Exploring the Power of Cisco Secure Firewall 10.x Release

Once again, thank you for joining us for this session, exploring the power of Cisco secure firewall ten.X release. My name is Harry Davis and I'm the director of customer dot.00:11Option for the secure firewall product. Joining me today and leading this presentation is Alexander Torez, customer success specialist for the secure Firewall product line. Before we start a couple of housekeeping notes, please feel free to ask any questions in the Q and A section in our panel of customer success engineers will answer as many as those as possible. We anticipate this material will take nearly the full hour, but we will try to answer some of your questions.00:20If possible. Once the event ends, we will capture any outstanding questions in a follow up email that we'll send to all attendees. Finally, there will be a short survey and again at the end asking about the webinar and an option to request further adoption assistance. With that completed I will hand over to Alexander to kick off the session.00:41Oh, thank you Harry. Thank you everyone again for joining this webinar series. As Harry was saying, my name is Alexander Torres. I'm a customer success specialist for secure firewall.00:58Currently supporting customers in our adoption of secure firewall features. Today we'll be talking about the, well, we will be briefly talking about the new additions soup ten.one version. We will be reviewing requirements to adopt.01:17Like these features specifically on the firewall side and.01:37Yeah, so let's kick it off. So I would like to bring your attention here and start this this webinar with a brief introduction to the concept of hybrid mesh firewall and I would like to bring your attention to the section at the top here.01:42With the security outcomes, hybrid mesh firewall is an architectural concept designed to deliver critical security outcomes.02:02At the score it provides robust network segmentation, which allows you to logically divide your network to limit the blast radius of any potential breach. So it offers advanced macro and micro segmentation capabilities.02:12And by enabling granular control over traffic flow, not just between broad network zones, but also within specific application and workloads. And of course this significantly enhances your security posture. By leveraging advanced threat detection and exploit protection, we can proactively.02:29We identify a neutralized sophisticated threats.02:49Before they can impact your operations. Let me just and then finally it leverages cutting edge AI security to continuously learn, adapt, and improve threat detection and response.02:52And this makes your defense is smarter and more effective. All of these outcomes are unified under a single security cloud control plane, which is allows you to write policy once and enforce it across the entire mesh.03:10Of your hybrid environment, including like perimeter defense distributor segmentation, workload, runtime protection, AI model and AI security, and all of this is also integrated with visibility on a Splunk platform to prebuilt via prebuilt dashboards and native frontime applications.03:26And this is this allows the users to experience to experience at one security view across traditional and cloud native environments within Cisco cloud control platform, you can bring every Cisco domain into one consistent environment and with that.03:46Enabling teams to proactively manage and operate across the full IT state.04:07From a single experience for simpler operations, faster decision and lower friction, of course. Having said that let's talk a little bit about firewall platforms before we dive in into the new things that have been.04:12Been Included with a version ten.O of course we want to briefly talk about the platform, the product on top of which all of these is running. Let's take a closer look to the latest updates on on the platform so just so we can have like additional context.04:32So this is the current secure fire portfolio what we're seeing here is ranging from the branch and all the way to the data center or service providers. These are the platforms that are currently being sold by Cisco on a secure fire.04:52World.05:12Family of products including our cloud options as October 2026, I mean starting from the left here we have the 200 series with two models. One of them is like brand new model, which was re recently announced. I will show that in a another.05:13Next slide, as we will see well metrics here are measuring the device's performance when running basic NGFW services including application visibility and control and intrusion prevention. So.05:33So right after the 200 series we have the 1200 series which has six models in it, the 31 series, 3100 series with five models, 4200 series with three models.05:51And all of this range from 18 gbps 45 gbps and 140 gb/s respectively. In the data centers segment we have, well, this AI data center focused platform, which is the 6100.06:09The serious as of today, it has.06:29Four models, two of them are like brand new as we will see and this series of platforms is of course running is designed to support an outstanding 60 hundred 635 gb/s.06:32And last but not least, we have, of