Transcript
Hello, and welcome to today's experience ensuring.00:10Cisco secure firewall. And we will have a great agenda that we'll cover in a, in a minute. My name is Angela Martinez and I will be your host for today's session of firewall features, best practices, and also troubleshooting.00:16In today's event, we will have three sessions scheduled for the next three and a half hours. 1st, we will focus on covering new firewall features that will be present, that are present in the latest version. Then we will provide an overview on Cisco APIs and auto.00:34Information.00:54And finally, we will wrap up this experiency series with a troubleshooting session. We will cover some techniques, best practices and snort tuning. Today we have a lot of, a lot of people that will be helping out.00:55For our presenters, we have William Hunch, which is a senior manager with our security business group. We also have both customer success specialists supporting firewalls.01:15And then we have either Pacheco from the tech team and he's a security escalation engineer. We also have different panelists from the customer success team that will be ready to answer questions that you may have on today's topics.01:30Before we begin, just a couple of housekeeping items. We will be utilizing Slido for Q and A, as well as for some polls that will be presented throughout today's event. To access Slido, there are.01:54Multiple options available. The Slido panel will be available during the entire event and you will find it on the right side of your Webex Webex app. If you don't see the Slido panel, you can manually open the panel by going to the apps menu on the bottom right section of your Webex app.02:10Webex app and select Slido. Another option is to access to access Slido is to scan the QR code that you, that we have here right now or another way is to go to slido.com.02:29Use the QR code, which is the one presented here and use the passcode secure FW. One word lowercase. Please use Slido for all your questions.02:45And our panelists will be monitoring those questions and ready to respond. So without further delay, I'm gonna pass it over to our 1st presenter, which is William, and he will be presenting the latest features in.03:00Send it all version. So thank you William for being here. Awesome. Thank you so much and quite the action packed agenda for today. Thanks everyone for taking a good chunk of your day out to.03:19Listen to us, give you an update for those. And I also already saw there are some questions coming in. I hope we'll be able to address a lot of those as we go through the session today. One of the questions I think in the initial Slido picture that was there is what is your current firewall version that you're using?03:34As I talk through the agenda, please feel free to plop this in. It just helps us give context for the presentation over the next 1 h. What I will be talking through in the next couple of minutes is where have our firewalls come from and where are we today in.03:53Terms of a firewall journey from more traditional firewalls to an actual hybrid mesh.04:13Net and infrastructure that we're providing these days. And now I'll go into, well, how do we manage all these different components together? What are some of the threat defense and security specific features that we have introduced and then go to new platform launches that we have aligned with this ten.O release.04:20So looking at what's being populated here, I see quite a lot of responses on seven six that seems to be the largest number but also 764 so some of the maintenance releases of that, which is by the way now also the suggested release. The gold star is next to the 7th.04:39164 for the ftds and 765 for the fmcs.04:59One of the question that I saw in there was is already for production and I think I'll talk through that as we go through the session today. It's also good to see that there's quite a few of you that have earlier versions on 7472.05:04We'll definitely cover some significant benefits of going from version to version, not just specifically to our ten.O release. Alright, I just see one question since I did mention it. 765 addresses security.05:20Pretty gaps. So 765 is an FMC specific release. There is NO 7654 ftds. 764 is the suggested release for ftds. FMC there's only one additional piece that only pertains to fmcs that's in the 765 release. So NO need to worry about the discrepancies there.05:40Okay. But with that, I really appreciate everyone's answers. I already covered the agenda as everyone filled in, so thank you for, for doing so. And I I do believe there's gonna be a lot of useful information as we go through the session today.05:59Starting and setting the scene 1st with why do we still need firewalls and how has the landscape changed? We usually like to start with this as a level setting of the security environment has changed quite dramatically. Applications.06:17Compared to previously being really just in the data center on prem are now highly distributed. They are either on prem, in the cloud, connected to each other, modular modularized, talking to each other. So making it quite challenging to establish what are the different components of these applications and actually what can.06:36Be trusted in terms of communication as these applications talk within each other to each other.06:56Users access these applications either on premise or in the cloud. So establishing their trust is really critical. With all these fast paced evolutions, it's gonna be really challenging to or there is more challenges introduced in terms of vulnerabilities.07:02Because there's so many moving factors now that the environment is comprised of. So therefore just more attack vectors. AI is adding some additional challenge for each one of these. AI starts to talk, make different calls, has workloads talk to each other, is actually.07:20Be helping the attacker develop exploits for vulnerabilities much faster. So all of this coming together really represents a new environment for security environments.07:40So we kind of needed to evolve from where we were to where we are today and I'll just build this out so you can read the slide, but we basically started from a stateful firewall, Cisco with asas and back in the day PIX was really the market market leader there. We built on top of that with next generation firewalls.07:53Brought in that next generation piece of, protecting users being application and user aware, integrating threat prevention, bringing in our Talos research team to actually provide insights to the enforcement points.08:13But starting last year, we've seen a shift from just a traditional next generation firewall to a hybrid mesh firewall. The key here is that the enforcement and security postures are really required to be distributed across the entire environment, as opposed to just.08:28Developing a policy for enforcement point by enforcement point, it needs to be something that is consistent. That is a consistent security posture across this hyper distributed environment because the attacker is only looking for the one spot where it's inconsistent and that's where they get in. And once they get in, then there's lateral movement.08:48So we want to build an infrastructure that one has a consistent policy as a front line, but even assumes that an attacker can come in and protect from that lateral movement. The other piece is obviously building and not just having the attacker use AI, but equipping every one of you with capabilities to scale beyond.09:08It's just human scale.09:28Have you performed actions that otherwise would take you hours, days or months within just a couple minutes. So that's something that we have worked on and we've actually established quite the presence in hybrid mesh firewall, in our offering.09:30It all starts with a secure firewall still, but the key is connecting that to the fabric, to the mesh that you have as a security posture. We know that not every one of you can have just one firewall, just Cisco firewalls, even though we would wish that that was the case. But.09:49Realistically speaking, there can be mandates, there can be requirements for multi vendor strategy, it could just be a strategy for redundancy, security, on your end or through acquisitions.10:09Yeah, it's just unlikely that every acquisition that your company makes, they have the same vendor, so you'll need to work with that and we acknowledge that. So we have introduced mesh policy engine to actually help with policy not just across our firewalls from Cisco, but even Palo Alto Networks, Fortinet etc.10:22Have a consistent policy construct. Now we're not gonna go into a individual firewall management for all firewall vendors out there. That's not our business model. Our business model and our focus is on your security.10:42That is what we're focused on. So that's why we're focusing on that policy and intent. Today's session is not gonna cover specifically mesh policy engines, so we can definitely talk about that separately. We're gonna focus on specifically the evolutions with secure firewall that most of you have installed in your environments and how it works with this overall.10:55Or construct of the hybrid mesh firewall.11:15We're also bringing in smart switches, so that's kind of one more granular enforcement point inside the data center, but then getting even more granular with workload and agents and EBPF based segmentation where as I mentioned earlier, the firewalls really help with that frontline defense having a consistent po.11:18Policy that guard guards your environment, but assuming something will come in, you need to make sure that there is lateral movement that is.11:37Under control as well and that you segment your environments accordingly, and then also get that insight of what lateral movement is happening and feed that back into the front line into the firewalls. And we have a lot of great solutions there at Cisco with secure workload, integrating with the firewall with direct life updates.11:47So a lot of greatness happening to really make sure that you have that consistent experience, not just in preventing the attack, but also preventing and limiting the lateral movements. Now the challenge is that all of this is a lot of different moving pieces. So we have delivered security cloud control to bring.12:06A centralized management wrapper around all these different pieces to make it as easy as possible for every one of you to develop these different capabilities, and these different enforcement points, really define a policy once.12:25And then enforce it wherever it is needed and then have automation take care of some of those pieces as well. Before I talk through how security cloud control actually really helps manage all these different components, I just want to outline a sample architecture of.12:40How do all these different products work together? So it's a bit of an eye chart, so bear with me. As we start, the firewall is really still that front door, which you want to make sure is secured and allows the connection between these different aspects of your environment. The connection between the data.12:59Center up to their campus and branch, up to your, cloud virtual firewall deployments. So really the bare, the, the bones behind the infrastructure are still powered by the firewall.13:19But then integrating that with the more dynamic and evolutions as we've seen with employees directly accessing the internet, but also coming from the internet into your data centers, want to make sure that there's a consistent experience from a.13:32Provisioning perspective from