Intro to SASE

Hello everyone. My name is Max Gainer, and welcome today's webinar covering Sassy.00:10Today we have Diego Barantez and Kevin Hudson as our presenters. We also have some time at the end of the call or the webinar for some Q and A over chat, so you can put your questions in there and then we'll go over those answers as best as we can when we're finished.00:16And also we're gonna have a Slido with some questions on it as well to get the webinar started. Okay, looks like we're, I think ready to start our webinar.00:33Diego, could you advance to the next slide? So this is just a quick overview of what we're gonna be doing on the webinar today. So we're gonna have the sassy overview 1st and we're gonna be going over the solution architecture.00:49Then we're gonna go over SIA or secure internet access, SPA or secure private access, and then finally selecting a deployment method that best used for best for your use case. So Kevin, I'll hand it over to you.01:04Hi, Kevin Hudson. I have my technical CSS with Umbrella and Secure Access. I've been with Cisco for about eight years. We're gonna start with the sassy overview to begin with that, let's go ahead and.01:20Look at some of the, the past history of where we came from. So remote users, we've got users and devices and apps have all changed over the past 51015 years. Remote users were all very familiar that COVID.01:35Rapidly expanded the need for access. In order to not overwhelm circuits engineers decided, ok, well, we'll hairpin all this traffic right back out. But that crushed the user experience for products such as Webex and Zoom.01:56For personal and mobile devices, four G about 1015 years ago was the main driver of that. The security teams really had NO way to protect their infrastructure because you're pushing out with the MDM but it has NO access to any.02:16Kind of triple A at the time. For IoT devices, security teams were trying to use VLAN and Mac white listing, but that rapidly grew unmanageable because then you have devices such as cell phones which can swap their Mac.02:34For cloud applications, companies tried initially to just use vas to make everything work, but, that failed to scale to enterprise. And for software as a service.02:54On prem proxies and pack files became a management nightmare, and then in terms of decrypting all that outbound traffic to run features such as DLP, that crashed out their hardware.03:12And then lastly, with the hybrid mesh setting up MPLS has an expensive cost and it takes a lot of time to deploy it. So, all of these changes were happening, everything was.03:29Attempting to be fixed and that fix generally worked until it didn't. So then all of those changes in the user's applications and devices coincided with the changes in the direction of traffic and the destinations of that traffic.03:46And we switch from the initial AD 20 being internal traffic to now being AD 20 external traffic, and that leads to several option or several difficulties that have to be dealt with.04:04App performance at that bottleneck is gonna cause packet drops latency, and that's going to cause your users to be unhappy with the degraded performance.04:22From real time things like voice and video. Can you go back one?04:41And your overworked hardware is going to be dropping packets so you go ahead and turn off inspection which leads you holes in your security. So all of that together means you have to find a way to combine your ability to control your traffic and control your security.04:46Whether whatever destination or whatever source the traffic is. So that's why we're looking at the Cisco sassy. Next page Diego. So we have.05:05SD WAN, which is splitting your traffic between your internet and your local, and then we have the Cisco security, secure access. It's moving the security stack from your perimeter out to the cloud, which means it's closer to your roaming devices and your branches.05:21Alrighty, thank you very much, Kevin. So then my name is Diego Arrantez and I'm one of Kevin colleagues with our signature customer success team. So I'm gonna be talking a little bit about our solution architecture for both SD one and secure access.05:50So as you've heard sassy is the combination of both networking services and security combined together in gardner's definition. Here on this particular slide, we're actually.06:11Not being maybe 100 % accurate with today's with the sessions topic because we're here we're gonna talk about our template functionality, which is not as unified as we would like. However, in our next session with our automated tunnel setup, we do bring everything together in a.06:29A single dashboard with secure control. So we're gonna cover both deployment methods today, again, focus on manual templates, which they do require you to change between SD one dashboard and secure. You're gonna see.06:49The next minutes, and then our next session is gonna bring you that whole unified experience. Okay, in regards on our networking as the one size, as you know, we have that application quality of experience that QoS per application, we want to have that one optimization.07:08And then routing.07:27The networking, deep analytics, acceleration, and then on box security for certain workflows. So this is gonna bring our connectivity portion where through IPsec tunnel send all of that to secure access, which is gonna be our security stack on the cloud, which is gonna allow us to.07:29Do DLP firewall as a service, CTNA, secure AI workloads.07:49Functionality remote browser isolation or RBI, web security gateway, so that URL filtering capability and also not included here DNS.07:57Now, for secure access, this is kind of like an overview on how it works. We're gonna have different redirection methods, more commonly for remote managed devices. We're gonna have a client installed, which is gonna be our roaming security module or the umbrella