. And once it's come back, it's completed, you will then have the tunnel.02:12:27Ready to send traffic across. So after a little while, you'll come back to the screen and you'll see the the tunnel status and that will be green and will be active.02:12:44And we can further dive in and go into overview, go to the dashboards, and then look at site to site VPN. And that's up set as it active, and when we've got these tools on the right hand side to do some.02:12:59So further investigation into what is happening on that tunnel. So we got the general details that look at the IP addresses that are configured the standard settings, but we've also got CLI details and these tell us the.02:13:17Details from the FTD from CLI perspective. So the show cryptopsec SA is one of the commands verifies that the device is up and the tunnels are communicating, but also importantly shows us.02:13:34How much data is going across in terms of packet, in terms of data size. So it's good, good validation. Once you've created the tunnel, it's a good validation to go into this just to confirm that.02:13:51Everything up, everything's working, the encryption levels that you've set are as you want them to be. And you can do that on both of the.02:14:08Ftds that you've got within your FMC, so we've got both details here for Paris FTD and also for the Tokyo firewall and then the other tool that we've got from this dashboard.02:14:24Is the packet tracer. So if you want to validate that packet should be able to pass across this VPN tunnel, you can.02:14:42Use this for troubleshooting as an example, so the instances where you brought the tunnel up and something isn't working, you might get a call from one of the end users. Yep, I can't, can't ping between these devices.02:14:59Then they're expecting to be able to across the VPN tunnel, you can come to this tool, put in your details for the, the device on one side of the VPN tunnel and then the address on the other end, put in the protocol that you're trying to test, and then use this tool and then you'll.02:15:15Get all of this information back. So in this instance, that packet's allowed, but we'll look at something a little bit later where it isn't allowed and we can troubleshoot a bit more detail, but typically you may not have something set up in the access list or.02:15:35That team might not be working or something in the the routine may not be working, which you can see from that packet trace. So yeah, really good tool to, to do some further troubleshooting if you're having.02:15:52Trouble with connectivity. So yeah, like I said I've put in something else an address which shouldn't be allowed and that has gone through the packet tracer and because it's not allowed, we see that it's dropped.02:16:08The reason for that is that the VPN isn't allowed within the, the VPN protected network. So that's the end of that demonstration, so.02:16:28What we'll do now is talk a little bit about virtual tunnel interfaces which are used. They used significantly in in route based VPNs, so yeah, before we discuss route based VPNs, I'll discuss vtis in a bit more.02:16:43Detail.02:17:03So let's discuss why we might need route based VPNs and hence vtis. So with an IPsec policy based VPN, enterprises faced the challenge in tracking all remote subnets and including them in crypto map access list.02:17:04Any subnet change in the enterprise results in updating the crypto map access list on VPN gateways. These updates as well as time and operational effort are prone to misconfigurations which can also cause issues with the tunnels coming up and processing traffic.02:17:25So also in a policy based VPN, the crypto map to an interface, but the the crypto map has to be mapped to an interface which can restrict the flexibility of using multiple forwarding paths in processing crypto traffic.02:17:44So, the VCI is a logical interface that represents the source and destination endpoints of the tunnel. The tunnel interface.02:18:09Interconnects the underlay network, the network that the tunnel source and destination will use, and the overlay network, the traffic that will traverse within the tunnel. Any traffic sent or received on this lot of interface will be protected by IPsec.02:18:17And this allows, this allows for traffic routing to be used to send traffic with a logical tunnel being the next top and results in simplified configurations with greater flexibility for deployments. So let's described a little earlier, when the requirement for a user to configure what traffic was to be protected is removed.02:18:33It reduces the chances of misconfigurations which frequently occurred with manual configurations of access control lists with crypto mapped.02:18:53So there are two types of VCI tunnel. There's a dynamic tunnel which we'll discuss more a little later on, and that's used in hub and spoke environments, the static vcis, which we'll discuss here. The static VCI was introduced in FTD version six.seven and allows the creation of IPsec.02:19:11Deploy connectivity between either two ftds.02:19:30Or an