Transcript
Hello everyone, thank you for joining our expert insight series. We will wait few like five more minutes for our.00:10Everyone to join and then we will start with our presentation. Thank you very much.00:20We are going to start the Slido right now while we give two more minutes for other people to join. If you can help us scanning the QR code, and also you can find the Slido app if you're using the Webex app.00:26It should pop up on the, right bottom of your screen.00:43Yeah, so we are interested in knowing a little bit more about your deployment, so.01:03If you can start by telling us what version you're using for your SD WAN deployments here.01:08I don't see, ok, I I'm starting to see responses We have only one vote, three votes, ok? 2920 1215.01:3229, ok? So we have a mix of versions there. Okay, 29.01:51Skipping the lead ok 2018 is also there. Interesting. We already have someone in 26. That's very interesting. By the way I think yesterday 20 six.two was.02:06Was released as well, so we we didn't, we didn't have the time to add it yet but you should be able to use it or to test it. All right, thank you. Let's, let's move to the next one.02:26Thank you, Alejandro, maybe let's start the session or do you want to do one more one more slide or question before we start it? Yeah, now we just wait for this one and then.02:46You're ok I just realized I didn't have my camera on.03:01Okay. Okay perfect. So yeah, I hope this session will be very useful for those that have never configured it and don't don't feel very confident. So I'm gonna close the slider now. Thank you.03:21Okay, thank you very much, Alejandro. 5 min past we do have more attendees right now, so once again, welcome everyone to today's.03:37Cisco expert inside Sirius.03:57Today we are looking at introduction to SASE, integration with configuration templates. Today's session will be delivered by two expert specialists. Hiya Moreno is a senior security customer success specialist at Cisco.04:00With more than ten years of experience in technology and cyber security, he specializes in security solutions, SASE architecture and Cisco secure access.04:19And his role works closely with customers to simplify complex security challenges and help them successfully adopt, integrate and optimize their solutions. He enjoys turning technical concepts into practical outcomes, building strong relationships and ensuring customers gain real value from their technology investment.04:28Passionate about security and innovation. Hiro brings together technical expertise, a collaborative mindset, and a genuine commitment to helping organizations move forward. Security.04:49And confidently, together with him we have Alejandro Luis. He's a CCIE enterprise infrastructure certified engineer with over eight years of experience, including three years on the tag team. He specializes in Catalyst SD one and SASE helping customers adopt enterprise.05:01Networking and SASE solutions with a particular interest in automation.05:21Based in Barcelona in his free time here technical block about SD WAN. So together with those two presenters, we also have a team of specialists that will be constantly watching over any questions that you would have. So please feel free.05:26Feel free to to write them to us. I think for that we are using the the chat window today. I'm not sure if Slido has an option of posting questions over them. So please use your, your chat window or or Slido to to post your questions.05:46Where if any questions will be unanswered, we will also have.06:07And time ok yeah so in the slider you have an option to to ask questions via the Q and A tab. So please use that with that we will be able to quickly and efficiently answer all your questions that you would have about.06:11And about today's topic.06:31Okay, let's move to the next slide. We have a an agenda that will be, will be delivering today. 1st of all, we'll do an overview of sassy. Then we will also touch on the solution architecture and afterwards we'll touch on two years.06:34Most cases, we'll talk about secure internet access and a secure private access. At the end we'll do also a deployment model comparison, and that will be a good introduction and we'll also invite it for tomorrow's session that will be a further.06:53Advancement of this topic. Okay, not to waste any more time. I will now hand it over Toro to start with the 1st part of today's presentation. Enjoy. Thank you, Dominic. So hello to all. Nice to have you here. I already see.07:13Cases that I can't recognize from all deployments that are doing that we're doing together, right? So happy to have you here and to all the new people, thank you to be here and well let's start. So let's start with the sassy overview. So when we're talking about this part of the sassy overview, let's go to the shifting.07:32The IT landscape, right? So when we started thinking about SASE and we're starting thinking about what we have.07:52What we have in the in the network, right? We need to understand what we need to protect. If we know what to protect, we will be able to do that, right? So, we have remote users, we have personal and mobile devices, we have IoT devices. And then these users accessing to.08:00Cloud infrastructure, hybrid infrastructure, and cloud applications, right? So taking in consideration remote users, when we're talking about the remote users, working in home.08:20Well, they going to internet, they need to be protected from all the layer of internet, right? And even when they, they are trying to access to private applications, well, we need to protect that. And when we're talking about private applications, we are talking about cloud level applications or in the data center, in the headquarters, right? So we need to.08:31Manage how to protect that traffic. Then we have the part of personal and mobile devices, right? How are we protecting that when we have these type of devices inside of the company, right? And more complexity to that. The IoT devices. When we're talking about the part of IoT is interesting because we cannot do too much inside of these devices.08:51But for sure we can have a sassy model or we can have a way that can protect that.09:11And thinking more further than that is, are we protecting that, right? We protecting that in each firewall of the company or we have a single way to protect that and that can protect every space that we have in the network, right? So that's why you are here today. So, changes.09:17Is in the type of traffic and destination.09:37Well, let's start thinking about how the traffic is up today. Well, let's see that we have internal traffic 20 % around and the 80 % of the level of the MPLS connecting from the headquarters to the branch offices or even more. Let's start thinking about the user that are working remotely that.09:40But even these traffic need to go inside of the company.10:00And this remember me a little history that I have with a customer a long time ago. Decryption inside of the headquarter, a headache sometimes because the decryption can put the resources of the devices in a really high moment so you can understand that if you deploy in firewalls or proxies.10:03Making decryption, right?10:23So starting from there, problems, the upperformance, the user experience, how we making the IT world in the networking area and security to be one, right? To don't have fighting between people from a networking and security and work together, Tools and vendors.10:24An integration that we have in the company, right? So let's start thinking from there.10:44Then, let's start talking about SASE, unified, right? When we're talking about SASE, we are not talking just about, we have SD WAN here, we have secure access. No, we are talking about a whole concept, right? A whole architecture that we will need to have at the final. So.10:50When we're talking about the SD WAN side, high performance in the network level and when we're talking about secure access, we are talking about modern security, right? As you can understand, when we're talking about secure access, some of you are familiar with this monster because.11:09The secure access is not a product, it's a service that make and give a lot of things around the protection level, right? So you are familiar with this right now and maybe probably in the deployment you're feeling that. But today we will be focused in the manual integration between secure.11:26Because when we're doing the onboarding, we understand that this is a real problem even for our customers. So we are taking it from here today. So let me pass to the next one. That is the solution architecture.11:47Well, in this case, I will give the voice to Alejandro that will give a little introduction about the SD WAN work, so please Alejandro, go ahead. Yeah, well thank you Kairo. So as you say, this is a combination of of the two technologies. So we have on one side our security stack, but also.12:01We have the networking.12:19So all of those those users that are remotely connecting to all of the applications or their users, data centers, they need to have a connectivity or or they require a connectivity that is not only present, but that is also good. They need good performance, more and more, as users we demand good performance from the network. And this is.12:21For the SD one side of the SASE solution comes into play. So we're not going to touch in detail all of the SD WAN components and the feature it has. But the core idea here is that SD WAN has a really rich set of features that will allow the traffic to be optimized. We can shift.12:41Traffic's automatically depending on the performance.13:01We can do also some on box security, so if we're thinking about those hybrid sassy deployments where, you know, some of the sites maybe need or have the requirement to have some local security rather than on the cloud for, for various reasons. We can have all the monitoring as well embedded on the SD WAN solution.13:04And all of this is the networking side.13:24But of course, this is not the only element. We have the connectivity and we have a good connectivity, but then of course we need to secure that connectivity and this is where the security stack comes into play. So for that one, I think you're better explaining this than me so I I will hand it back to you Heider.13:27Thank you. Yes, as Alejandro comment, networking, security, unified it, right? So when we're talking about secure access, we need to think about what data is moving from our network outside and how we protecting that. We have the data loss prevention that provides at the level of compliance.13:45With HIPAA with a PCI PII or GDPR.14:04Part of the protection and even customizable rules that you can generate the firewall as a service for the non web traffic zero trust network architecture that we can make in secure access with our new model of zero trust. That doesn't mean that we cannot do that with the VPN model, that you actually or multiple customers.14:09Using that today does depends how you thinking and you make your architecture, right? The part of the EI access that is super important because.14:28Right now we are not talking about only about applications, what our or what application the users are using that we can discover throughout the cloud security broker with the shadow IT. Now we are talking about shadow EI too. So we need to have the governments about the EI access part, right?14:36So these are things that you need to have in mind, even with the SWG does the proxy solution in our site in secure access that helps you to protect the traffic, right? But you will see later on what is the traffic paths, how it works, and how.14:56The word of SD WAN and secure access get unified. Now, when we're talking about the Cisco Secure Access architecture, yes, we have