an identity per perspective, so bringing together those solutions is gonna be key here. You want to be able to deploy the full stack of these capabilities across every one of your environment pieces. So that's where we bring those together.13:48And then lastly, again, like I mentioned, we don't just wanna prevent the attack or prevent the unauthorized access.14:08But we assume that it will happen at some point and then prevent that lateral movement and give control over that lateral movement, that is how all of these pieces come together. Now, you're seeing kind of a complex piece of multiple different pieces, different environments, different products.14:17How do all of those come together? And that is with our security cloud control for you to have one place where you can manage multiple different products in your environment from the secure firewall, multi cloud defense, hypershield secure workload, secure access and AI defense. All of these in one place, so you can easily.14:34Find insights, summaries, use AI to have a real impact, all of that coming together in one place. So that is really where we bring all of it together and I will talk through some of the individual pieces that this enables for you.14:54One of the critical pieces, is really that end to end visibility across this infrastructure. As I was talking through how you have your data center, you have your campus, your branch, you have your cloud, you have the internet, all these different enforcement points. The key is that you need to have insight of what's happening across this.15:11Complex environment so you can take action.15:30So that is what security cloud controls all built around to have these comprehensive insights, but then also raise up critical insights to the top, so that also powered by AI, we can show you what are some of these capabilities, what are some of the critical pieces you might need to fix, look into, with.15:33Urgency as opposed to having to navigate, click through all these different product management tools.15:53You will get all of this in one place. And that way you can make an informed decision of what should my day to day look like as an admin? What do I want to prioritize on 1st, focus on 1st, and prioritize to solve versus what can wait for for a later implementation?16:00Another benefit of having all of these pieces in one place is now for us to help you have with that consistency. We want to make sure that you develop your policies, your objects that are consistent regardless of where you enforce it in your environment.16:18So that you develop develop an object that is the same in your multi cloud defense deployment for a virtual firewall, for a cloud native firewall, but also for your threat defense firewall that might protect you at the branch or at the campus, but even within a data center for your ASA firewalls. So bringing all of these together to have that common policy, but then.16:33Even common object definitions, so that you have that unified definition. There's not one odd out object that.16:53Maybe this ASA has a different definition of it, so there you might have a gap. That is really what brings all of these pieces from a policy perspective together. The other thing that is really great about security cloud control, it is it is widely available.17:02What's globally available. So that gives you a lot of reach, but it also gives you regional coverage where you might have requirements for isolation. So each of our regions is isolated as a silo. The HA is within the region. It's not shared across the other region. So.17:22So for GDPR requirements especially in Europe, that makes that in a very attractive solution, and we're working on spinning up additional servers as well, so that there's additional options for you to choose from. But we want to make sure that there is something for you especially if you have requirements for regional limitations.17:42The other big benefit obviously is it's a cloud delivered service, so you don't have to manage the management of your different security components. You only focus on the enforcement point, make sure that is running. The management is covered by Cisco.18:04So with the connection that we developed down to the individual enforcement points, make sure that all of that obviously is encrypted, addressed and in transit. But that delivers you a uptime of 99.99 % making sure that your management of your entire infrastructure is always available.18:17The other benefit is that it's super fast for one, you to adopt it, and I'll talk through some of the key pieces that we're helping you make adopt some of these features, but it's actually a faster way for us to deliver further innovations to you.18:38As opposed to software updates, and we will talk about specifically in just a second. But as opposed to having you to rely on you upgrading your firewalls within security cloud control, we can deliver innovations on a much more rapid pace without you having to do anything. We will manage the upgrade in the backend.18:54Since this is a solution as a service for you, and you don't have to even think about that. So that's another great benefit here. We obviously want to make it easy for you to actually take your existing environment and then go to the cloud.19:14There's the same look and feel, particularly for the firewall management with our cloud delivered management inside security cloud control as you're used to it from an FMC. So the same capabilities. I know a couple of years back, there were still some feature gaps and we're really at a feature parity within.19:33These these times today.19:53Where you can do pretty much everything you can could do previously on premise on your hardware FMC, you can all do all of that in the cloud. It scales pretty widely more than most of the FMC hardware that you might buy up to a thousand 200 firewalls and we're working to even expand that further. You get the AI assistant AI op ops, and I'll talk.19:55For that in a second as well, directly built in and then obviously all the compliance and patching, we take care of that for you.20:15There are some options for hybrid deployments, and I'll talk through that in a bit as well, but wanted to make sure that you're aware of that. It's really easy to onboard firewalls to security cloud control. You.20:22Can either do the registration key based zero touch provisioning with just a serial number, deploying virtual firewalls to the cloud or even bulk onboarding through a CSV. So really making it easy to take your existing environment up into security cloud control. I'll talk about it in a second as well for how you can even bring your existing fmcs.20:37If you want to maintain that hybrid deployment.20:57Now some of the key benefits here is security cloud control delivers something and I've been shocked by some customers actually not being aware of that yet. We have had that for a bit, and it's a really great capability to clean up your existing environment.21:01I know firewalls have been developed over years, sometimes decades, and possibly iterated through multiple administrators throughout the years, and it's really challenging to understand what all these historic policies were built for.21:18This will really help you identify what are healthy rules, unhealthy rules or disabled rules, and the unhealthy rules, we differentiate them into shadow rules, redundant rules, expired rules, which ones can you merge together? Where do you have objects that are fully overlapping? So a lot of inconsistencies that are really quick tweaks.21:34It's for you to bring down the complexity of your environment. And then one maintains a more sanity moving forward.21:54But then also even get a bit more of a performance from this. So there's a lot of capabilities and benefits in just optimizing your environment and policies. The other piece is, as we now know your environment inside security cloud control, we can have AI actually guide you through best.22:02Practices and recommendations. Based on your environment, we can give you guidance of here is what, how you could resolve this error. Here is how you should.22:23Developed this feature. And that's the other piece where we we can give you guidance of, well, some of the best practices might need a look at. E.g., you have something that's uninspectable. You probably should enable that.22:34Allowing a rule that has intr intrusion or file policy is something if you have the license for it, you should certainly configure that and then we'll give you a guidance through how to do that. We'll also give you a guidance across all the different features available. I mentioned earlier, it's easier for us as Cisco to deliver new innovation.22:49Questions to you, but it's also going to be challenging for you to keep track of all the different things that are now available. So we want to make it easy for you to understand what are the different things that I am entitled to with the things I already purchased, and it's in our interest to make sure that you get all the value from it. We don't want you to sit with firewalls that have.23:08Unutilized capabilities that you actually have a license for and have a need and a benefit for in your environment.23:29So we'll guide you through what are these capabilities, e.g., SD WAN, you maybe only have it deployed on 19 % of your firewalls, and here's a wizard that guides you through how to deploy it for the others. We don't just tell you that here is a feature, but we actually guide you through how to develop or how to implement that feature on a step by step.23:36Guide within the UI itself, and we even share and link the the YouTube video.23:56That our technical marketing team has put together that goes into more depth of why does this feature matter and what does it actually do for you. Now, as I go to the next slide of, how can we go to cloud management? What are the different options available? I just want to take a pulse check of where we are today.24:02How far are you on your journey to a cloud management? Are you already using security cloud control? Are you exploring to use it soon? Are you kind of dabbling in initial capabilities? Are you not ready to use it yet? Or do you have some regulations that actually prevent you from using cloud?24:22I will use the opportunity to think a glass of work Awesome. All right. So, ok. So.24:41The not ready to use cloud management just yet. Actually just went to the top. We had the exploring soon as the number one just a second ago. But that is actually number one. So that is very interesting to see that most of you are not ready for a cloud only solution yet.24:58But a lot of you are also considering to explore it and some of you have story to explore. If you add those together, it's actually more than half that have some kind of engagement already. So that's very promising, but I completely hear you on you're not ready. So the good news is we have a journey for you.25:13There's still different options available. We as Cisco completely hear what apparently more than a 3rd of you are saying, you're not ready to just go all in on security cloud control. So even though I talked a lot about security cloud control for the last 15 min.25:32That's not the only solution we have, and it's not the only solution we're investing in. Quite the contrary. We are working on a solution that works for you, for your use cases. We have the orchestrator deployments with the firewall management center where you have either the on premise FMC.25:48Or you have it through security cloud control. The experience, like I mentioned earlier in security cloud control