FTD and another Cisco VPN capable device or a 3rd party VPN capable device. So in SVTI allows that either end can initiate the tunnel. And as we see in the underlying configuration.02:19:33We specify the tunnel source, tunnel destination addresses, which are the live underlay addresses, and it's typically a routeable address across the internet, but also we have the IP address of the tunnel, which in this case is a loopback address.02:19:50FTD version seven.three gave us the capability to be able to use loopback addresses and they're useful particularly for VPNs as they're always in an upstate because they are central to the FTD.02:20:06They're able to be advertised across multiple paths. So should one path be unavailable? The other path is available, the VPN remains connected. So.02:20:21Now let's take a closer look at route based VPNs. So a route based site to site VPN uses the virtual tunnel interface for encrypting and encapsulating packets. As a packet enters the firewall, the routing table will forward that packet.02:20:39And if that packet is to be encrypted, the routing table will have an entry to forward the to the tunnel interface. The packet then enters the virtual tunnel interface where it's encrypted and encapsulated.02:20:58With underlay IP address details, and it's passed back to the forwarding engine where it's routed to the next interface determined by the routing table. And looking at the output on the right for the show crypto IPsec SA command.02:21:15We see that the local and remote identities are set to zero/zero or any. As unlike the policy based VPNs, the route based VPNs protect all traffic has been routed through the VTI.02:21:31So, as we'll see from here, when we pick a route based point to point VPN, we get the option to select the devices that will be used to create the tunnel.02:21:48With the difference between this and the policy based VPN being that we need to select a virtual tunnel interface to use. In this example, we've clicked the add plus button which opens up the add virtual tunnel interface window. In the add.02:22:03Virtual interface pop up, the following can be configured. The name is auto generated by the FMC, but can be changed if desired. We also need to ensure that the interface is enabled, so check box for that.02:22:19You can perform traffic inspection based on security zone. So at the VCI interface to the security zone, configure an access control rule. To propet the VPN traffic over the tunnel, you will need to add an access control rule with this security zone as the source.02:22:35We've also got the priority field and then here enter the priority to load balance the traffic across multiple vtis. The lowest number has the highest priority than the default here is zero. And for the tunnel ID, we can enter a unique tunnel ID in the range zero.02:22:53To 10413. Then we choose the tunnel source interface from the tunnel source dropdown menu, and the VPN tunnel terminates this interface, which is a physical interface.02:23:13So choose the IP address of the interface from the dropdown list. So the example here uses the outside interface gig zero zero as the source interface and will be the address used across the underlay. And then for the IPsec tunnel mode.02:23:29Click IPV four or IPV six radio button. In this example we've chosen IPV four button, and then in the IP address field enter the IP address and subnet that's to be used. The VCIP address of both endpoints of a route based VPN must be in the same subnet.02:23:45So an address in the 169254.X.X/sixteen range can be used and this will help save an IP address exhaustion and then also use a/thirty net mask. So that way only two addresses, the two ends are used for the VTI tunnel.02:24:04And then for similarly, we can configure settings for the other node in the tunnel if it's managed by the FMC. If it isn't managed by the FMC, then in the dropdown box.02:24:23You can select an extranet device, so pick that extranet device from the dropdown list and then only the device name and an endpoint address is required to be added.02:24:39So the settings for icon IPsec and advanced settings will configure the same way that we saw for the policy based VPN, so.02:24:57And then, again, I'll do a lab demo, but it'll be a route based one as opposed to a policy based one. And again, we'll use Paris and Tokyo as the, the two terminating endpoints for the VPN tunnel.02:25:18So again, go to devices, go to VPN site to site.02:25:45And then add a new VPN, select route based VPN, and then peer to peer, and then give it a topology name.02:25:53So call this one route based.02:26:12Root based peer to peer keyboard's a bit stuck.02:26:21Now we hit create button that then goes off into our configuration window again. So it's a little bit different than before again we've got node A and node B So we select the device that we wanna use for node A.02:26:38And this case we'll use, we'll use Paris, and then we need to set up the VTI for that. So I haven't got one pre created so we press the plus button.02:26:55We've