Mastering Secure Firewall Integrations

Hello and welcome to today's expert insight series featuring Cisco Secure Firewall. My name Isanya and I will be your host for.00:11Today's session on security coverage, mastering Cisco secure firewall integrations.00:20So in today's event, we will have two sessions scheduled over the next 3 h 1st, we will focus on covering the integration between Cisco secure Firewall and Splunk, and we will then discuss how to integrate Cisco secure Firewall with Cisco Identity Services engine, well known as ICE.00:27And today we have a lot of folks helping out for our presenters, it will be Adam Kilgar, technical marketing engineer, technical leader, and with senior Splunk technical success engineer. And we also have Chris Brayback and.00:49Both from our customer success specialist team supporting firewalls. We also have our panelists standing by ready to answer all your questions, all the questions that you might have on today's topics.01:10And before we begin, we will be utilizing Slido for the Q and A as well as some polls throughout the, today's event. And to access Slido, you can go to slido.com and use the code that it's right here with the passcode secure FW, one word lower.01:24Case and please use the Slido for all your questions.01:44Which will be answered and monitored by our panelists and without further delay, we can get started. 1st up with and Adam who will walk us through the Cisco secure Firewall and Splunk integration. So Ridwan, thank you and please take it away.01:48Great. So, yeah, myself and Adam will be talking about Splunk and Cisco a bit today. I am a senior technical succession success engineer here at Splunk. I've been Splunking for about ten years now.02:07And located in Knoxville, Tennessee. Our agenda today, we will talk a bit about Splunk in general 1st and then talk about how Cisco and Splunk.02:24Works better together, and then we'll do a demo on, Cisco and Splunk integration, and then we'll do some demos. So.02:39In terms of where we are, right? The state of our world demands that organizations be more digitally re resilient than ever. And as our lives have become more digital.02:56Unplanned downtime has become more risky. Talking about risk, cyber risk has become more valuable as it were, and so it's become business risk, right? And.03:12A recent study from Alliance Global, e.g., has surveys business leaders around the world concluded that cyber was the biggest risk that they could see.03:32Of course, the, the advance of AI has made this all the more worse. Resilience has become more regulated. Governments around the world now demand more from organizations when it comes to security and reliability of their digital systems and organizations are reliable.03:43To be financially penalized for not or for failing to deliver, right? And finally, innovation velocity has become essential. Depending on your perspective, AI is either a four letter word or the future of the future, but either way.04:03This is here to stay and it is accelerating good and bad. So, without further ado, my for 1st question is, how much are you all familiar with?04:22Cisco Splunk. Do you have it deployed in your environment? Do you have it either on prem or on cloud? And I also ask specifically about enterprise security, which is a specific Splunk app. No worries if you don't know what that is yet.04:37Awesome as the results are coming in, I see a lot of you don't have it yet, but there's a good quarter that have an on prem, on prem instances, a good few that are on cloud.05:00Now, can everybody else see the results of this? I'm sorry I don't know. Anyway, so yeah, we've got a good mix here. I will include some details that some of you will already know and some that maybe a little bit.05:20Over your head, it really doesn't matter. As we grow together, we will learn more. So, Splunk, the unified security and observability platform. Really fundamentally, our goal is to bring these practices together so you can make your.05:40Organization more digitally resilient. With best in class tools and automation engines that are purpose built to accelerate, detect, investigate, and respond cycles for incident management, you can respond to incidents quickly and at scale.06:00So the primary strength of Splunk is not only that it can do these things, but it can do these things with diverse sources. We can have 3rd party tools, logs from on prem data centers, logs from devices, from endpoint.06:19Points from.06:39Custom apps, everything can come and get collated together, different types of things like messages, events, logs straight metrics, and Splunk can bring them all together in an AI powered a AI powered glass pane.06:41What does Splunk do? So, sorry, i'm jumping my jumping my thoughts here. There is a lot more to Splunk. One of the things I will.07:02Mention up ahead here is you may have heard of various aspects of Splunk. We will be introducing just a very, very small sliver here today and there are myriads of trainings, hundreds of hours of education courses, and.07:16Documentation available for you to learn more, and of course please reach out to us when you want to. So what does Splunk do? In a very basic way, it takes messy machine data and.07:36Creates dynamic, interactive dashboards, of course dashboards, alerts, responses, all of this, right? We can deploy Splunk in the cloud or in data centers. The reason we have flexible deployment models is for you to.07:53Be able to extend what you're already doing and not have to stress about meeting one particular agenda. You can deploy either on cloud or hosted in your own data center, and with the recent addition of Azure to our deployment options, you can also deploy Splunk in these various.08:13Regions and with your cloud provider of choice.08:33The simplest way is to buy Splunk as a service and go to Splunk Cloud. I noticed a good few of you are already. In cloud, you can just take three simple steps and see your data, right?08:38Onboard your data and it's, it's really easy to send data from any of these sources, everything from open telemetry to, just regular Splunk forwarders etc. And, you can.08:56As soon as you give everybody credentials to get in, you can start getting value. A general look at Splunk deployment. The forwarders are where all the data get sent.09:13And I see forwarders in quotes because Splunk can ingest data from very many different sources. So, in the early days it was a specific universal forwarder agent on a machine, but.09:28You can, you can now send HTTP data and, you know, metrics and mentioned hotel. All these things can go Forwarders send the data to a bunch of indexers.09:47Obviously, we want DR and HA indexers and the indexers are where the data is received, parsed, and then stored. That is our data store, and.10:03The search heads are where our our UI, that's where we search the data from. A quick look at a Splunk Splunk UI, it's really just this simple, right? On the search bar, you can search anything.10:18And caveat on anything, but you can just search anything at an enterprise level level you shouldn't and there's there's ways to do this so that everything is performant. But that is.10:35The power of Splunk. It will make it easy. Once you search, you will see that there is a histogram showing when the events came back. Splunk is time series based and you can see below the raw event data along with metadata that has been extracted from the.10:53Data that is displayed. The Splunk processing language is really quite simple. You just have your search terms in the beginning field equals value in general.11:13And once you that's kind of what collects the mass of the data and after that you after the pipe, you process it. So in this example here, we've done a statistics command to count by a particular.11:30Status and then you get a nice table. You can pretty print that as necessary, and within moments you've got something you can present to a decision maker. Splunk is extended.11:47With its rich ecosystem of apps and add ons, and these basically are pre built packages that help you make sense of the data coming from various sources.12:03Syslog integration with Splunk. I want to make a quick mention of these apps and add ons, one of the apps that is that's available is Cisco security cloud add on, e.g.. It can take FTD data and ASA syslogs and.12:21It comes with the configurations that you need to visualize quickly. So Splunk and Cisco, our story of being better together is.12:38About creating resilience. Network infrastructure becomes distributed detector and enforcer insights from across infrastructure and applications, whether cloud native or three tier or somewhere in between.12:56Can help to identify potential issues even before they happen and all of this will improve reliability. So bringing together the data and the insights across network performance, application, and infrastructure and security.13:15Allows us to correlate the three domains together and take appropriate action. I'll pass on to Adam for talking about Cisco Firewall and Splunk integration. Sounds good. Thank you everyone. My name's Adam Kilghore. I'm a technical marketing engineer.13:32Here with the firewall TME team and today we're gonna go over some of the integration options for getting your firewall data into Splunk.13:52So we'll go with a few sim login options. So we have three primary ones we're gonna cover today. So we've got e streamer, which is kind of our OG log export feature. So I saw from the poll that a lot of you guys are considering Splunk or perhaps new to Splunk, so for our existing.14:01Customers, if you're using e streamer, we are kind of pushing customers towards syslog now. So if you're a brand new customer, we don't recommend going e streamer out of the gate. We recommend one of the syslog options that I'm about to cover. But if you are on estreamer, we do have some roadmap for this. So e streamer is currently supporting our ten.O release, which just came out fairly recently.14:21It will be supported in our ten.five release, but it is planned for end of life in eleven.o. So if you are an e Streamer customer today, you still got a pretty long runway, but we do want you to be considering a transition over to syslog in an upcoming release.14:41For syslog, we have what's called legacy syslog. This is available in all current releases, but it is a little difficult to configure, and it's kind of being replaced from a roadmap standard by our ten.O Splunk integration wizard, which I'll cover in just a moment. So for this legacy syslog, it does add.14:59That's some performance benefits. What we found is that for customers that are trying to export a very high volume of logs, they can struggle with the protocol, whereas syslog offers better scaling for high log export. Our legacy syslog does have a few gaps where it's missing some logged field types that.15:17And that's been fixed in our ten.O syslog.15:39So this is a slide from Breaksec 2124. This is a few years old, but it just covers legacy syslog versus e streamer. So a lot of our customers don't use discovery and correlation or impact flag alerts, but one that's a little bigger, bit of a bigger deal is our intrusion packet data.15:44And that one is available in estreamer but not the legacy syslog. So if you're looking at deploying from scratch and you're on a version lower than version ten, which most of our customers are, then syslog is still recommended, but just be aware that there are a few limitations for syslog versus e streamer, and on the versions below.16:03Oh version ten.16:23However, once you do get to version ten, we have what's called the Splunk integration wizard, and this is what we're recommending all of our customer base move towards. So ten.O is still a little new, most customers aren't on it yet, but it will be the recommended release in the not too distant future. So if you're an existing customer, we do recommend you kind of have this on your road.16:25Map for a potential upgrade in the future and also just be aware that we've made some improvements to syslog and login in general for the ten.O platform. So the Splunk integration wizard kind of brings together the best of both worlds. We've got the syslog, protocol which offers better performance in e streamer, and we've also added back a number of those missing events.16:45Types