is about the same as you have it on the on premise with some additional capabilities of AI that you likely don't want to run a full blown AI model on your already limited FMC hardware. But then you also have the.26:06The device manager for one on one management for devices.26:26Now the good news is you have different options to actually take some of these advanced capabilities from the cloud into your environment. There's benefits for you to go fully to the cloud where again, you don't have to manage any of the management. We do that for you as a solution as a service.26:31But with an integration of your existing firewall management center, you don't actually have to go all the way to the cloud. You can maintain your policies, you can maintain your management on premise with an existing FMC, but bring in some of the advanced capabilities that we enable through security cloud.26:50Control. So what I mentioned and talked through earlier that policy analyzer and optimizer, what I mentioned in AI assistant, these feature adoption guidance of here's the new capabilities available, here's how many you're using, and here's how you might think through develop deploying them.27:10All of this can be delivered to your FMC through that cloud integration. But you maintain control over that FMC on premise for yourself or either hardware or virtual. You get some additional benefits obviously if you go fully to the cloud where you don't need to manage that hardware, you have that.27:26Update uptime, you have the auto backups and all of that.27:46But again, there is a path in between. And the good news here is as well, as you onboard your fmcs to security cloud control to bring in some of those capabilities, you're basically halfway on the journey to fully cloud. If you do want to pull the trigger later on and then go to the cloud, you already have policies.27:51That are connected and that transition is then just a couple more clicks.28:11Even when you're ready. So it's kind of a really smooth journey between the three options fully on premise, partially where you integrate the benefits of your localized management and some AI capabilities from the cloud or a fully cloud based solution.28:15And the benefit of this integration, we actually have it for free. For everyone that has an FMC, either hardware or virtual reach out to your Cisco rep. We can enable that for you for free. You don't need to purchase anything extra. You actually get these benefits right out of the box.28:31With your hardware or virtual purchase. Now to just double down on how committed we are to, as you guys mentioned, more than a 3rd of you are not ready yet to go fully to the cloud, we hear you. So we just announced our latest firewall management center appliances.28:48We're actually working on getting them starting to ship very shortly. We have to release readiness commit later today, and then it should start shipping within the next couple weeks.29:09So just to show that we're actually investing in hardware as well for your management on premise to be even more capable. Like you can see there, we can now manage up to 1500 ftds. So increasing the scale there.29:21Improving the rate that you can have events on your FMC. And it's just extending the life cycle for an on premise management. So just want to make sure that we're fully committed to every single one of these management options, and I guess that's the 1st ten.oh specific piece that I'm bringing in.29:36As we're releasing these fmcs, one of the other pieces we've heard as well is what if we lose connection? What if our FMC loses connection to the individual devices? And the same is true for if it is cloud managed. We have already worked on that for the past couple releases with seven seven, we introduced some fallback clis.29:55We added and advanced those with. So now you can do NAT independent object object group commands and additional interface parameters that you can do configure through the CLI, even when your FMC loses connectivity connectivity to the device.30:14And the other benefit here is then once it does recover connectivity, you can see those out of band changes. You can acknowledge them, it shows where, where were those changes made, and you can then deconflict them and bring them into the FMC.30:31So that's kind of how we bring all of this together. Want to make sure that you're fully aware that we're fully committed to all three options. Pure hardware, cloud integrated, and fully cloud deployment. Now I've talked a lot about management and the evolution of firewalls. I want to get a bit.30:47More deeper on what are we doing to actually protect your environments and what are we doing to inno innovate in that area?31:06There's three main categories that we put our investments in. One, and that's kind of why you buy a security product, is to block these modern threats. To block these modern threats, there are new innovations that are required for you to be able to do so. I'll talk through what encrypted visibility engine.31:14And does how we've advanced it with our release.31:33What's nort machine learning actually does at the enforcement point to give you protection from zero day vulnerabilities and how we're bringing in AI protection. As I mentioned in the beginning, you have this complex environment with multiple different enforcement points. You don't want to just prevent the attacker from coming in.31:36But assume that some might come through and then protect your lateral movement, protect it through segmentation, intelligence segmentation, that might actually go beyond human scale. So we are helping you to deploy that across your environment. And again, feed that information that you get from segmentation back into your security posture.31:55Now, all of these pieces don't make sense unless it's actually easy to deploy this stuff. So we're working to make it as easy as possible to to deploy with that unified management experience and these improvements both in security cloud control, but also the on premise FMC.32:14There's a number of capabilities specific to our ten.O release that we have introduced with again ten.O Encrypted visibility engine has been enhanced. We released it quite, I think a couple of years ago, and we've ever looked we've had had additional advancements to encrypted visibility and.32:33Engine with every single release. I'll talk through it in a bit more detail of what it does with our release.32:53Another piece, you all might have heard that Cisco did acquire Splunk a year or two ago. So we're making it much easier now to integrate our firewalls with Splunk. We actually still have a financial offer as well to give you some additional gigabytes for every firewall that you purchase of Splunk log.33:00Smart machine learning makes our security posture really the leading threat detection out there in the market to really protect you from zero day vulnerabilities. No one else in the industry can do it to the extent that we can. And I'll talk through how and why with particularly the power from Talo.33:22And the deep research that that team is doing. Policy deployment, making it much easier how to decrypt which policies so that you can focus on the outcome, not the how. The next one is a fun one upgrades. We're talking about our release, most of you.33:41You are in seven six. I'm sure everyone is excited to do yet another upgrade. So we have invested heavily and I think as you are on seven six, you should have seen some of the improvements over the past few releases to make upgrades simple, swift, and airframe.34:01Few years back with the six.X days, that certainly wouldn't have been a statement for how our upgrades are performing. So that's why we invested in that because we acknowledge that as we introduce all these innovations that are really great to protect your environments, it depends on you to upgrade your infrastructure. So we wanna make that part as.34:20As Easy as possible. And then the other, the last piece that we added Inado is a dynamic firewall configuration and an integration with identity with multiple ICE servers, but also Cisco identity intelligence to bring you some of that power from Duo into the firewalls.34:39Now these are all specific features. A lot of you mentioned you're on seven six. We also added some additional capabilities with our seven seven release and then completed that with ten.oh, but depending on where you're coming from, there's incremental benefits of going to the next best release.34:58If you're coming from seven two, we added MITRE framework, e.g.. If that is something you care about, it might make sense to even go to just seven four because we, that will then have those capabilities. And by the way, we'll introduce the 1st word of your encrypted visibility engine.35:17And then added some snort ML in seven six. The reason I'm showing this is across the two main tenants of security efficacy and operational efficiency, we've added through every single release. So depending on where you're coming from.35:34It might make sense not just to hear me out on ten.O, but even seven six will be adding a lot of innovation for you. Now I'm talking about ten.oh. I wanted to take 1 s after we talked about these versions of six.X72 and now ten.oh. We changed our relat.35:49These modeling.36:09To actually allow for a simplified life cycle policy moving forward. We will have ten.O now. We will introduce increments to that ten.O release with 10.110.210.5 will be the final release of the ten.X train.36:11And that will be federally certified as well for customers that require these certifications. After that we will go to the eleven.O release and again eleven.five will be that final release. What that means though is that every single release moving forward will have the same timelines of support life cycle.36:31As opposed to previously with seven two being a long lift release, seven three being a short lived release. Seven four being an extra long lift release for government certification.36:51That is a lot of complexity. So we wanted to make it much easier moving forward. Every single release will have the same life cycle across the board. And we updated our public life cycle with that as well if you want some additional detail.37:02Now I want to get into some of the fun things that we have available in our products. So encrypted visibility engine. I mentioned that a couple of times, what this really does is it's leveraging machine learning to recognize threats in your traffic without the effort and the big overhead of.37:19Decrypting your traffic. How we're doing is it is taking the context that you have on the traffic, even if you don't look inside the traffic itself. There's fingerprints, tl TLS fingerprints. There are a lot of pieces that are connected to the packages.37:37That already give us a lot of insights of what's happening with this traffic without even having to look inside it. So what we're doing is we take all these insights from our Talos threat intelligence. With that machine learning, we feed in a score for every enforcement points of your firewalls that then.37:57Those guides.38:16Is this a high threat score? We wanna block that. Is it a low threat score, we will allow that. The next logical step that we added recently was, well, most of our traffic should be low risk. I hope that your environments are in that scenario.38:18Only a small set should be very high risk.38:38Those we know what to do. Low risk we can allow, high risk we want to block. The medium risk is the tricky part. That's where we're not exactly sure. Now that's where you want to deploy your decryption