module, as you might know it for.08:15Past, we're gonna have our new CTA module that supports both internet and private traffic workflows, and then we also have VPN as a service utilizing any connect but connecting to a head end on the cloud provided by secure access. We can also have clientless CTA.08:35Or browser based CTA for unmanaged devices, very commonly used for a contractor use case.08:55And then particularly relevant here on the session, it's gonna be our branch to branch or IoT protection based on IPsec tunnels. So then on the left, we have all of the methods on how we're gonna acquire the user traffic.09:02And then we're gonna send it to secure access within secure access once we have that traffic in our secure cloud, then based on your specific configuration, we're gonna be able to enforce all of the different mechanisms to inspect and allow deny.09:21That traffic. We can use DNS categories, URL filtering, layer seven firewall with gateway, DLP. We're gonna posture check your device to make sure that it has something like encrypted hardware, the latest release.09:40Any hot patch or specific fixes for the OS. And we also have our digital experience management where we're gonna measure that user experience that Kevin was talking about powered by thousandeyes, which it's included in your secure access subscription.09:59And then lastly, on the right, it is how we're gonna handle the traffic after it gets allowed. So we're gonna have two options. Either you're gonna egress through or not range, meaning that the.10:19Traffic is gonna exit from the Cisco infrastructure or in the case of private access, we're gonna backhold it to either your on premise devices or any private cloud workflows you may have.10:34Oh six as the one solution minimum version for templates, it is 10.5 and six.10:52Five for the CH, we're gonna support both IPsec and BGP tunnels. Very important Secure access doesn't support GRE, but it is supported for another 3rd party vendors of SSC.11:10We also support tunnel redundancy using ECMP and we have high availability with a primary and secondary hops. We can be routing either static or dynamic, and we have the possibility of terminating up to.11:2640 active and 40 backup tunnels.11:46And we do support a lot of different BGP attributes to be advertised from SSE. Now, with our SIA template, this tends to be a little bit more simpler because then we don't have to worry about any.11:51Routing decisions. Minimum version is exactly the same 10.5 and 17.5. We also support NAT, so you can configure net rules within secure access.12:07Here we do have active standby of eight active and eight backup per device. We can use ECMP to increase the capability of the tunnels so we can have up to eight tunnels sending traffic for the primary hub and then eight tunnels for our secondary hub.12:22And multiple server sites VPN VRF per policy. Now, let's talk how the tunnels work. So every time you get tunnels within secure access, you're gonna be giving what's called a network tunnel group.12:44NTG.13:04So these tunnels are always gonna give you two different IPs. They're gonna give you a primary hub and a secondary hop within the region. The, this pair of hubs works in a active standby scenario.13:06So you should only send traffic at a given time to a specific hub. Either you send all the traffic to the primary or or the traffic to the secondary. If you need to go over the one gig throughput of a tunnel, again, you can bundle multiple tunnels through ECM.13:25But the idea it is that all of your active traffic must go to a single hop. The secondary hop is gonna be there for failover purposes.13:45In case there is an issue with the primary hub, either plan maintenance and outage either on Cisco side or maybe something between your edge device and our infrastructure. So e.g. here we're gonna see an example on how that looks like.13:58Within secure access.14:18All of these are different network tunnel groups, each with one primary and one secondary, so with a routing settings or IP six settings, for SIA, we do static routing and for SPA VGP.14:20And as mentioned, you can use either templates or manual tunnel configuration or the automated tunnels, which is gonna be our next session. Then you're gonna connect to our head ends where we have multiple regions across the globe.14:40That active passive scenario that I mentioned. So then here we're gonna connect to those two. The SBA network tunnel groups, they don't support NAT. NAT would only be used for tunnels that.14:59Don't have routing, so if you enable NAT and secure access, then you're gonna disable all of the routing capabilities that you may have.15:18And then here are the tunnel statistics or automated use cases and then here is a quick.15:31Example on how you would configure a network tunnel group within secure access. Here we're selecting the region, and then you see there are two hops.15:52And now an extra functionality that we added very recently is that we can even add a backup region.16:08We add our tunnel ID, here is a NAT functionality that I mentioned to you. So if you enable this, then all of the other routing functionality is gonna be disabled. Then here we can select if we wanna do routing options, either static.16:27Or dynamic.16:47So here we're adding a static route to this NTG, or with dynamic routing, we're gonna define the AS number right here, and then.16:52Of these advanced settings I really like the block default route advertisement when we're testing setting up new tunnels.17:12So that way we're only gonna send specifically add to your configuration in the case of using dynamic BGP. All right, then I'm gonna pass it over to Kevin to review our SIA use case.17:19Hi, back again with secure internet access. Let me go ahead and move. So as mentioned earlier, the main important goal of secure access is to move your security stack away from your perimeter