too many components. We have too many things, but the things that we need to understand are the flows of the traffic. If you understand how the flow works, you will be able to determine.15:12Of how to protect the traffic, right? So.15:32When we have remote user, we have the CTA agent or the VPN as a service agent that we can use to connect to private applications or even to protect the internet traffic, right? We have clientless CTA CTA for remote to manage it so that you can.15:35Have the people that are tier party vendors working together but need access to some parts of your applications inside of the company will have the clientless access. The IPsec tunnels with SD WAN, how you connecting that, how you make a branch to branch access throughout secure access or how are you making.15:53The access through the IPsec tunnels from the headquarter to the offices through the SD one tunnels, right? So depending the architecture depending what you're doing and how you're doing that to protect that traffic, right? And then inside of secure access we have multiple components. I know you are seeing it in here, but you will understand later on in the next.16:12Like how it going and merge in a single technology, ok? So, let me move to the basic topic, right? That you need to know in order to understand SASE and also to understand secure access and SD WAN.16:32Are the network tunnel groups that you need to create in order to connect your CPUs or your SD one devices to secure access in order to protect the traffic, right? So one thing that you need to understand from here, traffic prioritize the primary tunnel and use it the secondary.16:49It will not only for failover, right?17:09You can have that architecture in order to connect to a point of presence in secure access, let's say that you are in Germany, so where you will connect to the native spot, that is Germany and you will connect your applications and permit the user to access from secure access to your data centers. ECMP support yes, we have ECM.17:12Mp support for the network tunnel groups. So you can create multiple tunnels in order to expand the the bandwidth that you can utilize, right?17:32Routing options. Well, we have all the static or BGP depending the model that you are deploying and you will understand that today. So now Alejandro I give you the the voice back to you in this area. Yeah, so in this part we wanted to explain a little bit the two main use cases.17:42That we will have with with sassy. So there are variants of it, of course, but what we are, what we want to do here is just present the basic idea or the main idea to understand how these two solutions will work together and or what is the objective of integrating them.18:02So the 1st one is secure internet access and for those devices that, sorry, for those users that want to access the internet, of course we want this connection to be secure because the internet is a, is an insecure network. So the, the basic use case here are the main use cases, how do I protect those users that are.18:20That are going to to the to the cloud.18:40To some resources over there. How do I make sure that they are secure, that they are not downloading a malicious file, that they are going where they are, they are supposed to go? And this is the 1st use case. We will see in more details how this works but the main components here is that you have your SD WAN router, your catalyst SD WAN router.18:43And then you have the IPsec tunnel that connects to Cisco secure access. And in general, you will see this is more or less the, the, the architecture that we're going to use regardless of the use cases. There are some variances, of course, on each of the use cases, but overall this is the idea. And by the way, today we're talking about catalyst, but this is true for all.19:03For other SD one technologies like you know Meraki.19:23As well, ok? So we also have a second use case that is the secure private access and here is the idea is a little bit reversed. So we want to give remote users.19:27Access to some private resources. So how do we ensure that those clients regardless if they are managed or managed, if they are using a VPN, if they are coming from the browser, how do we make sure, how do we make sure that they 1st can connect to the application or the resource?19:45And then how do we secure that connectivity? So we don't want anyone being able to, to connect to the application or to the resource. We just want the authorized users to to get there and also we can apply all the security policy to that communication as well.20:01Now, again, as I was saying, this is the main two use cases with variants, and this is exactly why we are going to explain this in a little bit more detail in a while. So on the next slide, we will see.20:21The SASE elements, so here I will leave it to you so you can explain it in a in a little bit more of detail. Sure, thank you. So when we're talking about the sassy elements or we're talking about how everything connects. Well, we know now the part of the network to know groups, right? But we.20:40You have the CPEs, so what are we doing there? So.20:59With managing the part of the tunnels, IPsec and the routing that we need to make in order to connect to our applications or to permit our users to connect to internet. Then we need to understand what is the perfect routing method in order to connect to a internet or to.21:03To the private access, e.g., for secure internet access, a static routing or data policy. When we're talking about data policy, we're talking about that we will be able to.21:23Bypass specific traffic that that we don't want it to send through secure access, e.g., what? The DNS traffic you cannot pass that through secure access. I I'm not talking about the, the DNS traffic generated by the this the the active directories or your internal.21:35Devices because you will have issues at the level of DNS. So instead of this DNS traffic through the tunnel.21:54We will exclude that traffic to go outside. And even e.g. if you have a web eh, web access through the end end user, this traffic will go through through the proxy that will be the proxy using in the agent, right? So also this traffic need to be bypassed from the cloud, right?22:01Why? Is it still the same thing? The routing can be messed up if you permit that traffic going to the cloud. That's why we come in today to talk to you about data policy, why important to bypass that. Now, when we're talking about SPA, the security private access.22:23We're talking about BGP because when you have multiple eh CPs you have your data center and even you wanted to connect or or manage how you wanted to like control the traffic because you have, let's say an example, you have a traffic in one location that also can connect.22:39To other location in other region, you can do multi regional backhaul and the only way to manage that is with BGP, right? Static routing is not a good practice to use for private access.22:59With Catalyst SD one, so this is just to have in mind, right? Now, templates. When we're talking about templates, we will go to manual tunnel configuration, that is the thing that we will focus today and policy groups with automated tunnels that will be the session that we will deliver tomorrow. Now, the headings.23:11The head end for the tunnels. When we're talking about the headends of the tunnels, we need to think about the network tunnel group that we're talking before. So we have the hub one and the hub two. Hub one will be the active eh tunnel. The hub two will be the passive tunnel. So in that way we can understand that the traffic that.23:31Flows need to go through the primary tunnel and then if something happened fall back to the secondary tunnel.23:52Then when we're talking about that part, we need to know that multi regional IPsec head ends. When we're talking about that, we have pops in France, we have pops in Spain, we have pops in Germany, we have pops around the world. So that's where you need to focus when you connect or create the network to another group in order to know where to connect the traffic.23:58Then we have the height availability eh capability that I explained before, active hub one passive hub two in this way, you see? Now, NAT, the NAT is enabled in secure access for secure internet access, right?24:19E.g., in which use case it works? E.g., you have two CPs, you are connecting these two CPEs to the same network to the group. These two routers are connecting the same traffic behind them.24:39Two secure access, so you cannot connect the same routing, e.g., same devices with the same routing through the same network to the group. That's why when you're using a secure internet access, you need to enable the NAT option. Now, when there is NO NAT, we're talking about, but another way.24:54E.g., for firewalls, when we enable the the the with Nonad is because we are able to have that capability because we don't have two CPs in that scenario, right? We have a single device and we can live with that.25:14And with SPA, e.g., when you're connecting your devices, eh, your CPU one CPU two, and you manage the routing via BGP, you need to share the same prefixes to the cloud in order to tell secure access, hey, this is the routing that you will manage. So that's it.25:29With the knownad option and then a static routing here, dynamic routing is. Now, then we need to start checking the part about the C automated. 1 gb throughput per tunnel max ten tunnels, ok? In ECMP and is the same thing.25:46There is an advantage when you're using automated tunnels and when you are doing, these tunnels with a.26:07Automated web view policy groups that you can have a maximum of each tunnel 4 gb throughput, but for that you need to support IPsec ESM, but you will see that tomorrow. Now, how are we making the connection? We're using plus addressing for the configuration of the tunnels.26:16In the manual way, ok? So you will be able to see that we're constructing multiple tunnels to the same hub and we can have.26:34Plus one, plus two plus three, right? And this at the final is one plus three. That means you can have multiple tunnels, that doesn't mean that you will have 3 gb of throughput. You will have one plus 3 gb of throughput. That means traffic will going to one side, traffic will going to other side and will.26:44Starting having.27:04Traffic at the style of, right? So this is the configuration of the tunnels, right, that you can see here. When I'm talking about the talking about this area when you configure the tunnel ID. So in the tunnel ID you have sassy 123 and then.27:07Plus one plus two plus three, and this is the way to make ECMP insecure access, but you will see that later on. And this is the practical configuration when you're doing a or establish a a tunnel, right?27:28I'm showcasing this today, because in the policy groups later on in the session of tomorrow, you are not able to do that. But in templates eh, you are able to do that without a problem, ok? So, let's go to the next slide now, this, you will be able to see that in the configuration later on too. So I'll have.27:43I give you the boys back to you.28:03Yeah, I felt a little bit in school with so many plus plus plus but I think yeah we will we will we will see it later in in greater detail. So what we, what I wanted to to to mention here because I'm conscious that we have people coming from the security world and we have people coming from the SD WAN world.28:05Right, and we're now converging this. So if your background is on SD WAN, maybe you already know this, but if you're in the security space more than on the SD one side, likely this is going to be new. So just to give some context, we have been evolving our SASE configuration.28:25Right, so when this 1st started, we used something