Exploring New Cisco SD-WAN Tools for Security and Application Insights

Hello everyone, Welcome to the expert insights series. So the topic for today is exploring new Cisco SD WAN tools for security and application insights.00:10So my name is. I'm gonna be presenting this session and Ryan is also with me that is gonna be handling all the demo part. We have a couple of panelists ready to answer your question and it's gonna be Eris and Tusher.00:19So, before that, I would like to let you know that today we are gonna use a Slido for Q and A So hope you get into the Slido is very simple. You can go to the slido.com and just enter the the event number and the passcode. Or you can use the the code directly.00:37To to do the same, right? So you can refer to the both options to send your questions.00:57That you might have during this topic, and if if not, if you don't have time to do this, I'm gonna try to put the information on the chat in any case that you might have problems to scan the the QR code. But I mean just please put all your questions in in this locations.01:03So talking a little about my background a little about me, so I've been on this industry for 20 years, so working in the enterprise networking in Cisco have been for 14 years talking about in the professional services and CX and I actually helding ccie certification and the one certification.01:20Talking about Ryan.01:41He has been in the industry for eight years plus eight years. He has been on on the Cisco organization. He was used to be on the on the for two plus years and he's holding CCMP enterprise Meraki and certification. So we have good stuff today to talk about all the topics.01:42So the agenda today is gonna be short, it's gonna be just for topics we're gonna start doing demos in the middle, you know, that you can see directly from from the from a lab environment, how this works. But the idea is to talk about all the new features to simplify operations I mean, we're gonna cover all the.02:01Dashboards all the tools that you can use on SD one to get your make make your EC to operate the SD one solution, operate and monitor. 2nd part is gonna talk about everything that is related to AI, so all the features that we have in AI that you can use for your operations.02:19And the 3rd topic is gonna be talk about the new feature that we are using just as it's gonna be available on the twenty.four, but it's gonna be available for you. As, as I say all the demos in the middle of this, ok? So let's talk about let's start with the.02:371st section of this, let's talk about the all the tools and features that you can use to simplify your.02:57Operation and as you know, we have now the possibility to to use the new dashboard. The new dashboard you have a new appearance where you have you can toggle toggle between the different dashboards your security tunnels and applications that are everything's on the top now, as you can.03:03And quickly go to any of these sections.03:23And then you can also use the monitor your one from different perspective for a global perspective and then you can drill down into the specific. This is a nice view that we have now, so I always recommend to use that. But also we have customerable widgets and view I mean important that you can adjust in the time that you wanna do.03:25Your views and even in you want to use a table view or do you wanna do a heat map or geographical map? I mean whatever is your your preference here, you can use now.03:46But also important is like you can customize your dashboard. I mean now we have the possibility to use the different dashlets, I mean, we have 20 plus different dashlets and you can go from single inventory to application our routing. So practically it's a store per.03:57User. I mean if you made some changes in your appearance, it's gonna be keep for you every time that you log in so disappearance is gonna be keep it.04:17And how do you access that to just go directly to the bottom, edit dashboard, you go there and then you can start you know creating your own view of this. So, e.g., we have something that is like AWS suggested because we I mean we have code credentials detected, so I mean.04:25It depends again what you are monitoring, what you're interested or what is the section that you wanna build, right? But these custom dashboard is a really nice option that I suggest that you start using. So, also very important and I think Ryan is gonna demo that is the use of global search.04:44So global search is gonna shortcut whenever you need to search for anything in the one so you can just type start typing and it's gonna search immediately if you're looking for a device, if you are looking for interface.05:04Or whatever configuration menu inside of the SD one is gonna be simple, right? So something that I definitely recommend that you use it. Search historing is case sensitive and also we can have a search history available. So you in the past that you just usually use a specific search.05:19This is gonna be, you know, pop up automatically and you're gonna save time.05:39Operating the SD one solution. So we have now when we do the upgrade to the one manager, do you know in the past, nobody knows what was happening, you never know what is the diagnostic it was working correctly and what is the progress of that?05:44So now we have the possibility in the version twenty.eighteen that you can get the diagnostic center. So this is a view that is gonna appear during the reboot or software upgrade of your SD one manager in order that you can see the stats information about what is going on. So you can see.06:01See and monitor the process in real time, and then you can get detail about all the services status, so in order that you can see that everything come up correctly or not.06:22This is activated and it's, it's gonna activate it after some time. I mean it's it's it's come up usually between the 5 min that you trigger the SD one manager upgrade, so you can see it's gonna be available this view in order that you can see all this information, right? So I think this is a nice option too.06:33To use it again because it's like complicated and doesn't know what is going on with your view, right? So I think this is important to to keep in mind.06:53Now, talking about security and EOX, so this is another tool that I recommend to you. We have now the advisory dashboard. So this is important because as you know, we have a lot of security comp complaints that we need to achieve. So now you can have in this section all the security.07:03Advisories for all your platform from a single view and then you will have the field notices also related to that. So in that way you can see if there is a really that is gonna be impacting you and we are gonna talk about later on on the life protect just how to tackle down that problem too. But.07:23And this view you can see all the all the security advisories in a single view, you can see.07:43What is the potential affected level? What is gonna be the the devices that are affected and then you can go in detail to the device and then you can start looking into the advisories and just go in detail. If you do click over the advisory ID, it's gonna give you it's gonna.07:49Go open the page with all