like discovery, like correlation, like the intrusion event packet data. And it's also very easy to configure and it has more options than estreamer did. So once again, this is on version ten.O and up, but definitely something to put on your roadmap if you are looking at doing integrations in the future or if you're on e streamer or the legacy syslog today.17:05So that brings us to our 1st Slido poll. So just a general question on what version of Cisco Firewall people are using right now. So if you guys don't mind dropping a few in, ok, we, I saw a ten.O drop up jump up to 50 % there, got me excited, but we do know that most of the customers, of course, are on the golden.17:25Star release, which is still our 764 train. We will eventually move the gold star to ten, but that's still a little ways off. And then of course we've got our seven.seven release and then seven four, it was a very long lived release for us and definitely still some customer base on that. So, definitely appreciate you guys.17:45Filling this in. This is kind of what I was expecting. Good to see a lot of customer base on the seven.six release since it is recommended and then a little bit of ten.O adoption, that's fantastic. Love to see it. And then some seven seven and seven four.18:05Okay, so thank you very much for that data and definitely appreciate that. So let's move on. So red one already covered the Cisco security cloud app. So I've covered, we talked about e streamer, we talked about legacy syslog, we talked about the ten.O syslog via the Splunk integration wizard and just wanted to point out that there's an app for that.18:20So Cisco Security Cloud app can ingest logs from all those different sources, so regardless of what you have configured, this is the app NTA that you want to install, and number one in firewall.18:40So it's gonna process all those log datas and also generate some dashboards and high level insights for you based on that information. So we also wanted to cover ten.O advanced logging. So we saw some of you guys have moved on to it already, and that's fantastic. The rest of you just kind of have it as a roadmap item.18:51Once again that will be the recommended release in the not too distant future, and one of the key features we added for logging is called advanced logging. So what this does is it gets us zeek style logs, we say style because this is a one to one Zek deployment, so we kind of modified it a little bit. But if you're familiar with Zeek logs at all, you should feel right at home with these logs.19:12So we've added a few of them, specifically for the DNS HTTP and FTP protocol. We also have logs for connection, notice and weird, and we'll be adding more additional log types in each future release as we put out ten.five and then eleven.O as well. A few caveats for this, these logs have to be.19:32Ported directly from the firewall, they can't be sent from the FMC. And they also do cause a little bit of a elevated CPU usage on the firewall itself. We have some documentation that covers that. I'll link that at the end and also show you a little bit in the demo, but just be aware there's a little bit of a sizing consideration if you turn on advanced logging for your firewall.19:52Can cause a little bit of elevated CPU usage.20:12This is an example of an advanced log. So we run a security operation center at a number of conferences that includes Cisco Live black Hat, RSA, govvware, and then some major sporting events like the Olympics and super Bowl. This particular log is an advanced log that we sent from our firewall depart.20:17Deployment at Cisco Live Amsterdam to our Splunk enterprise security deployment within our sock. So this log in particular is an HTTP advanced log, and I just wanted to highlight a few of the use cases for this. So with the advanced logs, we can add some additional fields that aren't available in logging in general, and that allows.20:36Allows us to do some advanced correlation searches in Splunk and kind of filter down a large event set and find some rare events that have a greater chance of being malicious. So for this particular query, I was looking at the method post, so the majority of HTTP connections are going to be get. So post is a little bit of a rare.20:56Method. And then we also have a rare status code. Usually we're gonna see a lot of two hundreds, some three hundreds, some four hundreds, and then 500 is a little bit unusual. And then the status message is actually a little bit unusual as well from the server for a 500 response. So a few oddities here, and what we found by combining.21:16Seeing these in our query was we got a URI that was a little interesting as well, and we found somebody attempting to send post requests to an internal server, then iterating through some URIs and root R one, route R three et cetera.21:36Potentially just looking for some sensitive information. So by running this query, by looking at the, by combining these different fields within the events logging, we're able to find an interesting event set that didn't pick up on our IPS or anything else, and that allowed us to digging a little bit and pull some full section packet captures and then just validate that when the.21:50We're gonna return this 500 response that it then dumps some sensitive information related to the URI request. So just a simple example, I do have a blog post that covers a few more. I'll link that as well and.22:10Briefly touch on that in the live demo. Another thing we want to cover is just leveraging some of our secure firewall unique capabilities to generate logs and then leverage those in turn within your Splunk deployment for your sock. So one of the top ones we wanna talk about is the encrypted visibility engine or Eve. And what this does is a.22:24This allows us to look at encrypted connections, e.g., TLS are quick and identify the process that launched the connection. So even if we don't have full TLS decryption, we can still get some information by looking at the encrypted session such as application detection, potential malware activity, and then we can also do something like selective decryption for high.22:43Connections and get some operating system details. So digging into this a little bit more, this is a little bit protocol dependent on whether it's using TLS one.21.three are quick, but we're always gonna have some packets that traverse unencrypted. So we'll have our three way handshake.23:04We can have packets like the TLS client hello, the server hello, the certificate key exchange. Once again that varies a little bit based on protocol, but we have some information to go off of even for an encrypted connection. SNI is available, e.g., for TLS one.two, and then we'll have stuff like the port and the destination IP as well.23:21So all of those data points allow us to create a TLS fingerprint that's related that allows us to identify the protocol or the, application that launched the connection. And this example is Firefox, but in other cases it can be malware. So let's look at a real world example real quick. So these are.23:41Events that were generated in our Melbourne security operations center for Cisco Live Melbourne last year. So this is once again getting into enterprise security, which I know most of you don't have deployed, but worth a look and once again this is a real world example. So what we did was we ran a query through our logs, so we had even a.24:01On our firewall, and then we were sending the logs with Eve data to our Splunk cloud deployment. Now we ran a query on those logs and we were looking for Eve logs that had a high threat confidence score, which was related to malware. So you can see here we've got hundreds, 901-90-9907 related to things like a older CD.24:21E adware, and even the pottery malware family. So what we did with this was we actually made a custom detection using that query of our Eve event logs. We boiled these up to enterprise security and made an enterprise security content update finding based on these which are now so we're able.24:41Work. So this for this workflow we did use enterprise security, but you can also if you are just.25:01Using Eve and sending those logs to a regular Splunk deployment, you can just run a query as well and get that data set in Splunk and look for some of these connections. So for us in the security operations center, this is very valuable because we're operating off a guest wireless network where we don't have endpoint visibility, where we're not doing full encryption, and Eve gives us.25:07This visibility to potentially identify connections launched by malware, even though they're encrypted. So a lot of value here and we definitely encourage people to leverage that e visibility both for blocking and also for visibility within their sock like we did here.25:27Another thing we like to promote is, the snort ML detection, and snortml essentially functions as a safety blanket is how, kind of how I look at it or a safety net even. So an example, is if we have something like SQL injection, we've got snort IPS rules.25:43It will block SQL injection and are very effective, but they typically can't match every single SQL injection permutation. So what our machine learning model does is it will actually look for behavior based characteristics and then block based on those. So, once again coming back to security operations center, anytime I see a snort.26:02It tends to be something that's a little more interesting than typically the stuff that matches our traditional IPS rule set.26:23Because it's something that was able to bypass it, slide by it, and then get detected. So snort ML, it does add a little latency if you enable it. We're talking in the microsecond range, so pretty limited, but just something to be aware of for latency sensitive customers. But it is something if I were still a firewall admin, I would definitely be looking to enable.26:29Because I've seen a lot of value out of it. If you do enable SNORTML, there's nothing's.26:50It's fancy you have to do to leverage it on the splunk side, it generates intrusion events just like the rest of your IPS rules, and then those get sent to Splunk. But I do think I do I have seen a lot of value in SNORTML events, so definitely something to I would recommend enabling and then just paying attention to and making sure there's workflows around in identifying and.26:54To analyzing those events within Splunk.27:14And then kind of one of the last features we want to look at is getting better logs with decryption. So, if you go to a conference like RSA, there's some things they hammer like year after year after year, like you should be using MFA, you should be doing decryption, you should be running zero trust, and all those things are great, but we often find that a lot.27:18Lot of organizations truly implement them fully. So if you're doing full TLS encryption hats off, that's fantastic. That gets you better visibility with Eve, that gets you better visibility for your intrusion events, for your malware, for everything really. And all those, all that event details can be sent to Splunk then for analysis and better findings and better workflows.27:37But if you're not there yet, we do have a feature called intelligent encryption. And what this does is this leverages the encrypted visibility engine to identify connections that are encrypted.27:57But then have either a high or very high risk level and then we can selectively decrypt those. So e.g., a lot of organizations are just gonna have loads and loads of traffic that goes to Google and Apple and companies like that, and that's typically going to be assigned a low or very low risk score by the encrypted visibility engine.28:07So what we can do is we can decide to, hey, say, hey, just anything that's very low or low, let's go ahead and just let it pass encrypted. But if we do see a session that has a high or very high risk level, let's go ahead and selectively decrypt that and give visibility on it. So if you're not doing full TLS decryption, this is something that kind of can kind of help you get there or at least.28:27Part of the way there and get some visibility that then informs better logs.28:48And better outcomes in SOC analysis within Splunk. So coming to our last slide though I believe, we just wanted to cover some of the features that we talked about and get a general feel for