up to the cloud and get it closer to your room.17:39Devices or branches. And the reason for this was that gigantic shift over the past 1015 years between users, applications, and devices that are being used. So.17:59When we've got the different options for the security stack, what we're looking at, how the traffic is being intercepted. What we need to identify up in the cloud is the device itself, where it's coming from.18:12How we'd apply the policy to you and also importantly where we are going to log that traffic. So we need the identity of the traffic that's coming up to us and then we depending on your decisions, need to make some decisions about inspection, whether or not you want to look at that traffic and figure out where it's.18:29Going in what is in it. So one of the 1st ways is with the roaming security module. Oh, I guess with with the pack file, the pack file.18:49Has several options. When you turn your machine on behind a protected network, if you're anyway familiar with umbrella, you know that you have to go and register your networks. What that does is it identifies traffic coming from those networks up to our 2867 servers and says.19:08Hey, this traffic belongs to this specific customer. So that immediately lets us know to apply.19:28Based on your policies, are you wanting to apply DNS? Now, because it's DNS, we're not gonna have to really worry about inspection, but the threat categories that you can set up in your policies, there's eight possible categories. You have harmful domains, phishing, malware command and control, and then.19:35Crypto DNS VPN, newly seen domains and dynamic DNS. So those are a wide variety of, of options that you can configure for your security strictly for the DNS coming out of that network.19:55Now, the next step that you can take, there's two things that need to be done for a pack file. You need to put the root cert onto the devices that are using the pack file, and in most cases this will be things that do not support using the Cisco secure clients such as servers.20:14Or VMs, but I guess the same, but once you've got the route sort on then we can start dealing with the idea of inspecting your traffic. To go backwards and get the identity, you need to do a SAML integration so that you can integrate your.20:31Active directory. And that lets us go ahead and authenticate and then inspect the browser traffic. So you are able to decrypt the traffic, build policies for DLP or AL guard, AI guardrails, set up amp or AV sandboxing, build policies for remote browseric.20:48Isolation or set up file type blocking.21:08And that's all specifically with just sending us the traffic from your network and from the ADM 04:43 traffic. The roaming security module.21:11Has almost the same features but also has a couple extra features. When you have the roaming security module, it has both the DNS module and an SWG module. You are able to set up a variety of.21:31Granular policies. You can have it work where it is off site and have both of those modules up and working all the time. If a user comes on site, you can determine whether you want either the DNS or the web module to stay up or dropdown, and then you can build different policies based on that.21:47You also want to use your ADM for info to set up your policies for DNS and web. DNS or the web policies in terms of the types of security that match up with DNS, you've got the command and control, the malware, and the phishing. Now harmful domains.22:06You can set up with RBI, but only for a warning So remote access VPN is a, a little bit more of a step than just using the secure call.22:26Client with the DNS and the web modules because you are able to actually VPN into the secure access cloud, and by doing so, you then have access to the firewalls as a service. And that allows you to get all ports, all protocols.22:46And, use IPS for known threat detection. Now there's some policy tuning that is available with that. If you have information such as HIPAA, you can put that traffic into a do not encrypt list.23:02You can also change the levels of sensitivity on that so that whatever you get logged does not overwhelm you. Or the remote access, you do need to have SAML that gives you both your authentication and allows you to do the posture checks that Diego mentioned. You're looking at your OS and your patches.23:19For the firewall as a service, there will be a requirement to use IP surrogates to map the IP address of the device over to the username so that it attaches to the policy. But again, the the main features that we're looking at, we need to make sure we have an identity.23:39And what kind of inspection you're looking at.23:57And so one of the next modules that is part of the Cisco Secure Client would be the ZTA module.24:29This allows you to, again, have almost the exact same features as the VPN as a service where you get access to the DNS protections, web protections, and any port, any protocol firewall protections.24:36Same situation where you need to have the root cert installed so that you can do the inspections and to have SAML installed so that you get your authentication and can get a posture check for the devices that are sending the traffic.24:53Or branch access. This is going to cover a lot of devices that either don't have the secure client installed or can't support the secure client like servers or guest Wi-Fi or IoT devices. If you remember from the 1st slide.25:21IoT devices overwhelmed IT departments because trying to build up these gigantic VLANs. Well, with secure access, you can use group tags and cert based authentication to keep track of your IoT devices, so you get the policies and logging for that.25:41For the servers, most likely they'll have a service account so they can use an AD username and group to get policies and logging and for users. If it's a guest user that you can't push the root cert down to, then you're