the information about the advisory ID and then you can see the CVSS score that you're gonna use to evaluate if it's a potential problem for you or not.08:10In the UX it's gonna be also available so you can see the failed notice if something is gonna get end of support end of life, so in order that you'll be aware if even if you are running iOS XE, I mean that it is running on end of end of support or end of of life, do you be aware of that?08:21So this is supported for all the iOS XE.08:40And it's also available and all the control components, I mean as the one manager, I mean Automaton and all the controllers. So this feature is required that you have cloud services enabled in order that you can have all of this.08:44Information coming down and you can see from this screen.09:04Another feature that you might need to know in the past is very complex to to manage the licensing, so now we have a simplified and a streamlined process. We have now this new dashboard and reporting capabilities to have all the, all the licensing.09:09Eh even in high level high available licenses. So we can see high level licenses from this screen from this tool and also the compliance check about where you are. So it's very easy to assign licenses the commission license, change license directly from the dashboard.09:27Without to use another tool. We have also the integration with EA enterprise agreement in case you have that modality of licensing, and then you can from that also generate license and assign lances. So really good tool that I recommend to you that you are not using and start using that.09:47In order to simplify again your operations and management. So cloud services is also a requirement for this. It's something that also you need to have it and do have this kind of views I mean you can see on the left section, so where we have the license manager report.10:07And in the right side we have the way to enable EA toggle analytics compliance check, right? Everything on the analytics is main is using is using for compliance purposes. That means like every time that.10:23And you get out of compliance analytics is analytics is doing the the that check for you, ok? So nice feature also to do talking about the underlay help visibility. So we have a couple of dashboard that can help you again to make this easy to operate.10:39I mean, now we can have a data plane drops. This is a widget on the monitor, so you can have an overview about, I mean all the drops that you have in different, in different sections. E.g., you can see different drops by different reasons, e.g., nor route when you don't have a route.10:59After that specific traffic, when there is a firewall drops.11:19Or even in that drops, you can see all of that. So you can you will be able to start watching into that, that activity. Now we have also have a way to have alarms.11:23About when something's going on on the underlay, right? So on the underlay, e.g., if we have an interface that is is status changing or if the control is going down or the BFD session is going down, we will have alarms of that now reporting. So this is very, very important.11:40Because now we can have, be aware of what is going on into the underlay at the moment that we are watching what is going on in the fabric and the and the on the data plane.12:00And also the the drops I think is very good feature that you should use it so you should start using that. So this is an option in in the monitor widget as I mentioned, so you can start just analyzing that drops in detail and understand more what's going on in your.12:11Your SD WAN solution.12:31Now, another cool feature for those, for those that you have been using NWP BA, sorry. So we have an enhancement of this, right? So this is, you know, this is a cool feature where we can see all the traffic flows or they are going in the network and we can analyze which policy we are hitting.12:34Even if we are doing QoS, all of that stuff. But now we have the possibility to enhance the our own test.12:52That means like when this NWPI activities is gonna be triggered. So this is gonna be now we have now the way to con make the condition, I mean we can put additional conditions to trigger that. So the condition e.g. you will see on the menu is like you can select the event.13:00And we've, e.g., we can talk about QoS congestion or events. So that means like every time that these events is occurring, then the nwpis is gonna start recording all data and we can analyze what is going on, right? So now we smart smart to do the analysis. We don't need to be there.13:19Scheduling or do out of scheduling just in vain.13:39Because now we have the way to enhance that and trigger just whenever we need to pay attention of those events. So, also we can have a security alert event in our own tasked trigger. Also, we can you can use that feature too.13:43And we can also schedule that to repeat, you know, so we have other task configured for a specific day and time, we can maintain that and also important is that you can download all of these and attach to attack for as a trace to attack case. I mean, this is also something that.14:01It's something very useful. I recommend to you policy and science again is an offer view that you can see inside of the traffic. This is maintained I mean you can see there's a policy going on, what's going on with the decision of the the routers, but the good news is about this.14:18Important you can download now we can attach it and use it for for attack purposes, so nice feature to to check out.14:39Talking about another cool, tool that we can use as QoS QNS statistics, we now have the possibility to monitor the QoS queue for interface and tunnel level, you know? So we used to have just in the tunnel side.14:48Without sorry in the underlay side, now we have the possibility to see on the tunnel side. So we can include it's included policy support and interface level visibility so we can see what is the policy that is enforced on the interface.15:06We can see the have the visibility at the tunnel level, ok, for queuing and policy. So as you can see it in this in this diagram, we are including all, we can see now the all the underlay physical queues, we have theos queues that we have on the sessions.15:24And everything we can see now in the QS monitor, ok? So this is also a cool feature.15:43That we can use. We have some limitations of these, e.g.. I mean, this is just supported in controller mode and max maximum tunnels that we session that will be displayed 4000, that is the maximum number of tunnels that we can see and only support bandwidth priority.15:51The W red and policy as an option to watch on the monitor, ok? So if you are using all of that, normally that is the the feature that we are using in QoS, but you have something different? Well, it is not gonna be shown and just have in mind the limits that I'm mentioning.16:10Another tool that you should use it, if you are not using is very important is about energy management. So the energy management is is gonna let you know what is the consumption that you have. You can compare side by side, and then you can also start using the.16:28See greenhouse gas emission and energy mixed trends. So this isn't important, I