SDWAN Security Policy, NGFW, IPS/IDS

Oh, alrighty. Perfect. Thank you Sergio. So here's a look at our agenda today. We're gonna cover several different topic items here, most of which, which we talked about in our o.00:00Learning slides. There's a lot to cover, so we'll preface it by saying that. So we're just going to plan here in the upcoming slides to set the stage, cover some of the foundational items, bring you awareness to some of the security capabilities and functionalities that we have with SD WAN. As you may know, some of you.00:20I've seen we have a lot of capabilities and functionalities, so it's hard to squeeze all of that in into a 60 to 90 min session, so we'll just cover.00:40Some of of select items here. So we'll start out by doing an SD WAN security overview and then we'll get into the next gen firewall or integrated security capabilities and some use cases as well as some key best practices or key guidelines that we want to keep in mind as we go about learning and.00:50Integrating those capabilities, then we'll get into how we go about configuring this and then we'll take a little bit of a look at security monitoring, as in what, what do we wanna do after we have this configured? How do we keep up with this? How do we look at some of the data, some of the statistics? So, and then we'll wrap up with a demo from.01:10Sergio. So this is just a look at what we're gonna cover today, so let's go ahead and get started.01:30So SD WAN security overview. So what we have here, as you can see, we have this flexible security architecture, and that's really gonna adapt to any environment as you see here. So anything from healthcare and retail to some of your government or complex government.01:37Or financial institutions. So by us deploying our, as we see our secure router or routers or really any of our capable Cisco routers at the edge, what we're getting is the ability for us to perform this comprehensive threat monitoring and this deep inspection regardless of whether.01:54The traffic is gonna be destined to our data center, to our public internet, private or or SaaS clouds as we see here. And really what what's happening here is this solution, our SD WAN security solution is really going to simplify our segmentation, and that's gonna allow us to do things like isolate our traffic patterns while also maintaining any sort of strict.02:14Boundaries or or premier, right? So since this is built directly into our routing stack, what we're getting is more of this unified security portfolio that's gonna replace a lot of our safe fragmented security appliances. So we're gonna have more of this consolidated unified policy driven appropriate.02:35Approach with our security built in security solutions here.02:55So with that being said, we have what we call our security ecosystem, and this is how we're leveraging our STS or our shared technology stack, and that's gonna give us this enterprise grade security right to our SD WAN branch as we kind of see here. So, what we're doing.03:00One is we're integrating our hardened snort in our Talos threat intelligence and what we're doing is we're really.03:20Boosting our efficacy while also reducing our our costs and that's gonna be by way of eliminating any sort of 3rd party tools, things like web root and so on and so forth, right? And that's just really gonna cut down on on our ops costs. And since we're running our you know the same code base across our portfolio.03:26We're gonna get a lot of consistent next gen firewall behavior and we're gonna get things like improved stability and and things of that nature. So.03:46Really and truly, the important thing here is that this is gonna give us the foundation for what we like to call our north Star goal. I know a lot of us in the enterprise, we like to refer to our North star, and that's really just managing a common security policy across our entire enterprise from, from a single dashboard or a single console here.03:56So here's a look at some of our core capabilities and again we see here across the top our Cisco secure router, which is starting to become more prominent now especially for the enterprise environment. But really here we're just, you know, also talking about some of our other routing platforms as well that support these capabilities.04:17So what we're, what we're looking at is, is really just unifying our security stack across like Meraki Catalyst, secure firewalls, just to give us more of a consistent.04:37Next gen firewall power across the board here. So, really it's gonna be the same engine and the same IPS intrusion prevention system tech under our hood. So we're not really dealing with any sort of fragmented policies or like different feature sets depending on what the hardware is. So.04:48Ultimately, we're just getting more standardization for our security posture. So as we see here, we can do anything from layer three to layer seven firewall, IPS IDS AMP, sandboxing with file analysis, and so on and so forth. So we're gonna dive into some of these in a little bit more detail here.05:09In the upcoming slides and in the demo as well.05:30So I know in one of the opening slides on the agenda slide, we talked about how there's a whole lot when it comes to Cisco SD WAN security. So we have, we have sassy, we have cloud colo, so we have on box, next gen firewall. So there's a whole bunch of different deployment options that we have.05:35So each one of these can, as I said earlier, can be sessions in and of it.05:55Are to over in 3075 90 min. So mainly what we're gonna do today is just focus more on the on box next gen firewall capabilities, some of the main ones that we see integrated with our customers today. But just to kind of show you the landscape here, the three deployment options, we got our integrated security stack, which is gonna.06:00On our full next gen firewall capabilities directly on our physical or virtual edge routers to block any external threats and to control our application access. We also have our cloud sassy base security, so this is mainly gonna be for us if you want to offload our traffic inspection to our cloud.06:20Via intelligent load balancing through IPsec tunnels. Usually what we're, we're doing there is just kind of pairing that with our integrated stack here for sort of this multi layer hybrid approach. So that's gonna be more of that sassy deployment option. And then we also have the cloud colo which is really extending our.06:40Overlay to whatever the nearest colo facility is. So we're gonna be able to, you know.07:00Allow it, we're gonna be allowed really to inject any sort of 3rd party