basically going to be not getting.25:58Being the full capabilities of the SWG.26:18Nor will you be able to run firewall policies because that does require inspection.26:23In terms of the IPsec tunnels that would be going up from branches.26:55To the secure access cloud. Diego went over a lot of this. They have a one gig capacity. We do support multiple tunnels per deployment from branches. I believe it's eight active and eight backup.26:59We have a note there that, we recommend multiple tunnels just for redundancy.27:17In terms of increased throughput, this is one of the features that we will be looking at a little bit with the manual templates is specifically when you go in and use the SIG feature template.27:38It automatically aggregates your tunnels for ECMP. There's really nothing else you have to do. Once you point the traffic down this service VPN at the SIG, then the ECMP will automatically be configured.27:52If you look at the right hand side where you have an ISP or multiple ISPs with different bandwidths, for unequal ECMP, you can go into your VPN service VPN and change your next hop settings.28:12Change the weight on that. So for if it's 8020 you can set one to four and one to one and get that unequal costs that you want. For health checks.28:32When a specifically for the man the manual templates, you do have to put a mandatory IP tracker in. Optionally, we recommend the service.sig.umbrella.com. If you have mission critical endpoints, you can change the default.28:49Of 300 and do some custom tuning so that you get the route to get pulled at the time that you desire in terms of PBR.29:08One of the points that comes up for direct internet access, that's going to skip a large group of the protections that we offer through secure access because you're just sending that directly out to your ISP and you're not sending it up.29:26To us. Reasons that I've seen customers do that.29:45If they don't have a reserved IP and the destination does not like seeing the traffic coming from a a Cisco/sixteen, but it's somewhere you you trust. So it's like your finance department sending information to visa. Another one would be software as a service such as Webex or Teams.29:49That have a demand for high bandwidth and low latency. If you're sending that up through us, even if we're not decrypting that traffic, it's going to cause jitter and the user experience will be less than star.30:09And another good example would be guest Wi-Fi. If you don't want to build a policy and you just don't want the volume going over your IPsec tunnels up to secure access and you don't want to deal with the logs, you could just directly send that traffic out to the internet.30:23And so for secure internet access, configuring using manual templates, there's basic prereqs, the Cisco vmanage had to be twenty.five.30:47And your edge had to be seventeen.five. You do have to have internet access and NAT is enabled and the ECMP does require a loopback address to be created on the transport side. You can create multiple tunnels in the same NTG.31:03I'm Using the same ike identity and the steps.31:24For the manual template creation or secure internet access, go on to secure, Cisco secure security cloud control, build your NTG, come over to.31:41The V manage website and set up your hardware and feature templates. You for the IPsec, the SIG template, you do need to configure a tracker and you configure your ike settings based on the information you get out of the NTG.31:57And you have to put static routes in and then redirect traffic over your service VPN. Specifically using.32:17Manual hardware and feature templates to build IPsec tunnels or secure internet access. There's probably a wide variety of reasons why you may still be using templates, whether the version and hardware limitations, whether the VPN zero and service route.32:32Don't comply with complex routing you want to use or something like VRF segmentation just can't get around. If and when you're ready to migrate, we do have a tool that will help you and will move your manual tunnels over into the automatic templates and.32:49Just let us know. So, the 1st thing I am using this environment. I have my edge one, my edge two devices.33:06And the base expectation is the device template that we're dealing with will have the WAN interfaces already configured with for internet, biz internet and PLS configured already. My edge VPN zero, I.33:24Do not have my next hops configured. I'm going to leave them as device specific and configure them when I push the attachment out to the devices.33:44So, let's look on the public facing documentation. The 1st thing it asks us to do is to go to your security cloud control, choose the secure access tab.34:01And set up a network tunnel group. So I've already done that. I have my primary region and my backup region. I have a primary and a secondary tunnel in each region. My plan is to have the primary tunnels on edge one.34:17And the secondary tunnels on edge two. So as you go through the instructions, the 1st thing it says is go to configuration templates under feature template.34:34Look for VPN and Cisco Secure Internet gateway.34:52We'll just give it a name and description.35:31In the documentation it says I need to hit the generic button, so let's do that or the mandatory tracker IP. It's gotta be generally just a dummy address.35:35It cannot be a 1609 address because that's the the BGP for, the private access tunnels. Now it also recommends sending up an optional tracker.35:55If you look here, it's HTTP, services.sig.umbrella.com. That's very tiny, the environment I'm in blocks that so I do need to use.36:13A different one.36:31Okay, then we get down to beginning of configuring the tunnel. In general, I'm going to use device specific for a lot of the information.36:48So that when I push the attachment, I can just add it all there as opposed to doing it four times.37:05My