mean if you have a lot of sites.16:47And you want to start talking about consideration about the calls, estimated emissions and carbon emissions too. I think definitely you'll need to start looking into this. This is normally something that is you know required but management or for hecco tips.16:55To have it. So these reports can be generated as in PDF or CSV so you can generate that and then you can and and support offline, I mean when when there is a problem of the connectivity with SD one, we can see the, I mean.17:12Available, right? And then you can have a comparisons, ok? You can comparison between the the different periods in order than that you can see how you are consuming more or less energy and then you can also have the trends to see who is the trend of con consume of energy. So nice.17:34A nice tool again to make you easy and easy to to operate. I'm talking about.17:51When we are talking about configurations, when you need to deploy something, well, you know, we have the workflows, right? So we have a dedicated section and manager dedicated for workflows is practically a wizard when you have a step by step how to make the things in the SD one.17:58It's gonna be simplified all the process that you have. If you need to provision the network, if you need to onboard a device, you need to do a software maintenance policy management, so you will find a lot of workflows available there, something that you really need to use.18:16E.g., you wanna configure thousand, you had a, you had a workflow that is gonna guide you completing. If you want to you need to create a configuration groups, if you are as the routing configuration, I mean everything is is the more typical action that we need to do in SD WAN.18:32Is available in workflows, so another really good feature tool that you should use it in your daily day operations. Something that is is important in the workflows is like you have a methodology to probably create the workflow to execute but not deploying to the devices.18:51So this is something also good because sometimes we need to create everything. E.g., we need to create a configuration groups but we don't have the devices ready to be applied or we don't want to provision those devices. So the workflow allows you to start the workflow.19:10Create the configurations and finally later on you can associate the devices and deploy using the same workflow. So this is something good to use and I usually use I mean for all my new deployments or even for new additions maintenance or growing up my, my SD one solution.19:26Something that told me that is really important to mention I think he's right is about traffic logs, you know? So now we have the chance to see all these in a centralized way.19:48All the traffic logs logs, sorry, and using the capabilities by power analytics engine, you know? So this is really a nice feature, so you can find when you go to logs, you will find traffic logs into the last as the last option.20:01And then you will find this option that in order that you can consolidate, and you can customize the time, the window, you can filter the logs, security log attributes, right? So, you can also.20:20Put all the the logs in an export in CSV for further processing or outside processing. And I think that also very important is also if you are using security features and you can see firewall rules, even in the filter affecting that. So in order to trigger the traffic logs, you need.20:39Need to obviously put some options like.20:58Criteria options like time period type device and you have a specific filter and then you can get the logs, right? So this is a really nice feature. We have some limitations e.g. you have air gap deployments, this is not available for.21:03The maximum request that you can you can submit is practically 20 requests in ten in per 20 h is the maximum. And just want to request time across the system, right? This is that is what we can we can do. So.21:23This is a nice feature again, I think something that maybe not many people is using, I mean, something that we can benefit and obviously I mean have more a simple way to watch all the logs, right?21:40As important if you are using operational comments, we have that option too. So this is pretty nice option that we have when we go to the device and we wanna go to the three dots. We go to the operational comments and we have a lot of actions from here, maybe, I mean some of them, e.g., the more.21:55As typical when we have a locked user, we can now reset the locked user from here.22:15So it's very simple to do it now. E.g., if we wanna invalidate the device, it's gonna be removed from the overlay network. We can do it directly from here or maybe you wanna stop the data traffic into that device is also very easy to do that, right? So we have other options.22:21Like a poor hop color, I mean.22:41And other activities like factory reset, probably not very used in in commonly in in the daily daily operations, but I think our reset lock user is very common and now it's very simple. So definitely I I recommend to you use this feature, this is a shortcut too.22:44To use in your daily daily operations. Talking about reports, maybe you don't know I mean now we have the possibility to create reports. We have predefined templates or something that use it please is something that we usually start generating reports.23:02These reports can be generated in PDF or CSV as for your convenience. You can generate up to a hundred reports without problem in these formats in PDF you are using CSV, we don't have any limit.23:19You can schedule the reports or run immediately so it's probably a nice action to run operational reports weekly that is gonna be help you to manage the solution. And you can select specific applications and you even can deliver the report via email for.23:35Example that is something that normally we want, right? So we can have this feature and e.g., we have eleven predefined templates that you can use that is the most common ones. Talking about this name of this session that is talking about the applications well.23:54Probably is the nice idea, talk about the application summary report, right? It's a nice report when you can see all the QoE metrics for your applications, what is the total use, who is distributed, what are the top applications that are in use, so everything consolidated in a single view.24:10Very easy to use, very simple to generate.24:30So, you can see performance again, different applications across the network, insights about what is the usage of that application. So this is for sure something recommend to you. But now instead of showing to you all of these cool features, I would like to ask Ryan to to show us.24:34The 1st demo to to talk about this. So right am passing to you. Thank you, thank you Edgar. Hello, everyone. So in this part of the demo, we're gonna double click into some of those new features we just spoke about in the SD WAN twenty.eighteen.24:53Let me just share my screen here.25:13Oh alrighty. So, here we go. All right, so here we have the the new dashboard view, right? As as Edgard mentioned, we have these different dashlets that you can see in the default.25:21Help you, application experience, site