capabilities. So really making sure that you have a combination of software innovations.38:41Of determining what is majorly good with traffic, you don't need to waste all your decryption capabilities on that. What is high risk? You can just block that cause we know that for a fact. The medium risk ones where we're not a hundred percent sure, that's where you decrypt a bit further.39:00We've also made it much easier for you in ten.O to actually use encrypted visibility engine. As you can see here, we're showing you those malicious processes that are recognized. We're showing you what are the different policies that you are enabled with encrypted visibility engine. It's now actually just a couple of clicks.39:21For every single one of these policies to enable encrypted visibility engine as you can see there.39:41It's literally a toggle to just turn it on and then you can refine what are your thresholds? Do you wanna just monitor it or do you want to actually enforce it? Making it much easier to configure encrypted visibility engine. Now that you have locked or allowed.39:47About a good share of your environment.40:07We want to make it easier for you then for the rest to decrypt that traffic where you want to get this insight. So we in ten at all, we've made it much easier to have a guided configuration with some predefined bypasses to define your decryption policy.40:10With that, you don't have these rule based decryption policies, but instead you will have cards. Those are actually gonna be pretty intuitive for you to know what are some of these inbound, outbound bypass, and blocked policies? So again, you can focus on the intent not having to think through the sequence.40:29Of these. Once you do the decryption, we're deploying or you can enable snort machine learning. Snort machine learning again protects you from rules that or from vulnerabilities where we don't have an IPS rule yet.40:48Our Talos team is amazing in providing comprehensive vulnerabilities, but by definition zero day vulnerabilities, NO one knows about those yet, so it's gonna be hard to build a rule for those. Instead, we're shipping machine learning models to the firewall that recognize this is a slight variation.41:05Of a different vulnerability, e.g. an SQL injection.41:25So we wanna block that too. And then that information and those security events, Talos does investigation on those two and then builds additional rules for those so that you have a performant and comprehensive vulnerability database again.41:30Really enabling your enforcement point to take action at a zero day vulnerability without even having a hard coded rule for it. And we've evolved and advanced that quite a bit over the last few releases with Tenanto delivering the most comprehensive.41:47Protection from these unknown vulnerabilities. So the ones that are known, obviously you should have protection from. The unknown ones, that is the tricky part, and with snort machine learning, we can actually protect you from a good share of those.42:05And all of that is powered by our Talos intelligence. You can see a bunch of mind boggling numbers here, but what I wanted to talk through as well is the Talos team with all of these insights and Cisco having a massive benefit here of having a lot of millions of devices out there that they can.42:20Can Benefit from insights from.42:40Can build this comprehensive set of vulnerability rules, machine learning that powers snortml, that powers encrypted visibility engine, but we can also have visibility into localized challenges. You don't just have coverage across the globe, but we know is also within every single region you can see across a hundred and 93 countries. So.42:43If you're wondering if for my specific country is there a protection, is Talos aware of that? The answer is yes.43:03The other piece is as Talos does these investigations, they might actually find zero day vulnerabilities. Something, and you can see they discover more than 200 vulnerabilities. Disclosure of those will depend on work with the, with the agencies, with the authorities.43:10So they might not be immediately disclosed. But what we will certainly do is we actually protect every one of your environments with, that has Talos enabled from these vulnerabilities, even though they are not disclosed yet. So by you using Talos with this advanced research team, you're actually also have.43:30In some of these zero day vulnerabilities or early vulnerabilities that Talos has uncovered protected already before they are ever disclosed. So that really helps you have a strong security posture. The other piece that matters for a posture is identity.43:50With our tenant O release, you're now able to take feeds from multiple clusters so that you have a more comprehensive footprint of identity feeding to your FMC. You can enable PX grid, you register that in a catalyst cloud portal, and then create that application.44:10Instance for the FMC and feed all of that information there to make sure that there is this smooth integration there.44:30That works both across on premise and cloud delivered FMC, and you get some additional dynamic objects in here. It supports up to five ice clusters now, so really providing a comprehensive solution with much more granular detail that you can then use inside the FMC.44:36To build more intelligent policies. That's the whole intent of this. Taking the information you're getting, and building policies that really help the environment.44:56And then the last piece on the software side, the thing that I want to talk through is dynamic firewalls. Again, you can, with dynamic attributes connector, bring in this intelligence, bring in security, identity intelligence.45:06You can choose between, ICE and then compliment it with identity intelligence from duo. And have this classification of trusted, failable, neutral, questionable untrusted, and feed that into your policies. Making it really easy to have a very well defined policy.45:22In your environment. And all of that is actually available for every customer that has our firewalls on the latest releases in security cloud control. Again, we're using security cloud control for particularly the CII.45:41Integration Cisco identity intelligence, sorry I should avoid abbreviations. So that's one benefit you get from the pure cloud or cloud integration. And like I said, we're working to bring most of these capabilities on premise, but you will see we're faster able to deliver some of these.45:56In the cloud and through the integration, so it's cloud 1st, then through the integration, and then if possible, even on premise. That's not the only pieces we delivered with our release though. We actually introduced a few additional platforms.46:16We started refreshing our portfolio couple of years back from the 1st generation of firepower platforms to this latest generation. This is not just a renumbering scheme and just pumping a bit more CPU in there. It's actually a meaningful change in the.46:33Architecture across every single one of these firewalls. The key is as.46:53Security environments changed and more requirements for additional encrypted traffic. I think about 98 80 %, at least of traffic is now encrypted. You need to, if you deploy encrypted visibility engine as we talked through earlier, you can bring that down quite a bit to then focus your resources on only a subset.46:59But regardless, it's an increased volume of encrypted traffic. So these firewalls have a dedicated architecture that offloads the heavy work of decrypting from the CPU so that the firewall gets choked up.47:19Much later and has much more performance with its given form factor. And that's true across this entire spectrum. For the 3100 series and up there's a dedicated hardware chip for the 1200 and below it's an on CPU chip architecture.47:35But that really makes it much more flexible for you. And then just to talk through the very latest additions to this is one, on the lower end, we introduced our 02:20 series. The 02:20 series have been shipping now for I think two months. We've seen a lot of strong demand for this really comp.47:53That form factor.48:13But still significant capabilities and throughput. And the other piece that this does across this entire spectrum of our firewall portfolio, every one of these has all the software capabilities that I talked to earlier. Encrypted visibility engines, snort machine learning. You can run all of these.48:14Across every single firewall module. So making sure again that you have that consistent experience and really advanced security posture regardless of where you're deploying or your firewalls. The other one we added is our 6100 series and that one is a beast.48:34It is a two rack unit form factor with up to 600 gb of throughput. It actually requires about 80 % less space than the leading competitors. It consumes 60 % less power because again you have a more compact form factor that you don't.48:54Have all a bunch of rack units that are just.49:13Running idley and you actually have more throughput at a 3rd of the cost. So this is a real massive step forward in these high end AI ready data centers or for service providers that require this throughput. And the key is that.49:15This thing you can even cluster that with up to 16 notes. If you want, you can get, I think it says eight 7.2, but I think we've tested it and so seen up to 8 tb of throughput, like almost unlimited inspected throughput that you can get out of this box.49:33And that's really what we wanna make sure that across every single use case, across the entire spectrum, you have coverage with our Cisco secure firewalls. I mentioned earlier we have this advanced capability.49:50For the security piece where we offload on the 31 hundreds and 42 hundreds and 6100 systems to make sure that the performance is there for encrypted traffic. All of these are ready for PQC as well, and really that acceleration, but then also making sure that you have a performance.50:07Firewall that doesn't consume a ton of power from your environments.50:27Now we're not just investing in hardware, we're also investing in our virtual portfolio. In our release, we have introduced our FTDU, the unlimited virtual firewall. So you can allocate 32 cores, 46 cores.50:33However much capacity you have available.50:53There's still some limitations on the RVPN, but you're not rate limited with those firewalls anymore. So really opening up the virtual footprint of firewalls giving you dramatically more flexibility, not having to lock in a specific hardware form factor, but again giving you that flexibility.50:56That said though, actually if I go back to, just 1 s, our, our firewalls, starting with the 3100 series and up, you can cluster those. So for an investment protection perspective, you don't have to size for.51:15What.51:35Sure I need to deploy a full refrigerator or firewalls right now, you can deploy whatever you need today or for the next one to three years. And then you can add additional nodes to your cluster as you build out a cluster that scales with your demands. So that's something that we've thought through to make sure that we provide some investment protection.51:36For you, that as your demands change, you don't have to rip and replace an old firewall, but you can add to the cluster as your throughput requirements change.51:56I'm so sorry for that. I just want to make sure to address that as we talk through it. The other pieces, again, FTDV U is new here. We also added clustering with Azure, 16 notes with asavs, 16 nodes with FTDV, so the clustering piece I just went back for