security services for our branch to internet traffic. So, really and truly these options are just giving us a lot of versatility for, for us as architects, as engineers to secure our environment while also doing things like optimizing.07:07The traffic flow and giving us just a lot more consistent policy. So.07:27So with that being said, that was a little bit of an overview of what the landscape is and what some of the core capabilities are. So we'll just dive a little bit deeper here and we'll talk about the different capabilities and functionalities as well as some of the use cases.07:33So, with security, we have segmentation, so we have end to end segmentation, and we have what we have is micro and we have macro segmentation. So when we look at the macro segmentation, typically this is gonna be broken down per.07:50VPN, so we see here we have, e.g., three VPNs, IT finance and a partner VPN, and we also have our micro segmentation here, which breaks that down a little bit further. So e.g., we got VPN one which would be our IT where we have say we have managed unmanaged devices and we also have things like shared resources.08:09This is right, like printers and so on and so forth. So typically what we do here is, you know, printers that's gonna carry things like a security group tag or sgts, so we could have controlled access within that particular VPN, so in this.08:29Particular example here would be our IT VPN. So this is just a quick depiction of, of what we talk about when it comes to micro and macro segmentation here. So when we look at our 1st real capability for our next gen firewall, which is gonna encompass all of our.08:45Functionality. So zone based firewall, URL filtering AMP, IPS IDS, just taking a quick look here at our zone based firewall. So this is really gonna give us that stateful app aware inspection from layers three through seven. So we're gonna be utilizing things like N bar two SDAVC for.09:05Or deep packet or deep traffic visibility.09:25And we've also baked in a lot of those robust operational features as well, like flood attack prevention, we have ALG support. We also have scalable rule sets, which we'll touch upon a little bit later here in the, the PowerPoint as well as a little bit in the demo with Sergio.09:28But really we have those things so we could have our sessions more stable and and a lot easier for us to manage.09:48And then also too, we, we can see that we have inter zone and intra zone. We have self zones and default zones, which we'll get into here in a little bit, and also the actions that we wanna take on our firewall rules. So whether we want to pass, inspect.09:56For drop/block traffic. So this is just the gist of what we have if we want to look at configuring a zone based firewall.10:15So, going a little bit deeper here, we have by default, we have inter VPN or VRF communication that's not allowed. So e.g., this would be things like guest internet that can't access a.10:24Point of sale or corp apps. We also have service view in zones in particular. Some examples we see here could be in as two different zones or we have interfaces in say VLAN A and then VLAN B can act as two different zones.10:40And then we also have interzone and inter zone traffic, and we can do inspection or we could allow or drop that traffic. So interzone would be if we wanted to allow guests to access say a printer and Corp IT, but that's only a over a specified IP or a port. And then inter zone would.10:59See if we wanted to inspect say all traffic from a point of sale to finance server for our PCI compliance. And then we also have self zone, so.11:19What self zone is, that's gonna represent our traffic that's gonna be originated from the router itself. So an example would be if we wanted to inspect traffic originated by our edge device when we're retrieving data. So things like update to our UTD. And then we also have our own zone for that.11:29Represent the remaining zones that we don't necessarily call in a zone pair, which we'll see later on in the demo, how we create a zone pair. So if there's NO policy defined in our point of sales, then it's gonna automatically inherit it as a default zone policy. So this is just a little bit of a overview of our zone based firewall.11:48Especially when we look at segmenting our our network.12:08So here's a, here's a use case for us to look at, and this is one that we typically see with, with customers. So when we look at securing our inter site traffic, e.g. here we got a CAT8 K edge next gen firewall.12:13Which is gonna make it really simple for us to enforce this compliance right from our branch here. So instead of just relying on say general site access, what we can do is we could apply a granular firewall rule to manage exactly how our users are gonna act interact here with our resources. So you can see we can easily create a rule that's gonna let.12:30Our IT admin connect to an app server over port 443 while also blocking traffic on port 80 along with that. So.12:50What this is doing is just giving us direct control over our internal flow and then also keeping our environment secure and audit ready if we have to go back and look at how this is configured and what, what rules were applied. And really this is just doing it without any sort of extra appliance, right? So it's all, again, maintaining that, that really.13:00The policy driven posture exactly where our data lives and where it flows. So that's inter site traffic.13:20And then we also have inter site traffic. So as we move to inter site traffic here, we could extend our policy right across our overlay here, and we're doing this by way of mixing our macro segmentation, like our VPNs and our vrfs here, along with our micro segmentation. So.13:27As we see here in this example, we got, looks like Dan and IT, so he has access only to his app server in our data center over port 443 in this example while we're also blocking any attempts over port 80. And then again this is gonna give us that same level of granular.13:47Role based control between our sites, as you have, you know, locally as well. So really, again, it's just a clean way for us to keep our, our communication especially inter site in compliance and secure without any sort of, headache.14:07And then here is another use case example. So this is where we're going to restrict or control our internet access directly from our branch. Another common use case that we see a lot. So what we can do is we can block our employees from any sort of, say high risk destinations or things like.14:25For places like social media while also creating some sort of exemption