course, our cloud options. We have a bunch of different variants for virtual ftds or private and public cloud platforms on where this can be adapted. And basically on.06:50Version ten.one the FTD view was made available as well. Well, it actually came in a previous release, it's not new on ten.one, but it's come it's it's it's available that's on on this version. One of the things of the numbers is that these reflect real inspection and not.07:09Just basic firewall features overall.07:29So let's just keep that in mind. So this table here of course kind of like summarizes the, the performance tiers available for virtual ftds arranging all.07:32Framing it from.07:52FTDB five and going like kind of incrementally up to the bottom. We have units that have different performance tier licenses depending basically on the license that you purchased then that will be the right limit assigned to the to the virtual appliance.07:55You that you purchase.08:14So that you're installing your virtual environment, whether it's private or public cloud. So, a ranging from FTDB five with a rate limit of 100 mbps and going all the way to the FTDB 100 with a rate limit of 60 16 gb.08:15Per second.08:35And up to 10000 simultaneous remote access sessions. So each of the tiers will have its CPU and memory resource allocation requirements, of course. The FTDB pay as you go. PAYG here gives you flexibility to manage performance and rate limit.08:36Based on your cloud provider's choice. So basically whatever you define on your cloud provider is what you will be able to use from up to ten K remote access VPN session limit. The FTDBU and the U stands for unlimit.08:56Will be the high performance model which came in version ten is basically the kind of like the previous major release. There is NO throughput defined for it. It helps with what you give it so for instance if you created with 32 cores or CPU cores.09:15You can have up to 20 K remote access VPN sessions, and so on like for 64 call course and 128 gb of RAM, then you can have 32000 mode access VPN sessions.09:35In the ten.one, the unlimited extends to AWS. This is what is new. Ten one zero is for private clouds, basically you were able to use the FTDBU on jvmiss or ESXi, but in ten.one we extended that capability to AWS.09:55Again, new members of the 6100 family are the 6120 and 6130 here. These are in industry leading price performance high highest performance per rack unit. This is our AI data center product.10:18Aimed for service providers and mobile carriers. They initially launched with an ASA software only with the performance tier as described here, the 6120 with a firewalling capacity of 350 gbps.10:37And, 6130 with a firewalling capacity of 550 gb/s and concerning VPNs, they have 1705 and 02:20 5 gb per secondly. Again, these are meant to.10:56For ASA only, alright? For FTD we do have the on the major segment of of products, we have the 6160 and the 6170 which can run FTD version ten.oh of course and ten.one.11:16As well, they provide basic flexibility to address every modern NGFW use case with two CPUs included in them with a 199 of proof 02:56 physical cores.11:35And, so now these models are not new. They are not new on ten.one, they were made available since previous version and they have of course like twelve sfps 56 available and for.11:50US FP 56, which is great like interfaces built in plus of course two network model base.12:10Which can be detached as needed, the 1.5 through 2.3 tb of RAM, we have two and redundants power supplies, of course.12:17Just a little bit of the hardware in here. Just going all the way back to the smallest series, we have the one the secure firewall 220. This basically of course designed for smaller environments with with eight giga.12:35Bytes of DDR five RAM.12:55On a on better accelerators for encryption and traffic processing, but the newest member of the series of the 200 series is the 240 P where the P stands for power over internet. Basically, this unit will have four ports.12:58Assigned for power over internet for up to 120 white watts total that can be supplied.13:18So it allows you to power something like an access point, a camera, an IP phone and if they are basically directly connected to these ports, they also support active standby. Of course, there's NO clustering support which is aimed for.13:27Higher end platforms like like the 6100 that we saw before, but this unit will have the capability to support active standby failover.13:47Oh, this is great for a unit of these sites sock embedded accelerators for encryption and traffic processing and about three to 2 gb/s for next generation firewall traffic profiles.13:58This unit is of course new in the version ten.one that oh, so this could be the the lower of the lowest version that it will be able to run.14:16So basically let's take let's take some time to see what's included in version 10:10 is of course the our flagship version as of today it had a big bunch of like new features that were introduced when it came out. We will see of course what's new.14:32On version ten.one in a later.14:52A slide here, but for now let's take some time to see again what is included in version ten.zero. Basically this for instance, these are not new features, these have been