tone interface for me is the gigabyte ethernet one.37:34Oh, and I just like to add little bit of differentiation between the device specific information.37:40Under the ike settings, there are a couple that need to be changed. The rekey and the DH group.38:02I Forgot to put in my key.38:19I think that should be good for tunnel one.38:48And then goes into A.40:19So if you follow the instructions, after you create the tunnels, it says go ahead and add the SIG to the VPN zero transport and management.40:38And then come back and add the SIG route to your VPN zero service route.40:56Oh, what I've found is if you have it in there, when you are updating your hardware configs.41:29One at a time, it will not push the entire config every time, and that's just a way of saving a little bit of time.41:44So, come over.42:02Okay, so what I'm gonna do is.42:22Pause to push the templates cause I'm gonna have to put in all the information into the, the attachment file. And when I come back, we can look at, we can either SSH into the devices or look at the monitor device real time, and then we can look at secure access's dashboard, so I'll be right.42:28Right back.42:47Okay, so I pushed the templates to both edge one and edge two. My interfaces all came up. I can see them up here, and if I SSH into the other one, you can see they're up up. When I look at the endpoint.42:48I can see.43:09Edge two is the backups and they are currently down down with the trackers. But when you look on the secure access side, you're technically up. So what that is doing is making sure that you're not wasting resources. If there's latency or packet jitter.43:10Or on the primaries, the backup will come up.43:30Now, you maybe aware of this, that in the SD WAN dashboard for manually configured tunnels, they are not going to show up.43:35Under tunnels SIG SSE tunnels. There's a variety of ways you can check for them by the command line. You can go into device.43:52And then over on the far left hand side scroll all down to real time and you can look for information there just to see are my tunnels being built? Yes.44:11So, that is a little bit different than the documentation here where it shows them in the the secure, the SD WAN dashboard. So I've put in to get that updated.44:31But that completes it. It's pretty simple. You build your tunnels in the SIG template, you apply the SIG template and tunnels come up. Hope you have a good day. So as I mentioned in the the video.44:50The manually configured templates do not show up in the dashboard. So in order to find out information, you need to make sure to check under your security cloud control.45:08The Connect networks and then network tunnel groups and see if they're coming up there or you can check with the command line or look for real time information.45:23And if you notice, this is.45:48Searching logs by a tunnel group, so that will let you specify which traffic you are looking for in the secure access dashboard.45:50Alright, thank you very much, Kevin. And then I'm gonna be taking over for the secure private access portion or our SBA use case to access private applications. So in secure access, we're gonna have two.46:20Two different backhaul connectivity options. One of them it's gonna be using side to side tunnels, so that's someone we're gonna focus on, but we also wanted to mention the other option which is the resource connector, and maybe we can discuss like the differences and where one will fit in.46:40Better than the other.47:00So on these backhaul tunnel, traffic is gonna generate from the CG NeT range, that's what we use for our internal routing within secure access. So you need to make sure that on your edge devices, on your internal infrastructure, the.47:01Range is allowed and not inspected by a firewall also need to make sure that there's like a route back to the CG net range. And then as mentioned previously, the NAT option is not supported for private access. In case you're already using that CG net range of 100.47:2160 four/ten for other functionality within your network, we have seen it assigned out there in the while.47:41We can change that to be sourced from a different set of ranges. So if you are not able to exclude that range, seeing that range from your network to be used exclusively for secure access, then.47:50Please reach out to support so then we can assign different ranges that are not being associated with anything else.48:09Internal infrastructure. Now, with the research connector here, things change a little bit. The traffic will be sourced from the IP that you assign to the resource connector. The research connector is gonna be this like.48:18Lightweight VM that you're gonna deploy on your network that is gonna automatically create a DTLS tunnel to secure access. So it's a lot simpler. It's a lot more plug and play.48:35The only downside it is that it supports CTNA flows only, meaning from client to server. It doesn't support, client to client or it also doesn't support VPN as a service or branch connectivity.48:51So in case you need batch connectivity or in case you need VPN, then you need to use tunnels. Again resource connector is only for CTNA flows. So what I have seen is that most of the time customers that want to leverage VPN.49:10They end up deploying tunnels for both scenarios. Also something that we wanted to, give you like a heads up is that in case you have, e.g., there in that diagram on the right side, if there's like a firewall and.49:26Say cloud ACLs or anything like that between.49:46Secure access and the resource connector, just that you're allowing the resource connector IP to reach your applications and also that that particular traffic is not inspected. As a rule of thumb, we recommend the.49:52Resource connector to be as close as possible to your applications. So then e.g. it might make sense if let's say you have a non prem data center and you have