who's who's using what. So we've got encrypted visibility engine, we've got TLS decryption, and then snortml.28:52And then we also are asking, whether you're using syslog or estreamer. This is multiple choice, you can select as many as you want. So just trying to get a general feel, and kinda I'm actually a little surprised. I thought eSTREAM would kind of dominate syslog a little bit, but I'm already seeing a lot of the customer.29:12Base is on syslog here, which is fantastic. Once again that's recommended. We have made a lot of improvements to syslog in ten.O, so definitely be aware of those as you migrate to that version, but.29:32Good to see the adoption here. So once again snort ML, it is fairly easy to enable. I'll link you to some documentation at the end, but if you go into your intrusion policy and you search for GID 411, you can find it and enable it. Once again, it does add a little latency, but it's something that I've personally seen a lot of value in just.29:45Doing it at security operations centers at different conferences and highly recommended. But I do see some solid Eva adoption here and that's great to see as well and definitely appreciate all the feedback from you guys. Thank you.30:05Okay, one thing we did want to cover as well is we do have a promotion for free ingest of Cisco firewall logs in Splunk. So, just going off that 1st slide though it looks like a lot of people are considering Splunk but haven't taken the punge yet. So this is one thing that could help you take that punge if you're ready for it. So, the promotion is.30:19If you have a firewall, it's any firewall, 200 to 6100, you can get 5 gb per day of ingest logs from it, if you have a sp if you have a subscription and a Splunk license. So if you are interested in Splunk and you have some firewalls, definitely talk to your account team about this promotion and see if you can get some log data.30:39For the 5 gb per day ingest, obviously that's gonna depend a lot on how much throughput is going through the firewall and how far you can stretch that. Typically we recommend people start with the threat logs and then scale up if they can. Obviously, if you've got like a 4200 and you're sending just massive throughput through that device.31:00It's not gonna cover all of your connection logs, but it is something that can get you a start, get you pulling some data from Eve and some of those features we talked about and potentially expand from there. And then lastly, before we get into the live demo, I just want to cover a few resources here. So we do have a secure firewall YouTube channel. This is run by my team.31:19There were 300 videos. So as we release new features like the advanced logging we talked about, like the Splunk integration wizard, like our ten.O release, we'll put out videos that cover those.31:39So obviously we've covered a lot of ground in this presentation, but if you want to go check out a longer video on any of these topics, we should have it on our YouTube channel. And then we also have our website at secure.cisco.com. So this covers documentation on a number of the features we talked about today. So advanced logging covers some logging best.31:49Practices covers configuration for that legacy syslog we talked about. So we'll, I'll show you this a little bit during the live demo, but I definitely encourage you guys to bookmark this, check out the docs, and then just use it as a reference as you look to roll out features like Eve or smartml, e.g..32:09And then lastly, some direct links to documentation, and I think we'll be sharing the PowerPoint slides. So this covers our legacy syslog configuration, logging best practices, advanced logging guide, and then a SOC blog post that covers some of those Splunk examples that I went over. So that brings us to the end of the PowerPoint demo, so I will do a.32:26Short live demo and then I will hand it back to brid one for a longer Splunk demo. So let me go ahead and share google Chrome and it doesn't look like I've been logged out, so that's great. So I'm gonna swap back and forth between on prem FMC and our cloud delivered firewall management center here. So.32:46Just want to cover a few of the logging options and caveats. So if I'm on the on prem FMC, if I go to integrations, and these are both on ten.O both the on prem and the cloud. If I go to integrations, I still have e streamer. Once again we are planning to deprecate that in version eleven, so if you're on estreamer, do plan to migrate.33:05Right, but you do still have some runway. And then we also have our Splunk integration wizard. If I go to the cloud delivered firewall management center and I go to integrations, you can see we still have the Splunk integration wizard because the cloud delivered firewall management center is on ten.O, but we do not have e streamer because the cloud delivered firewall Management Center.33:25Cannot send logs directly as estreamer does.33:45So I'll go ahead and briefly look at the e streamer config, so if you do want to configure e streamer, once again, if you are a new customer, we recommend syslog, and it looks like most of you are there already, which is fantastic. But if you do want to set up estreamer, it's pretty simple, just some check boxes save, and then you can configure a client.33:48So to configure a client, you just specify an IP address of your syslog server, you can set a password if you wish, which will be need to be delivered to the Splunk admin. Save it, that will create a client, and then you just need to download the certificate using this download option.34:07And then deliver that to your Splunk admin. So e streamer simple to configure, but once again, there's some performance limitations that have led us to migrate towards syslog. So I do want to show you guys the new Splunk integration wizard, once again, ten.O and above. So if you're.34:25Not on ten.oh yet. We we know that's the case for most of you, but something to consider as you plan your migration and your future roadmap. So if we go to integrations and Splunk, this will bring up our Splunk integration wizard, which works for Splunk as well as any other Sim as well. And here we can see that we can integrate, we can send logs either directly from the.34:45Firewall threat defense or from the firewall management center over Syslog to Splunk. So I'll go ahead and click on create a new Splunk profile and build a new one right here. So our 1st step is to configure the Splunk server. I'll go ahead and select our universal forwarder object here.35:06And then you can select from UDP TCP or TLS, so more options than e streamer. We'll go ahead and leave this at UDP 05:14. Facility and severity you probably just wanna leave this defaults, but they can be changed if you desire. And then with our Splunk server configured, we'll go and click next. We can then select our event types. So once again, these.35:23Are very similar to our e streamer. Some of these you'll notice are only available for the FMC. And in that case, once again our cloud delivery firewall management center cannot send logs directly. So these are only available from an on prem FMC. I'll show you the CDFMC config in just a moment here. But for the most important.35:43And ones for connection events, for intrusion, for file malware, and for intrusion packet.36:03These are all available from both the FMC or the FTD on our ten.O code. So a few caveats here, e.g., for the connection events, if I set this to FMC, you'll notice there's a little warning pop up here and that's just giving you a warning that sending all the connection events from an FMC can cause performance issues.36:07The reason for that is because an FMC could manage tens, dozens, hundreds of firewalls, and so if we aggregate all those logs in the FMC and then have the FMC send all those logs to a Splunk syslog server.36:28That can cause some performance issues on the FMC. So it's often better to just send have all the different ftds send their logs directly to the syslog server rather than trying to aggregate everything. So just a caveat there, and we have a little warning to tell you. Also of, also a small caveat is if for the intrusion events, if you switch.36:41This is the FTD, you'll see a little pop up. The reason for that is because impact flags are added by the FMC, so if we send the intrusion events directly from the FTD, we will not have the impact flags. For most customers, that's not a big deal, but just a little FYI there. So we'll go ahead and leave these settings as is and click next.37:01And then from here we can choose how the device how the logs are sent. So if you want to keep things simple, you can just say, hey, FMC ftds I'll just use the management interface, done. However, if you want to, you can also say that perhaps you have an inside interface, perhaps like the SIM network here that you want to, you would rather send the logs from rather than.37:20In your management interface. That's something you can configure on that option.37:40Or you can granularly select your options for every device and interface. So for this FMC we only have one managed FTD, so we can select the interface, whether it's the management interface or a different interface to send the logs from, and then we can even disable logging from a specific firewall and keep logging from all others.37:44So this allows us to select firewall by firewall, whether we want to enable login at all and what interface we want to send it from. One caveat is that if you are using advanced login, it needs to be sent from the management interface, so go ahead and leave that in place and click next. You'll notice that we skipped over the certificate, and the reason for that is because.38:04We selected UDP as our event type rather than TLS. So if we did select TLS, then we would have an option to work out the certificate exchange for that encrypted communication between our syslog server and our firewalls and FMC. So with that all in place, we'll just name this.38:23Demo three here. So this covers our Splunk server configuration, this covers our event types.38:44And then it also covers what firewalls and what interfaces they will be sending the logs from. So I kind of took my time to walked you through all the caveats on this, but it's something that you can literally do in under a minute, very simple and click submit and then that will be built for us as this demo three down here. I'll show you the CDFMC briefly.38:51So once again, one to one configuration almost, so if we go to integration Splunk, it's gonna be the exact same system except once again the CDFMC cannot send logs directly. So if I click on create Splunk profile in CDFMC, I will get the same options to configure the Splunk server. I'll just drop in a random IP here.39:11And click next. And then for the event types, once again, we don't have the FMC options. We just have the FTD options. So if you're using a cloud delivered firewall management center, then all the logs will be sent directly from the FTD. Now we are missing some of those FMC specific log types like correlation and discovery, e.g..39:31But for the vast majority of customers, these are the log types you're gonna wanna use. These are the ones that are, have the most value to you. A brief note on the connection ones, you can either send just the security intelligence events or you can send all connection logs and that's available via quick toggle option.39:51I think that's that's probably as far as I'll go with that, need to get the time back to red one here, but I did also want to cover briefly a little bit of our documentation. So once again, we do have the secure, Cisco secure Essentials website, that's at secure.cisco.com. If we come to this webpage, we can go to our fire.40:10They're all central hub and click on read down here.40:30And this is gonna bring up documentation specifically for firewall. So if I click on guides at the top, then this will take us to all the documentation we have. You can also select documentation specifically for different versions, whichever version you're on. And then if you scroll down here, we have login and sim. So.40:34So if you are looking to do the legacy syslog configuration, that's something I didn't cover in the presentation, but we do have documentation that goes over that step by step with screenshots. We also have a logging best