the.52:06Hardware.52:26You have that capability on the virtual front as well. And then one big ask that we have from customers as well is the clustering with auto scale. So that is now with GCP available in our release as well. And again, as I mentioned, our unlimited form factor.52:27I wanted to take a brief moment off and just get a pulse check of which of these various capabilities, and I don't think I even have all of them listed here, are you most excited about after hearing today's session? I'm really curious to to understand what matters really to you.52:47Awesome, so I'm seeing a lot of interest in snort machine learning.53:24I think particularly for those zero day vulnerabilities, that's a big deal for you to have that capability encrypted visibility, balancing what insights can I get on my traffic without ever decrypting it, but then having that selective capability of decryption. And I think the 1st one someone clicked was the FMC rec.53:27I've heard that that's that's a very exciting piece to make sure that you have again, even for more basic or.53:49Traditional deployments of an FMC hardware, you have that peace of mind that in case some connection gets lost, you can work through that. Now, all of this excitement through today's session is also echoed by our work with analysts and vendors out there. So we have seen.53:57Quite some good recognition from the industry for the investments we've made. So we have Gartner, we have IDC, here insights that's your peers providing feedback there, really excellent over the very most past recent twelve months.54:17The other pieces, I like to differentiate, there's analysts that take updates from vendors that look at customer feedback and assess from a strategic perspective, how do these firewalls work? Where Gartner e.g. positioned us as a visionary. But then there's these testing labs that actually take our latest firewalls with the latest.54:33Software and put them through real world tests.54:53That's where we also get recognized as a leader, and dramatically faster than any other firewall that is out there. The challenge that we've had with these over the past few years is actually the virtue of our heavy investment and innovations. There has been so much innovation over.54:56In both hardware with those flow offload engines, with the new architecture, with the just advanced performance of these firewalls, but then also on the software side, every single release over the last few years has added new innovations and differentiators that NO one else in the industry does as well as Cisco does with encrypted visibility.55:16The Engine snort machine learning.55:36So it's been really challenging to make sure that these analysts actually hear all these innovations directly from customers. So this fast pace of innovation kind of worked against us because they've still heard some feedback from earlier versions. But I'm excited to see that we're getting that recognition across the board now, as this really all.55:38All comes together for you to provide your security. Again, we're here to make sure that your environments are secure to protect you from being attacked.55:58But then integrate that with lateral movement in your environment, prevent that, limit that as much as possible, and then feed the information that you get from that granular segmentation back into your front line defenses. Again, really appreciate everyone's time today.56:09I think there were a few more questions. I'll try to get through some additional ones, but I think the panel did a great job answering a lot of them as well, and I'll hand it back to you anyway. Thank you, William for a great presentation. Yeah, we do have a couple of questions in Slido, so yeah, we'll appreciate it if you.56:27Can help us reviewing them. So, we will have a short, a short break, at 3 min break, and then we will start with the next presentation, which will be an overview on firewall API and automation.56:47Thank you. Hello, i hope you enjoyed your break. Now we will start with 2nd session of today.57:05And we will have Ike and Johanne as our presenters. So with that said, Ike, take it away. Alrighty then, gonna go ahead and start sharing my screen. Fantastic.57:22Hello and welcome everyone to this Expert insight session insight series session. My name is Aikran to join today with Giano Cassias, and we are here to talk to you today about managing Cisco secure Firewalls through its application programming interface. More commonly shortened to API.57:41During this presentation, we will be running a few Slido questions and polls. Scan the QR code on the screen to join us or navigate to slido.com on your browser and enter the session ID and session password. We will also be running our Q and A via the Slido, so be sure to join.57:58We have a couple of learning objectives today that we would like to cover for this topic. One teaching the fundamentals of APIs and how to interact with them. Two teaching how we can leverage APIs and automation tools to respond to threats in our network and three, showcasing how we can also leverage these APIs to create a.58:16Deploy access control policies to our secure firewalls.58:34For today's presentation, we have broken down our topic of secure firewall API management into a couple of subsections. One, the bulk of the topic, what management APIs are and how to enable them and how to interact with them. Two, programming with secure firewall, breaking down API interactions in the universal resource locators or roles of the API and.58:40Three, a brief overview of some API tools we could use to get started and secure firewall integrations that also take advantage of programmable APIs.58:59Before we get into the presentation, we would like to start with a quick ask of the audience. How often do you utilize APIs in your environment today? Whether you're here as a refresher or here to learn about APIs, we'd like to see how familiar we are with the technology.59:10And as is the answers come rolling in, it looks like we are rarely using APIs, so I'm glad we're having this topic today. Moving on to the secure firewall management API sub detection.59:291st and foremost, as with all things is why? What value can we extract from secure firewalls APIs and why should we be invested in this management method? Secure firewall, formerly firepower, is cisco's world class security platform designed to protect your network from increasingly sophisticated threats.59:45A foundational tool in network security secure firewall responds in like to the evolving threat landscape via up to the minute security intelligence and state of the art features such as snort three and the encrypted visibility engine.01:00:04In that same agile mindset, modern applications in our network are also moving faster than ever. Challenging NetOps and secops to respond to lockstep to any incidents that may occur. Dynamic applications, cloud compute and now AI are all individual and challenging security fronts for our teams to cover, but we can begin to cover.01:00:17These areas individually, we may at some point be overwhelmed by the sheer scale of it all.01:00:37With the power of automation, being able to automatically respond to threats in real time by leveraging secure firewalls context ridge APIs, we can cover our bases and give our teams the tools they need to stay agile. Automation and security intelligence and responsive and dynamic ACPs allow our net OPs and secops teams to run atops speed.01:00:42Application programming interfaces, APIs, are a set of definitions and protocols that allow program to program interactivity or application integration. As an analogy to this, we are leveraging the Webex application as an interface to interact with the Webex servers, sending receiving data from.01:01:05Voice, video, text, and recording the presentation for a later viewing, which we can retrieve by a web interface.01:01:23An API is NO different in functionality in this regard, allowing any authorized user to interact with whatever configurations which have been defined by the API. As for secure firewall, our API is built upon the representational state transfer API framework. The REST API standard defines how outside.01:01:29Or 3rd party applications, be that some bespoke script or program we build can interact with secure firewall.01:01:49REST API was chosen as it is lightweight, flexible, scalable, and platform agnostic, allowing any developer or enterprising persons to begin their own journey with our automation tools. The REST API leveraging the web server already present on the box manages incoming requests and outgoing.01:01:56Responses. REST API requests leverage four standard HTTP verbs. Git.01:02:15Post, put and delete to allow authenticated and authorized users to view and manipulate data and secure a firewall. Each of these verbs perform specific functions that are as follows. Get retrieving data from a specific girl.01:02:22Post writing bespoke data to that specific URL, put replacing or rewriting data and delete or removing data. As alluded to, we can specify what data we wish to manipulate or retrieve by sending an HTTP request paired with one of these verbs to a specific API object represented by an URL. To our secure firewall.01:02:37Management center.01:02:57These requests are in turn responded to valid or not, just as a normal web server would, as well with HTTP response codes. We have a couple of examples of common HTTP response codes you maybe familiar with, 200 and HTTP ok to signify a valid response was received unauthorized, 400 a bad request to signifying.01:02:58A malformed request was received and could it be understood.01:03:18Four four oh four. The 1st was the request was not found or the resource was not found. A small Slido quiz for us after that brief introduction to rest API. To modify an existing object, what request method should be used? That is the supplied HTTP verb in our request we add when addressing an object. Is it get delete?01:03:20Post or put, give it a few seconds just for everyone to lock in their answers and the answer for updating existing data is to put the new data in.01:03:41Well both post and put involve adding data secure F two secure FMC post is for creating new and unique objects that do not exist in this device. Put will update an existing object. Taking what we have just discussed, we can take a look at a quick example of an API request and breakdown.01:03:58On what we're looking at.01:04:17Looking at this example are all in the gray box, we can see four distinct portions. Beginning at the front, we can see HTTP designating the protocol we intend to use. In blue, we can see the host of the resource we intend to query. In green, we can see the path of this specific resource we are intending to query from our host. And finally, in orange with anything.01:04:19Starting at and past the question mark, we can see unique parameters we are supplying to the query.01:04:38Putting all of that together, we can move to the blue box below and break down the rest API request we are sending from our host on the left to our secure FMC on the right. In full, we are sending a gate request using the HTTPS protocol to the FMC IPO host address, querying the API FMC config V one domain policy access policies resource at the.01:04:44API and with NO additional parameters. And since this was a valid path in our API and we have supplied an authorization token, more on that later, the secure FMC returns a 200 ok HTTP response alongside the requested data, a list of all access control policies configured on our secure FMC.01:05:04We can interface with a secure firewall