for certain sites. So really it's all about.14:45Maintaining that control over what users reach without needing to say backhaul that traffic back to a central hub. So again this is just really making things more simple and and we all like simple and a simplified approach.14:53And then guest Wi-Fi to internet, another common use case that we see. So, when we talk about this, this is really kind of a major pain point, if you will, when it comes to things like bandwidth in our in our security.15:11So what we could do in this particular example is, we could enforce acceptable use policies here by way of filtering our traffic based on our site reputation and also our site categories as well. So in this example, what we're doing is we're restricting our guest access to say high bandwidth consuming categories.15:28Worries here, like, you know, like torrent sites, e.g., as we see. So this is just gonna give us again direct control right at our branch so we can prevent and limit any sort of congestion without needing any sort of additional hardware to be installed.15:48We talked about how we can match, so L three to L seven matching here, anything from our source or destination prefix and ports all the way down to things like doing identity based matching. So we could also do that as well as FQDN.16:09In a geolocation, we can match based on our protocols as well, as well as our applications.16:27So for our applications matching, we can do application recognition 1st. So this is where we're gonna be using our NBAR and SDAVC to give us a little more accurate or more precise layer seven visibility in that 1st packet classification here.16:38So what we're doing is we're just gonna classify our traffic and then it's just gonna cache those results into a application rule pack giving us just aL3 to L four app ID mapping, and then this is just gonna let us manage our traffic based on specific application families. So if you.16:55When your manager and you drill down into the apps, if you create say like a.17:15A group of interest and you drill down to apps, you may see different applications and different different application families. That's pretty much what we're talking about here. So we're gonna have a little over 1500 predefined signatures for that. And we could also do custom apps as well.17:23So that's application recognition. So just just some guidelines here, more of best practices. So when we configure our zone based firewall, we just want to make sure that we prioritize our specific app matches at the top of our rule set rather than trying to rely on like a generic.17:40Your HTTPS filter, and then also we just want to remember that our session reclassification is going to trigger automatically whenever we do an update to our firewall rules or if we have or if we use any sort of enabled app discovery, so these are just a couple or few guidelines.18:00Or best practices we wanna keep in mind.18:20So moving on, we'll talk about the FQDN support, another one which we see. So when we, when we use or match on FQDN, we use what's called our DNS snooping agent or our DSA, and that's just gonna handle monitoring our DNS.18:23Test Responses and also building a dynamic database for any of those domains to occur an IP here. So.18:42These mappings, what ends up happening is they're intelligently cached and that's gonna be based on your time to live values, and that's just gonna ensure that our firewall policies are staying accurate. And then also too, if we look here when a flow comes in, the system checks the destination IP.18:51Against the FQDN and then it's gonna determine what the correct action is. So it's really just a much cleaner way to kind of enforce some more granular and domain based security at our, at our branch sites instead of using say IP addressing.19:09These are just several guidelines when using FQDN matching. I won't go through all of them, but you know, one of them is here, I'll call a couple of these out. So your FQDN can only be used as a destination object, and also too, we want to keep in mind some of these amounts here.19:25So we could have a max of 64 FQDN patterns per device and also 5000 SQDN to IP mapping entries supported. So just try to keep some of those in mind. I believe we had an issue with one of these in the past running into the max number of FQDN patterns per device.19:45But, for the most part we shouldn't be good there, but just in the off chance, just try to keep that in mind.20:05We can also match on geolocation, so this is a very neat capability that we have built in for matching. So this is essentially allowing us to restrict our access based on our geographic boundaries. So this is gonna be perfect for enforcing some of that strict jurisdictional policies that.20:15That we may need to enforce or put into place here. So in this example, really quick, we have Dan and Kent, who.20:35Are working say out of like say a Boston office in the US, so therefore they will only have open access to our USA or say NYC server, but not to the EU server. So what the system's doing is it's gonna pull its mapping data from a 3rd party database.20:43And then it's gonna tie that.21:03To our iOS XE image version. So what we could do is we could apply these rules to either a source or we could do a destination, just making it easier for us to, to manage across our branch sites. So that's geo location support. And then we also have identity based firewall policy. So we.21:05Could also match based on identity. So if you want to get more granular with it, we can implement the identity based firewall policies that are going to be going.21:25Beyond our standard IP matching, so what we're doing is we can integrate ICE or AD and then we can then set up, we can then have SD WAN set it up so we can recognize our users or groups or any sort of specific SGT to enforce our rules here.21:36So here, as we can see, we have a user group HR where the destination is the branch server, where.21:56The action is to drop, so HR cannot access the branch server or the DB app at the branch server. Whereas if we look here, if we do based on SGT, so HGT one for managed devices, they can access our branch server DB app and our action's gonna be inspect. So.22:05That's just a option that we have when it comes to matching. We also have some guidelines as well. We have a link to this that we could share at the end here. We also have a link to our ice setup guide if you're not already familiar with that. We do have several.22:25Best practices or guidelines we wanna follow we won't read through every one of these just due to time but one thing I do want