got a default name which is outside static VT one which is determined by the the FMC.02:27:17We then got the, the opportunity to select the security zone, so in this demo I won't select one cause I've already got rules created for the VPN to go through, but.02:27:33If you haven't got a rule straight for your AC in your access control policy, then you would select a security zone here and then that security zone is then used within your AC, access control policy to determine what traffic is allowed through.02:27:52And then we've also got the tunnel ID, which is set to one and then the tunnel source, which is the physical internet facing address and interface which is gig zero zero.02:28:12So that's now been added, we'll do similar for node B, but.02:28:30Obviously pick Tokyo is the node that we want to use. Again, haven't got a VTI created, so I'll create one for, for Tokyo, keep similar details.02:28:34That we had for the Paris one, However, I changed the tunnel address from two.one to two.two.02:28:50So yeah, so that's.02:29:10All set, save that, if just go into the into the two ftds we can see that the interfaces have been been created. So under the.02:29:14Internet facing interface gig zero, we've got tunnel one under there, which we've just created, which is a VTI type, and then same for similar for Tokyo, we've got gig zero zero, which is the outside internet interface, internet facing interface and then a sub interface of that is tunnel one that.02:29:34VTI that we've just created and like I was talking about for group based VPNs, it's everything is determined, everything's determined by the routing.02:29:54And forced through that VTI interface. So what we need to do in this interface is route the traffic that we want to go from Tokyo to Paris and Paris to Tokyo. We need to set them up.02:30:12And in this demonstration, I'll use static routes. However, when we look at the ST WAN, we'll use a dynamic protocol, we use BGP for that.02:30:30Yeah, so setting up a static route, I wanna force that from the Toky FTD, anything that's going to Paris.02:30:49I'll set up a static router that and then add the VTI in Paris as the gateway that we wanna point traffic to.02:31:07Yeah, so this will be the Paris VTI address to the.02:31:44The 169 address. So that's the static router for tokator.02:32:03To Paris, we'll save that and then we'll do similar for the Paris end.02:32:20So yeah, go into the go into the routing option, then select static route. We'll add a route, we'll send traffic out through the the VTI.02:32:37And then anything that's destined for the, anything that's destined for the tokyo land will be part of the static route and that will be.02:32:54Directed to the Tokyo VCI address.02:33:11So yeah, the 169 address, the, the VCI address.02:33:54In, in Tokyo, so we'll save that.02:34:01And then once we've saved that and deployed it, we'll see similar to what we saw for the policy based VPN. So we can go go back into overview, go to site to site VPN.02:34:30Yeah, see this same or similar details that we saw earlier, so got the general details, we've got the CLI details, which are a good.02:34:47Point to come to when you've initially set up a tunnel just to verify that data is traveling across, that it's working ok. And also that you all of your encryption levels that you've set up are the ones that You've.02:35:04The ones that have been used for this tunnel, and again you get to see both devices from here, Paris and Tokyo. We've also got the packet tracer option as well.02:35:22Again it's used in the same way that it's used for the the policy based VPN. So I won't show anything.02:35:42With that here So that's the demo for route based VPN and how you configure it.02:35:48What we'll talk about next is DTIs, so dvtis are dynamic virtual interfaces, and they're used in, used more importantly, mostly in hub and spoke.02:36:04Topologies. So dynamic vtis, they're introduced in FTD version seven.three and they give us the capability to do hub and spoke VPNs in a scalable manner. So previous to dvtis for large hub and spoke deployments, it was.02:36:23Required that SVTI would need to be configured for each spoke, but now only a DVTI is required for the dynamic creation of the IPsec VPN tunnels. So what we've got, the virtual template.02:36:43That's attached to a tunnel group. So when the VPN tunnel is established, the DVTI in the configuration that we see here, that's cloned and a new virtual access interface.02:37:00Is created for that spoke. So as the virtual template configuration is cloned automatically, there's NO need to create a separate SVTI for every spoke. Cloning the configuration also helps preserve the IP addresses as all virtual access interfaces use the same IP address. So traffic that hits the.02:37:17Virtual access interface is then encrypted and set to the spoke.02:37:37The virtual access interface remains active until the VPN session is terminated. And for dvtis, we can only borrow the IP address from another interface and typically this would be a loopback interface as, as we've