health, tunnel health, WAN edge health, and, and circuit health, right? And, each of these have their own dropdown filters. You can filter the dashlet on to see more specific information.25:40And then you can even go click into view details, and it'll take you to that section of the dashboard that has more details about those, you know, those different features or or things you wanna see about in your network.26:01So, something new that we highlighted right was the ability to edit this dashboard. You come over here to the action sec section and hit edit edit dashboard. And here we can really customize the dashboard based on the user logging in and and what you'd, you would prefer.26:18Just see up front. We can also remove things that we say we are interested, like for instance, right now we don't have any edge help data, so we'll just delete this widget.26:38We come up here to add dashlet, and then select which dashlets we think are more important to us. And, from the highlighted features, right, we have AWS and Azure dashlets in case you have cloud hosted routers.26:49That you would like to monitor Down here we have the data plane drops and widget and the underlay alarms that was mentioned. So we can add those into our dashboard. By default, they're created down below, but we can easily.27:05Sort this based on.27:25We what would we'd like to see up front, right? So we can just move these around how we want, and then click save to apply that. And then also wanted to just mention here, we can sort up the 24 h of information here.27:27And display what you wanna see in that time frame.27:47Also quick if say if we just wanna start from scratch, we just would like to go back to the default and easy button here to reset to default. Why? You know, going into the energy management, I don't have much information on this one.27:53Here we you know, we can get insights into our energy usage. This applies to, you know, all the WAN routers deployed in your.28:10Your network and SD WAN, we can kind of, they have their own filters and different windows here we can sort through as well to get more insights on that. Next we have that advisory window.28:19From here we can get an overview of what field notices are published, if they apply to, you know, the sites or routers that we have deployed in the field, and you can double click into these to get more information on those field field notices.28:37Once you've read the field notice and you're aware of it, you can also click acknowledge advisory.28:56And that will get moved to a specific acknowledged filter, so that way you can kind of keep track of what you've seen, what you haven't seen, and have that separate window for it.29:02As soon as this loads, we'll see, here we go. And if we go to field notices, you can click on acknowledge and you can now see like under the acknowledged tab, we have the acknowledged field notice.29:17Same goes for security advisor advisories, you still have that same functionality there and you can filter based on what's been acknowledged, what's not, the impact. So if you want to see the most critical ones that apply to our devices, we can do critical, you can see there.29:33And then right here we can double click into that to see what, you know, devices are potentially affected by the security vulnerability, more information about it, and then you even have a link to the official Cisco advisory notice there we can, we can click on to so.29:52Very useful, very useful page especially given all the security stuff going on and you know just keeping overall awareness in your network of the security incidents and, and releases, so very, very good stuff here.30:09We'll dive into a little bit more later in this presentation about live protect. Okay, going back. So next thing we want to touch on right is global search. So this is gonna be a great tool we use to easily navigate the dashboard and.30:27To find things that pertain to, you know, what you want to see, right? So in this example, we're just looking for anything with branch routers. We have applications, we have config groups, devices, feature profiles. So it does a good job at just listing all the potential things that apply to your string or whatever you want to see.30:46Search for.31:06We click on this, right, we have like devices. We want to look at the branch to Seattle router, you'll you'll get the system IP, the verification here and then you can click into device details. It'll take you right there, right? So while we're on this page, just want to highlight that new QoS monitors page that we highlighted.31:08And you can easily see those, that information here, you know, and filter. You can see we can do policy rate, policy counter packets, bytes, and all that good information. You can do, you can filter this based on the seven days or cut or a custom window.31:29Timeframe to see those QS statistics and monitoring. Going back to global search, another really helpful thing here too is if we wanna say we want, you know, we wanna look at T lock, right? So you'll have a list of, you know, anything that's related to ask T lock and that name pop up, but also under.31:47The help section is really nice. You can click here, and this will give you a direct link to the Cisco documentation on how to like configure a T lock or whatever it is you're searching for, right? You can use that help context to immediately bring up Cisco documentation.32:07And be able to follow the guide there on on configuring that or or the how to, right? So that is a very neat feature there too, so you don't have to make a separate attempt to go go Google that or whatever. You have it right here in the dashboard. Next thing would be.32:23License management so here we're going to.32:44Oh hold on, sorry. Administration license management. So yes, as, as we highlighted in the presentation, right, we've overhauled the license management page, much easier to navigate, much over, much easier to see and keep track of licenses. You have your license report.32:50Repository here where we can generate or see what license we've generated, and what we can utilize.33:10In this little, this also, you can, if you have EA license agreement, you can generate EA licenses here at this is this page as well instead of having to go to a separate, you know, your PMP or license portal. Here we get a snapshot of the devices and what licenses are applied to those devices. So overall.33:16Much more anesthetically easier to see and navigate your license administration and management. The next thing would be the workflows. So here's our workflow library.33:36So again, we were constantly updating this and adding new workflows to make a configuration and and walking through the steps of doing some of these things a lot easier. We can search and filter these workflows based on what we're trying to do here.33:52Search here as well for workflows, you know, when you start it, you, you know, you get your, you get your, your description here and and what what the flow is intended for, any information about the workflow and then you can begin that.34:08So this is constantly being, you know, updated and added for different workflows that customers want to see and be easier to do things with. And