called device and feature templates, and for that we needed some special templates, one that is the IPsec template, and the other one is called SIG secure internet gateway.28:44Each of these templates will give you the use cases that you're looking for, ok? This was our 1st approach or this is the 1st approach that we have. And depending on certain things, you might be, you know, you you're using templates or you're using a newer configuration method. So.29:00So 2nd method.29:20Is the, what we call the UX two.O And maybe you've heard this, this term before because we have mentioned it across, you know, Cisco live, our expert insight series on on SD one. And the idea here is that we are migrating how we do.29:23The configuration for SD one?29:42So we're NO longer relying on device and feature templates, but we now use configuration and policy groups. Now this has certain benefits and it's it gives you, you know, more granular control. But the main point here is that we have two different ways of achieving SASE.29:44Right now depending on your versions depending on the hardware as well that you're using because that the hardware is tied to the version. And so what we're going to focus on is on the 1st square, the 1st orange square on UX one.O.30:03So on the next slide, this is just you know what we're going to see. So can you, yeah. Okay, so with that little context behind, now from now on, we are going to focus on this method.30:20Okay, now this session is completely dedicated to device and feature templates. We know that not all of you are on the versions required for doing the automation. However, we encourage you to go there eventually.30:36There are a lot of benefits of going there, but we know that it's not an immediate step and that we still need to, support this and also to, to, to show you how to do this sassy configuration for device and feature templates.30:52Okay so yeah with that I think we can, we can continue to the secure internet access use case. We're going to touch more in depth and for that I will hand it back to Hydro. Thank you, Alejandro. So let's start talking about the secure internet access part and let's see what it.31:09Involves, right? What what you have inside? So when we're talking about that, we are talking about that we have roaming security module, we have remote access VPN, we have zero trust network access for internet access. We have pack files, and we have the branch.31:30A side to side tunnels that is the tunnels that we're using or we're doing in manual templates or automated way on the session of tomorrow. So let's just understand from the SSE world how it looks. Now, when we're talking about the pack file, right? We have the part of the connection to the DNA.31:46Security, but how exactly we connecting the level of the DNS security with registered network, right? So when we're doing a registered network, we will be able to use the pack file. If you don't have registered network, you are not able to use the pack file, so take that in mind. Then at the DNS level, we have thread categories protection.32:06You are fishing command and control.32:26A dynamic DNS. So these are the type of protection that we will have in thread categories. If it's ok, it will returning back the IP of the website. If not, it will return in the block page. Now, after that we will go in with the IP and the domain to the SWG, and what happened in the SWG? We will have the decryption that is the main.32:29Topic here because if you don't have decryption enabled, you cannot do that prevention, you cannot do EI blocking or detection of a EI applications in the cloud detection yes, but not a enforcement. You have anti malware, you have the AB analysis, so in.32:49In order to see those traffic that is inside of this, we need to decrypt. If we have decryption, we are ok. If not, we will have a neighbor in the network.33:09So just to have in mind, then internet, right? So even you can have for non web traffic the firewall or the the tunnels connecting to secure access eh, to protect the non web traffic because back file only support web traffic, non web traffic, non web traffic will be take over through the.33:18IPsec tunnels.33:38Now, when we're talking about the old method that all the people use here is the roaming security model. So we don't need a the back file in this case, it's just the agent, and it's the same structure, same way to connect, the same is history as before, but with an agent that even can report the identity to the cloud and that make our.33:40Our world easier because, e.g., for a pack file you need to use SAML authentication in order to enforce the user identity. In this case, the roaming will share the identity to the cloud and then internet. Simple. Then when we have remote access VPN, well.34:01We will going directly to the firewall as a service for the known web traffic, but even the web traffic will pass through the firewall as a service. That means IPS and IPS decryption will be applied. Then come back and go to internet. And these are the ranges that is being used in by the known web traffic when we go into internet. So that means these IPs that you have here is the.34:18The IPs that you will utilize if you have a service outside of.34:38Your network that needs to permit the traffic from a specific sources. These are the sources for the non web traffic. Now, when we're talking about the SWG, that is the web traffic. So then the firewall as a service pass the traffic of the web traffic to SWG and we applying the decryption part and other things. So.34:43Here, we are talking about this branch that is given by the SWG. Same thing will happen for roaming, for pack file.35:03Eh, that it will be also market with that destination. Then internet. And what about the DNS traffic when we're talking about the remote access VPN? Well, we need to deploy the DNS agent and we can do backup options. That means if you have remote access VPN, you connect through the tunnel, you make the.35:12Proxy back off in the roaming module.35:32And then you just only let the DNS model, and then you will have DNS protection firewall as a service and the proxy with SWG, right? Same history as before. Nothing else, nothing different. Now, trusted internet access new model, new way to connect, new intelligence.35:34Way too.35:54A work with secure access. So when we're talking about the trusted internet access, we will have everything. The DNS level with doc. So it will have the three layers of protection in a single module. So you will have the same as before, but with a single model. This is the evolution of the roaming.35:55Model when we start talking about trusted internet access with the CTNA model. And even you can have with the trusted inter eh with the zero trust model, you can have private access, but you will see this later on.36:15So same history and that's it. Now, when we're talking about the part of Catalyst SD one or when we're talking about the secure internet access connection via the CPs, how exactly is being managed? You can have multiple pops connecting to one to one to the CPs connecting to.36:28One hop and the other to the other hop or you can have both CPs connected to a single.36:48Hope. So in this case, I will explain with double hop is the same history just where you point the traffic, right? So let's start with the DNS traffic. When we're talking about the DNS traffic, we can protect with the catalyst SD one yes right now it's possible in the version 20 six.one that you can enable the DNS traffic.36:54Like interception in your CPs in order to protect the DNS traffic.37:14If you are not in that version, well, you can use virtual appliance or registered network. And then thread categories pointing to the traffic of the DNS as before I explain it with the other models. Same history, just it's an interceptional traffic at the level of the all the DNS traffic that is in on the network and it sent everything.37:19To Secure access. Now, when we have the response, we have the web traffic, then.37:39We will have the NAT option enabled. As I told you before, the NAT option enabled will help us to permit the connection through two different hubs, as you can see here and go to secure access because if you have same routing behind this device and this device, you will not be able.37:44Able to go to secure access or connect your devices because you will have mismatch in the routing. That's why we enabled that. Well, after that, the web traffic go to the firewall as a service, right? And the firewall as a service gives the part of the IPS decryption and the IPS.38:04Then in returning back the traffic to the web gateway and we having the decryption with all the models that we're talking before, and then we going to internet. Simple like that. And then the non web traffic, what happened with the non web traffic? We're moving here.38:21We are moving to the the part of the connections exactly the same as the web traffic intercepted by secure access through the tunnel, going to the IPS, IPS decryption and then directly to internet with the address destination.38:37Now, I will give you the voice Alejandro to explain a little more about this part. So you can proceed. Yeah yeah sure thank you so about the use case of SIA, so the version as you can see, it's 20 4174, this is where we started the the support for the seek template.38:53Now, based on the responses that we had at the beginning, you're on 29 or or well, that was the, the, the lower version that, that we saw. I hope we don't have anyone on, on 17 four or 24 because.39:13That that's that's not the version we want you to be on. The encapsulation it's going to be IPsec, of course. So we we have that security going to the cloud. And on the secure access side as mentioned already, we have to use NAT, so we will eventually reach the internet and the NTE has to be configured.39:26Here with NAT. We also have a NAT on the SD one side, but remember this is on the transport, let's say on the underlay.39:46All the traffic going to the internet will use the tunnel that's going inside the IPsec tunnel. So not in this case is referring to the secure access site. Then we all have this tunnel redundancy. We can do ECMP. We will see later on how we can redirect the traffic either using static routes on the service VPN or on the VRF of the.39:54To the clients or we can use we can use a data policy that will give us a little bit more flexibility. We also have the option to do active standby, so of course the redundancy is very important. If our primary terminal goes goes down, we always want to have a secondary there.40:14To keep the connectivity going. We also have these trackers that will allow us to detect when the tunnel is having any issues. We will see that in in more details as well later. And the, the nice thing about this configuration is that.40:30You source the traffic on the transport on your transport VPN or on the global VRF, and you can reuse it across your different vrfs. So this means that you have multiple vrfs on the land side that can reuse the same set of tunnels to reach the internet, ok?40:48We can also, use the the yeah the network tunnel group. We we said it already, we enabled it for. So a little bit more detail on the IPsec tunnel capabilities.41:08We will have support for one gig per IPsec tunnel and of course we can deploy multiple tunnels for higher capacity. If we are doing this, we have to understand that we need to identify or uniquely identify each of the tunnels for secure access. So imagine your secure access.41:25And you're seeing.41:45Three or four different tunnels coming from the same router. How do you make sure, you know, which tunnel is, is which one? How do you maintain your IPsec sessions with the right, with the right right IDs and essays? So we