API in two ways, either directly to locally managed firewalls on FDM firewall device manager or indirectly via our managing secure FMC.01:05:24The pros and cons of both of these access methods are largely reflected in the limitations of locally managed versus centralized management styles. The secure FMC and FDM API are similar but have some differences in exposed functionality. We can expect deeper feature depths and secure fire fmc's API and conversely.01:05:37We can expect broader feature configurability in fdm's API.01:05:57The full feature set of each API can be viewed in their respective API explorer. A feature of secure Firewalls API that we'll get to in a moment. Enabling the secure firewall Management Center API feature is done through a simple toggle in the settings of the device.01:06:02In the top right of the GUI, we can click the system button represented by a cog. Navigate to configuration, REST API preferences on the left hand menu, and toggle the enable REST API button to on and click save. With that simple click of a button, we have now enabled the secure FMC API Explorer for viewing and our secure FMC is now ready for any.01:06:18Put all API requests.01:06:38Okay now with all the talks of automation coding and scripting and whatnot, it would be helpful to know what we can or cannot do with our newly enabled programming interface. The secure fmc's API Explorer is a resource that becomes available once we enable this API on the device. The API Explorer is a fully sorted and categorized list of all.01:06:39All the API features available to us as well as what verbs are available to interact with each individual object.01:06:59We can navigate to the API Explorer by accessing the API API Explorer resource on the secure FMC. In full HTTPS, the IP of our FMC, colon the HTTPS port if we have modified this to a non standard port, and finally aPI/API Explorer.01:07:06Another slido quiz for us, how can the API Explorer be accessed as we justice via SSH or from the FMC GUI? Give a little bit less time for this one just because we went over it.01:07:25Wire earl? Fantastic. Now authentication to the secure FMC API leverages token based authentication. This token based authentication allows an authenticated user to interact with the API for a limited period of time, about 30 min, allowing a user to complete its API transactions.01:07:40Without having to repeatedly authenticate per request. This valid API token can also be refreshed up to three times to extend its usage that will be 2 h in total.01:08:00When connecting to either the API Explorer or when attempting to access the API, we will need to authenticate to the device with an account that specifically has API permissions or best practices, we'll want to have unique API users to leverage and authenticate with our new tool.01:08:10Users in secure FMC cannot be authenticated to both the secure FMC GUI and API at the same time. Thusly, if we attempted to use one user for everything, we will be forced to log out on the other feature we are not using. Also keep in mind, this API user must also have the relevant permissions to modify data in our policies.01:08:27E.g., attaching policy configuration permissions to the API user will allow them to configure policies via the API.01:08:46General best practices for the rest API are as follows. Keeping GUI access users and API access users as separate level roles. This will be especially true for the default admin account. It is not advisable to give or use that admin account as an API user.01:08:55Do not give the API access users more privileges than necessary. Validate the data received from secure FMC and validate and sanitize the jsons that we send to the secure FMC. And lastly, if we are using either common criteria or unified capabilities approved products listed CC or UCAPL modes disabled.01:09:11Rest API.01:09:31Now to access the secure firewall API properly, we'll have to send requests to the specified urls defined in the secure firewall API Explorer. Well we could manually code or script a small application to do so interacting via HTML and delivering the proper jsons to modify data. We can also leverage API clients that are a little easier to.01:09:35API clients can come in many forms such as a browser plugin, specialized developer tools such as the open source program Bruno or the postman enterprise application or even the built in API tool in Cisco XDR XDR orchestration. Just like when we are accessing the API Explorer via a web browser, any interactions with the API directly.01:09:54They must be authenticated. Supplying their temporary authorization token to any subsequent request. Initially generating this authorization token is just like accessing the API Explorer via browser.01:10:14We log in with the proper credentials, requesting an authorization to retrieve the API token at the API object while supplying the API user credentials in the header of the request. Now that we've gone over some of the basics of REST API, I will be handing it over to Gianne who will be showcasing accessing the secure FMC API.01:10:24Explore as well as demonstrating how we can leverage an API client to log into and access our REST API.01:10:44Jian? Yeah, thank you like let me share my screen then. All right, so, hello everyone. So we're looking at this 1st demo. We're gonna show how to adapt the changing demands of network management by using the FMC API.01:10:50So we know that managing a firewall through GUI is great for single changes, but if you need to scale, automate or integrate with other tools, the API can be your best friend. So today I'm using an FMC version seven.six.two, and actually before we can start coding, we have to prepare.01:11:10For our environment. So 1st we must enable the REST API by going to system configuration.01:11:29And just as we saw in the presentation on the left hand side, look for REST API preferences, and we have to ensure that this checkbox is enabled here. So once that it's done, you can click save. And 2nd thing that we need to do is to create a new user. So let's go to users. Actually, this is a critical best practice.01:11:36This.01:11:56And as you can see, I already have one API user created here, right? So ensure that you assign the right privileges to this host. In this case I'm assigning the admin role so that I can have the necessary permissions to read and write data. This is gonna be the account.01:11:56That we're gonna be using for all the API communications of today. And once that we have our API user created and ready to go, then we can go to the API Explorer then. In the API Explorer, well, we already saw that in the presentation, the way that.01:12:18You can access here is by using the URL of the FMC and adding a/API/API-explorer and it will ask for your credentials.01:12:38So here's where we are going to use our new admin user to sign in. And once that we are there, you can think of this as your interactive documentation. It is a client build right into the FMC. It explains all of the resources, adjacent objects available for your.01:12:49Reviews and it also provides detailed information about the attribute value pairs in each object so you can experiment with the very the various HTTP methods that we have available. So let's take a look at object.01:13:09And before we jumped right into postman, which is going to be the API client that we're gonna be using today, let's look at a practical example of a read operation in the explorer. So let's say that I want to retrieve a list of all the network objects.01:13:25That are currently configured on the FMC. So in order to do that under the objects category, we have the get method for network objects. That's the one that we're gonna be using. And once that you click there, you'll notice the get method as long as well as the request URL.01:13:42That we should use. We can see that it actually follows a very specific structure.01:14:02And I want you to notice here, 1st of all that we have the domain UUID. Some resources required an object ID or related parent object ID in the URL. So in this case, that's the one that we need. And in most cases, well actually in this case every FMC has a list.01:14:08One domain and the API uses that ID to ensure that you're accessing the correct database partition. In the Explorer, this is often filled in for you automatically based on your logging. Actually, if you scroll down, we're gonna see the domain UUID right there. When we move to a 3rd party client, you.01:14:28We'll need to keep this ID handy and don't worry, we're gonna see that in our next demo, but for now let's.01:14:48Now that we have the domain UUID, which is the required parameter, we can give it a try and hit the try it out, button that we have on the right. So, before I click execute, we can see that we have s this parameter section. We have.01:14:56Questions like a limit and offset.01:15:16And well, you can see that the domain UUID is the only one that is required and the other ones are optional. But if you have a massive environment with thousands of objects, you wouldn't want to pull them all at once. You would use actually these filters that we have available in order to to filter the.01:15:19The results and the number of items that we want the API to return.01:15:39So we're gonna keep them blank for now and as we have already the the main UUID, pretty much we're good to go. Click execute, and then we're gonna have the response. So in the response part 1st we have the curl command used to make the, the request and we.01:15:44We're gonna see here the URL that we use in order to make this request and also we're going to see the authentication token. We're gonna talk about that in in a bit, but.01:16:04Part of the responses as well to see the response code which was already covered in the presentation, each code means something in this case it was successful, a 200 code means it was successful, and we also see the response body.01:16:16In this case, the response body is going to include a list of all the network objects that are configured on the FMC, right? And as you can see for each of these network objects, we can still listed the name of the object.01:16:31As well as the unique ID assigned to that specific network object. So it's important to keep that in mind. And we can also see some response headers, right? Apart from of the body.01:16:48So the API Explorer is great for learning, but actually for real world tasks, you will likely use a tool like postman. So let's go to Postman then. In here, you will have the URLs, just as we have them in the explorer, but there is a pro tip here.01:17:04You don't have to manually copy and paste every URL or UUID from the Explorer into postman. Cisco provides a pre built FMC postman collection that you can download from the Cisco devnet page. You can just simply download this collection and import it directly into postman. And actually before we start using post.01:17:23And making some requests from here. I'm going to go back to the explorer so that I can show you in my devnet page.01:17:44So here is, the postman collection. As you can see, there is a collection for FMC and there is another one for CDFMC. So you can download the one that you will be using. And once that you have it on your computer, you can import it into postman.01:17:52So you will see something like this, the collection that you can expand and you will see different categories here. And for each of them, you will find the HTTP methods that you have available to use. In this case for authentication, we have the request to ask for the token, the initial token