practices doc, and this covers some considerations on syslog versus estreamer. It looks like a lot of you guys have already gone syslog, so fantastic.40:53The doc is kind of trying to lead you in that direction, but you made it there already. And then just some information on the different event types and some sizing considerations, some ways that you can reduce log ingestion, estimate the amount of logging that's going to go to a specific syslog server from a specific firewall.41:14That maybe useful for you if you're looking to take advantage of that 5 gb per day offer and then just some tuning options to potentially reduce the logging load on your Splunk or other sim, solution. And then we also have features specific documentation, like e.g. for advanced logging. This was written by my colleague Bill Spra.41:34And this kind of goes over, the advanced logging feature. So if you have questions about what the specific differences are between advanced logging and a connection event for something like DNS, this covers what the exact fields are and also covers some of the fields that are available in the advanced logs, but not in the traditional connection.41:54Lastly, I also wanted to go over.42:15Cisco blog. So, we covered the boiling up the Eva events to findings in enterprise security via ESCU. That's covered in this blog post here. You can just google my name in Cisco blog to find this page. It's also in the PowerPoint. And then if you're interested in some examples of advanced logging in the security.42:19The operation center that's also included in this blog post here.42:38So with all that, I will turn the time back to Ridwan and thank you all. Alright, thank you so much. Just a moment, please, as I get my.42:42The screen share going, ok, so.43:02Now you've seen a demo of how Splunk and, can receive all of these logs. We want to take you to through a quick demo on how you can use them.43:21We're gonna use an app called Enterprise Security. As I mentioned earlier, Splunk is extended by a variety of different apps and enterprise security is our.43:36Premier security app and this at this point it is used in thousands of socks around the world and it is one of our.43:52Premier apps and you can find out more as you go. But we're gonna use that just to take a quick look at a particular attack. So, to bury the lead here, essentially.44:07We're going to see this event that takes place like this, right? So, an attack starts on August 31 at 08:49, where there's some scanning activity, eventually they go through.44:27They find the encoded SQL or they encode, they do the SQL injection and gain access to credential files and then data leaves. What happens.44:43Pardon me, what happens when, we have these logs is we can actually take a look at this. So, going through our apps, we go to enterprise security and.44:59Kind of four one starts as an analyst would come into the day is going to be their analyst queue.45:17All right, so as we're looking at this.45:37We, we see stuff has happened, right? And, the, something to point out up front is Splunk ES bubbles up the notable items.45:39Depending on a variety of factors and ultimately what you get is a risk based queue as opposed to just saying a massive.45:58Flood of all kinds of alerts. So if we start here looking at our problem today, right, Cisco secure firewall, High priority intrusion classification. We can click on it and.46:14You can say, oh, what's happened? One of the really useful things in all of these classifications is that you get the MITRE analysis or MITRE identifications as well. So.46:34Not only can you, can it help your particular analysis, you can also share your findings afterwards, right? So we see here that, you know, the, so we see this, this.46:52Backdoor has has access attempt has happened. As we look through some more of these for a few minutes later, and here's our time frame, right? We see, oh.47:09SQL union select possible injection attempt. So our attacker gains access to a host in our DMZ. Unfortunately, it was only protected by managed firewalls that we don't see logs for.47:27But we've got ftds on the inside, so we've got better visibility. Now, let's see. Next we can look at.47:44What happens just here? Now we've got access to our, oh actually my one of the things we can see.48:01Is our excuse me, one moment, please. I've got live demo issues here.48:18My apologies. Okay, so, as we're investigating, one of the things we can do is go and run a Splunk search on any of these, right? And the, this is the Splunk search bar that we were looking at earlier.48:58And if we can query a particular index, in this case, we are looking at our proxy logs and we can say, oh, you know, W get activity, right?49:15And this is something to keep in mind that anytime we've got event logs, we're not, we're not stuck in whatever app we happen to be using. We can step out of it and.49:30And go forward from there, right? So, back to our next event here as we're looking, at 09:00 P.M. we see this Linux possible access to credential files.49:49In this shell shell session, the attackers dumped some credential data and we can actually go down and see here what exactly he's done.50:08We could similarly see that in a search over here when we go and look just through our Splunk search.50:26UI. So now the attacker attacker has dumped some credential data and our password in our shadow files. He's got credentials for pivoting internally, and he took this content offline.50:42And correct our passwords. Unfortunately, we were using the same administrator passwords across the environment, but of course changing every 30 days. Thankfully, we had an ES notable running for exactly something like this.51:01So if we look at this guy, we can see another spawning process rule, and he's using the win RM process.51:22To gain admin access. We've done another search where we could see more details on that and.51:38What we found out is that he's used the evil-winrm warm and they did some probing and they found our domain controller.51:55And now they are here. So the scariest part of our attack flow, you don't really want NTDS to ever show up on our threat screen.52:15Right? This is our active Directory database, and our attacker has gained admin level access to a critical part of our infrastru infrastructure now. So what do they do?52:31We can look at the details here and they're gonna use proc dump to make a copy of our active directory database. Something to point out here.52:50Is how these detections are configured. So e.g., if we look at this one in more detail, the event based detection is based on all of these criteria, which we can.53:06A bunch of which come out of the box in enterprise security, and then of course we can modify them as necessary. E.g., do we want this as a severity medium or higher? Do we want to add more details?53:26What do we want our drill down searches to be, right? When our analyst looks at this and they see this issue, when they click on the notable, what are their options, right? And on top of that, also.53:41Something very important to point out. What are the assets and identities associated with any particular notable event, right? Because obviously the ceo's laptop and, and random person in the organization's rap laptop.53:59Are going to have different weights, going back to our attack happening, after this, we see.54:16This Cisco security firewall high intrusion classification alert. If we click through, we find that they've used ICMP to exfiltrate the file.54:35Their probing of the network indicated that they had few other options and our firewall monitoring has flagged this event, but it's not given us.54:52A lot of detail. We could drill into the data, go over and look on the firewall management console itself or even gain more context from the Splunk stream data we're capturing in the environment.55:07Another thing I wanted to show you was.55:30Actually one thing I'll mention here is there is a whole app that shows the MITRE attack or the MITRE framework to make it easier to both both ingest and identify.55:42So, and this is the, this, this is not part of enterprise security itself, right? It's just to help organize and structure your data as you build.55:59Now, coming back to our situation here, if we look at our findings in a timeline.56:23So this is where we can see everything kind of together as it happens, right? The kind of view that would be incredibly useful to a SOC analyst. We could.56:39Even reduce the number of alerts by only sur surfacing risk risk based alerts as opposed to, having a flood for our analysts to deal with.56:55So here's a view of our attack chain, and you can see it all together in a nice, you know, time based format, where our attacker comes in.57:10Gains access and eventually moves the data out for more information.57:29Splunk has a lot of documentation that is as general or as specific as you want to be. And one of the really nice things is you can go and.57:48Do a trial of Splunk, just with as little as your own laptop, right? So that early on we mentioned how you've got, forwarders sending data into a Splunk system where there's an indexer and a.58:06Search head, but there's enough places companies where it got started with just an engineer looking at what they can do on a laptop, which can be all of these things. And in the.58:22Splunk website, you could also have options for free trials of the various more specific things. And that is all I have. Thank you.58:38All right. So, thank you very much Adam and Redwin for this excellent walkthrough of the Cisco secure Firewall and Splunk integration. That was a fantastic session and we really appreciate you bringing this technical insights to our community today.58:54So, now we're having a short break. We're going to have 30 min and we're going to start at 1130.59:14Central, and well, we'll talk to we'll talk to you soon for the upcoming session on Cisco secure Firewall integration with ICE.59:28Thank you very much. Welcome back, everyone. Up next is Chris and Nimanja, who will discuss Cisco secure Firewall integration with ICE. But before I pass the ball to Chris, please join us on the Slido for the Q and A as well.59:43As some polls. I will give a moment for you to join before we move to our 1st question. To access slido, you can go to slido.com and use the code 2580744 with the passcode secure FW, one word lowercase.01:00:03And well, as I as I mentioned, please use the slider for all your questions which are our panelists will monitor and respond.01:00:23So I'm gonna give a moment here for you to join before we move on to our 1st question alright so.01:00:30Let's have our 1st question here, and it is, do you currently have Cisco ICE integrated with Cisco secure firewall? Yes, NO. You do have eyes, but they are not integrated.01:00:49Okay, NO yes, we see a couple answers here. Okay, that's that's that's great. Seems half of the audience almost half of the audience.01:01:05Here is using.01:01:24Eyes integrated with firewall. That's great. We still see a couple of answers coming. Okay, so now let's move on to the next one. If you have eyes deployed in your environment, what.01:01:27Version do you currently use?01:01:47Is it three.53.zero still the gold star released, that's great. Okay, I like to see that most of the people are using already the three.four, which is the gold star. That's.01:01:49That's just great. Okay, some of you are not using eyes right now. That's fine. Okay, and now our last question.01:02:09What are the use cases for Cisco ICE and firewall integration in your environment or the one that you are most interested in? You can select all that apply. You can have radius authentication, TACACS, device admin, PX grid.01:02:28Asset remediation.01:02:48It is fair if you're not planning to integrate them at the moment, that's fine. Probably if you are not aware of these use cases well we we will talk about them in a bit. Okay, most of you are using it for radius.01:02:52Okay, great. So, now I'm going to pass the ball, to Chris so we can start with our session and yeah, without further ado Chris, the floor is yours. All right.01:03:11Let me share this out everybody can see this right now. So this is, you know, second half of the expert insight cert series with firewall and ICE integration. So I'm Chris Brightbok.01:03:28Nemandya will be doing the