will see how we can make this uniqueness later on. We.41:46We have this availability per data center, so all of the of the regions have a a primary and a secondary so you know when the primary is not available, we will fail over to the secondary one and we will rely in this case with ike, that period detection.42:06And also we can rely on the tracker that we are going to configure test connectivity to the internet. Now, because we can do a multiple tunnels, we can of course increase our throughput. So, we have support for eight active and eight by.42:22Up tunnels. When you go through the configuration on the SIG template, you will see that this is a hard limit. You cannot configure more than eight tunnels directly on the my on the UI of the SD one manager. And then of course well this will give you ECMP, higher throughput.42:43And we can load balance traffic there. We can establish the same IPsec tunnels from a single public IP, and this is what I was explaining a little bit before, where we have this internet facing interface.43:01That has a public IP, has not enabled, and then we can use one interface to source all of the eight tunnels, but again, we need a way to uniquely identify each of those tunnels.43:17In terms of load balancing, we can, we can do either equal cost multi path and you know this is or or an equal cost multi path. This is, this is very useful when you have this parity on your internet links. Maybe you have a provider that gives you more bandwidth.43:35With the other one and you can decide.43:54How much you want to, how much traffic you want to send through each of those links. So, you know, the, the, the, the load balancing is based on, on the different IP attributes, source destination, IP and ports. This is, you know, what we are, what we are used to on the.43:56Networking world, nothing special about that. Yep, and next one please?44:17And this is the tracker that I was referring to earlier. So, we have these trackers that will test and that will check the connectivity is there for our internet traffic.44:24So we can customize our tracker, so we want to test a specific URL, we can do that and we will have the router sending HTTP pings to the URLs that we are specifying there and and based on that we can determine if the.44:42Destination is alive, but also we can drive certain things like latency and some requirements that we can then use to mark the the tunnel as down so we can move to a different one, ok? Okay, now.45:01Talking about the redirection of the traffic, so think about it. You have your traffic coming on your client side, so you have your users traffic coming on your VRF, on your client VRF.45:20And then you need to redirect that to your SIG service. So there are two ways to do it. We recommend to use policy based approach, a policy based approach, which, which means for those of you that understand SD WAN, we're going to use a data policy.45:35To redirect the traffic to our IPsec or sorry, to our SIG tunnels. What's the difference between the policy and a static IP route on the service side is the granularity that you will have?45:55So, we in general recommend that use the policy because you want to probably bypass some traffic and then this traffic is easily or you can more easily bypass it with a policy rather than a, than a static route.46:11But you have both options and Idro will show both of them on on the demo later on. Perfect. So yeah, I will hand it back to you Hydro so you can show them how to do the configuration for SAA.46:31Thank you, my friend. So let's start with that part of the configuration and let's start thinking about how to configure it and what we need to have device versions, the Cisco manager move have internet access, right?46:47Not proxy supported, not enabling the T logs and ECMP requires a loopback interface in order to do what you see here in the bottom, right? Eh this is in order to increase the throughput. So take that in mind, this is the plus in sameer connection.47:02But with plus alerting plus one plus two plus three. And, you will see that in the configuration more in the private access, in the internet access eh you will see that we use in loopbacks, but you will see. Now.47:20End to end process of configuration. 1st, create the network to the group, configure the template, create the loopback interfaces for scalability. You can use the gigabit interfaces, but it will not be able to give you escalability in the future. So take that in mind and you need to have.47:35Loopback interface if you want to escalate. Now add SIG and look back to the device template and configure the traffic direction via static routes or data policy. So let's go to the demo. Now, in order to create the tunnel, so we're going to secure access to the connect network tunnel groups and we put the name of the tunnel.47:54Right? In this case we will put expert inside series. We will put catalyst as the one NO matter what you put there, that's fine. And you will put the nearest location to your data center or to your branch. In this case Germany. There is a new feature that is backup region, we don't we configure it today but you will see that, e.g., you can have more.48:14Now two regions Germany and e.g. Estocon, e.g., if the Germany get down and you need a backup region, you have another one. Then the tunnel ID.48:34And the tunnel ID will be working as ikey identifier for the connection and the passphrase in order to communicate the tunnels, right? To permit the authentication. Now, eh, for this example, we will enable the NAT option because we are connecting multiple CPs in this case, right? So you will.48:45Be able to see that in secure access, the configuration is simple. It's just the network to the group. For sure you can create secure access policies in a way to secure the traffic in a specific way, but this is the important part in secure access, ok? Now you have the region and you have the backup region in Spain in this case.49:05Now, in configuration, we will go into the part of templates, and in the templates, we will go to inspect the feature templates, right?49:25Oh, we, we can add that feature template for seek. Now we're going to create this seek template. We will put this as generic and we will put the name of the template, ok? So one thing that you need to have in mind template name and description cannot have spaces so you need to configure it in that way.49:36In order to, to permit you to configure the template. Then the VPN tracker source IP, I will make a little recommendation. As you can see, we have global variables or we have a static variables. If you permit to have global variables eh, to configure that later on, you will, you, you will permit yourself to use the.49:56The the template in other devices without a problem, ok? So just a little recommendation and then the tracker. In this case I didn't configure in this configuration, but I will show you later after the the demo. Now, eh, the configuration part of the tunnels. So these are things that you need to have in mind.50:16Here when you configure, you will put the IPsec one.50:36Then the tunnel source interface, in this case we will let it as device specific in order to configure it later on and the pre shared key we will put global in this case, ok? Again, if you want to configure it for multiple routers that are in different locations, you must configure devices specific to configure it later.50:39Get on, ok, for each device that you have. Then recommendation MSS 1350 and MTU 1390, ok? Have that in mind because this is super important with secure access.50:59IPDF healthman group 20 or 21, ok? Things to have in mind that it will make your deployment going well, ok? Then here we IKD and the IK remote ID. We will put device specific and configure that later on.51:14Then when we jump in here, we will have the IPsec one and then we will go to the configuration of the IPsec two, ok? So we put in IPsec two and we configure the same thing again. It's the same thing, it's the same connection, but it will be to the connection of the hub two. That means we will have the high availability, right?51:32So, take in mind that the TCP MSS perfect. The empty the the MSS and MTU just you know this is to, to permit the the header of the apsec tunnel that is 40.51:51The bytes in order to permit the traffic. If not you can have TCP issues at the level of when the user's going to internet or to the private applications. Just have that in mind, ok? Then the same thing we configured in the template.52:11And then add another final, when you click add you will see that you will have IPsec one, IPsec two with the same configurations and then later on you will understand how to connect that or how to to do that, right? And in order to have the high availability, we will put the IPsec one as the primary IPsec two as the.52:25The secondary tunnel, right? In order to permit the connectivity.52:45Then we click save and then we will check what is the template that we will attach them later on in the you will see, we will edit and under edit, you will be able to attach the seek template.52:50You attach it and you click update and you then will be able to configure all the configuration that we're getting from the network to the group. So tunnel source interface will be the loopback. That's why we're telling you to configure loopbacks instead of gigabit interface. If you want to have a scalability, you need to have.53:07Loopbacks. And then the tunnel route is where the tunnel traffic will be sent is will be the gigabit internet that is the one interface in your device, right? So as you can see both tunnel interface for both tunnels are gigabit interface one. And then you will see that we will start copying the configuration of the primary.53:28The Tunnel destination.53:47The secondary tunnel destination here, right? That are the public IPs in secure access the IT ID that is the email ID that we using as a key authenticator or AKD for the authentication, right?53:49We configured into one for the primary hub and the other one for the secondary hub. Perfect. Then IQID for the remote ends are the public IPs of secure access. You need to take care of that. You you cannot mismatch here because you, if you configure in the opposite.54:10Right way, you can have an issue at the level of the connection, ok?54:30So now the tracker IP, that's why I mentioned it before that you need to configure the source IP address of the tracker here if you have multiple devices that you wanted to configure with the same template. And then after that you will be able to see that the configuration will be pushed to the router, and this is the thing. You need to under.54:34Understand that you can configure multiple devices at the same time and that's why the templates and the devices specific configuration will help you to achieve that, ok? In order to configure multiple variables for different routers, ok? Then later on when the template gets configured.54:55You are able to go to secure access and check how the connection is going, right? So let's go to the tunnel, and we're going to the expert inside series tunnel, you will be able to see that the primary region that we that was the only one that we configured in Germany is up. So everything is configured and you have the backup region if you.55:14You want to configure that is a new feature in order to if for like example Germany get totally down, you have the secondary region that you can fall back the traffic and send the traffic through the other region. You can choose the region that you prefer there, ok? It's the same thing, it's the same tunnel ID configuration.55:33Eh, but with different numbers, ok? To connect to the spine pop or to the other pop. Now we can see that the tunnels are up in secure access. Now let's go to