then finally reports. So reports, yeah, so we looked at reports. Here we have Myra.34:25Reports so this will that you'll see all your reports that you've ran in the past and can, you know, refer to and pull back up.34:45Here we have the report templates that we have, you know, I I'll I imagine that, you know, we'll expand upon these reports and keep adding more that our customers find are useful. And then for just to show you an example, right? We have landed license management report. I'm not gonna run the actual report, but you can see here just clicking.34:53Into this we can give it a name, click how we want to generate that report, we can either run now or schedule a different date.35:12Run at this time so that way you can kind of schedule it maybe have a reoccurring report either daily or weekly. So, you know, you can have that on hand every week or every day or whatever you need for it to keep tabs on your environment and get more details and stuff.35:21On those on those categories. So super helpful. All right, and that'll, that'll be it for the 1st part of the demo back to you. Yeah, thanks Brian. Yeah nice demo. Nice, nice demo.35:41So we're gonna continue then with the with the next section. So, we are gonna then talk about all the AI features that we can use on SD one, I mean that you can get benefit of 1st what we can we can start using is the AI assistant, you know, probably do notice.35:56In the in the demo of Brian.36:16We have the option to open the system. So the system is a cloud based service build solution. I mean, it's not extra codes. You can start using them. I mean you can use for different use cases. You can use for documentation again for troubleshooting, for that case management, also very nice cool features so it can help.36:19You to generate the directly and generate everything you needed.36:39So we have practically three, three areas where we can use this AI system. As I said for troubleshooting examples like how is my network doing, show me the top use applications or my doing, right? So documentation search about what is this topic.36:43From Brown for sass.37:03What is the multi region fabric et cetera or even in the case management, use summary of my tag case, get detail of my info tag case, right? So we can start using the system for all of these activities simplifying again our operation. What are typical questions that we usually see?37:04It's like provide a summary of my network health, which is having utilization about 80 %, what applications are causing that problem?37:25Why my office 3605 is having low QoE score that they at this specific site based on my network flows in the last month, do a recommendation enabling TCP optimization. I mean this kind of concern is very powerful in order that you can, you can have all the answers.37:34And answer all of these in a single way instead of doing you know manually. Now, if you're gonna go beyond of that, we have, we can use a system event to generate configurations. If you are in the in the plane to use software as a code that you are automating your environment and you want to start calling.37:52Put it in a specific format in HTML or jam format or whatever you need it, it is capable to do that. It's very powerful to do that. So you can provide what you needed and in which format that he had he can format the configurations in order that you can use for that even that advanced scenario.38:13But NO extra to that, I mean, this is.38:33Something that is probably the most the most common usage of AI. We have other features are integrated in the SD one. E.g., we have the productive path recommendations. So practically this is powered powered by one in science.38:35That we have in thousandeyes. So we can analyze historical data about the application flows and different paths and then forecast the feature network issues that can count the problem and make recommendation about the paths. So that means like if my traffic is going to a specific path.38:53And I'm not sure if I'm using the correct policy and probably I should be using different policy to get benefit, I mean and improve my SLA. So this is gonna let you know, I mean it's gonna analyze from the AI perspective.39:11Oh, what is the traffic flows that are going and it's gonna do a forecast and it's gonna do to you as some recommendations. So who it looks at after you you want to see in detail, you can start giving you after it finds a recommendation you go in detail and then it's gonna start let you know what is the path recommendation on the.39:26Reason why should take in that in the methods that are.39:46We need it. So it's gonna recommend for every site or device and it's gonna do startation and correlate QoS statistics and metrics to let you know what's gonna be the benefit to use that path. And then you can do graphical comparison between the current and the recommended paths for every.39:50Question on each part. So very powerful tool and again something that you can get benefit of. I mean, if you are not using that, you should start using that as as an option.40:10And so we have the way to do bandwidth forecasting. That means like we can predict predict the feature needs that is coming, right? This is a very difficult question when we don't want we don't know exactly we should increase our bandwidth.40:22So what it's gonna do is gonna do a forecast for three weeks ahead based on the data from the last twelve weeks. So the AI is gonna analyze all this and it's gonna create the forecast for you. The analysis is made is based on the QOE traffic volume and rates and it's and the visualization.40:37It's gonna be for each circuit in the in the current predictive values and the force card between a mass range I mean maximum range, so it's gonna be a prediction, I mean a forecast based on the minimum maximum range and as I said it's gonna let you know exactly if you should be prepared or you are prepared but what's gonna occur under demanding traffic that you're.40:57Passing through your secrets, right? So pretty nice feature again using the AI to to estimate that and let you know if you need to go into that path.41:17And finally, anomaly detection, this is a proactive proactive tool completed, so what is let you know is like deviations on the different KPIs. So if we found that the KPIs I mean the SLAs is.41:27Experimenting very initial patterns, e.g., in terms of latency, packet loss jitter, I mean it is gonna identify those paths and let you know what is going on on that, right? Probably sometimes we are not aware that this is occurring because sometimes this is not.41:44Visible or sometimes we don't receive a ticket related to that problem, but this is gonna start using again the AI to find the trends, analyze all the all of the deviations and then start try to do a pattern in order that you can understand and then you can act proactively.42:03Before this is gonna be a serious trouble in your environment, right? Performance issues.42:23So this is a pretty nice feature too I recommend to use it because we can be prepared. So what's going on and use all the AI that you can observed the day all the AI features that I listen is more proactive, right? So this is the difference to start working from reactive