said is always up.02:37:41And due to the way that dvtis operate, when it needs to learn the spoke address dynamically, only spokes can initiate the connection. So to further explain this diagram.02:37:58As each spoke is added, the virtual template configuration is taken on the hub FTD, as each spoke joins, we get a new virtual access interface that's created for like a spoke, and then we then got that spoke to hub connectivity.02:38:16And then one of the key considerations in the SD WAN topology is to allow spoke to spoke communications, so to implement spoke to spoke routing distribution via the hub without requiring full mesh.02:38:40Connectivity, the ST WAN wizard, it brings in BGP route reflector support. So this enables the hubs to be configured as an IBGP route reflector and the spokes as IBGP route reflector clients. So this allows the spoke to spoke communication.02:38:54But it also determines the best routing paths in instances where there might be multiple paths.02:39:12So with that, let's take a closer look at the SD WAN wizard. So after clicking through the SD WAN topology wizard, you'll be directed to the wizard, which.02:39:27Has got four steps to navigate, which is hub configuration, spoke configuration, authentication settings, and SD WAN settings. So the 1st step in the wizard is to click the add hub button to add the device. It's going to be the hub.02:39:43We then need to create a DVTI and we do this by pressing the plus button, which opens up the DVTI window which creates a default name. And this can be changed, but typically the default is fine. And then from here we have the template ID which is used as part of the tunnel name.02:40:02We also pick the tunnel source interface and IP address that will be used to route across the underlay. And also for the DVTI interface, we need to borrow an IP. We can't hard code this, needs to be borrowed. And an IP numbered.02:40:22Is the only option and like we said previous generally good practice to use the since this interface is always up. So once you're happy with these details, you can then click ok.02:40:39So then back on the add hub window on the hub gateway, the, the address is automatically created based on the outside IP address of the DD, the DVTI interface. And from here we create the spoke tunnel IP address pool range for the addresses that will be configured for the spoke tunnel addresses.02:40:58To create the ranges, press the plus button and add the relevant address ranges. But remembering to keep the range large enough so that you cover the number of spokes that will be in the topology. And then from here we can save and add the hub device to the ST WAN topology.02:41:19So with those details added, you'll then see a summary of the hub configuration. You can then click next and move onto the spoke configuration.02:41:41So for that, for the spoke configuration, we can either add spoke singularly or we can do a bulk edition. And for this example, we look at the bulk edition. So to do that, just go to the bulk edition and click add spokes bulk edition.02:41:55Which will then take you to the next screen. So from here, select the devices that you want to add a spokes, and we can select the VPN interface by using the name pattern. So.02:42:13My spokes will have an interface with the name outside and that's what will be used from the spokes as a terminated interface. So for the name pattern I use this, we can then click next and we get the option to validate devices. So.02:42:28If you're all happy with that, with the devices you've got, you can click add, and again a summary of what we've just configured, so once we've added.02:42:47We get the summary of the spokes with the name of the devices, the interfaces, the IP addresses for the VPN interfaces, and also the identity details. So once happy, click next and that will take you to the following screen.02:43:02So screen that we come to next, that's the authentication settings and typically excepting the defaults is fine, obviously discussing what we did earlier, that depends on your policy, but especially when we're looking at the IP two and IP set proposals.02:43:23There is the option for authentication type, and as discussed earlier, ideally certificates, the method to be used. So but in this example.02:43:42Say because Luca covered it earlier in rate access, we won't go through certificates but we've got pre shared automatic keys in this this example. So once you're all happy, click next and that will take you to the next screen. And here we get the SD WAN setting screens.02:43:58So we want to be able to distribute the routes from the spokes that they can communicate with each other. So from here we need to enable BGP on the VPN overlay topology, configure an AS number and also a community tag to mark the routes.02:44:17We can also redistribute connected interfaces, which we can enable by configuring the redistribute connected interfaces box. So.02:44:34By default, a BGP connected route map for the actual configuration will be generated for interface inside. But