there for quite some time.14:55However, as they, as the new versions are introduced or new versions are are made available to the public, new features are are are added to if and so it gets it keeps getting better as new versions are released or publishes as I said.15:13So, included this, this is I mean version ten and version ten at one are not the exception to that rule on if on basically dynamic app interface without decrypting traffic include was included it and it includes now Quickmel has a better accurac.15:32Urgency and performance and scale.15:52As for Splunk integration with our with the FMC was included, this is something great because it facilitates the adoption of Splunk. In version seven.x, there were some gaps in streaming and syslogs and these were improved in version ten.15:55Including of course like the easy configuration. Advanced logging gets you seek style logs that can be sent from the firewall directly to the CM. So be aware of the performance overhead with that because the firewall needs to be sized accordingly.16:14But this is a unique capability for our firewall and it's a feature for which other organizations have put in a dedicated infrastructure outside of the firewall to handle in our case, on version ten you can have the option to include six logs directly from the firewall, which is great, of course.16:34Identity and virtual patching is also something that was included. Something new on this area we have the dynamic firewall risk score drive policy and we have the integration with the tenable.16:56Integration we are excited this is something of course we are excited about is also like multiple real life helpers that have been added and some additional options that will be available once you integrate your FMC with security cloud.17:12Control they will be only available if your FMC is actually running version ten. And currently these are one of these things includes the AI ops. Usability and virtual environments improvements we have FTDVU as I said before.17:30FTDC container and of course there is a great focus on UI simplification from our developers.17:50So let's take review how the firewall interconnects with a firewall management center. This is of course part of the feature set that I was mentioning before. We will see a quick demo about it and which can give us an idea on how to.18:06Great these features, these great features together. So of course we, these features are currently available on version.ten ten.O.18:26We've got a few feature lists on the left hand and our right hand side of this slide here for cloud connection direct on prem connection. So traditionally see ICE integration works via PX grid.18:35Whether it is either a connection or via PS grid cloud. In this session, we will be focusing on features not directly like the process for the upgrade of the appliances. As you will see this purposes to be.18:50Give you like an idea of what are the reasons for you to if you decide to upgrade, what are the reasons for, for that?19:10That you could use. So yes. So moving on on dynamic firewall is getting into identity intelligence and also some ICE capabilities.19:18So with CII or Cisco identity intelligence, we can now determine trust levels for a user dynamically, which means this is not just a login once and validate against Active Directory and you're done.19:35This is, this means constant constant checks validation of user behavior and dynamic changing of user posture. This means the integration of course with a security Cisco identity intelligence.19:53We can also combine this with the ICE posture model, this part of the secure client deployed on the endpoint. With this integration, you'll get access to a million posture checks and then you can check antivirus patch status, individuals.20:10Files and registry entries.20:30And these are just a few of the tons of things that you can check on a host with the ice posture module. So we can combine these two using our PX grid cloud and our Cisco identity intelligence in the secure firewall.20:34And we can take that user risk explainability provided by Cisco identity intelligence and the device risk explainability provided by ice poster and use that for dynamic access control on the firewall itself.20:54So either to take actions based on their user risk or the device risk from both sources. So if our default state is allowing access, e.g..21:11We can take to, we can take changes to users and device trust and use that for quarantine and remediation actions through dynamic firewall routes. So as the user poster changes or as the device poster changes.21:28We can then populate these dynamic rules according to the criteria we specify and then restrict or allow access based on the posture of the device and the and the user. As you identify the different conditions which are fully customizable.21:44You can determine which posture you can you want to restrict and how you want.22:05Different levels of user trustworthiness. So just give me 1 s here. I need to get things ready for a second so I I have prepared.22:11Heard a live demo about this.22:31It's going to be a bit comprehensive, but hopefully it will break down to the components in a digestible format for everybody. It will, it will have it will