to call out or two things I do want to call out, one is the port requirements or port numbers here. So port 8910 and 443 have to be open for us to allow PX grid and ICE to.22:43To, have connectivity with our SD WAN controller and manager. And then the other one is the controller losing connectivity. So if we look toward the bottom here, if.23:03If our controller loses connectivity to ICE, our info is going to be stored in the manager for half a day, so about 12 h by default, but what we typically see is customers change that timer using the command below. So you could change that timer and extend that out a little bit longer if you don't want.23:12To have it just for a half a day or 12 h. So those are just a couple things to keep in mind.23:32So rule sets, when we talk about rule sets here and Sergio can show us a little bit more of this in the demo coming up here shortly, rule sets are really just a way for us to create multiple rules that have the same intent or same purpose. So you can reuse these rule sets and.23:40Between our policy. So as we see here, we have two rules, so we got rule one and we got rule two two here under the without rule sets column here. So you see those two rules and they have the same purpose, right? There's just a difference in our source and destination IP and port. So.24:00What we can do is we can create a rule set for this. So we just have one set and just one class map, and what that's gonna do is just reduce our number of config lines that we're pushing to our device. So best practice here is just to make sure that you try to use rule sets if possible to make it easier for you to use interchangeably.24:19Between policies and also to cut down the number of config lines you have on your devices.24:39So that's firewall zone based firewall. So let's talk a little bit about IPS and IDS here. So our IPS IDS engine in Cisco SD WAN here is gonna run on snort V three and we're gonna be using our Talos threat intelligence for our secure branch.24:46So snort, for those of you who don't know, it's a Cisco developed open source IDS IPS engine that's gonna give us real time traffic analysis and also things like signature matching for us to detect and block export exploits, right? It's gonna run mainly as a virtual service on.25:06In our different Cisco platforms, and it's gonna be as a virtual container that we put on the device. So what we can do is we can select from different.25:26Predefined profiles which we'll see here in the next slide. So we'll see here, so we have different profiles, signature sets, balance, connectivity, security, and max detection.25:36So, the question we may get is, hey, what, what signatures are we using? And the answer to that is Talos. We are using Talos signatures to monitor the network. And the different signature sets as we see here, they have different capabilities, so balance is gonna be more for protection without.25:51Really having a significant effect on our router performance. We also have connectivity, so this is kind of, to be a little less restrictive and give us a little better performance by imposing a little, a little less rules. And then we also have security. So this is gonna be more for protection than.26:11Then the balanced approach, but this is gonna come with a little bit of a effect on our, on our performance. So this is going to be just the different signature sets that we have. You may notice this maximum detection here.26:31And I believe as of version 70 seventeen.seventeen is when we'll see the max detection be available. So if you don't see this available yet, just check your version. Some quick guidelines here.26:45Few best practices, so what's, you know, question we also get is, you know, what's UTD? That's gonna be your unified threat defense. So we have couple of different IPS config modes here, fail open and fail close. So we're allowing.27:03During the fail open mode to allow our traffic when using our unified threat defense service fails and then fail closes when we drop the traffic. And then another one here is any sort of voice traffic that we have. We just wanna make sure that we bypass that from any sort of UTD inspection.27:18URL filtering, so this is a, this is another capability that we have in this. Maybe we want to have some control over access to a particular internet destination. Maybe we don't have or we don't want certain users accessing gaming or social media, we can.27:41We can incorporate URL filtering. And with URL filtering, we're gonna be using our webroot engine so we can govern whatever internet access we have without adding any significant amount of CPU overhead. So we can do things like creating a custom allower block list using regular.27:59Expressions as well. We could also by, you know, do a bypass category where we could bypass category based filtering for specific traffic. So really anything that doesn't match any sort of custom list is gonna be evaluated against, you know, one of these 82 plus mutually exclusive categories.28:19Tier or it's gonna be checked against our web rep score on zero hundred, and I'll show that here in the next upcoming slides. But this is gonna be more of this this tiered approach to give us more granular policy driven control.28:39It's just a high level overview of how our URL filtering works here. So 1st we get the URL request from say a user or an employee. Then from there, either on box or cloud, we're gonna do a lookup based on that URL request, and then we're gonna return with an allowed or up below.28:57Blocked and the user's gonna go from there. If it's blocked, we can get to a block page which we can then set up in our advanced settings in our URL filtering profile.29:16And then this is a look at our web reputation scores here. So this is just a couple of examples. We can configure our URL filtering engine policy based on our tolerance for risk. So essentially here, the higher the score, the more trustworthy a site is to be. So we have Cisco, which is.29:29A high score which has to be trustworthy, right? And then we also have some other sites below that that kind of scale down in the web rep score. So we have NBA byte.to, which has a risk score, so that essentially be a little less trustworthy than say Netflix or Cisco.29:49So then we have AMP, so we talked about URL filtering, IPS IDS, next gen fire zone based firewall. So now we have AMP. So for file related threats, we use AMP to give us file tracking. We could check everything against our Talos intelligence to to flag for us.30:11You know, any clean or any unknown or malicious traffic, all real time. So if there's a file