presentation in a little bit or the demo. Alright, so just a little summary of what we're gonna be going over here.01:03:46We'll cover a little bit on ICE, looks like everybody has it, so it shouldn't be a a huge shocker of of what ICE can do and why it's there. Then couple of benefits for the integration, some screenshots and discussion with the ICE configuration and business impacts, best practices.01:04:04This and the demo alright so with the ICE and firewall integration, basically what we're transitioning to is to an identity aware network.01:04:24And that's basically moving away from IP addresses as your identifiers and moving more to who is using those IP those IP addresses and and using their, you know, their logins, their usernames and stuff like that.01:04:42For, for that part of network access or access control. Right, so with ICE, this will fill out here in a little bit, but basically it sits in the middle of a lot of things.01:05:01So go ahead and fill this out a little bit. On our on our left side, if you've gone through any of the ICE sessions in the past, you'll probably be familiar with this where you have all of your network devices and endpoints. And then on the right side, you kind of have your, your other things where you have your, your ADP or your.01:05:17Your LDAP, your AD, MDM, then you have your various, you know, partners and integrations over there under security services. So, basically with ICE, you wanna see the stuff on the left side, secure it, and then if you have other devices.01:05:37That are integrated with ICE, you're capable of sharing that context that you've gathered from all of the devices on the left side to make them a little bit more effective at blocking and basically introduce new features as well where you can block based on certain context attributes that that ICE has gathered and.01:05:56Kind of categorized. So, for those of you not familiar with ICE, ICE is broken up into servers or personas. So the the 1st one is at the top and we'll just kind of go top down, but that's the the pan.01:06:17That is typically referred to as the admin node. 2nd one is the MNT node, which is the monitoring or monitoring and troubleshooting node. And then we have the policy service node and the.01:06:36PX grid node at the bottom. So the PAN at the top, your admin node, that one's used for basically changing policies and doing administration type activities. M and T that one is more of logging and reporting and stuff like that. The the PSN, the policy service node, that is.01:06:51Is used a lot for kind of like eight oh 21X and access control policy decisions.01:07:11As far as the PX grid note, that's gonna be what we're gonna interact with most here with the, the FMC integration where PX Grid is gonna be kind of that, that conduit that facilitates sharing of that context between ICE.01:07:19And the FMC. Alright, so just a little bit more about the integration between the FMC and ICE using PX grid. So it will basically start sharing that contextual information.01:07:35To make this as beneficial as possible, it is also good to combine that integration with ICE, with an integration from the FMC to Active Directory or LDAP to get more of that user data. And that way when.01:07:53You're setting up your policies, you can, you know, you can basically filter based on username, user group, or anything like that that you can see within your active Directory structure. And then when that comes over from ICE and all of that is kind of married together.01:08:11Then you can start blocking based on, you know, usernames and, and groups and stuff like that, as opposed to just the IP address where that person normally logs in. One other benefit for the, for the FMC is when you start looking at your events.01:08:29Within the FMC, if they are related to a, a user or a system that has a known logged in user, you'll start seeing that user ID as well for those particular events. Alright, so benefits of.01:08:47Integrating with ICE. So you can have a little bit more granular access control and as I've been kind of discussing before, you can filter based on a, a username or a group. You can also filter on sgts. Sgts depending on who you're at.01:09:05Asking, they're either scalable group tags or their security group tags, but they are basically the same thing.01:09:25It's a tag that is defined in ICE either statically or you can use various conditions within ICE to define groups of of endpoints.01:09:31And then with those you can assign authorization policies as well as these sgts. So if you have a device that comes in, you know, maybe through eight oh 21X on a, on a wired connection, it's in a specific group within Active directory.01:09:47And maybe it has a certain other parameter or maybe it was profiled a certain way and you know that it might be like a windows or a Mac laptop, then you can assign a specific SGT to those. And then within the firewall, you can use that SGT to.01:10:05Block or allow traffic accordingly. As far as the visibility, so with that you're gonna see those usernames that we just discussed, automated responses, so the rapid threat containment.01:10:23That is possible with, with the integration between ICE and the FMC basically allows the FMC to call the ANC policies within ICE. And I believe those are adaptive network control policies.01:10:38But you have various options. I think the one of the more popular options is to quarantine a specific session or or host. You can, I believe, shut down the port or bounce the port as well, so.01:10:59You have those options for rapid threat containment. As far as dynamic policy adaption, so when you start looking at the the traffic that's coming in and you focus on the user, it doesn't matter if the user is coming in through wired wireless or.01:11:16VPN environments. So you're looking for the user and it really just doesn't matter how that user comes in if you want to get more specific and act on users that are coming in.01:11:35You know, specific ways. You can say hey if this user comes in this way then do this. If it comes in this other way, you know, take this action. But it's not required if you just wanna, you know, treat a user or a group a specific way, you have that ability now that you're not.01:11:45Kind of looking at specific IPs since those might change based on, you know, different networks of the customer or the, the users may connect through. All right, so business impact and operational efficiency. So these are a few things that we've already.01:12:01You kind of talked about our faster instant responses, so when you are looking through your logs, it's always gonna be faster if you have all the information in one spot, so with this integration, instead of you trying to figure out, you know, what user was this and then trying to figure out how to contact that user.01:12:21You'll just have that information right there available. You don't have to look at the IP address, go and see, you know, what host was associated with that IP address at any given time, and then maybe what user might have been logged into that host at that time. You just have that user information right there so it it makes it a lot quicker.01:12:42The automated policy management, with that we're kind of using containers on the, on the FMC for management of firewalls so we're calling either sgts or possibly.01:13:01You know, group level roles, which is 2nd one as well but those can be modified in other locations. So ICE can add other other endpoints to an SGT or classify them as that SGT and you'd have to update the policy.01:13:17Within, within firewall to have that take effect with role based kind of, you know, a lot of the same where, you know, if somebody joins or leaves your company, you, you put those people in specific roles or if they move from one, from one department to another.01:13:38Then they may move from one AD group to another and and from there, based on how those groups are treated within your, within your firewall, then it'll just happen automatically.01:13:57From the firewall perspective. As far as impro improving compliance, this kind of ties it all together. So if you have all of this information in your reports, it should hopefully make your life a little bit easier where you won't have to also save, you know, DHCP logs and, and other logs that kind of identify who is all.01:14:12What systems at what times when specific activities were taking place.01:14:32All right. So here are a few of the different configurations. So this is the the new way or the easy way to configure the integration between the FMC and ICE. So with this one.01:14:41There's three things to fill out. You do have to do a little bit of work, but basically you just need the primary PAN, you need to have a username and a password that user has to have the ERS operator group permissions on ICE.01:14:57It can be an admin, but it's probably best if you just set up a new user specifically for that integration that has ERS operator group permissions. The other thing is you'll have to enable API, the API settings on ICE so that the FMC can use that when it connects and.01:15:14Starts passing back the certificates.01:15:33To establish all that trust, but yeah basically once you configure all that stuff, the FMC is gonna communicate with ICE and they're gonna basically set up that communication channel pass back whatever certificates they need back and forth to establish that trust between those two between those two servers.01:15:36And then they'll, they'll start sharing that information. So the old way is also, it doesn't look like it's that difficult, but it is, pretty, pretty difficult compared to the easy and the new way.01:15:56With this one, you basically just need the primary host name, if you have a secondary PX grid node, you would put that in there as well. Where it gets difficult is with the the bottom row where we have PX grid client certificates MNT server CAs, and PX grid server CAs.01:16:13Needs.01:16:33So the PX grid client certificate that would need to get created on ICE 1st and then you export that and there's specific certificates and keys that you would then import into the FMC. And this is where you definitely want.01:16:34Get involved with the documentation to check that out. But I believe we will be going over that in a little bit with the demo as well. The MNT server CA and the PX grid server CA. So those are the root certificates of each one of those servers.01:16:54So, whichever server is running your MNT persona, then you'll need to look at the root certificate of that, export that and then import it into the FMC. Same thing for the PX grid persona. You need to look at.01:17:12Whatever server is running that persona, go up through the chain, find the, find the root CA, export that and then import that into the FMC and that's where you would basically select all these things. So definitely a lot more complicated than letting.01:17:31Kind of an API driven setup work. All right. So, and all of this is basically so we can start leveraging dynamic attributes within our access control policies.01:17:49So within those dynamic attributes, there's gonna be a few things. You're gonna have device types, you're gonna have sgts that you can call. You'll have some dynamic objects, but all of that is to basically make things a little bit easier.01:18:05And a little bit more feature rich where you can call different types of devices, just give you a little bit more granular control within your firewall policies. These are a few examples of those dynamic attributes. So we've got our, our device type.01:18:23There's a couple of examples here. Obviously they're alphabetical, but you see where, you know, you can have various types of devices, you can also call out, you know, different types of devices, windows, Apple devices, Android.01:18:40Pretty much whatever you want. If it isn't there, you can create custom profiles within ICE and then those will actually show up here as well. Next we've got our ICE security group tags. So these are basically the, the tags that are set up in.01:18:57Nice.01:19:16And they they come over if you have anything statically set or if you have ICE that is assigning these groups dynamically, then it'll pull these groups over and these groups will be kind of loaded up with whatever endpoints have been assigned to them and those