tools.42:29Start working on the proactive using AI ops to to start operating using these features, right? But again, I'm gonna ask Ryan to to go back to to demo as all of the some of these features in order that you can be more, more familiar with that. So Ryan, I'm hand it back to you for.42:48For the next then. Appreciate that egger. Let me share my screen again folks, give me over here. Sorry, my system's acting a little slow right now. Give it just a minute. Okay, there we go.43:06Alright, so, yeah, thanks Edgar for highlighting those features, right? And then we'll we'll, we'll look right into those. I did, I did want to look over traffic logs and operational commands from the previous segment.43:28So real quick I just wanted to show you all the traffic logs feature here Hold on, sorry let's see. Logs.43:43Oh, give that a minute to load. Okay perfect. So, yeah, as you can see, this is a really powerful feature for capturing those C flow deed and packet packet flows that were interested at certain sites. So, from the time periods section, you would select your time.44:01Period, your site that you're interested to see and then the device. From the advice the option, the advanced option, you can also include like certain flows that are going over a circuit.44:21Or certain flows that are going over like your firewall. So if you want to see like specific flows like going across a specific circuit at a site and and or firewall, this is where the advanced filter would come into play. And then we once you've got your parameter set, you just activate get logs.44:34To pull that report and then at the bottom we'll have the results. So just to give you an example here, we can look and from the view logs page here, right, we have all these different fields that we can filter the flows on. You'll see your application name, your protocol, source port, destination IP.44:54And, the, you know, as you can see that you get very, you know, granular flows here with great and this is you know a very powerful view and and a feature, you know, that our customers have requested and then you can even export those flows for even more, you know, flexibility and, and searching and, and diving into those flows.45:13Oh, let's see. Yeah, and then I was gonna say, oh yeah, one more thing. You can filter because I I noticed there's a lot here, right, that we're looking at with the flows, so you can edit this and limit to what you really want to see from the flows. That way you just has less less noise and and things to go on when you're looking at these different logs. You can do like a company.45:34View view or our compact space or stacious or comfy view based on what you wanna see or how you wanna see those traffic logs.45:54And then the one other thing, sorry, was just the different operational commands that we talked about, it'll load, sorry for the slowness here.46:02Okay, come on. All right, sorry about that. I'll go to Azure central. Oh, sorry, tools operational commands. Yep. All right, so from here operational actions. So yeah, these are great useful operational powerful tools, right? Where you.46:23You can request port hop, reset lock user, that's a big one in case folks, you know, accidentally log in too many times, get locked out or forget your password.46:43That's a very helpful tool to get, you know, access back to that router, and validate easier way to remove your devices from vmanage, stop data traffic and factory reset. Okay, so going back to the main, what we just talked about, right, was that.46:52With us.47:12Powerful, SD WAN AI assistant, right? So, right here you have your pre prompts right that you can just click in and immediately start getting a response to, and then you also have your you know your custom, your custom queries that we can use, which become very.47:13Powerful right especially when we're just trying to get different insights into our.47:33Our network, right? So, let's e.g. sorry we go, new thread, ok. So let's just say, which sites are.47:39Performing poorly, give me the summary. So as you as you'll see, the AI system will kind of walk through its process, what it's doing, give you step by step visual.47:55There, yep, it'll even tell you it's next steps, getting the data, and then once it's finished, will give us the result.48:14And depending on your network size and.48:34And all the data that's there, it does take the assistance some time just sort and populate that information.48:37Just in the interest of time, we'll, we'll kind of just go into the next piece right here, where you can, you can ask AI assistant to help you try troubleshoot a certain issue.49:00I'm seeing circuit lapse, what are some steps I can take to diagnose this issue?49:16So this would be a good documentation standpoint or troubleshooting, you know, example that we can use AI assistant for, you said.49:51Does take this some time, it just depends on your network and and configuration, but yeah, as you can see, great documentation and step by step.50:10Clearly lists out the different, you know, the different circuit, identifying circuits, analyzing the BFD session history, how to monitor, how to isolate and even the the official Cisco documentation for those troubleshooting steps. So super helpful there.50:18Another great thing, right, is attack reporting, so you can even, you can even ask AI assistant to say, hey, you know, we found this issue in the network, you know, based on the troubleshooting we've done and the information we've collected I would like you to create a TAC case.50:37You know, and input all the steps we've done, all the work we've done so far included in that tag case and and then go from there, right? So very powerful. You know, this, this makes opening tag cases seamless and just more effective because it's got all the steps, it's got the problem detail description, and that way the.50:53Engineer receiving the case can, can have a great, a great, you know, foot to stand on once they receive it.51:13They know what we've done and and this helps for faster resolution and getting getting through our problem, our problems. So you can also use it to summarize all your TAC cases so a great tool to get an overview of all the take attack cases you have open. You can use AI system to give you updates on those TAC cases, you know, so.51:20Yeah, awesome powerful tool here. You also have different views too, so that that's really nice if you like the dock view or you like the full screen, it all depends on what you prefer, right?51:40All right. And then quickly we'll go into, predict, predictive path insights. So sorry predictive networks.51:54So yeah, here you'll have your recommendation summary, right? All your different apps will be listed here. And then if you have any recommended actions, they'll be displayed down here below.52:15And you can see just a snapshot of what that is, switch from MPLS to private one to private one. So that's the suggestion for our office 3605 app apps here that we can double click into that to get even more information.52:25You have all the details here, right? Current path quality, the recommended path quality. So once we make that change, this is what we'd expect it to prove to or or be. The impacted client