that we.01:18:10You're gonna be requesting. And once that you click on one of the methods, it will automatically open a new tab that will provide the.01:18:30URL that you need to make that request. Of course, you just have to make some changes here in order to reference to your FMC and put the protocol HTTPS and point it to your FMC. So we're not gonna be using the collection. We're gonna do it from scratch. In this case.01:18:39And as in all API clients, the 1st things 1st is, authentication. So every REST API call must include an authentication token to verify that the caller is authorized to perform the requested action. And initially you need to obtain an access token by supplying the admin credentials.01:18:59And this is called a password granted access token, right? So here's where we are exchanging our credentials to request that token. So in order to do this, we set up a post request actually. Remember that this.01:19:19This is in order to create something new. We're gonna put that post request here, and we're gonna be using the URL in order to request the or generate the token, and once that we go to the authorization tab and select basic authentication.01:19:36As part of our initial authentication for this initial request, we're gonna provide the user credentials that we have or that we're gonna be using for this demo, which is the API user that we created at the beginning. So we click send and on the bottom we're gonna see the response. So for.01:19:561st we're going to see the response code.01:20:16Which is 204, which again it's in green. It means it was successful. And we also see the response body. As you can see, the response body here is blank. That's ok. That's expected, ok?01:20:20The but we were expecting the token, so we need to go to headers and that's where we can find the X out access token. Actually, that's the one that we are looking for, and make sure to copy and paste this token somewhere else for now because that's the one that we're gonna be using for our upcoming requests.01:20:36Okay, so take note of that one and you remember that I mentioned the domain UUID? So this is where you can find also the information of the the main UUID. Just keep that ID handy as well and just remember that this one is the ID of your global domain.01:20:56So you can have multiple domains configured on your FMC and if that's the case, you will need to make a different request so that you can get the right ID of your domain or the domain that you're gonna be making changes to.01:21:16So that we can put it or include it in our upcoming requests. That's gonna be part of our URLs. Okay, so that concludes our 1st demonstration on how to create a user, authenticate in a new or in a 3rd party API client, and for now.01:21:32Now I am going to pass the ball back to Ike.01:21:52Oh Fantastic demo. Okay. Thank you again team. Okay, programming with secure firewall. As we mentioned before, REST API leverages for HTTP verbs for.01:21:57Interaction. These four verbs are often referenced in REST API as the create read, update, and delete post get put and delete respectively. The crodneymonic is a quick reference to each of the verbs verb actions towards the API.01:22:17Post to create a new object, get to read an existing object, put to update and delete to delete. Knowing how these verbs operate is a critical component in interacting with the API as we use them to act on objects and secure FMC. API objects are also limited to interacting with certain verbs as well, all of which are defined in the API Explorer if we are.01:22:31Never unsure.01:22:51For a couple of examples with object repairs and as a way to elicitate how interactions with the API work, as we saw in the demo, we can take a look at registering a secure firewall to our deployment. After initial configuration via the secure firewall CLI, IP addressing DNS manager configuration, and the associated.01:22:54Registration key, we can in lieu of adding the firewall to the secure FMC via GUI instru instruct our secure FMC via API instead to register our firewall.01:23:12In this case, since this is a new secure firewall and NO record of data, we will be using the post verb to the devices, device records API object. When sending the post request, we will also be supplementing the device registration information in a JSON tied to the body of the HTML request.01:23:22We can see an example of what that JSON looks like on the right side of the screen now. Not only can we perform device management with APIs, we can also create manage, and manipulate the access control policies configured in secure FMC.01:23:38With the robustness of our REST APIs in the power of automation, we can make large squads of changes to our policies quickly to remain agile against any emerging threats. Listed here are a few of the many API objects that allow us to manipulate and deploy to our secure firewall of. E.g., access control policies, file policies, SNMP alerts, and prefer.01:23:54Interpolicies.01:24:14To name a few. Now looking towards api's tools and integrations. As Jihan mentioned in her demonstration about postman collections, we have developer.cisco.com. I would like to take some time to take a step back from talking about specifically secure FMC.01:24:16Rest APIs to introduce this learning platform killers specifically for developers looking for more information or training on Cisco's automation tools. Developer.cisco.com is Cisco's one stop shop for all things code.01:24:35The site host documentation for all Cisco device APIs, including by not limited to secure firewall APIs, secure email threat defense APIs and Meraki dashboard API documentation. We also host self paced guided labs as well as open sandboxes for training and experimenting with.01:24:47Both are served via your browser and required NO additional downloads, allowing you and your team to jump straight into learning automation. And finally, we also offer a sample code as a guiding north star for organizations that are starting and need a bit of help understanding how to begin their automation journey.01:25:05Be sure to pay a visit to developer.cisco.com/secure firewall to begin exploring this critical developer developer tool, sign up for free. Now with the update to Cisco's identity services engine version 3.1, ICE also leverages the power of REST APIs for its interactions and integrations with other Cisco security.01:25:21Products via PX grid version two point oh.01:25:41Cisco secure Firewall can not only integrate with ICE for enabling user control and our access control policies, but can also leverage the integration for dynamic and automated warrantine actions. By itself on the secure FMC, the correlation and remediation policies are a powerful tool. Dynamic tool powerful tool to dynamically.01:25:45To react to policy violation incidents. Apologies. Say e.g., a server designated to only talk to a few hosts exhibits non standard behaviors and begins to reach out to the internet.01:26:04With a correlation policy, we can set parameters for violations and with remediation policies reactively modify access control policies to slow down the endpoint across the firewall and add more stringent intrusion prevention policies to better scrutinize the endpoint. Together with ICE, correlation and remediation policies are bolstered in their ability to protect their network.01:26:13Information shared between secure firewall and ice, user to IP mapping, security group tags, VLAN information can dynamically react to a malware infected endpoint.01:26:33Once secure firewall has identified and sent a malware event to ice, warning of an infected endpoint, not only do we find secure firewall locking down the traffic across itself to slow down the infected endpoint, we also have ICE completely isolating the endpoint from movement. Ice can force a change of authorization to remove device from the network from any access points, update their associated.01:26:43The security group tags to quarantine networks, all while being backed by a Cisco trust site network to deny any movement of those quarantined scts at the switch wireless and router layer.01:27:03No movement. Our automation tools are also available to those that are leveraging cloud delivered firewall management center via Cisco security cloud control. The access methods for both the API and API Explorer are slightly different compared to an on prem solution.01:27:13For our API Explorer for Cloud delivered FMC, we could find it under firewall administration, integrations, firewall managed center, and the security cloud control. From there, we can click on the cloud delivered FMC and find the API Explorer under the action section in the right hand flyout menu.01:27:31Oh Reaching out to your cloud delivered FMC API is similar to an on prem deployment, still requiring an authorization token whenever we are interacting with it. We can generate an authorization token by creating an API user in our CDFMC tenant by going to administration, API user management and creating an API.01:27:47A user with the appropriate role.01:28:07Once that user is created, we can then generate an API token for that user to use. This token, unlike the on prem authorization tokens, does not expire and should be securely stored and obfuscated in code. If we lose this token, we could always either revoke it and generate a new token or hit the refresh button to.01:28:09Generate a new token to use.01:28:28Accessing Cloud delivered FMC API, however, will be dependent on the region with which your CDFMC tenant resides. As an example for the APJ region tenants, that is Asia Pacific and Japan, we would reach out to HTTPS aPI.apj.security.cisco.com/firewall supplying our.01:28:31API token to the head of our request to specify our tenant. Shorter section, but I will again be handing back over to Gihan to showcase another demonstration. This time around we'll be taking a look at interacting directly with the secure Firewall API and showing a vertical slice of programming with secure firewall.01:28:50Thank you like let me share my screen again. Okay, so, let's continue with our demonstration and how to use our REST API client to manage our FMC. I will show a couple of examples now using the different HTTP methods available.01:29:10In postman and actually for the FMC, we're gonna see a get post put and delete example. And 1st remember that last time we got our authentication token. So that's the one that we need to need to copy and go to our next request, which is gonna be a get of all the hosts configured on the FMC. So for.01:29:311st we need to include that token as part of the headers of our request. So let's go to the headers tab and add a new key, the name of the key, it's going to be X of access token and the value of course is going to be the token that we generated in our previous request.01:29:51Okay, so this is very important. Without this token, the request is gonna be rejected on the FMC side. So in the explorer, we did a get request just as in here in this example that we did it for network objects. In this case, we're gonna do it for host. As you can see in the URL.01:30:11That I am using, I already included the UUID. Again, this is the UUID of my global domain.01:30:31In case you are using a different one, you will need to make a different request. So I click send and let's take a look at the, at the response, 1st of all the code which is at 200, which means it was successful, it is showing in green. And then we see the body response. So in here.01:30:41This is pretty much as the output that we saw in the API Explorer, which is the list of all the hosts