give you this chance to have experience on and all of the things that we've talked so far.22:34So we will start with our user risk scoring, user risk scoring. This is our identity intelligence UI right here. So we can have our list of users and we're going to go ahead and do a search for a specific user here that will be.22:53Following across the course of this demo.23:13And this case it is a user with a questionable level of trust and you can see here we failed five checks. So we can go ahead and drill down on this and we'll see a quick overview of some of the checks that have failed. You saw that we had a list of the full list of checks and we've got a lot.23:15March number.23:35Of different criteria that can be used to make that questionable designation. So over here in security cloud control, we've got a trusted device and once again that questionable So that shows how we can separate that trust level between the user.23:38On the device and make a differentiations based on which one and not just doing one identity but two different components as well. So that transit device disposition comes from identity service engine.23:56So we'll navigate to over to ICE and we'll check our policy here. So as I covered before, there are a large number of different criteria that the device posture model can monitor on the endpoint itself, and here we see a fairly simple policy. This is basically checking for the presence of a file.24:15It's looking for an anti malware, whether it's enabled, whether we have an endpoint firewall enabled and a few other components, but once again, the ice poster model is difficult to configure but very granular, very capable in what it can monitor even down to hard work like inserting a USB drive, e.g..24:34So we can take all that device posture information and bring it into our FMC and we're back to security cloud controller in our dashboard here and we have a dashboard widget that can check operations in user risk.24:51Which is highlighted right here. So if we have a spike in risky user behavior, we can get notified right here on the dashboard and then we can drill down on it. We can see a description of what's going wrong. We can see users highlighted that have experienced a change in trust and there is.25:08And why they have experienced that change in trust, and then lastly and perhaps most importantly, we can also have our remediation actions so this all ties back to the access control policy and dynamic objects as we covered in our prior slides.25:27So we'll go ahead and build over there and take a look at our access control policy, and once again, this is going to be populated by dynamic objects as we are highlighting here that represent different level of levels of trust.25:43So as a user goes from trusted to untrusted, the dynamic attribute that they are mapped to can change and that can result in a block or an allow action. So in this final section here.25:59In this final section here, we're going to go and ahead and do a change in the trust action. So we're going to have a user login from a little bit of an unexpected area. And then rather than doing their MFA normally, they're going to do a bypass.26:18A bypasscode, excuse me, I need to. Right, so.26:37Alright, so let's run this again. They will, they will have our yes, they will do our bypasscode, so that is still going to be accepted and device bypasscode that you would see here and it still allows, it still allows to login, but it's all.27:01So a little bit of an unusual activity and that's the kind of activity that.27:20CII can monitor. So we're backed into security cloud control and we have our our log that shows that user is indeed untrusted based on a few of those flags, which once again are fully customizable on our side. If we go to the identity intelligence tab.27:25Within security control we can take a look at the different user checks and get a history of our activity that led to this this position and then under unified events we can see a change in the trust in place. So we saw how this user initiated a few pieces of activity that were a little unusual.27:46And that resulted in them going from a standard access which was allowed into a mapping to the untrusted user the dynamic attribute. And this resulted in a change of access which is now blocking an internal resource.28:05So this might have been a little bit too comprehensive this is of course that there are multiple components here, but it was a good example to show how we can bring all of these together, some powerful integrations to provide that zero trust and not just detection but also like monitoring that change in.28:22And also remediation actions that are applied dynamically through those dynamic objects. Moving on to another feature on version ten.oh.28:42We have tenable in tenable vulnerability management basically discovers vulnerability information for organizations. Tenable is the leader in vulnerability management. Different organizations do monthly or weekly vulnerability scans to identify hosts.28:59It's vulnerable in the network and this sets the vulnerability patching schedule. So from the FTD perspective, this just means enabling on an IPS rule that will block an exploitable vulnerability. The way it works is