catalyst. And in catalyst, you go to device, you go to your router.55:52Right? And you can go to the, interface an interface, you will be able to see if the tunnel interface is up. That is the tunnel interfaces that are connecting to secure access. So you can see that the tunnels are up and admin status.56:08Up and operational status up. That means you made the configuration. Now, the routing part, right? You have two ways. 1st thing that you need to go is check what is your service VPN VPN ten in this case.56:23Go to feature templates edit your VPN template, right? In the feature templates, and then you will have two type of options here, well in a specific for secure access. You will have the option for the service route.56:40As you can see, you can new service route and you can put 000/zero to send all the traffic to secure access for internet access, right? Then you are doing that with this. And now, and now with the IPV four route, you are making a specific traffic to bypass secure access.56:57So you can configure, e.g., as I told you before, the DNS of a secure access in order to send the traffic, right? Slash 32 at.57:17Perfect and then the other DNS. Now, you may ask what are you doing if I have a FQDN? Don't worry, you will see that later on because this is a common question where we configure in templates and is the capacity to bypass traffic that is not directly to AP instead.57:27Of IP using FQDN or a domain, right? So after that you can update and you can deploy the policy in your router, and it will have the new configuration to send the traffic through secure access and bypass these two IPs. Now, if we check in the data policy.57:47Complete a configuration policy and we go to add policy. We need to create the application 1st. So if we go into custom application, we click new application and we can put the application name, right? And then in the server names, we will put the FQDN that you want to configure, right? So we will copy in the.58:05Proxy of secure access to don't permit the users that have roaming agent to send the traffic through the tunnel instead of that bypass the traffic outside. And this will help you used to even improve eh the the the tunnel configuration and the stability of your network. Right now I have already one configured for the two proxies.58:24That we have the specific and the general, right? And then I will create an application to match it later on. So.58:44New application category list and we will put the name of the application in this case SSE proxy, and I will choose the custom application that we created before. And then that's it. We created now the application to be bypassed later on.58:53And if we click in next, you will be able to see that now we will ask him the type of configuration for for that. So we will need to use traffic data remember that and create a new policy for that. In the creation of that one.59:12You will put here the name of your SCC routing policy because this will be your routing policy that you can accommodate or work whatever you need to do here, right? For the SCC routing traffic, and it will have a sequence, so it will match.59:30The primary, then the secondary policy, then the 3rd policy in the sequence rule. Now, here inside of the sequence eh, you will add the source of the traffic. In this case, we will put the source of my traffic that it's from my devices, right? That are going to internet, in this case the.59:47The 100 three/twenty four. You'll have that in mind. Accept and you will be able to see that later on we will have an option that says secure internet access.01:00:07In that way, we are sending all this traffic to secure access, ok? When the users are trying to send traffic to internet and then a second policy, and 2nd policy will be for the bypass, ok? So as you can see here, we will configure the same network, right? But we will tell to the.01:00:18AI don't want.01:00:39To send the traffic of the proxy over the tunnel. So we choose the tunnel, right? Sorry, we chose the proxy, and then we choose the option of accept but with VPN not. And with VP not VPN, and with this option, we will send the traffic to the.01:00:41To the normal transport interface to send the traffic to secure access. So you are bypassing the traffic and then sending the traffic to secure access depending what you want. Then if we go into events, in secure access, you will be able to see where.01:01:01Right now the traffic going to secure access after you deploy the policy, and you can see that the traffic that is making match here is from our device that we configured before.01:01:20Right, so you can see here, you can see the network of the user, right? And if we go into the computer, you will be able to see that it's tunnel name experiency series and the IP and the event the egress IP of the device that having now after the traffic is passing through secure access. So you are.01:01:32I'm navigating now through secure access, you will be able to see these logs in in the in the events of secure access and that's it. It's a simple configuration eh you don't need to overthinking too much how to do that and you will be able to see that this traffic will start in appearing in secure access, ok?01:01:52So coming back to secure access, we will do a refresh.01:02:12And you will start seeing the traffic that we sending to a secure access through the endpoint that we are using to send the internet traffic. And that's it. Simple like that, we don't need to do too much more. Now, let's go for the secure private access and please eh.01:02:16Ask questions, check in the in the chat if you have any double about what we presented and we will be able to answer it there, ok? Now, going to the secure private access, let's explain a little bit about it. Now, when we're talking about the secure private access, we need to know what are the two options, right?01:02:36We have the.01:02:56Side to side tunnels eh, that will come or you can connect the VPN as a service or the CTNA for private access and that you need to know that for remote access VPN it will have the IP pool. So the source traffic will be the IP pool. And then for the CTNA, the source traffic will be the CGNAT, 100 that 60.01:02:59Four.zero.zero is/ten.01:03:19If you have that already range in your network, you need to request the attack case, the change of that addressing for the. Now, traffic from the range need to be allowed and not inspected in the firewall side. In the other end, in the after the tunnel. Firewall must have a roll back to the range. So BGP.01:03:21PBR or static. NAT option is not supported for private access. If you enable NAT, you will not be able to accommodate private access traffic. If cgnat exists in your network, as you as I told you before, you need to ask to change it.01:03:41Now, in the other side, we have the resource connector and the resource connector, you need to understand one thing. We are not talking more about the range. We are talking about that the traffic source of the application e.g. from the user that is connecting via CTNA or CTNA clientless.01:03:57It will have the source IP of the resource connector. So each traffic will have the resource connector IP. Now, if e.g. you wanted to do bring your own IP traffic, that means you need to have the public IP of your company market as.01:04:17So you can configure, e.g., an example portal.Azure.com and create that as a private resource and attach the resource connector.01:04:37You can send that traffic as private and it will have the public IP of where these resource connector were deployed. And that's it. That is the when the the way to use bring your own IP. You can do that through next two, but the recommended method is using resource connector.01:04:47Now, about the traffic section about the secure private access, well, we have remote access VPN, CTNA, and branch traffic. Now, the remote access will connect to the VPN as a service head end and then from there to the side to side tunnel.01:05:07But connecting to the firewall of your company and access to your applications or even in the cloud, you know? Then.01:05:26CTNA for private access. We go and connect 1st to the C proxy that is taking the decisions, and then you have two options side to side tunnel or the resource connector. And from there, your network.01:05:33Then branch to branch, you're connecting to the network tunnel group and from the network tunnel group, you will connect to a other device that is connecting through other network tunnel group to secure access, and then you can go e.g..01:05:48From the company eh or from your branch or headquarter that is in US to the headquarter that is in London where you can connect both branches. Now, there is another method that is UCTNA that is working in the firewall as a service.01:06:05Sorry is in the firepower threat defense secure firewall. And then in the next deploys of a catalyst SD one, we will have also UCTNA. So literally UCTNA, what it will do is pass the traffic directly to the device.01:06:25No traffic sending to the cloud is joined going directly and connecting to your catalyst SD one or to your secure firewall. In catalyst SD WAN is not still there, but in FTD is already there so you can configure when you want.01:06:43Now, if we're talking about the secure private access flows, well, this is an interesting part because it's a little bit complex but easy to understand. So let's start 1st with the traffic of the VPN as a service. When you're connecting through the VPN as a service, you will ask it for.01:07:00Authentication using Radius certificate or SAML or you can do combinations like certificate with SAML or Radius with certificate or even. So depending what you want to configure, right? Then you will go to the VPN as a service heading.01:07:18On the VPN as a service heading, there is the device posture with the secure firewall posture model and the secure firewall posture model will say, ok, this device is ok to pass the and be allowed to authenticate. Okay, then it will return back and said, ok, you can continue your traffic can connect.01:07:38Eh, to any device that you want in secure access that are connecting through the network to the group. So you can see that the traffic is now being sending to the firewall as as a service after it connects and then you have IPS decryption and you have some capabilities at the level of private access that you can utilize to secure your.01:07:56Private flows. Then it will go to the network to the group and connect to your IPsec tunnel to your CPs and then it will permit to access to the applications in your network, ok?01:08:16Then second flow, in 2nd flow you have certificate and SAML authentication, ok? So a certificate is still not supporting in iOS or we're working to have it there. And now we have for the moment the SAML authentication for a.01:08:31IOS or Samsung or general Android devices. But for a Mac oS or Windows device, we have both of them. Then you need to understand one thing 1st iOS devices or Android devices, we have HTTP three eh that is quick with Mac.01:08:51Ask and Windows and Mac we have HTTP two, eh that is for Windows and Mac. Then.01:09:11Let's check about the posturing part. For sure it will ask to the C proxy. 