applications in AWS and UCP, then you deploy a resource connector.50:09Pair on each of those different locations. So two of them on AWS, two of them on GCP and then two of them on prem. And also another good functionality of the resource connector, it is that you can use it to create a bring your own NP environment.50:29The downside of this is that you are like hair pinning or backhauling an internet connection since it's gonna go from your CTNE client to the CTNA proxy, to the app connector, to your resource connector and then to the internet.50:48So there is like that extra hop in there because traffic goes from secure access to the resource connector on your infrastructure and then to the internet. But since it egresses from your infrastructure, then it's gonna have your own AP. So this is very good for scenarios where.51:08Certain traffic needs to come with your specific IP and not an IP from Cisco or where e.g. reserve IP is not an option. If reserve IP, it's an option it's usually better because eliminate that extra hop and then the traffic.51:28It's gonna egress directly from Cisco to the internet with an IP that Cisco lists to you. So let's go over how that looks like the entire workflow between all of this different components.51:46So let's say for remote access VPN, you're gonna go ahead and let's say you're gonna connect through DTLS and you can either authenticate using radios certificates or SAML, you're gonna connect to our VPN as a service hadn't deploy in any of our data centers hub.52:02Spots.52:22We're gonna do a posture check on your device, and then we're gonna start applying that firewall as a service capability. And if the traffic is allowed and we see e.g. that the application you're trying to access, it is behind.52:25On NTG, then it's gonna be automatically routed there through the tunnels between your Talos the one and secure access and then you're gonna have access to that application through there.52:45If you're using a CTA or mobile devices, CTA and Windows or our browser based CTA, through different mechanisms, they go from regular HTTP to quick and mask, you're gonna connect to what we call our.52:59CTNA reverse proxy or C proxy. Then we're still gonna do a posture check on the device that you're connecting from. If you pass, then it's gonna go through a very similar path. It's gonna go through our firewall services, and then if you're trying to access a.53:17Application behind an NTG, then we're gonna send the traffic there.53:36And here, on this orange arrow, let's say e.g. that CTNA on windows or Mac, we're gonna go over that scenario that I mentioned going through the research connector. So then here, same path we go through our reverse proxy on the cloud. We do the posture check.53:46We're gonna go with our firewall, and then we're gonna do the routing and then we're gonna see like, hey, this is specific application is not behind the NTG, I'm supposed to send it over to this resource connector, and then the resource connector is gonna.54:03Send that traffic to the application on your on premise. And then lastly, we also support a branch to branch use case. So let's say e.g. that these servers that we had on the left, they are trying to reach a resource on AWS.54:18So then the traffic is gonna go from that NTG.54:38Gonna go to our hubs. This is gonna go to our firewall for policy evaluation. We're gonna do all of the checks, the lab, then we're gonna see the destination for this, other different network tunnel group.54:43Based on our routing configuration. So now I'm gonna send it through this other NTG.55:02Through two different hubs that it is connected on the side to side tunnel from AWS on this example. So then now the servers have access to an application within AWS.55:09Now here, ntgs, as you have seen, they are, I always like to say that a tunnel is a tunnel, so it is not that, e.g., there is like a specific section on secure access where you specify that a tunnel it is SIA or SPA. We do tend to.55:29Comment that you keep ntgs for each use case because it simplifies routing.55:49And then depending on 2nd, it will force you for that particular tunnel to be an SIA tunnel. But there is like NO setting that says like, hey, this tunnel, it is for internet only. So a lot of the capabilities that we saw on the SIA portion are repeated here on SBA. We still.55:54To have that 1 gbps throughput capability, we can still support multiple.56:14Tunnels through ECMP for higher throughput, and we still have that same redundancy capabilities between a primary and a secondary hub.56:22ECMP is exactly the same thing. We're gonna do that low balancing done by flow pinning.56:42Is on the four tublet with source destination, destination IP, source port and destination port. And then the big difference between an SIA tunnel and an SPA tunnel, it is the different routing capabilities.56:48So as the one routers, I'm gonna share private resource prefixes through BGP to secure access. We can leverage DPI for app classification within templates. So then your edge devices are gonna exchange routes with.57:05Secure access and then within secure access we're gonna have like that.57:25Router in the sky where he's gonna be able to make routing decisions on where to send traffic. Okay, for SBA, we're gonna have.57:30Different methods of sending traffic as we saw. We can do regular VPN as a service. So same thing as SIA. We're gonna use the anyconnect module with CTNA private access, it's the same CTNA module for SIA, and then we have that branch to branch.57:47Capability as well.58:07So let's say e.g. remote access VPN as a service, we're gonna connect to a Headen in one of our data center locations and then you're gonna exit through a side to side tunnel. Then for CTA private access, we're gonna connect.58:09To our reverse proxy on the cloud and then we can use either a side to side tunnel.58:28Or a resource connector