endpoints as you see them on the firewall side.01:19:18The last one we wanna look at here is dynamic objects. So once you set up your dynamic objects or the dynamic object connector, you'll basically get two options. So it's either the trusted device or untrusted device.01:19:39And that is if you just hook into the the standard PX grid on prem note. So if you, if you have the Cisco identity information.01:19:55You'll have a few more options and you'll be able to configure that a little bit more. But as far as just kind of the default, if you just hook ICE into the FMC, you'll just get these two options and they're, they're basically based on.01:20:10MDM and posture, you know, trusted is definitely, they are compliant. Untrusted is they're not compliant based on either posture or MDM. The next thing to look at is basically.01:20:27So, and this is more associated with getting the active directory, integration set up so you can kind of read everything and, and choose those groups. But this is just showing the various like users and groups that that are possible within, you know, our lab environment for the cloud.01:20:44Oh directory. All right rapid threat containment. So this is one of our probably more advanced use cases with the integration between ICE and the FMC. So with this, basically, the fm.01:21:04MC or one of the, one of the firewalls would detect a malware event or whatever event you specify, it would go ahead and trigger that remediation if you can send a notification and then ICE would set send that change of authorization.01:21:23To the, to the host where it could either quarantine or shut down or bounce the port. All right.01:21:41So here we have a, a little bit different description or diagram of the, the rapid threat container.01:21:56So in the bottom left corner we have our computer and we see with the solid white line how it goes through the firewall and then out to the internet. It goes to a malicious site, at which point the secure firewall alerts the FMC.01:22:12The FMC will basically send that message over to ICE to say, hey, this happened, go ahead and start your process for, for what has just triggered, then that's when ICE will send that change of authorization. You can also notify any security teams that that's how.01:22:27Happened as well email or or however.01:22:47Alright, so next we have best practices and troubleshooting, a lot of best practices here. So with certificate expiration, that is one of the things that if you work with ICE long enough, you know that that is a a serious.01:22:56When you start having certificates that expire. If you're using certificate based trust, then things will stop working. This is also true with PX grid, if you're integrating with, with the FMC, so.01:23:13You definitely don't want to let any of those certificates expire. You can set email notifications within ICE to alert you of, you know, various time periods, you know, 30 6090 day expirations for the ICE certificate expiration.01:23:28Alright, with ICE scaling, so this is basically just talking about expanding ICE, you can start out relatively small with PX grid. If you if you don't have a large environment, you can.01:23:47Basically have your PX grid node shared on one of the other nodes. As the environment grows, then you can basically expand your ICE deployment up to I think it's 5050 separate nodes, and I believe maybe four PX grid nodes.01:24:01So depending on how much you're using it, you have a lot of room where you can potentially grow there. Alright, the filter overlap, so that this is basically just to kind of filter out where you're getting your.01:24:20Your prime sources for, for identity, so eight oh 21X and map, those are usually gonna be better sources just because they're, they're coming through and they're more true versus like a passive identity source where it's just kind of looking.01:24:37Remotely at like active Directory logins and saying hey, we saw a login for this system, so we're assuming that this person is logged into the system. But if it's not that person and you know maybe there's just a bunch of network shares or something connected.01:24:53That could be false information, so that's why NO one's want to set those up, look for the the most legitimate identity information. System health kind of goes back to the certificate expiration as well.01:25:09If you see errors, address the errors, you definitely don't want to have a bunch of errors firing between ICE and the FMC or or on either one of them really, that could impact that that capability of getting that latest up to date information as it's changed.01:25:26And have that context, you know, kind of passing back and forth between the FMC and and the ICE servers. And, I guess with, with all this information, so if there's any questions or anything like that, you know, we can definitely do our best on the call to.01:25:45Answer the questions that are out there, but for reference, the seven.six admin guide and then the, the ice three.four, those are both the the gold star versions, these two products right now.01:26:05All right, and with that, we will go ahead and pass it to the Manya for the demo. Alright, thank you Chris, thank you so much for this great presentation. I hope everybody can see my screen.01:26:22So, welcome. My name is Nemana. I'm a customer success specialist here with Cisco. Today I will, will be demoing FMC and ICE integration with the purpose to enforce identity based access, basically to our demo production network.01:26:43Works as well as automated response, right? Or RTC. So our scenario has, three user groups, right? We have employees with internet and production server access. We have contractors with internet and contractor portals act access only and domain admins with full unrestricted access.01:27:03So please know that the configuration steps we're showing today will apply to both on prem and cloud delivered FMC and conceptually will apply to FDM as well. So with that let's dive in, let's jump to the FMC and we're going to take.01:27:23Take a look at my environment.01:27:43So here you can see I'm running FMC version 762. And in order to prepare for the actual integration, my very 1st step is to verify the FMC baseline settings. So I can go to configuration and then do management interfaces.01:27:45And here, what I would like to do is to verify that I have already configured, properly configured the host name. I've assigned a unique hostname to my environment. I've also configured domain, as well as DNS servers, right? So this is important, for this integration.01:28:05Because if there's any overlap in the host name, it may actually cause the problems if there are multiple deployments. Aside from the host name hostname and DNS, I'm also going to check NTP.01:28:25And here I can actually check my NTP servers that are configured and we can see that I'm configured to sync my deployment via NTP, right? Which is looking good.01:28:42If I need, I can of course add additional servers. We can also check how these NTP servers are used and here we can confirm that my deployment is using one of the configured NTP servers, which is what we expect. So once we did this baseline.01:28:57Verification, we can go and actually check the integration with AD. We're going to go to the integrations, other integrations and then we're going to select roms.01:29:17So, as you can see here, my AD integration is active, right? So the FMC can sync users and groups. I can click here on the download button. It's going to sync with the AD I've configured, right? For my lab, it will.01:29:30Take just a few moments to complete but for lab it's definitely going to be fast. I have seven groups and 15 users only. However, if we need to check the sync results for whichever version, right, we can go to the sync results tab and then basic.01:29:49Please select appropriate realm. Select the group and see all the users that are in that specific group or we can go to users and then select a specific user and check which group that user belongs to.01:30:08So now we can go back to the realms and I'm actually going to edit the realm that I have configured. Okay, I need to refresh. Alright, so here I wanted to point out the group filtering, right? So instead of.01:30:24For Downloading the entire directory, right? We can just filter on important groups. We can also do a synchronize right here right here from synchronized now button, and we also have automatic synchronization, we can set it to begin at the specific time, right? And run on configured intervals, right? So.01:30:44You can configure this interval anywhere between 1 h and 24 h. So now let's take a look at round configuration.01:31:04And notice here that we have user session timeout. So if this timeout expires without the new login event, the firewall will mark the user as unknown, right? So this is helpful for some scenarios, right? So if you run into those scenarios, you can use it and it doesn't affect your security group tags in any way.01:31:13Alright, so now we can jump to ICE deployment. We will check the version I'm using for this lab. And you can see here I'm using three.five patch three. Now for my deployment, I only have a.01:31:35Standalone node, and if I dig into the the node, right, you will you will be able to see that I have the PX grid enabled. I also have my SXP service enabled on this node as well.01:31:54So looking into the settings, we're going to discard any changes. I can select API settings and here I've enabled ERS API. This is important for the.01:32:15Quick configuration open API interfight is enabled by default, also CSRF check is disabled and I expect it's this disabled on your, in your environment as well. So if we go to work centers and then if we go to trust set settings, I wanted to show you.01:32:29The SXP set settings specifically I've enabled publish LGT bindings on PX grid, for this lab because we'll have some static mappings, right? And we'll need to publish them to the FMC.01:32:49Now, another requirement for the quick configuration is the internal CA, right? So it needs to be enabled so I can go to internal CS settings within the certificates, and basically make sure that it's enabled or enabled if it's not, right? So for my lab.01:33:02I've already enabled this setting. Now, we're going to go a little bit further on ICE. I wanted to show the policy set, right? So I have a specific policy set. For the lab EIS policy set, I have a defined condition.01:33:22As well as allowed protocols. And if we dig into the lab and take a look at authorization policy, which is the interesting part, you can see here that based on the active directory groups, I'm assigning security groups as well, right? So employees, right, are going to be one of the groups.01:33:42Contractors I also have developers as well and then for the default rule I'm just using deny access.01:34:02So we can jump to the switch, and, here I can do show authentication command, show authentication session, right?01:34:13Interface GI00 and then details. And here you can see that we're actually doing.1X, right? So this is our user Alex Morgan status is authorized. We have our LGT assigned as well. So everything is looking good.01:34:30Put, from the switch side and if you go to operations live logs, we can see that this user is also properly authorized on the network.01:34:49Now if you take a look at trusted components, I wanted to show the static mappings, right? Because unlike the the users, right, production servers will be assigned as it is statically. So I have a few items here for for our servers, right? But.01:35:04I also wanted to show that you can basically just signed the entire subnet to a specific security group.01:35:22Now going to security groups here we can define security groups that we would like to use and I defined some like these C project servers, right? So that these are contractor portals, right? And some other like PII DB servers and so on.01:35:32So these are automatically synced from ICE to the FMC. So, going back to the FMC, let's take a look at integration and then other integrations.01:35:47And let's take a look at identity sources and ICE. We have two ways of integration advanced and quick, right? For advanced, we're using the PX grid host name or IP address, right? So remember this is a PX grid host name and we also need to have certain