disposition that.30:31Changes after it's say crossed our network, this system's automatically gonna alert us so we aren't kind of left in the dark. So for your more, I guess quote unquote stealthier threats, we're gonna integrate SMA, secure malware analytics, AKA threat grid, so we can sandbox those files.30:40Can give or do more of a deep behavioral inspection on those. So those any of those findings, those are fed straight back into the AMP cloud.30:59For further analysis. So here's some terminology and supported file types and protocols. We won't go through each and every here, but just to kind of note a couple of these, we have retrospection here.31:11So that's a term that we use so we can keep tabs on files even after they've kind of cleared our perimeter, so if a file gets marked clean, and then gets flagged as malicious by Talos after the fact, the system's gonna automatically alert us of that status change. So that's retro.31:29Inspection and then we have our supported file types. So as we see here, we have a hefty list of supported file types for us to select and analyze. We could select one or more of these. And again, this is gonna be under the advanced tab.31:49When we create our AMP policy. So as we look at our next gen firewall policy configuration here, we'll kind of go through this a little quickly here so we could have time for Sergio to show this real time in a demo here. But when we build out our.32:04Our next gen firewall policies, it really helps for us to think of all this configuration as a structured hierarchy, right? So we start with our global policy, global firewall policy here at the top, and then we can define our sub policies by mapping any sort of specific VPNs or vrfs or interfaces.32:24Two zone pair targets, and then within those we can then set our layer three to layer seven matching criteria logging, and then that's just gonna give us flexibility to layer in any sort of advanced threat inspection as we see here in, in item four. So that's gonna be like IPS URL filtering, AMP, and we could also.32:44To do that at a per rule basis. And then once that's done, we have global firewall settings, AKA are additional settings that we have. So that's gonna be things like our logging, we could enable policy optimization, set our container profile settings and several other items as well, which will.33:04We'll see here in a minute.33:24So when configuring our zone based firewall, we could think of our structure like a modular stack here, if you will. So we can start by grouping our objects like our subnets, our protocols, our apps, and then feed those into our ACLs and then our class maps.33:28And then these class maps are then gonna be organized into our policy maps that we define our past, drop, inspect to our match criteria, and then ultimately that's gonna get tied together by our zone pairs, which we see at the top here. So that's a little bit of the device construct flow/building blocks for our zone based fire.33:48And then the actual.34:09Practical application here. So really the 1st step as we look at the workflow for creating this policy is, in Sergio, we'll show this here. We want to create a policy. We, we type out and define our policy name. We put in a description as we see in step one, then step two is we have the.34:11Optional, ability to select any config group so we can get a recommendation on the set of default next gen firewall policies.34:31And then we could add a sub policy or, and or configure additional settings. So, our source zone, destination zone to give us a zone pair or any sort of user, user group, and then we have our additional settings for things like advanced inspection profile to attach say our IPS or IDS or AMP.34:41Policies as well. And then once we get that, then we can do a summary of a reviewer summary of what we configured and then we can click create next gen firewall, and then from there we are done. We have created that next gen firewall policy and we could view any existing.35:01Security policies that we created in the past or we could go ahead and create a new policy. And this is an example of what a zone based firewall policy would look like here. We could see the name of the rule, the action, the source destination, so any of those matching categories.35:20For IPS here, as we can see, we can go for groups of interest under profiles and create an inspection or intrusion prevention profiles/policy, and this is where we define the name, the type of signature set.35:38That we talked about earlier, we could do detect or inspect mode and then we also have the ability to do advanced configuration for things like custom signature sets. For URL filtering as well, we also have the ability to define our URL profile here. We define our.35:52Categories to allow or block our URL as well as things like advanced settings. So we have allowed and blocked URL lists that we could also create in our groups of interest, and then we could also enable any sort of alerts and UTD locks.36:12And then the config and workflow for this similar to the previous couple capabilities, we come in under our profiles and we could create an advanced map protection policy and we can define the policy name, select our AMP cloud region along with our alert log level.36:34As well as.36:54Integrating or putting in our threat grid API key, so this will be required to be configured if we want to use file analysis. Some additional settings here that we do want to keep in mind when it comes to our next gen firewall policy, we have some.36:56Options here for us to harden our environment against things like flood attacks. We could set different thresholds for our TCP SIN, UDP and ICMP along with things like you know capping any sort of half open connections. We can also maintain visibility and.37:16Toggle on and off unified logging and we could do audit trails for us to get a consistent track of our security events for our policies. And we could also do optimized policy for any sort of performance gains and also define our advanced inspection profile in our advanced inspection profile here.37:34This is where we can, attach say AMP or IPS IDS URL filtering policy to this and we can enable NAT as well. So if our virtual services have to go out to the internet for any sort of manual signature updates on our edges, we we this enabled.37:54And then we could also download the URL database to our device, which is, which is optional for doing URL filtering. Okay, and then for us to enable any sort of advanced threat protection on our edge devices, we have to start by hosting our security.38:14Application container