that.29:19As network scanners find vulnerabilities, the tainable VM maintains a centralized vulnerability repository and this repository is then as integrated with this FMC and the FTD to apply remediations or actions with the traffic.29:36With the traffic itself. So from the FTD perspective, it's it just it is just an IPS rule that will have updated in signatures or intrusion rules depending on on the recommendations given by the integration whether the connector integration.29:55Integration with the leveraging the integration with tenable, which means we can pull that information directly from the cloud real time. So to leverage this we apply an intrusion rule via tenable CX deck.30:14That can then protect hosts against attacked for these vulnerabilities. This also uses the dynamic objects where if we have a vulnerability scan that detects a vulnerability on certain hosts, we can then change the access to that host if we desire.30:34So we'll have a quick demo here to showcase the configuration. And here we have a dynamic attribute connector, as I said before, it's just an integration with tenable, with the, in this case a cloud delivered FMC under security cloud control.30:53We can set two settings like severity systems CVSS that we integrate from the connector or the severity score that we'll we will be downloading. In this case we have a low severity score, so we'll collect all this information. Then within policies and the recommendations.31:13We can set up the level of recommendations, so whichever host that has been labeled as compromised with in this case a high security level vulnerability, then it will be classified as a value.31:33To be included into the into the recommendations here, right? So once we generate and apply the FMC will collect all of the vulnerability database from the tenable and then it will create this recommend this list of recommended rules or intrusion actions.31:53As as you can see here said by the recommendation, so the rules will be, I mean if accepted then will be of course enforced to protect those specific hosts. So this is just another way of using a tenable integration on F.32:11In version ten.zero. All right, so having said that let's move on with the features available on version ten.one. As I said before version ten.zero is currently packed with far more new features.32:33But there's still a lot of new things included one which are worth mentioning. 1st of all, hybrid private access, which allows you to use a common CTNA policy across both secure access and secure firewall.32:49So we create the policy once and we can enforce it on hosts as they come into, for instance, go to work into the or in the campus or remotely or from a coffee shop, and we can choose the traffic path, so.33:07We can, we have that resource protected in our campus so we can redirect connections there regardless of where the user is. So newly in version ten.one, we have hybrid private access deployments that can now support IPv six traffic flows.33:25We have expanded platform support, now we support every model except this is supporting in every model except the cisco secure firewall 202 hundred series and this includes all models like the 1260 100 series appliances.33:44And there is NO more their requirement to have a dedicated CPU core for hybrid private access. The tunnel set up with secure access. So our development team, as I said before, is putting a lot of effort into.34:02Creating new.34:22Easy to use research, new in version ten.one oh we have the secure access option under the sassy topology diagram here when creating a VPN topology. So the single workflow from security cloud control is to create to automate tunnel creation between managed firewall.34:24Use your access.34:44Integrated in security cloud control. So minimal clicks this will of course reduce the configuration errors and at the time to establish working tunnels. This is much easier to use when compared to how it was done in the past.34:45So, another new feature included on is of course multicast across FVTI side to side tunnels. Multicast traffic is now supported to be sent over an encrypted tunnel using SVTI side to side tunnels. Multicast can be used for video broadcast, data replication.35:05Financial feeds, so if your organization uses multicast and are if if you are interested in having that traffic encrypted over a side to side tunnel, you can now do that on version ten.one.35:25CSDAC air gap support, Cisco this stands for Cisco Secure Dynamic Attributes connector as we saw before. This has been so far used to dynamically adapt your firewall policy in real time to the changes in public and private cloud workloads.35:46And by allowing you to manage workload attributes fits obtained from multiple public or private cloud environments. But with this feature you can now go to software.cisco.com, download a CSDAC file and install it on the FMC.36:03Once the file is installed in your FMC, you can, the FMC will be able to have CSDAC integrations without going out to the internet. So this can be useful for things like cyber vision, V Center and Apic and generic, even with generic text, you should be able to.36:19In adopt this integration and update the dynamic attributes connector and this I kind of like