clients path recommendations, right? You can export that to a CSV file for easy viewing and, and data manipulation.52:41And then this is the the the site the remote local site to remote site, so that would include the path that would be using and then we can make that change as the predictive network will make that change, but you know once you.53:00You know decide that's what you want to do, right? The I only have read only access here so I can't demonstrate quite the, the, the, the part where we activate that policy change and and go through that, but it will walk you through those steps on making the change based on the recommendations we have here and and predictive path insights or networks.53:16And then here's the bandwidth forecast, forecasting.53:35That we can see here, our current bandwidth, you can click these on and off so you can kind of see it better. See in this assistance we don't really have like a forecasted bandwidth right now just cause there's not much traffic moving in this demo, but you can kind of scroll through the time bar here and kind of see what those lines represent.53:41And what we'd expect from that.53:59And then quickly going into anomaly, you can kind of see the, the different, this will give you a visual representation on the anomaly rates we're seeing. That'll give you a better view of like, hey, you know, how often are these anomalies happen? If you see that they're happening frequently enough, you know, that gives.54:02Just you know.54:22The ability to say, oh, I, you know, I can see this is happening much more often than it should. That'll give us a good area to start troubleshooting and kind of getting more insights in, you know, to what's going on with that anomaly, and then here we.54:23Yeah, we don't unfortunately have much more data here, but I think everyone gets the, gets the gist with this.54:43And then from yeah, from that point, I'll give it back to you Edgar. Sorry for the time to change. No, it's ok. Great, great demo, great demo, really. I I like the way to you to handle the cases using the assistant. I think everyone's gonna love that.54:49For sure. Okay I'm gonna just go to the, to the last section of this. We are gonna talk about the live protect. So there's a new feature that we're gonna have in the SD one. So practically life protect is is gonna be used to stop block vulnerabilities instantly.55:07And update in your schedule. I mean, what is the purpose of this?55:26So the idea is that it's gonna create an advanced threat protection. I mean it's gonna be is helping you to handle the vulnerabilities installing shields in your routing and sorry in your router in this case. So.55:31We can prevent the the the threat, we can have really time controls interrupted security. We can have two modes to activate this shield. One is gonna be monitoring just I mean it's like it's gonna be just detecting a report, any potential compromise that can be.55:48And occurring or protecting that means block and report everything that is a potential compromise. So the targets for this is gonna be twenty.eighty.four that is gonna be the target review that is gonna be available on this or even the 20 six.two.two that is gonna be also something that is gonna come.56:07But more details we are gonna mitigate, ok? This is means like we're gonna stop that the vulnerability be exposed, I mean I'm gonna block that vulnerability. So what, who we are gonna achieve in that? So we use.56:26Agent that is means is an agent that is gonna be running that is an extended packet filtered software that is gonna be running embedded into the ISO image. I mean you don't need to install extra software for that and it's gonna be separate. So it's gonna it's gonna be.56:43Able to dynamically remedy security threats.57:03Without using compensate compensating controls, the program execute in the Linux kernel of the device, ok? So what is the benefit? So the benefit is instead of the IT organizations needs to be patching every time that there is a vulnerability.57:06So and we know what is is the implication of that. The idea is to have a shield in order to protect that in the middle that we have the final code that is gonna be fix the vulnerability, right? So the idea is to have this protection life.57:27Another than that we should be more prepared for that. So without downtime. So how this works and how is the process normally when we have so the threat is discovered, then after the the attacker the threat is discovered, the attacker has some minutes to be exploited.57:43And then what happens normally we have the CVE published and then we have a patching gap to create, you know, the, the fix for that vulnerability, right? So that is the normal flow that we usually follow. So what is the idea with this is like when we have the the vulnerability.58:03We are gonna reduce this posture. So we're gonna reduce this posture, we're gonna preserve the uptime we are maintain the patch discipline, right? So.58:23We're gonna stop the attack, but we are not gonna stop the network to do any patching on our devices. We are gonna use this protection inside of that. So who is gonna be this is the comparison if we go with the traditional and how we can reduce the time.58:32So once we have the thread discovered, we will have a time to be disclosure advisory and then the shield to be deployed, right? And then we will have the time to patch that is gonna be running in parallel. I mean it's gonna be running in parallel to actively create the patch to fix.58:50The problem.59:10What is the difference? If we follow the traditional is the the the red line is gonna be the whole time since we had the threat discovery until we patch completed. If we just we just lie protect, we're gonna reduce that, so we gonna reduce this posture time before the patch and then we're gonna apply apply the the permanent fix.59:11If it's still needed for that, right? So practically this is the architecture, so we have our in our iOS XE we have the that is gonna be the agent that is gonna be running on the kernel of our in on the iOS XE.59:31This agent is gonna be created as a container, it's gonna be running, it's gonna be the security observability runtime enforcement tool and it's gonna be it's gonna be capturing different process and network events in order to do the enforcement onto the onto the platform, right? So.59:47Who is gonna validate Cisco's gonna validate this procedure before you deploy it, right? So we have the, we have the advisory, then the Talos is gonna do the exploit analysis and shield design.01:00:06The shield is gonna be testing and then it's gonna be disclosure the shield and batch release and the operational stage and deploy, right? So we are gonna validate the possibility to do the shield and test it out before releasing in order that you can apply.01:00:21And then we're gonna put the supported platforms, the limits and the modes, everything that you're gonna use it, right? So what you're gonna get is gonna be a validated protection, less customer important for control design, support and retirement. So everything of that is gonna be handled by Cisco.01:00:36For you.01:00:56So it's very important that I mean how we are putting Talos in this situation