1st, if it can connect, my user can connect it's meeting the requirements for the device posture. It's everything ok? Okay, you can pass. And then it will return in the posture and say everything it's ok. This posture is been doing with duo. That's why.01:09:19We have dual here in the images, right? Then later on is this exactly same flow of VPN, but one thing that you need to take in con.01:09:39The posture in VPN is being made the authentication during the authentication. In CTNA is during the authentication and after the authentication for each access that you do for each application to know if you meet the requirements. That is the advantage of CTNA. Then you connect.01:09:50Into your private applications. That's fantastic, that's really good. Then we have our tier method and is the part of the resource connector, right? So resource connector will connect the tunnel to the C proxy and from the C proxy, you will evaluate the same thing, the device posture, then coming back, that's it. Then to the.01:10:10Service, but instead of jumping to the network to the group, we will go to the resource connector gateway and this resource connector gateway have a connection directly with the resource connector of your network that need to be sit down.01:10:30Around the private resources. So then it connect to the resource connector, and as I told you before, it will have the private IP of the resource connector when you connect to the applications. And then you are connecting to the applications. So now you may ask what happened with if I wanted to access to an application that is in AWS?01:10:43Azure or whatever other service or even other branch. You establish the tunnel, IP six here, right? With secure access.01:11:03From your CPs and that's it. Then you establish another tunnel from AWS and then the connection going through the network to network tunnel group from to the firewall as a service then to the network to network group that connects to AWS and then.01:11:12You have the connections, ok? You see? That's it. If you can see that it's not so hard, but it is, ok? Now, Alejandro, sorry for that. I passed the voice too much time in my side, but now you've turned.01:11:30Thank you Hydra. Yes. So, yeah, that was that was a very detailed explanation on those flows for private access. So thank you for that. Now, going a little bit to the use case and the requirements and a little bit of the overview.01:11:50We have the the for templates, we need 25 or 17 five even before you know this is a regular IPsec template that will be established between the routers and secure access. In this case, we will use BGP for the routing, so this is an additional element that was not present before. The.01:12:08See again we will have, we can have ECMP with loopbacks and we can have this active and standby. We support active and backup tunnels, and we will also rely on IPsec DPD and BGP conversions, ok?01:12:28We cannot directly compare to the SIG use case, we don't have the the tracker directly on the on the configuration UI as, as we had before. In this case difference is on the service VPN, so with sig, you could multiplex or you could reuse one tunnel for a.01:12:45For different VPNs, but in this case, we're gonna source those IPsec tunnels from the service side. So they will live on my service side, which means we will have them tied to a specific VRF.01:13:05And then on the network group side, we will use BGP and you will see that by default we are going to send some AS prepends on the secondary hubs. Just yeah, I will show you that in a little bit more details. The attributes that are mostly.01:13:19Useful here are the extended communities and the AS parts. These are of course the the needed or the mandatory attributes on EBGP. And so a little bit of, of the same information that we had for SIG, but for SIA, we also have this one.01:13:36We can have multiple ones. This doesn't change.01:13:57We can have up to eight tunnels as well, and we can load balance between all of them. Again, we can use the same public IP address to establish those tunnels. We will see it on the demo. We can have load balancing, but in this case we cannot have unequal code load balancing.01:14:01Directly on the IPsec configuration as opposed to sick where we could determine what was the weight for each of the tunnels and based on that we would send more or less traffic on each of the interfaces. In this case, we're going to use VGP, so this is how would say the additional element for routing where.01:14:20Not using the static route or or the policy here, we're just sharing or interchanging routes with secure access.01:14:40To understand how the the flow of the packets. Now, you will see that secure access does something for us to automatically determine what's the primary and the secondary hub, but we can also influence how secure access sends that traffic to us by doing some AS prevents.01:14:46Now for the configuration, this is going to be the demo. I went a little bit faster on the previous section because it's not that different. I've just touched on the differences that are more relevant for SPA. Now, a little bit of the the information that I wanted to, to touch on is.01:15:08That the loopbacks for ECMP are required just as as we saw for the suffix part where we're gonna see that on the demo.01:15:26This is where we're going to uniquely identify each of the IPsec tunnels, and this is how we would do it. So my steps here will be I need to create my entity on secure access. After that, you know, the NTG will receive my IPsec tunnels on the SD WAN side, then I create my IPsec loop.01:15:37Bugs and BGP routing templates on SD one, and then we combine everything together on the device template, ok? Now, for the demo, once again, this is the use case that we're going to target. We have a remote user that will access a private resource that is on the data center or on a hub site.01:15:57So we're gonna start by configuring the private private resource configuration. You're gonna see how how that is done in secure access. Then we're gonna see how to configure the NTG as well. It's some of what had already shown.01:16:18Then we're gonna go for the catalyst SD one configuration to bring up those IPsec tunnels, Notice that I am using loopbacks or that I will be using loopbacks, but all of that communication will go to a single interface, which is the gig one interface towards SSE. And then I will have my service site configuration, you will see that I have a gate.01:16:34Way that is between my client and my SD one router and so I need to handle some VIEWP configuration as well.01:16:54So let's start with the private resource configuration. So for this, I'm gonna go to secure access and create a new resource, a private one. I will give you a name. This is going to be a PC on site one oh two, and I have to define what's the IP address that secure access.01:17:01Access needs to be able to reach for this specific resource. I'm gonna create the, well sorry I'm gonna select the protocol to be TCP RDP, we want to be able to RDP to this client on port 3389.01:17:21And then I'm gonna specify what are the connection methods. So I will select zero trust connections, both of them client based connection and also browser based. You can see that with the browser based, I am going to get a very nice public URL that I can very easily use when the resource is ready.01:17:38Reachable and this is actually the method that I will use to connect later.01:17:57I will also allow the VPN connections and then you you know here you can put other things around the the decryption and associated rules. But for now I will just do it very basically, I just created the resource specifying VIP, the ports, and that's it.01:18:03Okay, so the the the top part is done. Now we need to create a rule name that will allow me to connect to the private resource. So for that I'm gonna go to my access policy and then I'm gonna create to a new private access rule.01:18:21This rule, of course, needs a name, and this one is the one that will identify the user that's allowed to connect to the resource. So to do that, I'm gonna specify who's able to connect here see that you can match on different things.01:18:38Users, security group tags, network tunnel groups even. In my case I'm gonna pick users and I'm gonna select the active Directory users. My user is over there, so I'm gonna allow it for me. And the resource is a private one. So I will select my site one oh two PC, the one that I just created.01:18:55And that's it. It's super simple. I'm I'm also gonna keep it very simple here, but here you could add some additional posturing and endpoint endpoint requirements that that need to be met for the remote user to, to reach the private resource. In my case, as I was saying, I will just pass through it without any changes.01:19:17I'm gonna hit next and go to the security part of it. Here I can determine what are the security features I can e.g. enable IPS, but again, I'm gonna keep it super super simple, so I will disable it and just save it as it is.01:19:37So here we have done the access rule that will allow me to or will authenticate me and that will make sure that I am connecting to the resource and that I am allowed to do it. Now we have the NTG configuration ahead of us. So this is a little bit of a repetition of what Hydro already showed you, so.01:19:56So, you know, I I'll probably go a little bit faster here.01:20:16So the, we need to give you the name and then specify the device type. This is going to be for catalyst, but look that you have many other technologies available and my region I'm gonna go for Germany as well. Now, in this case, I won't select a backup region.01:20:19So I will create the tunnel ID. I'm gonna call it sassy EAS, EIS, sorry. And then I'm gonna give the passphrase. The passphrase is very important. You need to keep it safe because you're gonna reuse it once you go to the IPsec configuration.01:20:40For my routing, this is a difference from what Hydro showed us. We're not doing not here. We are going to select dynamic routing. And the dynamic routing will prompt us to specify what's the AS number that my SD WAN router will use.01:20:58In my case I'm gonna use 65000 and of course this is, you know, you need to make sure that this matches with the router configuration. There are some advanced settings that you could also specify. I didn't show it here, but you can, you know, allow or deny the default route at the time.01:21:15Placements do some multi hop configurations.01:21:35But I'm gonna keep it simple again and just leave it as it is. Okay, so this is the information that I will need to use once I'm creating my IPsec tunnels. So make sure to to have this handy and copy this. Now that we are done with the NTG, we can move to the IPsec part, so.01:21:38So secure access is ready to receive those IPsec tunnels.01:21:58Now I have to do my IPsec configuration or my SD WAN configuration. The initial configuration of the SD one router is super simple. It only has a VPN zero and my internet facing interface. It has of course one service VPN, the one that is going to my clients is the VPN ten, down on the bottom.01:22:02So what I'm gonna do now is I'll start with the IPsec configuration. So for my catalyst 8000 B which is the device that I'm using right now, I'm gonna look for the VPN interface IPsec. Notice that this is not the template anymore, but the IPsec template anymore.01:22:25So I will give you the name.01:22:42The, the interface name will be IPsec one, but 1st I have to unshut it to make sure that it's gonna go up once it's on the router. Then I'm gonna select the IPv four address to be a variable so I can, you know, reuse this template across multiple devices and I will provide that value later on. My source.01:22:44Is going to be an interface. Remember that we have those loopbacks and this is where my loopbacks will go once we push the configurations. The tunnel route via interface is my gig one. Remember we can support one public interface that goes to secure access and we uniquely identify it later. So you have it ethernet one for.01:23:04For all of my tunnels I'm gonna simply hard code it over there at my destination IP.01:23:24For the IPsec tunnel it's gonna be a variable because it's gonna change. My IP MTU and my TCP MSS I'm gonna set them right