certificates with advanced.01:36:03Configuration, right? So we need to have a PX grid client certificate MNT or PX and server CA now for network filter, we can specify network filter as well and we will describe two topics. Now we're going to go to ICE.01:36:23And within ICE, we're going to deal with the actual certificates, right? I'm going to go to administration and then certificates.01:36:43Here I'm looking for the PX grid, right? The certificate that's used by the PX grid. We can see here it's active, it's the status is good, right? So we can verify that. Also, we can select it and click on view and take a look at the certificate hierarchy, right? So this certificate.01:36:52It is my last route certificate and we can also double check the serial number. So this would be the certificate that that I need for PX grid CA. Now also we have here we have the server certificate, right? The admin and if I take a look at this.01:37:10Certificate we're going to notice that this is the same certificate that I'm using for preexcribe as well. So this one certificate is going to be, be good for both.01:37:30PS Grid and MNT server CA, and if I go to trusted certificate, I can actually find this root root certificate. I can select it right there my lab CA, I can select this certificate. I can take a look, right? I can compare the serial number.01:37:44For the the common name, and once I'm once I verify the certificate I can just click export and here it is. So the other certificate that I need is a PX grid client certificate, and for that certificate specifically, we will need to go.01:38:03To the PS grid services and then client management.01:38:23And we're going to select certificates. So we will select generate certificate without the CSR, right? Without certificate signing request. For common name, I'll grab the FQDN of my FMC.01:38:28You paste it here, I also need to configure SAN, so I'm going to select FQDN as well. So again, I'll just paste it and then I'm going to add the IP address as well, which I will grab.01:38:46And paste. So the download format that we need to select is PAM, and we also are going to provide the certificate password that we're going to use back on ICE when we import the certificate.01:39:03So once you're ready, we can click create. When we click create, it's going to trigger the automatic download of the zip file. And we're pretty much ready to go back to ICE and configure certificates. Now although we can add certificates right here, right? From we have a plus sign here. We're going to go.01:39:21To to the objects actually, right? So you can see here we only have one certificate at the moment. We're going to go to object management just to show you, you know, just in case you need to delete some certificates or change anything, you can go here. So 1st we're going to do internal search.01:39:41And here, we can give it a name, the internal cert is going to be our grid client. We're going to select the certificate from our zipped files, I need to unzip it 1st.01:39:58And then once we have it unzipped, right, so I can select the correct directory and select the actual certificate, right? So this is client certificate, and I also need to select the key.01:40:19So the next thing is we need to supply password, right? Since this is encrypted. So I'm going to supply the same password that I've used on ice side and click save. And here it is, right? So we've managed to import ICE PS grid certificate and now we're going to.01:40:37Import, PS create server CA and MNT CA, which is going to be our root CA. So if we browse, this is the trusted certificate that we.01:40:57That we've used, and it's not encrypted, right? So we can save and we've imported this certificate as well. So now we can go back to the integrations, to identity sources.01:41:11And, we can just select PX grade client certificate that we just added. We can select our ICE root CA as MNT server CA and again ICE root CA as PX rate server CA. ICE network filter, we will not add anything, right? So.01:41:29This is this filter is just to basically narrow down, you know, the the session data that you're getting into your FMC currently is set to any and both topics are relevant to us. So we're ready to test.01:41:48You can click on the test button and basically we get this failure, right? So let's see what's going on within the logs. So we have the pending status for this account, right? So if we go to ICE and we're already in administration services, client management where.01:41:59Going to select client.01:42:19And here you can see that we have one of the clients, it says DF and C that it's it's in pending status, right? So we can select it, approve it, say ok, so it shows as enabled. But if I go to the settings, right, I have this option to automatically approve new certificate.01:42:22Case account, right? And I'm going to use this for my lab so that I don't have to go back and forth between FMC and ICE. You might already have this enabled in which case you don't necessarily have to approve manually.01:42:42Alright, so going back to ice, we can we can retest the connection, right? And now it's a success. So we're ready to save.01:42:57Alright, it takes a moment. Now we also have a quick configuration, right? So for this configuration, we specify primary PAN FQDN, so that's the difference. We use PS grid in the advanced configuration. We also need to specify ICE credentials at least.01:43:20PRS operator and then the the rest of the configuration is very similar or the same, right? So we have ICE network filter again if we don't put anything, it's set to any and topics, right? We also have the option to regenerate certificates and the various information that we pull from ICE. So let's test this.01:43:40It's quick configuration just to show how it looks like and we can see it looks good, right? Because we have that automatic approval of the clients. We can close it, right? And basically, you know, I just wanted to quickly show how the quick configuration would work, right? Advanced configuration definitely more applicable to all the soft.01:44:00After versions and so on. So taking a look at the client management, right? So we can kind of refresh and you can see here that we've auto approved quite a few clients, right? For our integration, right? So just just be aware, right, of all the the clients that are approved. Now.01:44:20We can take a look at the actual policy within the FMC. So we have our access control policy specified right for this lab today for our demo and in this policy since we're dealing with identity, we're going to have the.01:44:40Identity policy configured as well. So identity policy is required if you're going to use, you know, user groups from AD, usernames, and so on. If it you're just going to rely on the it's not required. So we're basically matching traffic, I'm matching based on insight.01:45:00Source to a specific realm for passive authentication, so the FMC knows when to look, in which cases to look for the identity information, right? If we don't do this FMC will not attempt to get this information. We have a couple of L3L4 rules, right?01:45:20For a demo, but most importantly we have our identity rules set up, right? So 1st of all the contractors, this is allowing 1st rule. Rule five actually is allowing access for the contractors for entity five access.01:45:40Two are.01:46:00Three project servers we which is contractor portals, right? So this is per our requirement that we went through initially, right? Of course, this is all happening on private IPs. Then we were denying contractors for any other access, right? So contractors should not be able to access anything else that.01:46:02Specific portals and we of course we are allowing contractors to to.01:46:22Access internet right based on our SGT tags. Now we have two identity rules where we filter out Jado and J Smith users right for this demo from our specific network, which is defined here, right? So this is pure identity rule and we also have our.01:46:28Our domain admins and enterprise admins that have full access to the same network.01:46:48Yeah now moving forward, right, for our employees, right? Employees are very similar with contractors will, based on the keys we will not, they will not have access to portals or some sensitive servers PII DB servers, right?01:46:54So those that access will be blocked. However, they will have access to, pro of course production server network but to development server, so we have a security group there and production servers as well.01:47:14And we have one, a rule for employees internet where we allow access to the internet. Now I wanted to quickly show how easy it is to add rules, so we have, let's say we have a new user, right? New employee, and we're going to give it the limited access. I'm going to add.01:47:31Add inside zone as a source for the users and the realm is already pre selected and I can actually filter on the user. This is going to be our user Sam taylor. So I'm going to select Sam and also add it to the source, and.01:47:51And for the dynamic attributes, I'm actually going to just select the ICE security group tags. You can see all the different security groups that we've imported from ICE on the PX grid and I want to add access to the development servers for Sam, right? So here we're adding.01:48:11A destination dynamic attribute and we're ready to apply. Well, actually, we can add logging at the end of the connection, right? So this is allowed action, right? And we can apply.01:48:30And here it is. So in case you've noticed that maybe you forgot the to add intrusion policy as I did, you can just click here on this icon, right? Shield icon and just remediate that that issue real quick. You're going to get the.01:48:48This dropdown and you can quickly just select appropriate policy EIS intrusion in this case and confirm, and we're all set. So now we're set to save the policy.01:49:08Save our changes and then whenever we're ready to deploy right so we can deploy these changes as well. So let's take a look at how our policy is actually.01:49:20Working. So we're going to go to unified events, and we need to extend the time a little bit, right? Because this is lab with limited resources. I'm going to start sliding time range.01:49:38And I'm going to select two weeks. So the 1st thing I'm going to verify is source entity, right? So we have our contractors as a source, and I'm going to select a destination.01:49:58Everything it's going to be to our production servers, and I guess we can add the PII DB servers as well, right? So the contractor should not be able to access.01:50:16These resources on our network. So we get a lot of blocked attempts, right? Which is what we expect. So this is our user, this is our destination production servers, and we also have the, the action block and the rule that we're hitting is correct Contractor is denied. And we have other.01:50:31Like Elena, right? She's trying to access actually our sensitive PII servers, which is not not great, but she's also hitting the same rule and she's blocked, so in that way it's good. We also have some other contractors as well like David so.01:50:51We can say that this part of of our requirements is working good. So now let's change the conditions, right? And let's say, let's select contractor portals.01:51:08Oh, let's yeah let's do the just the portals, let's apply. And what you're going to see is a lot of allowed connections, right? So this is atlanta, right? The contractor FGT destination is the contractor portal FGT, so everything is looking good.01:51:24The access control rule rule is looking good as well. We have David the same and now we have a couple of blocks, right? So what is important to to notice, right? This is still a good access control policy rule, but we do have inclusion block here, right? So this is still possible if something is detected on the network or we.01:51:44Would get into the and then going down right so we can see Sarah right, and David also accessing the same portal, so we can say that this part is also working as intending. Now selecting employees, we're going to verify access to production server.01:52:04Security group, we are going to apply this filter.01:52:24And we can see here, we're hitting the the good rules, so Alex she has source correct the destination is also correct. However there