which is lightweight, and it's about 60 meg, and we could look at this in the demo where we go to download this. So essentially what this is going to do, this security app hosting image, it's going to enable three core services. So we got our signature based IPS IDS.38:35Yes snort P three. We also got our flexible URL filtering of your cloud or on prem for.38:54Database lookups, and then we also have our direct AMP cloud connectivity for our advanced malware detection. So we'll just need to make sure that we have NAT configured correctly so we can pull down our annual signature updates and also stream our security logs to say like an external syslog server.39:02So that is the secure app hosting image. And then here, I know we'll probably be getting some questions if we didn't already get them already on platform support. Just note that this is not an exhaustive list here. This is just a quick list that we're sharing just to give you an idea of the platform support for the different features.39:21Capabilities. If there's a platform that is not on here, if that's the case, just refer to the model platform data sheet and that will tell you what features can be used for that particular platform.39:41Just some guidelines here, anytime you upgrade your iOS XE image, that UTD container will need to be upgraded separately. We also highly recommend that you upgrade that image as soon as possible, if not right away. And if you're upgrading from a version that's below 1712 and you're.39:56Going to a version above that snort V three is gonna be automatically applied. So you just wanna make sure that you convert any of your custom, if you have any custom snort V two rules, just make sure that that gets converted to snort V three schema so that gets carried over.40:14Okay, so just a few more here and I promise I'll give it over to Sergio. We just want to show how and where we can monitor our next gen firewall policy if we get that configured because security monitoring can be a whole session in and of itself, but we just want to make sure that we take just a moment here to highlight what we can.40:31Seeing what we could do.40:51So as we see here, we have multiple widgets, so we'll just cover a couple. So we have one widget here showing our firewall rules and names, so that's gonna be our firewall rule counter here. It's gonna give us things like our rule hits, our top rules, inspected, allowed and dropped. We also have our top threats, which is.40:52Gonna be giving us insights into our AMP and our IPS engine, so any sort of high, medium or low.41:12Event occurrences, URL filtering, so that's gonna give us the ability to see which top URL categories were allowed or which ones were blocked. So as you see here, there are many other widgets that we can glean into to get information about our policy once it's deployed.41:20We could also go a little bit deeper, we could go in the device level. So if we go into monitor devices and we select a particular device on the left hand side, if you see it here, we could go under security monitoring, and then this is where we can drill down and look at info as we take as it pertains to their firewall or IP or URL filtering.41:39For firewall to give us information like what the zones are, the policy name, and the number of bytes transferred.41:59And then we also have in as of twenty.eighteen, our manager can give us more visibility into our firewall logs here, so we can do things like running custom queries so we can quickly and easily pinpoint any sort of traffic patterns, and this is just integrated into the analytics portion so we can.42:08And we can run as you see here targeted queries by time, site, and, and device as well. And these can all be stored for up to a month.42:28And then we also have our heat map here. So we have alarms that we can view and we could also filter those for things like IPS alerts, UTD updates, UDD version mismatches and and so on. And then this heat map here is gonna give us the ability to see the alarm severity as it corresponds.42:39Bonds to that particular time of the day. And we could also do advanced filters as well as we see on the right, we could do custom conditional searches, and then we could also export these alarms as well.42:59And then we also have the ability to roll back and do version control. So as you create your policy, you may see the ability to the version control and it'll give you the version number, who it was updated by the name of the user and when it was last updated and any sort of comments that were left.43:14And then we also have the ability to look at the config difference here as we see here, you have between version 20 and 19.43:33Anything in red, yellow or green, anything in green is added. Anything in red is removed. So, so we have that capability as well if you're curious on versioning control. So I'll hand it over here to Sergio so you can go ahead and get started on the demo. Sergio I'll give it over to you.43:40Alright Paul, thanks for that nice presentation, but now the time has come to see how this can be done. So I am right here on the SD WAN manager. As you can see I already have a policy, but this policy it's empty. It has nothing.44:00I can reuse this next generation firewall rule that I have, but just for the sake of the example, I'm gonna create a new one. This will take you to the next generation policy creation process. 1st you need to give it a name.44:17Let's call it demo, next generation firewall. It's for SD WAN, then you need to associate this to an existing configuration group. And next step, you need to actually create the policy.44:35By default, it will create this source zone which is the VPN one in my example. This is the default VPN that you have right now and the untrusted zone. You can also change this if you want. You can edit this and change it to a different zone, like e.g. the self zone.44:54Or to a different zone, if you have multiple VPNs, that's really up to you. In this example, I'm gonna use untrusted, which is the internet. My default action could be either drop or pass. In this example, I'm gonna use a pass and just block everything on every role that I have over here. So let's create it.45:15Let's edit the 1st one and as you can see here, I can give it a name for this 1st, let's block, kind of block yeah 1st sequence, it's like before rule, and here you can add the matches and for this match, you can.45:33Use the classic source and destination or protocol, but in this example, I'm gonna be using.45:52The FQDN. Because IP addresses can change, but fqdns most of the time will stay the same. So for this, I can