to connect to our on premise, and then for branch to branch, we use a side to side tunnel against a side to side tunnel.58:35Alrighty, so let's go over the configuration. Prerequisites are pretty much exactly the same as an SIA tunnel. I just want to highlight here the multiple tunnel requirements and the specific format.58:56Because on the SSE side, all of the tunnels must have the same local like identity does it's not supported in iOS XE or with templates.59:15Given each tunnel requires a remote accidentifier per tunnel, we have added a specific capability on the SSE head end to accept this format of tunnel ID plus a suffic.59:31So e.g., let's say that, oh, what would be like a cat nine K branch is tunnel ID at and then those numbers are given to you by secure access, then we append the suffix and that way we can create multiple tunnels. So e.g., then here we could create three.59:47The tunnels against a specific hop to get a tree.01:00:06Gigabits per second throughput by using the suffix of tunnel one, tunnel two, tunnel three. So basically you just need to add that plus sign and then a toughx at the end to be able to authenticate correctly within our head end. And this is again very specific between iOS XE and.01:00:11In secure access.01:00:30So a quick overview on our end to end process on how to configure this. Very similar on SIA, we create the NTG and secure access. We're gonna use the same tracker to check for health. We're gonna use the same feature template functionality.01:00:35Different side, we're gonna configure service side VPNs. We're gonna configure them settings based credentials that we got from secure access. We're gonna configure our BPG settings to use either static or dynamic using the AS number.01:00:54And then lastly, we're gonna configure traffic regulation that traffic goes to secure access. And same as before, here we have a quick video/demo of the configuration.01:01:09Hello, welcome to the Expert insights series. My name is Kevin Hutson. I'm a technical CSS for Umbrella and Cisco Secure Access deployments. Today we're looking at configuring a private app interconnect between SSE and SD WAN using manual templates.01:01:28Multiple reasons why you may still be using templates, whether it's because you have version and hardware limitations, whether the VPN zero and service route conflicts with more complex routing that you have or if you have issues with VRF segmentation.01:01:46Whether the issue maybe at some point if you do decide to upgrade to the automatic templates, we do have a tool that will move over your manually created tunnels with minimal problems. So what I've got is the public facing documentation about how to set this.01:02:01Up. The 1st step is to verify your network tunnel group on Cisco secure access to give you an idea of how I'm setting this up. My environment has edge router one, edge router two.01:02:21My baseline configuration is I've got VPN zero set up, my WAN interfaces with biz internet or internet, biz internet and MPLS. I do not have my.01:02:37That is basically the configuration is we will set up VPN 100, add two IPsec tunnels to it and then add by BGP to that. When I look at.01:02:56Security cloud control and my secure access page. I go to connect network connections, and then network tunnel groups. I've already got my tunnel groups configured. I have a primary and a backup data center at each data center, I have a primary and a secondary tunnel.01:03:12My intentions are to have the primary tunnels coming off of edge one and the secondary tunnels coming off of edge two. The main things I wanna are my BGP peers and my AS groups.01:03:31I also want to get my tunnel group IP and my addresses. So once I've got my network tunnel group set up.01:03:48The next step is configure SD WAN interconnect with Cisco secure access using IPsec manual method. The way that this happens is I'm going to set up a VPN 100.01:04:02I'm going to add my IPsec tunnels to that VPN, and then I'm going to add BGP in here. So, I want to go into my feature templates.01:04:18I really do need minimal configuration in here. One important thing is adding in the DNS server that will give you access to your validator.01:05:19And that's about it for the VPN 100 next I'm gonna go and add a pair.01:05:53Of VPN interface IPsec tunnels.01:06:09And make sure they are not shut down and the IP address for the tunnels will correspond to the neighbor.01:06:43That would be BGP peer.01:07:03I'm gonna leave a lot of the other information as device specific so that when I do push my attachment, I can put that information in all at one place.01:07:33I do need to adjust my MSS and MTU, to avoid fragmentation and turn off the.01:07:53Or turn on the clear fragments need to make sure to change my ike to two, my rear to 28 800.01:08:09And my DH group to 14 2048.01:08:27That's number one.01:09:04Okay, so.01:12:05So I have my VPN 100, I have my primary and backup IPsec tunnels. Now I just need to add my BGP template.01:12:06Then you can always go back to the secure, the NTG and get your information.01:12:49Alright I've gotta add my neighbors from the network tunnel group information.01:13:51Okay, so now I have everything I need, my VPN 100, my tunnels, and my BGP. So I'm gonna come over to the device template.01:16:40I'll go down to the surface VPN.01:17:00And I will add my BGP.01:17:28And then I will add.01:17:37My IPsec interfaces.01:17:40So my next step is to apply these.01:18:02To my edge routers. I'm gonna go ahead and pause, update my templates with all my information and then we can look at the results. I'll be right back alright I am back. Classic working.01:18:06Mistake. I hope some of you noticed when I was going through and creating my BGP I did not hit add. So I left off one of my neighbors.01:18:26Now, I can check everything out. I do have my BGP up and running on both my edge one and my edge two. When I go