because at the end Talos is gonna determine if the if the shield can be built or not. So we are gonna use that technology to be aware if this is supported on the operating system, if it's the.01:00:57Caberra actionable.01:01:17What is the root cause of the problem? Operational continuity, so all of these processes gonna be handled before you receive the shield in order that you can have the alternative to protect you. So, the the life protect is gonna be observable and reversible, I mean.01:01:19It's not a black box, very black box very important. And you can then you can have the most evidence and roll back and retirement, that means like, I mean once you have deployed that, I mean and it's in function probably I mean also when you get the new patch, the new patch is gonna be probably disabled in that.01:01:38That shield because it's not required anymore, so you have to fix on the patch or once you patch your device is gonna shield, it's gonna be stopped automatically or probably you can stop manually that that shield, right? So that is the way that it's gonna it's gonna work and we see the two modes that we have. So very important to mention that this is not.01:01:58Placing the patching. I mean this is not doesn't mean like you're gonna start creating shields in order to create shields and not patch our software that is not gonna occur. The patching is gonna be running in parallel all the time and what we gonna do is just protect you and reduce the exposure time in the middle that the patch is coming reduce your exposure time.01:02:18But I'm gonna go back again with Ryan just to to show that in that demo.01:02:41So Ryan, I'm with you. Thank thanks Edgar. Let me just share my screen and we'll go over that real quick. All righty, so yeah like you know just went over with live protect, right? So in this demo in this part of the demo, I'm just gonna highlight.01:02:45Where we can find that, you know, how we can apply those shields, how we can see the progress, and, go from there. So we can find it here under the advisories, the same section we reviewed earlier, right? With security advisory section. Right now, you know, as you're mentioned, right, that we only have the live protect available.01:03:05For our controllers, but we do have support coming for WAN edges soon. So for now, you know, we only have the controllers with that we can see here.01:03:24For the shields. So right, right here we have our control components, right? Security advisory, so we can see that this security advisory does impact our, our controllers. If you click here, you can see.01:03:35The affected advisories here for our controllers so then we'll move over to live protect tab here. So this was for live protect for shields that are available and these are live protects deployed right on your devices. And you'll see there's a filter here for both control components and.01:03:50And wedge at win edges.01:04:10So we come over here. Oh, one thing I would like to mention here too is this goes for any security of vulnerabilities or life protects, right? So you can either scan now like instantly or you can go to settings and set this up on a, to scan on a certain interval, right? So right now we have weekly biweekly, and monthly.01:04:12Monthly, and then you can do a device vulnerability check.01:04:32To basically share the device configurations for your devices to see, you know, if there is any vulnerability with your current configuration. So from there, we'll go into getting the deploying the shields, so you'll come over here to live protect, go to control components.01:04:39Security advisories, right?01:04:58You'll see the advisory here, and so for that, you can deploy the shield, right? So we have protect mode and monitor mode. So we'll just do mon monitor mode for now. And you can see like a manager's shield's available, controller, which is the vsmart, right? Is available, but now we don't have one available for.01:05:00For the V bond, which, you know, the validator, so this advisory, this specific advisory doesn't affect the validator. So from here we'll go to monitor mode. It'll say initiating tasks, you click here for more details, it'll bring us to the in progress page and here you can click on the.01:05:20Logs to kind of see how that process is going.01:05:40Okay, and it's finished, you can see we've got the monitor mode is now ok it is successful as we can see here. So then we'll go back and you will see that the the shields are the are for monitor mode, right?01:05:45So this, this means that, you know, the the protect agent, you know, where we're monitoring the the these devices, these controllers for the vulnerability, right? So if there if it is of impacted or we see it's being hit with the vulnerability or some exposure, right, we'll get an alert.01:06:06And and logs to show that we're being affected or actively. No action will be taken in monetary mode, it's simply just for alerting and logging purposes. So from there, we'll go and you can filter.01:06:23Right, as well, to see the different, you know, keep track of what you have deployed, what's in protect mode and monitor mode. From that we'll go to protect mode and you can disable as well, but we'll just move straight into protect mode.01:06:40So this is actively applying the shield, right? We're we're doing the, this will actually stop the device from being affected and protected from that vulnerability. And again, we can kind of see the logs here for that too. So if there's any error issue, it will see it here.01:06:59As well, alright and then you know as you can see it went from available to monitor and then now to protecting.01:07:17So that is how we can deploy those shields everyone and that'll be the end of for this demo. Thanks Edger. Thank you Ryan, thanks. So then with that we are just going to the to the final of this presentation and this session just as conclusion, please measure operation and monitor and easy.01:07:36See using all the dashboard and capabilities that we mentioned on the 1st section I mean.01:07:57Very easy to use all of that. Use AI, start using AI for your network ability and user experience, you can use a agent as you saw. It's very easy to start, you know, answering questions on get a deep research on that and troubleshoot. And the final point is like mitigate your trade.01:08:01That you saw how easy is to we can protect our systems to vulnerabilities that is gonna be something that everyone wants to achieve, right? With that, well, we will have an extra session that is putting on on the on the chat and it's gonna be the final session for this for this season.01:08:22And we are gonna provide also Aris shared the community page that you can subscribe to the common session of everyone or check the the recordings that we have for the previous previous sessions. With that I'm just gonna say thanks to everyone, thanks to Rice to share Ryan to be this.01:08:41On this session, I hope to see you soon on the next exploring science series. And and finally, you're gonna receive a final survey after ending this session, please just answer that. It's gonna help us to improve and have more visibility about what are you looking for from these sessions. Thanks for everyone. Bye.01:08:59