define it something like this. Yahoo.com and will block.46:00The entire FQDR. All right? So action is dropped in this case and you can optionally log the events or not. I'm gonna log this. So that's the 1st rule. And also keep in mind that you can use rule sets. You can add a new rule or a rule set.46:16Paul already mentioned the difference between rules and rule set. For simplicity I will be using simple rules, but keep in mind that here you can use the rule sets too, e.g., I have this example for FTP and I can make this rule part, this rule set part of another rule.46:35So it's just a way of reusing the same rules in case you have this, this reusability for your network. So let's add a new rule. Second rule, the 1st one was for FQDN. 2nd one is gonna be for an application. So I'm gonna block.46:52YouTube, but I know I don't want to block the FQDN in this case. I want to match in a different manner. I want to match the actual application. To do that, I already have YouTube here, but if you want to create a new application, you just come over here.47:13And search for the all the different applications that we have here.47:32E.g., you can search for file transfer protocols or you can also search for peer to peer applications or you can match pretty much any application that we have over here. In this case, I will be using the one that I already created.47:36Which is YouTube, and I'm gonna drop it. Log the event, and that's my second rule. My 3rd rule, gonna be a little more interesting. This time I will match.47:56I'll leave empty matches so I can match every other traffic. And instead of of dropping or passing, I will just inspect the traffic. This will allow me, I already have one of this, but I will create a new one.48:14I will create a new advanced inspection profile. This is where I can enable all those nice features that Paul was mentioning. So let's collect inspection profile. 1st I will create an IP an intrusion.48:33Prevention system.48:53I'll create a new profile. 1st you give it a name PS demo. Select your signature. In this case I'm going for balanced. You can opt for detection or protection. In this case I'm going for protection and in case you want to have your allow list, you can.48:55Set it over here or use custom signature sets.49:15I'm going through the default configuration and now I have intrusion prevention here. If you want to run URL filtering, so, well give it a name filter, then select the category that you want to block, well to either block or allow. In this case it's gonna be blocked and.49:19And for wealth category I'm gonna go for.49:38Social media, social network actually. Moderated risk and as Paul mentioned, you also have your allow list or block list in case you want to do it. There it is and now the advanced malware protection, let's call it AMP demo.49:41You just need to select the region, the alert lock level, and if you want to enable file analysis, you can do it right here, but keep in mind that you do require to have the API keys. If you don't have that, you cannot enable file analysis. In this case, I'm gonna disable it just for simplicity, but keeping.50:02Find that that's something you can actually do here.50:22And TSL action in this case is pass through. You can also opt for decrypt, but if you do that, you need to enable the TLS SSL profile. This is just to open encrypted tunnels. So that's it. That's my inspection.50:25Our rule at the end, and that's pretty much it. Everything else it's gonna be allowed in my network. So that's my rule. I can watch the summary here. As you can see it's been applied to this sound to untrusted, some additional options, and I will create the rule.50:43There it is, it's done. Now, how do I apply it? I'll go to configuration and policy groups, and now I need to associate the new firewall rule here, the demo, next generation firewall. Now, next thing you need to do, click on save.51:05There it is, and now I need to deploy. If I don't click deploy, it's not being enabled. So let's do that, click on next.51:25If there are any variables, it will be shown here. I don't have any variables, so I am just pushing this configuration. Now, this process is gonna take a while, but, I will take, I will use this time just to show you how to.51:42Upload the virtual machine, how to upload the the image required for this feature to be enabled. To do that, you need to go to software.cisco.com, download and upgrade.52:02Then you need to search for your device. In my case, it's a catalyst 8KB and search for the UTD snort. 1st you go to your device.52:19Your preferred device and then search for your software version here at the left. I am running this software version and this is the file that I need. You need to download this and upload that file here. You go to maintenance.52:35Software repository, and it should be uploaded over here. Mine it's already there. That's why I didn't show you this before, but you need to upload this over here. To do that, you just click over here, click on manager, and upload your file over here. If you don't have this.52:52You're once you try to apply your configuration, your next generation firewall policy, it will fail because you don't have the proper application to run this configuration. Oh, let's go back to our active, it's it still hasn't finished. It takes a little while. It takes.53:10Around 5 min or so, but, NO, yeah, it's uccessful. Okay, so it's almost done. It has successfully installed the application. So it's gonna take a while, but it's just the 1st time. Now, while that thing loads, let's go to our PC.53:30And as you can see I have internet access, I have YouTube, I have access to other webpages, have Wikipedia, Facebook, I can load almost anything. It hasn't finished because, yeah, it's still in progress, but once this thing is finished.53:49It's a little while, but once that it's done, I should have blocked all this based on the firewall rules. I am blocking social media, I am blocking YouTube by application, and I am blocking.54:08Yahoo by FQDDN. So let's just wait for it see how it's going.54:24Yeah, it's successful.54:45So it might take a little while. Well, let's do a refresh on Facebook. You see that? It's NO longer accessible. I still have internet access because I have.54:50Wikipedia, but Facebook has been blocked because it's a social media. Youtube is gonna be blocked by FQDN, so it should not load. The same is true for Yahoo. And since I am blocking the FQDN.55:07Yeah.com. I cannot even ping a hundred percent packet loss. Judith is not loading or still trying.55:25I didn't do a hard refresh, but this is not gonna