into.01:18:35Secure access all four of my tunnels up. I may have mentioned this to you previously with the manual templates, you cannot.01:18:51Come into the monitor tunnels SIG and see your temp tunnels there. So you do have to either use the CLI or go into devices.01:19:08And then over on the left hand side, down to real time.01:19:28And you can use some of those commands your tunnels are up. Other than that, again, it's the public documentation.01:19:39Creating your tunnels, the network tunnel groups on the secure access dashboard, setting up VPN 100, your IPsec tunnels into instance of BGP, and then.01:19:55I'm Attaching that to your devices. Other than that, have a good day. Alright, and then let's go over our SPA verification. So as we.01:20:11Go on the demo, very similar thing. We can go to our.01:20:31Secure access connect network tunnel groups to review the status. Keep in mind that it's still not gonna show because we're using the it's not only gonna show under monitor tunnel and seek sse? Because we're using that manual method. So it is.01:20:37Going to show up on our catalyst as the one dashboard. We need to go to the and then here we can review the IP address range, the type of routing we're doing for the SNTG, the status, and then if you want to go.01:20:54And click on the details for a specific tunnel. E.g., now here you can see all of the different client subnets that are being advertised, and then you're also gonna see a bunch of cloud subnets from that CG net range that we discussed earlier, that's totally expected.01:21:10And it's for our, internal routing of secure access. Then if you need to troubleshoot if you're having any issues with the tunnel under monitor, network connectivity, and then you can filter as needed for a specific NTG, and then here you're gonna see.01:21:29The messages, you're gonna see if a tunnel goes down, goes up, any changes done by an admin on the tunnels as well. So very useful information if there's any problem with the tunnels coming up.01:21:49And you can also see here the constant rekey as well. Alrighty. So now since we did like an overview and we went over the details of configuration of the manual templates, we do wanted to take a.01:22:07To stop and then discuss the differences between this method that we just reviewed and then the newer automated tunnel setup that we're gonna have for our next session.01:22:27So as you can see here, the comparison, the automated tunnels, it is a lot simpler. It reduces complexity complexity quite a bit on the configuration side and it also supports.01:22:39A lot of, extra features that we don't on templates. Like e.g., you can also have auto negotiated tunnel parameters. It's gonna have automatic multi region redundancy and hybrid any cast. It's better on scalability.01:22:57Then it's also fully API driven and fully automated. A lot of these things are not available on the template side.01:23:16However, when should we still continue to use templates? Templates are very good if, e.g., you're working with something other than secure access. So e.g., you have C Scaler Palo Alto Prismas or any other 3rd party vendor that does SEC.01:23:24You can still leverage templates to help you with that configuration. If your software is older than the twenty.eighteen.two that it is required the tunnels or if your specific hardware doesn't support these newer releases.01:23:43Then templates, it's gonna be a, the only option that you're gonna have.01:24:03Also, this is more so of an edge scenario. If you're using multi organization routing, given the automated tunnel setup, it does require like a video of a catalyst as the one organization.01:24:09And a secure access organization, so you cannot have, e.g., or three secure access connected to the same control on the same catalyst as you want integration.01:24:24So if you e.g. need to have like a separate instance, if you're like an MSP or if you want to like have like a separate instance just for testing or something similar, you will require to use templates. And then lastly templates, it's something that we have historically used a lot on.01:24:42And a lot of customers might still have their entire infrastructure and SD WAN setup on templates. So if you want to move to the new method of automated tunnels policy groups, we do require you to move to policy groups for management.01:25:03On that device. You cannot have templates for some things and then policy groups from others. So until you're ready to make that transition for all of your SD one stack of feature sets outside of SSE.01:25:23Then it's better that you keep using templates in the meantime, and then you move over. However, we do want to say that we would like you to move over to take advantage of all of these new functionality that we are given.01:25:40So then our idea is that you upgrade to the rated recent releases to make sure that we support policy groups, make sure that you onboard secure access and catalyst as the one into secure cloud control to have that real single dashboard unified experience.01:25:57And then to move from SD one templates to policy group configuration, for which we do have a conversion tool and a lot of documentations to help you on that journey. So once you are on policy groups.01:26:15Then we can have those three components of secure SD WAN, SSE plus our new dual and Cisco identity intelligence functionality to provide identity context aware.01:26:32Security decisions all within the single dashboard of security cloud control to provide that unified sassy management experience for which we're gonna demo to you and we're gonna discuss more in depth in next week in our next session for.01:26:50Passy.01:27:09Thank you very much. I hope this was informative. Alright, thank you everyone for joining today. The recording will be available shortly and please plan to join next week's session as well. Have a nice day.01:27:12