away. These are you know some of the recommended values. And then I'm gonna head to the ike configuration.01:23:29On the eye configuration, I will change my version to be version two and I will change the Helman group to be 14. Okay, now these values are based on the secure access documentation. You will see that depending on what's available on the SD one site, you can select.01:23:47Based on ssc's preferences. Some of them are not supported, so this is why I chose 14.01:24:07The pre shared key, that's super secret, so I won't show it, but I paste it here and then my local and remote endpoint IDs, I will put them as variables because we need to provide them later on. Lastly, for the perfect perfect forward secrecy I will change it to none.01:24:13And I will save it. Now, notice that well I will do the same for my IPsec tunnel too, it's gonna be a little bit faster because I can simply copy the, the values, sorry, the template and rename it. But what I was saying is notice that.01:24:31The amount of information that we needed to provide here was greater or was more than what we needed to provide for the sick tunnels. So, you know, this is of course more manual steps that you need to follow, but it's the way that we can support SPA for now.01:24:48And for this version specifically, ok? And then for the session. Now here I'm gonna configure my loopback interfaces. These are going to be on my transport VPN later on and they will source my IPsec tunnels. They are going to be loopback one and loopback two. I'll just unshot them and put up a.01:25:08An IP address to them a/thirty two.01:25:28A proper look back here. I'm gonna do the same for my second one. I'll just copy the 1st template and I will rename it. The only thing to change inside is the loopback number and the IP address.01:25:31So this one's going to be loopback two and the other, the other IP address as well. Okay, so now with this, I have my IPsec, I have my loopbacks and now I need my BGP configuration. So the last template, it's gonna.01:25:49Be the one for Cisco BGP all the way down.01:26:08And here we have to provide the name and I'm gonna provide the AS number. Now, this AS number is very important to match it with whatever we put in secure access because if not secure access is expecting a number and we're providing a different one. The other thing that we need to do is to create two neighbors.01:26:12Because we're gonna have two tunnels. So depending on the number of tunnels, you create more or less neighbors. I'm gonna put the address to be a variable. The remote AS is static, so I will just put it right here, and this is my neighbor number one and this is my neighbor number two.01:26:33Okay, so exactly the same. I'll just do a rename there of the variable just to better differentiate them when I am putting the variable, the the variables, values later on, same remote AS, I'm gonna add it.01:26:51And I'm gonna save this. Now what I've done here is I have my different components created, but now I need to put them together. So for that, I'm gonna go to my original device template and I will attach or add those elements that I just created. So my transport and management be.01:27:06The end this is my global VRF that will handle my two loopbacks.01:27:26So those loopbacks are there. And then my service VPN will handle the rest. So over here, I'm gonna add the two IPsec tunnels and then IPsec one and IPsec two.01:27:31But also I need my BGP. Remember that BGP is going to be the information that I sent from my client side or from my BRF side. Now over here, you know, we just need to fill out all the information for all the, the, the variables. This is going to be for my IPsec tunnel number.01:27:46Or two. As, as you can see I am using a/thirty one over there. You can use/thirty and it works well as well. If you want to preserve address space, you can do it like this. The remote endpoint ID is just the secure access public IP.01:28:06And notice that I am using my local endpoint IP, and I am giving the suffix LO2. So this is just to differentiate that this is my or my loopback two and my IPsec tunnel number two, ok? I will do the same for the other.01:28:25Router, my IPsec one configuration. By the way, if you hover over those letters on the, on the left where you can see the variable name, it will give you more information as of what is the, the, the tunnel or the loopback that you're looking at at the moment because it maybe a little bit.01:28:44Confusing. How do I know if it's IPsec one, if it's IPsec two? You can just hover over those values and you will get a little bit more of a description that will allow you to identify those. Now what I'm doing here is I am putting the BGP neighbors on secure access site, so.01:29:04You know, based on the IP address scheme that I selected, these are the two addresses for BGP on the other side. All right. So the hard work is done. We just need to push this to the SD one router.01:29:20Just a little recap on the configuration that will be added. You will see over there is some loopback configuration. I'm gonna put it side by side with a nice quarter so we can see what's been added. So you have the loopbacks on the SD one.01:29:36Configuration portion. Then we have all the loopback configuration with the IPs, you have the IPsec tunnels, and then all the IPsec profiles, all the I profiles, all that information is there for me.01:29:52And the last thing at the very bottom is the BGP configuration. Okay, so I'm sorry I briefly flashed it, but the BGP configuration was there. It was on the service side, so under an address family of a BRF and you know this will take a little while to populate on the secure access side.01:30:09Right. So while we wait for this to populate, what we're going to do is how do we make sure that on the SD one side, things are looking good? So I'm gonna head back and I'm gonna go to my devices. This is going to be device one oh two/one.01:30:29And I am going to check the interface. Now this is the same that showed you, so you can look for the tunnels with this big number and those are the IPsec tunnels. You can differentiate them based on the IP address, and then you can see that the admin and operational status is up already. So this is just to know beforehand.01:30:47And before secure access reflects any information that things are correctly configured. Another thing that you can do is you can always fetch real time information from your SD WAN devices. So what I'll do is I'll go to the real time panel and I will look for my BGP neighbors. So let's see if.01:31:07BGP is already, you know, established here. And as, as you can see it is. So I have my two neighbors, and the state over there is established. So that this means that if everything went well, I should be receiving already some routes from secure access, so I will check it for my VPN.01:31:27In ten.01:31:46And now you can see that I am receiving routes, ok? So all of them are coming from BGP. You can see the next cop, the 1609 address that's from secure access and you are you will see that we are receiving them twice. This makes sense because we have two different neighbors, one for the primary and one for 2nd.01:31:48Hubs in secure access site and notice that the AS path here automatically or by default comes with an AS path prepent from the secondary hub. So what this will do is make my router prefer the primary hub instead of the secondary one.01:32:09Before I mentioned that we can do the same for secure access, so I didn't do it for the demo because it would take a little bit more time, but you can also do some prevent outbound to secure access to influence the routing. Okay, now best path was selected from the primary hub, as we can see over there.01:32:26And now that we have given some time, let's go and check if my private resource is available. Again, we have shared the routing information between SD WAN and secure access. So I'm gonna do a reachability test on my site, sorry on my.01:32:46You see over here. Again, this is for RDP on the port 3389.01:33:06Client based and browser based access is available and if I click on test reachability, I will see if my resource is ready to be accessed. Now, when it takes a little while, you know that it will probably fail. And this is the case here, so it fails because.01:33:12Because I am missing one important step.01:33:31Okay, so we have configured BGP for secure access, but remember that I told you that we also need BGP on the land side. This is usually what we will have on a real scenario. So if I go to my network tunnel group.01:33:34I'm gonna check if I am receiving any client subnets. And as you can see there are NO client subnets received from the SD one router. This is the reason why my private resource is not available yet. So with a little BGP tweak, we're going to make it work. We're going to add our neighbor on the land side.01:33:52And a little correction I think I showed here the AS path, sorry, the AS number to be 65001, but actually it's gonna be IBGP, so I'll just use the same 65000 that my SD one router is using.01:34:11So I will go to my BGP configuration. I will add my my device over there, my LAN router, and I will update this. Now, you know, I won't go through the configuration this time. I'll just fast forward when when this is done. And now that this is done.01:34:27Once again, I'm gonna quickly check that now I see those routes from my client side living inside BGP. So, well, 1st of all, my neighbor is over there is established, and now I need to make sure that the route, the, the 19216.01:34:47Prefix is living inside BGP and it's getting advertised to secure access.01:35:08So I'll just check the routes, once again, these will show me all the routes coming from secure access. So actually what I will do is I will filter for 1902 and I can see that my client subnet is there already. So this is going.01:35:13From my BGP and should be advertised through EBGP to secure access eventually. Now let's go back and make sure that my secure access.01:35:33Is receiving those clients of client routes already. As you can see, I have my 1916810 prefix over there. And lastly, I will check my private resource. I will do the.01:35:45Connectivity test once again and right away you can see that it's now successful and it works. So this means that I'm able to access remotely the resource, so to test that, I will copy the URL that was created for me.01:36:03And I will try to access it from an incognito mode so I can go through the login process. It will take just a minute. And once I complete my authentication remember that I use my active Directory user.01:36:21I can now log in to the PC and I can, yeah, I can do RDP I can access it remotely using my browser, ok? So I can simply use my browser and go to the PC, yeah. Now just test that it has internet and that everything works, so everything is looking good here.01:36:36So the last thing that we want to make sure is that we check that the activity in secure access is present. So if I go to my monitor and activity search, I will filter for my CTA clientless activity.01:36:56And here I am able to see that I created some traffic, you know, my, my user authenticated and it's accessing the site one oh two correctly. The other option is to look for the events and click on the CTA client list and you know you can see the same information over there.01:37:11Okay, so this is what, you know, what we need to do to enable that private access communication. So yeah, this is how you, how you do it. We did it in a very basic way with only two tunnels, you can have more than one and then you, you have to think about.01:37:31BGP and how do you, how do you do equal cost multipath? If you have a BGP router on the service side, you need to make sure that you allow maximum paths