are a couple of again intrusion blocks right that are actually blocking this connection.01:52:31Now.01:52:50Oh, here we do have this group prod allows so remember, if you remember this specific rule is identifier identity rule, right? Based on AD group and Priya is our domain admin and she has full access to our, to our subnet right that we are protecting. Also, we have a couple.01:52:51Couple of user that we've specifically blocked based on the username, that's Jane write and John. So we've blocked this user, right? So and they are actually hitting the correct rule as well. So, everything is looking good, right? From this perspective, so we.01:53:10We can kind of move on and just show that we can actually.01:53:30Also use the source user, so let's use Priya so That's, that's the actual username. So if we apply this filter, we are going to see we should be able to see all connections from Priya and you, we can see here that she's hitting.01:53:35The rules right as expected, she's still an employee, right? And she's hitting the employee internet access, right? And also she has a full access to PII DB servers, contractor portals, production servers, whatever it is, right? So we only see allow action in this case, which is a.01:53:55As we are expecting.01:54:14So again, this is a pure identity rule based on AD groups, right, where Priya is belonging to. So let's now let's verify the internet access. What we can do, we can kind of select source entity, for our contractors, but we are.01:54:17Going to add employees this time as well and for for a destination we are going to use the destination IP filter.01:54:36And then we're going to negate all the private IPs, right? So you can actually use this, menu rights to to kind of just select already pre configured object, right? And we can apply.01:54:48This filter, and you should be able to see basically employees internet access, right? So we can see source entity employees. We don't have any destination entity here. We still see the source user, right? Based on our identity policy. And if we scroll down, we can.01:55:08You can also see contractor internet, right? So we we see here Elena, right? So she's a contractor and Sarah and we can see again source but NO destination destination on the internet, of course. Now, if you would like to see more data, we can always go to the dashboards, right? If you want to see.01:55:27See that aggregate data?01:55:47And there is a dashboard we we would use switch dashboard, there is a dashboard access controlled user statistics. We will select connections, and here we will see all of our allowed connections by user denied connections by user. Actually let me extend that to one week.01:55:49So it, it takes a minute, right? But here it is, right? So we can see all the allowed connections by our users or all the denied connections, unique users over time, as well as traffic by user in kilobytes. So all this information is typically very useful, so.01:56:19All of these are active links, right? So if I want to see allowed connections by user, I can click on that specific user. It's going to take a few seconds, right? But it's going to actually load those connection events and if we need to analyze anything, we can kinda dig in right and.01:56:39Apply any additional filters. So going back to dashboards, I also wanted to show real quick intrusion events. So this is also very useful so we can see dropped in intrusion events by user. We can see these events by.01:56:59Impact, right? So we have impact two events by user and impact three events by user as well. So the VPN we don't have VPN configured, so we're going to skip that part. We're going to go to analysis and then we're going to go to user section and we have in the.01:57:19Patients of compromise so we can select it.01:57:39So in case you have any indication of compromise that's actually mapped to a specific user, you can click on users and see what's going on. So we have our user here, we have email, we have the indication of compromise.01:57:43Is event types, all those details, and we have a host history, right? So nice thing is that we can kind of track the user this way. We also have the option to use contact explorer. So which in production I believe it's going to be very useful and here we can see where.01:58:02More details about the.01:58:22A user, so I'm going just going to extend to one week here we would be able to see traffic and intrusion events over time, you know, traffic by source IP, by source user, operating system, and all those, that data that's actually collected by your FMC.01:58:24Now here I think.01:58:45What we need might need to do is to apply the filter, ok and that did recent but you can see how this data is very helpful, right? Connections by.01:58:48Access control, right? Traffic by destination IP.01:59:08Ingress security zones, connections by SSL status, applications, and risk, intrusion events, and so on and so forth. So a lot of really useful data is available here for you and you can filter on a specific user.01:59:11Now, with that said we can go back to analysis and we can go take take a look at active set sessions, right? So here we only have one active session at the moment that's Alex Morgan, right? So we can see the timestamps, the realm, last scene, authentication type.01:59:28And oh we can scroll this table, so it's it has a lot of columns and it has a lot of information in it depending on what's available to your FMC that information is going to show. So that, those are our active sessions. We also have the user.01:59:48Option right so these are our users from our realm that we have and they're discovered in a different ways and we have, we have one one active session for Alex. Some of the users are available for policies, some are not depending on the.02:00:08Identity and how everything is configured. But again, a lot of data here. So we also have the user activity so let me just show this. This is my secondary FMC saying hello. So here we can actually see logins and logouts.02:00:27For our user and, you know, with time stamps, with rounds, and everything else IP addresses. And if I scroll to the right, a lot of VPN columns, right? But also we have security groups, endpoint profile, endpoint location, so this location is effectively your network device as well as device class.02:00:47So you can find some very useful information here except for logging events.02:01:07All right, so now we I wanted to go to the policies and show the last part which which is automated re response or RTC rapid threat containment. So I have one policy intrusion remediation configured here and it's enabled, of course, and I'm going to click on pencil to edit.02:01:14So here we can see that I have one rule configured with one response, which is going to be shutdown and denied, so this is a remediation response. So let's quickly take a look at the.02:01:34Actual rule. So here we can see that if any intrusion event occurs then and it's from the ingress security zone inside on the device FTD zero three, then we're going to apply the remediation that we've configured, right? So this is just the basic, but you can you know.02:01:48So you can use more complex conditions if you would like. So we're going to remediations and the remediation specific remediation that we're using is the PX grid ANC policy assignment.02:02:08So, the one that we're using is a port shutdown. So let's take a look at that one. And here we can see this remediation name shutdown and deny, we're going to apply for the source of the connector, right? So.02:02:21That would be on our.02:02:40Users from our from the inside right that are maybe connecting in our office or site. So going to the jump host, we can just verify again that our user Alex right is looking good, still connected, still the session.02:02:43Is going on in our eyes we can go to endpoint assignments within the ANC, right? And we can see there's nothing there. We do have two policies that we have configured but we're going to use ANC shutdown. So with that said, let's try to simulate intrusion in.02:03:02Event, right? So I'm going to go to my client.02:03:22Actually to my client PC. And what I'm going to do, I've configured my intrusion policy in a way to trigger intrusion event based on the access, right? Based on the access to, our production servers, I'm pinging.02:03:26One of them and this should actually trigger the intrusion event. So going back to FMC, I want to go to unified events, and what I'm hoping to see here is an intrusion event.02:03:43So it's not showing. Oh, here it is. So we have intrusion event. So in place allow from Alex, right? So this is what we expect and we know that we have that correlation policy that will trigger based on the intrusion event, right? So this is intrusion event with this associated connection event.02:04:03So now let's verify, right, if everything executed correctly, right? So if we go to our switch, let's see what happened with our session, right? So now session, it appears to be terminated on the switch. If we take a look at the interfaces.02:04:24Can see that the GI zero zero interface that we've used it managed it is down, right? Administratively down. So going back to ICE, we can see when once we refresh that our policy is applied to our Mac address, right? So we have applied ANC shutdown.02:04:43With the policy action action shutdown to our address. If we go to live logs, it will not show there, but our live session.02:05:04Will actually be terminated, right? So to make sure that this same user after being correlated with intrusion event that cannot access the environment again, we will go to the ICE policy and.02:05:15One of the things that I've configured, right, is this a global exception. We can see here, the rule and see action shut, right? We are basically basically have ANC policy condition. We are matching the policy and we're denying access. So all endpoints that actually end up with this policy.02:05:34Are going to be denied access.02:05:55And with that, this concludes our demos so you know this integration of ICE with the FMC, it allows us to basically NO longer rely on static IP addresses to to secure our network. We know who is connecting and we can enforce granular access control.02:05:59Using security group tags or, you know, active directory users and groups. So thank you all for your time and I'm going to pass the ball back to Chris.02:06:19All right. So we're basically just wrapping it up here. So a couple of key takeaways, identity being the new perimeter as opposed to relying on IP addresses. The X grid is here to help simplify kind of the the exchange of all this contextual information between ICE and firewall, ICE and and.02:06:44Whatever you have on your network.02:07:04For modern threats, automation is definitely a key aspect of it to respond as quickly as possible and deal with those threats in a timely manner. With that being said, I'd like to thank you guys for joining us today.02:07:07Yeah it's been a pleasure. Thank you Chris, and thank you Nimanja. That was a great session and demonstration. I'm gonna share.02:07:25Really quick, a couple of things and links. Okay, so just very quick, a couple of things before we end today's session. 1st up, heads up that we will have another exciting firewall expert insiders coming, so.02:07:41Will be on the lookout for information on that shortly. In the meantime, we have another webinars on the specific topics, so please take a look at our upcoming firewall events scanning the QR code at the top. We're going to share with you the links in the chat as well. Also we have a cyber tabs.02:08:01Tools to help with firewall trainings, providing bite sized videos of different highlighted features in different languages. So, we also have here the QR codes so you can access the link, but we can also share the the link directly in the chat.02:08:21And finally, well, we valid your feedback, so please reach out to us if you have any questions or if you want to provide feedback.02:08:41You will be receiving a survey after the session closes, so please do fill that out to let us know how we're doing. And with that I wanted to thank our presenters and our panelists for that great session and we also wanted to thank you.02:08:50Thank you all for attending today's expert intent series, so thank you. Have a great day.02:09:10