it's only good if the only interface that you want to redistribute is the inside interface.02:44:49So, if you're doing multiple interfaces or, your interfaces are called something different, we can configure an interface group by selecting the plus button and then adding specific interfaces.02:45:06From the hub and spoke devices. And then whatever we select be it a singular interface or an interface group, a BGP connected route map will then be regenerated with those selected interfaces.02:45:22So once that's complete, we get the SD WAN wizard summary and we can confirm all certain required. And then once we're happy with that, we click the finish button.02:45:42Which then saves a configuration of the FMT and then is ready to be deployed to the fdds. So all of that takes 5 min if you've got a large hub and spoke environment.02:45:58This wizard will save lots and lots of time. So just to look at the the routine just to validate that.02:46:13After we've deployed the configuration, we can go to the hub and verify the routine. So the routes that we see on the screen here that are denoted by our V, they're shared by like V two and these are the VTI interface addresses.02:46:30So we can ping these in between for testing purposes, we want to test connectivity after we've deployed. And then the routes that denoted by the days of the BGP routes of the.02:46:46Connected interfaces that we redistribute earlier. So these are the routes of the inside interfaces of the spokes that have been redistributed from the wizard. So that's the the hub. We then look at the.02:47:02The spoke, so we've got two spokes here again similarly, we'll see that the the V and the.02:47:18And the B routes are here to show where we've got the VTI addresses and that are distributed by V two and then the BGB routes which are the the redistributed connected routes.02:47:34So this is the spoke, so there's routes in there for the, the hub and the other spoke. So next.02:47:52I've got this lab demo, again, the same topology that we've seen before. So we've got Paris and Tokyo and then also London as well. So Parison Tokyo will be the the spokes in this example, and then London will be the hub device.02:48:08So we go to where we've been before devices VPN side to site, bring up the wizard, select the SD WAN topology, give it a topology name, click create, and we go to add hub.02:48:27Set the device and this will be London, we then add the DVTR that we want to use. So it gives you that default name. Tunnel source will be the outside, which is the internet facing address, and then.02:48:46Within, like I said earlier, we want to set up a loopback address. So we can create one within this wizard, I'll create one here and call that loopback ten, give it a loopback ID.02:49:03And then also give it an IP address. So in this instance we're gonna use 1010 200 network range. So what's all happy with that?02:49:21Click ok, we then need to create the spoke tunnel IP address pool. So again we can click plus.02:49:36Go further into the wizard thing select that range that we want. So take it from the 1010 200 range, make sure that you're creating enough spoke addresses to cover your the spokes that are gonna be in your topology.02:49:54So in this instance.ten to.fifty, give it the/twenty four net mask. So that's all created all happy with that and then click next.02:50:10And this is where we add the spokes. So without a spokes, do a bulk addition, and then click the two spokes that wanna add, which is gonna be Paris and Tokyo, select them and then add them. Use the interface name pattern as I say my device's names are outside.02:50:24So just doesn't name, a regex named pattern matching, so I'll add those devices. We can check those. If we're happy with those, click, click next. And then, yeah, we've got the these default authentication types.02:50:45ASGCM for IPsec and ike. And then I've got the pre shared key for authentication. So what's happening with that? We then go to the SD WAN settings.02:51:04Here we're creating the BGP for the overlay to need a an AS number, so pick a private AS number 65500 set of community tag.02:51:22It's just a random binary number that I've created there. Also, you want to redistribute the connected interfaces by default, as I say it selects the inside but if you've got different naming conventions then you can add those using the plus button.02:51:37And again, once you're happy with those details, you can click finish and that then goes away, save it to the FMC, which you can then deploy to the your hub and spoke devices. Certainly goes away for a little while.02:51:54What it's deploying, and then after a short while come back as completed.02:52:13Yeah, so that's deployed.02:52:33And the tunnel status hasn't come up yet, it sometimes takes a moment or two to or a minute or two to come up.02:52:48So, that's now come up and we've gone through the same overview dashboards, site to site VPN, and we see that.02:52:59The the hub to Tokyo and the hub to Paris connectivity. And again, like we looked at earlier for the the