to be higher so you know you can have multiple best paths.01:37:50So, but, but what we wanted to show here is the basic workflow on how you get that up and running. Okay, so it's been, it's been, a lot of information.01:38:06We're almost getting to the end and this part is going to be lighter, but we wanted to do also a deployment model comparison because at the beginning we were saying that it's possible to do sassy in a manual way as we're doing right now with the templates.01:38:22But we can also do it in an automated way with, with higher versions, and this is what you will see tomorrow. So just to give you a little snippet about tomorrow, this is the comparison we are on the far right with templates and manual configuration.01:38:38And as you can see, all of the things that we have done are hand, you know, we have to do it ourselves, all those IP addresses, the remote endpoints, the BGP, everything has to be manually created, which is.01:38:55It's a little bit cumbersome sometimes if you're not familiar with it and it could be a bit complex. And so what we will show you tomorrow is the automated way where using an API driven approach, we can achieve the same outcome, but in a much faster and much simpler way.01:39:11Okay, so obviously the operational complexity is lower with the automated tunnels that you will see tomorrow. We still have, we preserve the high availability. We have some differences in terms of scalability. You will see that and well some, some additional information there for the integration.01:39:29For manual templates, you can do secure access, umbrella, and custom.01:39:50Customer generic IP six but with secure access and the automated tunnels you have this option as well and easier, I would say. So I think this makes one important question. If you are using templates right now, should you continue using templates?01:39:56And we were discussing these two answers in the past days and we we found a couple of, a couple of scenarios where you will use templates still. So the 1st one is if you are an environment that doesn't have the automation.01:40:16That, that the new versions can give you. Now this per se I wouldn't consider it as the scenario, but the important part is if you have a restriction to update to a version that is not supporting sorry that is.01:40:36Supporting the automation, then, yeah, this is a scenario where we can see that you still need templates. There are some hardwares that won't go beyond, e.g. 2012. So if you're in that situation, ok, you can use steel templates.01:40:56The other corner case is if you have something that is not yet available in UX two.O on the configuration and policy groups. Now, I honestly don't think there are a lot of these cases. Most of the things.01:41:14Or yeah, all of the things are supported already in UX two.O Maybe if you were talking about another version, I would agree a little bit more, but nowadays we have, you know, that functionality available in the UX two.O position. So.01:41:30Of course, going through templates to configuration groups is a migration and it's something that you need to plan for and it's not something that is not automatically. However, there are some steps that can help you get there. And think of it this way.01:41:48If you move to configuration and policy groups, you will unlock the access to the newest, to the newest features that you will have in SD one because the templates won't be.01:42:07Developing those new features. It's, it's mostly the configuration and policy groups that will have there. So eventually you will get there. So to help you do that transition, we have this migration tool. I will very briefly touch on it and this conversion tool will help you.01:42:23Convert your templates and policies into configuration and policy groups. It lives on the SSP portal, and you can use it on two ways. So you either use it online or offline. The online method is supported starting on 2015 1715.01:42:41You have to connect, you have to to get connectivity from the SSP portal to your SD one managers, so it means it has to be publicly available. You can whitelist one specific address if, if, if you don't allow external connectivity. And then all of the conversion will be done on the cloud and you will get.01:43:01The policy and configuration groups imported into your SD one manager automatically. Now, this is just the conversion. It's not moving your devices from templates to configuration groups, it's just the conversion of the configuration. You also have the offline method where if you're running 2018 two or higher, you will be able to.01:43:21Generate locally a file that you then need to upload to the SSP portal to provide you the file that you can later import back into your SD WAN manager.01:43:41I will take 2 min just to show you how this would look like. This is the online method and I am going to convert this template to configuration and policy rules. There are two devices attached to the template.01:43:53I will go to my configuration groups. I have eleven. This is to show you the before state, so I have eleven of them. I will go to my SSP portal. Oops. I will go to my SSP portal over here.01:44:07And you have the configuration conversion tool. Again, this is online method, so this means that my manager is reachable from the SSP portal. I can quickly in in one click collect all those templates, lists policies, everything that I'm using.01:44:23And I can select which ones I want to convert. In my case, I'm gonna stick to the one that I showed you before, and with another click, we just converted the configuration elements into the UX two.O framework.01:44:39Okay, so this is just a recap. You can directly upload those elements into your manager, and that's it. So you know you can check the status over there, you can create.01:44:56You can generate a report just to have more details on what what happened, if something failed, then what was it and going back to the SD WAN manager, let me go a little bit faster.01:45:13I'm gonna refresh refresh the page. Now you can see that I have twelve and the the CH based head and router. This is a new configuration group that was literally just imported from the SSP portal. And of course from here, you have to plan this change from templates to configuration groups.01:45:30I'm not saying this is an automatic process. You still have to think and you still have to plan for this configuration change because there are certain elements in the configuration that are in different places than than before. But this is the 1st step or the head start that the migration tool will give you when you're going.01:45:50For this migration.01:46:10Okay, so what's next regarding this migration, of course, you need well the the recommendation is to upgrade to a release that supports the automation. You will get more details on the specific versions tomorrow for the different use cases.01:46:12And use that configuration conversion tool so you can head start your, your, your journey or your migration. And so with that, you're gonna start transitioning to a more integrated SASE management.01:46:31Environment, and you will learn tomorrow that it's not only automation that we're adding, but we will also introduce the unified part of the SASE solution that is coming. So we have come a long way. We have come from templates. Tomorrow, you will see configuration groups, and then there is another level.01:46:47With the unified solution that we will show you that we will briefly touch on tomorrow, ok? It's gonna be a sneak peek.01:47:07So, with that, here are some references that you will be able to access. I think I think there was a question on on the chat as of where the recording will be placed, so you will see that on the, on the.01:47:14Unity space for all the Or you can see not only this but all all the recordings for the different expert inside series.01:47:34Yeah, so right now we are in Q1 so you know we have this red sorry green box over there. We just covered the 1st session. Tomorrow we have the automated tunnels one.01:47:41But there's a bunch more on the security topics that are coming next. I don't know Heida or Dominic if you have any, any more comments on that. Yes. For the Q2 that we have on coming for if you working or you have multi order today, you will have the excellent guide to migrate.01:47:56From multi org umbrella to secure access multi org, then we will have introduction to integration with Meraki to VPN that is also a hot topic. For Q3, we will have mastering CTNA with Cisco secure access where we will talking about, the CTNA deepest part and like.01:48:16Open it to understand to all the people from the start to the end. And then we will have the secure EI with secure access, governance, protection and EI operations that we will work around everything related to secure access.01:48:37Eh about MCPs and EI. Then eh for Q4 we have inside secure access traffic flow decryption and security and finalizing with Q4 digital experience intelligence with thousandeyes and secure access. So more than welcome, you will receive invitations later on so feel free to assist, so that's.01:48:52Great, thank you.01:49:12Perfect eh if you have any questions, please feel free to shout in the chat.01:49:29Eh please, there is NO any question that is a stupid question so ask it because this small question can resolve a big problem that you have. So do that if you have. Do you have anyone, please?01:49:34I I don't think there are any pending questions at least on the slider. Will the URLs presented in the last slide will be shuttered? Well yes, all the the slide will be shuttered in PDF later on.01:49:52Yeah, after that I don't think we have more, I think I, so it looks like everything is clear. Perfect.01:50:11Perfect team. Yeah, thank you very much. I think with that we can close today's session. Thank you very much higher and Alejandro for delivering this, this great, great topic.01:50:27I would suggest like a heads up after you close the session, you will receive a survey, a quick five question survey about the experience of this expert insight series, so I would like to ask you to take 2 min to to fill it up. And with that, I guess we can say goodbyes and.01:50:42We'll see you tomorrow for 2nd part of this session. Thank you very much for attending this Cisco expert insights series.01:51:02
About this Video
Author : Cisco Customer Success
Uploaded : October 01, 2026
AI summary
The recording demonstrates how Cisco Catalyst SD-WAN integrates with Cisco SASE through Cisco Secure Access to deliver Secure Internet Access and Secure Private Access. It shows practical enablement using device and feature templates: creating Network Tunnel Groups, building IPsec tunnels with loopbacks, configuring NAT for Secure Internet Access and dynamic BGP for Secure Private Access, setting MSS and MTU, using ECMP and trackers, and directing traffic with Data Policies versus static routes. It explains DNS interception, SWG decryption, Firewall as a Service, CTNA and VPN flows, and step-by-step validation in SD-WAN Manager and Secure Access. It concludes with a clear migration path to automation using Configuration and Policy Groups and the cloud-based configuration conversion tool.
- Learn how to enable Secure Internet Access and Secure Private Access end-to-end with templates, including Network Tunnel Group creation and IPsec setup.
- Understand traffic engineering choices: NAT versus dynamic routing, BGP design, ECMP scaling with loopbacks, and precise Data Policy bypass for DNS and proxy FQDNs.
- See how to validate and operate: tunnel health with trackers, route verification, event monitoring, and prepare for automation using the configuration conversion tool and Configuration and Policy Groups.
Internal error
No related resources available.