work. And Google is still available because I didn't block that one. So that's it guys. That's how the next generation firewall actually works.55:44Works, something that you need to take care of.56:04Is that I am using the actual URL, but if you do it like this, you're still allowed. So watch out for that. To solve that, you need to add the actual URL into your firewall rule. So just watch out for that and that's it. I will.56:08Handover back to you Paul.56:27Thank you Sergio. All right, so let's go ahead and let's bring this back up here so we can close out. All right, so appreciate the demo Sergio.56:32Just a few things here as we close out. So.56:52In conclusion, we covered a lot of different things today. We covered granular segmentation, so we can do that by achieving for granular segmentation, what it's doing is it's achieving robust network isolation through micro macro segmentation using.56:56Sgts, user groups, and identity where policies. We also have as we saw as the basis of our entire presentation was the integrated next gen firewall capabilities, so zone based firewall, as Sergio showed, IPS IDS, AMP URL filtering. We also talked about advanced.57:12Threat protection, so this is where we utilize our UTD hosted services including snort V three based IPS IDS, URL filtering with our web group reputation and AMP with cloud based sandboxing via threat grid. And then also centralized policy management. So this is where we do everything really in one dashboard.57:32And were able to use items like reusable rule sets and automated version control really just with.57:52Just with one click rollback functionality, and then also unified security visibility. So, we could do enhanced threat hunting and compliance through centralized logging, security dashboards, and detailed event heat maps as we saw in our monitoring dashboard in one of our one of our slides.58:00So we could do all that within the SD WAN manager.58:20There are several resources that we have to share with you. We have a little bit of what we covered today. We also have a document white page on logging as well, also how we can utilize the secops dashboard. It's essentially our monitoring dashboard for our security feature.58:26Features and then also.58:44The SD WAN security overview page that shows us how to configure each and every one of these capabilities on box in step by step. So that being said, that brings us right to the end of our presentation here. All of us will.58:48We appreciate you for your time to attend the session here. We thank you for joining us and thank you to Sergio and also our panelists for helping with some of the Q and A.59:08As we go through here, Sergio, I'm looking for any outstanding questions. I don't see any right now, but right now we'll give it maybe just another few seconds if anybody has questions.59:20Okay, if not, I think we are good to go. So this was our SD WAN expert insight series, SD WAN security policy, next gen firewall, IPS IDS and other capabilities. We all hope that you have a great day and.59:38Yes, he's asking if we can do like an image or when, when we block can we put like a image to show or it's just like Cisco block? I think I think I can do it live. I have this demo over here. Yes yes, if you have something to show, would be great.59:57Alright, let me share my screen once again, and for those for anyone who was asking about the CLI thing, you can do this command, show logging, and it will show all this. As you can see, it has the timestamp, it has the packet that has been dropped, the UDP YouTube thing that it's been dropped because of the rule that I just.01:00:15Enter, and here is the role that it's actually been.01:00:36Used, which is the block youtube thing that I did on the demo next generation firewall. And regarding the block page, e.g., let's try new tab x.com.01:00:39This is the web page. You have two options here. You can use the default page, which is this one or you can redirect to a custom one, which is what most clients are doing. You can do that by going over here, policy.01:00:59And it's part of the objects over here, security profile, and I have the URL filtering thing. This is this is the one that I was using. You have the option to redirect to a different URL.01:01:14You can put it over here or use the default block page, which is this one. There you go guys. Awesome.01:01:31Good questions. Thank you Sergio. Thank you, Aris. Okay, alright so looks like we are caught up with that.01:01:46Yeah can you do that one more time a little bit slow. Yeah, each part, sorry.01:02:04Yeah, thank you Sergio. And, what we could also do, we could also if you'd like just like Charles chimed in here. Reach out, we'll reach out to you or you could reach out to us more than happy to maybe set aside a few minutes if you want us to.01:02:19Deep dive a little bit further. Reach out to us or if you have an account rep, you could go through that channel and they could get in touch with us. But Sergio, are you able to show it again or hold down?01:02:37There we go.01:02:57Now, what do we, what do we want to show again? Block page. Oh block page yes, go over here. This is how it looks like. It's a very simple thing. I am using x.com as an as an example. So whenever I reload, this will be redirected to this webpage.01:03:00And if you want to use something different, you just come over here, change the objects and profiles. I will show you how to reach here, you go to policy, objects and profiles at the top right, security profiles.01:03:20And URL filtering. Then you just edit your current one and come over here. If you don't want to use the default block page, you can redirect, which is what most lines do. And that's it guys.01:03:39Anything else guys? I don't see the chat, so I have NO idea. Thank you. Thank you soon. All right, I think we're caught up, so.01:04:01Let's see, 3rd times a charm. All right. Yeah, I remembered you Charles. Got a lot of familiar faces here, which is great. A lot of new faces as well, so definitely open to a lot of opportunity.01:04:19All right, Appreciate the feedback, everybody. I think we are caught up on all of our questions. And if you have any questions that come up after the session's over, please feel free to reach out to your appropriate account rep or you could reach out to us or reach out to us in the Cisco SD WAN community forums.01:04:38Either one of us or all of us will be involved in that and we're more than happy to help. So with that, let's, for the final time, that concludes our SD WAN expert insights series. We hope everybody has a great rest of the day. Thank you.01:04:59