other VPNs, you get the same.02:53:16Details within this dashboard as well so you get the the connectivity, the number of packets that have traveled encryption levels.02:53:34All of those same details.02:53:49Yeah again just to reiterate another really useful tool that when you create these sites like VPNs, you should should be using.02:54:07And then just to look at the packet tracer, when we look at something that isn't working, hey someone's phoned in, said that they're trying to make some connections to.02:54:26From a device to a device and it goes over this VPN tunnel, we can come back to this packet tracer tool like we saw earlier and put in the details.02:54:46So putting the IP address details and then, yeah, it's come back.02:55:05Like the, like the end user's experiencing, it's come back with a drop.02:55:12So we can do some analysis, but looking at that information in there, it looked like the access control policy wasn't.02:55:31Wasn't set up to allow allow traffic between those two networks, so we got come back to the access control policy and there is.02:55:47There is that access control policy there. However, it looks like someone's disabled it. So I've just gone on the user's device and doing a ping.02:56:04Doing a continuous ping in between the, the areas that they're having trouble with. And yeah, it's it's not working. So yeah, so as I says it looks like someone's disabled the the rule between.02:56:19The between the the hub here and tokyo. So I'll re enable that rule so that traffic can travel from between London and Tokyo.02:56:34Then with that rule deployed it, we'll then go back to the machine and yeah now that thing's working. So again, just to talk about we've got that packet tracer tool, really good and.02:56:55Can use it for a whole lot of, a lot of troubleshooting. Again we'll go back to the package tracer tool, put those same details in, and again.02:57:16This will, will hit the trace now button, but this should now come back as, as working.02:57:36Cool yep so some troubleshooting there using those, those tools and then also as well just to.02:58:07So another tool that we can use in troubleshooting for the site type VPNs, we can use the unified events. So you go to analysis, go to unified events, put in the.02:58:24The filters that you want to filter on so typically the either the IP addresses and or applications or ports. So I filter that to remove some of the noise and just concentrate on the the specifics that we want to see.02:58:40So you've got the source address, destination address of the, of London and Tokyo. As we can see, we had some blocks.02:59:00And then since we've enabled it, it's now going through that access control policy that we enabled to that London to Tokyo access control policy. But before that, because it wasn't any access control policy, it was just going through the.02:59:16The default rule, so yeah, another tool to use when, when doing your troubleshooting.02:59:32So with that, that's the end of the, the talk for site to site VPNs and and the demonstrations, so from that perspective, I'm all finished. However, just to take another two or 3 min, I'd like to finish.02:59:49Shouldn't.03:00:09Just to discuss some of the free education services that we provide in Cisco customer success. So one of these is is the cyber capsules and that offers a series of concise videos that are packed with expert recommendations.03:00:09That typically last for about ten to 20 min. So they're aimed at significantly enhancing client security posture around a particular product and one of its key features. We've currently got about 30 of these.03:00:29Videos available to view and if you click that QR code, then take you to the cyber captures port. But I say we've got about 30 at the moment and there's plans to add lots more in the coming months.03:00:47We've also got coming in the next quarter is another customer success webinar. So if you want to learn more from us and the rest of our colleagues in customer success.03:01:04Then this is the upcoming sessions that we've got in the next, next month or so, to obviously A one that we've got there. But if you haven't received an invitation and you're interested in this.03:01:20Then please see the registration link that's there and then lastly, it's important to us that the feedback that we get from these sessions because it helps shape our future sessions as well.03:01:35So that we can align them with your needs and the topics that are important to you. So once this webex concludes, you'll get a survey and that'll open the automatically open in your browser for you to complete. So, that will come up in the browser and your input is really appreciated.03:01:51And then lastly, we'd like to say a big thank you to all of you for your time and attention over the last couple of days. We hope that you've picked up some important knowledge which will help improve your security posture. It's been a real pleasure to have you join us. And with that, I say goodbye and wish you a great.03:02:15Great rest of the day.03:02:32