slightly mentioned this before.36:40For encrypted visibility engine has is not a new feature is of course involving.36:59With the time here we have like a kind of like a brief roadmap of or on how if has evolved since it's released on version seven.two, starting with fingerprints and application detector seven four active blocking seven six with integration of HTTP three on a.37:07Up week.37:27To be detected by if on seven seven, they bypass encryption for low risk connections. On version ten there was an improvement on the how if it's is configured on the UI and the designation of the threat confidence score, it was reduced.37:30To only like two options.37:48And then there are of course new widgets available. On version ten.one we have a new feature well if enhances its capabilities to derive fingerprints from SSH key exchanges and stone binding requests, which means the Eve will be able to identify applications.37:50Running SSH through the FTD and identify client processes.38:10So this is a very exciting feature in this example here, we are seeing like real traffic for an SSH application passing, sending traffic through the FTD and currently without without the encryption capacity capability or if even without having a.38:16And a decryption policy in your FTD, if we'll be able to create signatures based on their application data running this SSH connection and of course identify that in this case it was.38:36It was, it was a party as you will see in the next slide party application running here and this this is visible because you NO longer will have malware hidden on trusted protocols like SSH anymore.38:53This is a quick example on how the fingerprint looks on on the, on the unified connection event. Basically here we can see the SSH fingerprint and it was successfully to successfully identify the process name in this case as.39:18Said it would be a body.39:38As a requirement for, for it to be able to use this capability of identifying SSH applications, of course it requires your FTD to be in version ten.one and have an updated BDB version of at least four.39:4128.40:01In case you are not aware, if updates is database table based on VDB updates, so make sure that you have a periodic update and running on your FMC so it automatically downloads bdb's updates as they are released.40:03And they will be pushed to their devices upon the next policy deployment. It's the recommended feature to have if it's a very, one of the features that I highly recommend to have enabled in our customers. And as I said, this keeps getting better.40:21And it's definitely worth to give it a shot in case you haven't used it yet new on tenant one we have also now the capabilities of identified encrypted DNA.40:37DNS infection, this is.40:57This is something great so far, the firewall has been added the capabilities to decrypt and inspect support for DNS over HTTPS or or quick traffic does the DNS payloads inside HTTP and quick steams when traffic is.40:59Encrypted so it's NO longer the case that the DNS malicious traffic will be able to hide from the firewall even if open like encrypted connections.41:19The FTD will be able to DNS use the DNS service inspector to apply policy enforcements and either allow or drop this encrypted DNS traffic. One other, as I said just like.41:29If Snortel is another feature that keeps getting better.41:49This is also like one of their very recommended features to have enabling your FTD in case you haven't done so yet with the version ten.one has been enhanced with the capability to now detect SQL injection HTTP common injection and cross site scripting.41:53So of course we can identify URL queries, URL encoded post data and multi platform data post data in addition to the HTTP ORI. So this is just a quick example of here identifying vulnerability exploitation attempt.42:14Arbitrary script embedded in a forma format case number here is a potential thread that ACDP parameters was able to classify thanks to the intrusion rule in this case as machine learning.42:33This all of these builds in a SNORTHMML foundation. So this is already a powerful tool in our arsenal. Again, it leverage machine learning to detect sophisticated threats so it it keeps expanding, it keeps growing. We're committed to providing comprehensive protection against common and emerging exploit techniques.42:57So be an expected coverage, we've also focused on making even more efficient. So there is great focus from our developers to for to this specific signature if you haven't started using it yet, it's a good time.43:17With the version tender one. That being said, I thank you all for your attention during this session. I hope this was helpful for you guys. My name again is Alexander Torress. I'm a CSS on Cisco and.43:37Thank you everyone any qui I think we have one more question that I saw there. No, maybe there's NO questions. Any if you have any questions, please let us know.43:53Give it just a minute I guess there's NO questions right now. So again, thank you again for spending time with us on this topic and for all the group any for the questions we did have. Please commute our survey at the end and we are gonna look out for the any Q and A email follow up and enjoy.44:14Wait the rest of your day.44:34