that are configured on the FMC.01:31:01It's pretty much the same, right? For each of the hosts, we're getting the same information, the unique ID of that host as well as the name. And this is just a list of all the hosts configured on the FMC. But if we want to get more detail on each of these hosts, remember that.01:31:10We need to make.01:31:30We need to reference it in our URL. So let's say that I would like to consult on a specific host or how it is configured. So I will need to copy this unique ID and include it in my URL. So I am adding the ID at the end of my URL that I.01:31:31I can get more specific information about this host.01:31:51That specific host ten.oh 19 one oh six. And when I click send remember this is a get request. I will get all the information about how that specific user is configured. If it allows overrides, if it is.01:31:55What's the IP that we are, that we have configured here? So now let's say that I want to create a new post. In this case, let's go to the post HTTP method. We're going to remove the.01:32:16The ID of the object that is already in the FMC configuration, and as we are creating something from scratch, well, we already provided the token so that we authenticate ourselves and so that the request can be.01:32:31Available on the FMC and we need to provide additional information to the FMC, like what's gonna be the host name and what's gonna be the IP. So for that I will need to include a body.01:32:48In my request. This body is, will, will provide more information about my host and actually this is the structure that it will need to follow for this specific request. It's not always the same for all the requests, all the post requests. This is in a JSON format, but whenever you have a.01:33:03Doubts on how to use any, any object, you can always use the collection that I mentioned in the previous demo and get some examples from there.01:33:23In this case we're creating the expert inside series test host. We provided this a description that it was it was created for this demo and just make sure that this is a pull request and that our URL is the one in order to create a new host and we click send.01:33:33Let's take a look at the response and again we're going to see the response code which was successful, and part of the response body is going to be more detailed information on how this host was configured or created. And the most important part of this is the unique ID that was assigned.01:33:52To this new host. Okay, so as you can see the timestamp is zero, but if I add this unique ID at the end of my URL and change the request to to get.01:34:12So that I can consult, the host that's that was created. I'm gonna hit send now and well it's pretty much going to provide the same information and the only difference is going to be the timestamp because well it was created like a few seconds before.01:34:25Again, every time that we reference a new object or host or whatever we do on the API it will we will need the unique ID. It doesn't matter if it if it is a host, a user or a rule.01:34:45Everything has a unique ID. So now let's modify this host. I'm gonna copy what it's currently configured, which is this part of the configuration and now we're gonna use we already get the post and now we're gonna use put. So we mentioned that with put we can modify an.01:34:59A specific host and what which host are we going to modify? Well, that's why we need to put the unique ID of that specific host at the end of my URL. Of course, we have to provide a body.01:35:19Again, saying what would be the change that we want to make to that specific host. 1st, let's go back to the FMC GUI so that I can show you that this host was created. So here we have the export insights here is a test host.01:35:33And if we take a look at the details, we're gonna see the IP and let's say that I want to enable overrides, e.g.. So that's the change that we're going to make using the API. So let's go back to postman here.01:35:49And as you can see part of the body or how it is configured right now, it's that right now it's not allowing overrides, so I'm gonna change this value to true, meaning that it will be allowed and we're gonna be changing how the object or how the host is configured. We double check the.01:36:07Method and the URL and now we're ready to hit send again. So let's take a look again at the response it was successful and now you can see that it was changed to true. Let's double check on the FMC.01:36:27So if we go again to check the details, we're going to see that now the checkbox of the overrides is enabled, which means that actually the the changes that we perform from the API worked, right? Now let's go back to the FMC, we already did an example using a get.01:36:46Method, a post, a put, and now we're missing just the delete.01:37:06Method. So let's say that you want to delete on a specific object or in this case we're gonna be deleting the host that we created. So that's gonna be the HTTP method that we're gonna be selecting here.01:37:12Which is the lead, and again, we have to tell the FMC, which host or which object we want to delete. So again, we have to make sure that we include the unique ID of that host. In this case there's NO necessary, there's NO need to include a body. I mean it's.01:37:28Just fine if you keep it like that from our previous example but it it just you just need the HTTP method and the URL to be more specific so that you can click send.01:37:48And well again the response was successful, it was we got a successful code here and it will just provide more information on the host that was configured. So I'm still seeing this, so I'm gonna refresh the FMC.01:38:02Page, and I'm going to try to find it, the expert inside serious host. Okay, so it's not there anymore, which is expected, right? So imagine you can do this not just with a single object or a single host, but with many of.01:38:20So if you need to clear your configuration or something, so this can be very, very.01:38:40Useful. Now we already went through a couple of examples on how to, check, create, modify, and delete some objects. Now let's go and take a look at the policies, right? We can do the same with the access control rules in our.01:38:46And before we start making some requests in regards to the policy, let's go back to get our initial authentication token because we are gonna need it to make this additional request and remember that this is this should be part of the headers.01:39:07Okay, just make sure that it's just the value of well the value is just the token. And once that you're ready, well, we're ready to authenticate with the FMC and we can start by making a get request so that we can have a list of all the access.01:39:26Control policies that we have configured on the FMC.01:39:46Okay, so let's hit send, the response was successful. And again, in here we are just going to have a list of all the access control policy names that we have configured on the FMC. Let's go back to the FMC that I that I can show you. We can double check the.01:39:50Policies access control.01:40:10Okay, so these are the different access control policies that I have configured. I have a couple in here and if we go back to postman, we can confirm that actually those access control policies are the ones that are listed in here.01:40:17And well, pretty much as we saw in the previous examples or each of these access control policy, you will see that it comes with a unique ID, right? Which is this one. So let's say that we want to work with access control best practices. So, let's get more details on how this policy.01:40:33Configured.01:40:53And for that, we already saw that we need to copy this unique ID and add it at the end of my URL so that I can be more specific on what I want to get, which information I want to get from the FMC. Now we are consulting an a specific policy.01:40:54Here and well we can see more details like a general configuration of the policy, but as you can see here, we are not taking a look at the rules that are configured on this policy. So let me take a look at the policy.01:41:14So that we can see how if if we have every anything configured here and yeah we do have a couple of rules configured in here. And if we want to consult these rules or a list of the rules that are inside that policy.01:41:32There's something else that we are missing and that should be part of our URL. So now that we specified which policy we want to consult, we have to tell the FMC that we want a list of the access rules that this policy has configured.01:41:52So now that I include asset rules at the end of my URL, now we can get a list of the rules that are configured inside the policy, right? Again, we're just going to see the name of the rule, the unique ID of each of them and well, the, the link that we.01:42:09You can use in order to reference to each of it. So let's look at a single rule.01:42:29But we're gonna copy the unique ID again. This is gonna be the 1st rule allowing second rules yeah allowing everything, let's do let's go with the 1st one so that we can check more details on how that rule is configured.01:42:35And see if there's logging enabled if if we're just allowing traffic or blocking traffic. So we're gonna do the same including the unique idea at the end of our URL and now we can get more details where it is placed in our policy, if it's part of which.01:42:55Category, what's the action that we have configured there? If it is enabled, what's the unique ID? Logging information, it's there so again we can get more details on how that specific rule is configured. In this case where.01:43:16Taking a look at this initial rule, which pretty much pretty much is allowing everything and well now let's say that I want to create a new rule from the API.01:43:34So in this case, we will need to change the method to post. Remember post is used to create something from scratch, something that is not configured on the FMC. We have to modify the URL because right now we do have the unique ID of a single rule, so we need to remove.01:43:50Move that from our URL, but we we actually want to create a new access rule, so that's the way that we should keep that specific URL.01:44:09Remember every time that you have any question or if you are, if you have any doubts about how or which URL to use, you can always go back to the collection or to your API Explorer and consult a couple of examples that you have available either in there.01:44:20Now, just as we did before with the host we well 1st double check the token and we have to provide a body, right? This is you have to select role because we want a JSON format, and this is the structure that we have to follow in order to provide it.01:44:36Information to the FMC so that we can create a new rule.01:44:55You can find more examples again in the collection of some requests that were successful and some others that failed so that you can have our references. And well in here I am creating a new rule that it's called API new rule. It is going to be enabled, it is an access rule.01:44:59And we're gonna be sending events to the FMC and in regards to logging, I just have logging enabled at the beginning of the rule. So just for the purpose of this example, I'm gonna log it at the end of the connection as well. This is not a best practice, by the way just for the purpose of the demo.01:45:19To see that it is actually creating this rule from the API and I'm gonna click send. Okay, so it was successful. We can see the code there. And again, the most important thing here is that it will provide a unique ID.01:45:38To this new rule that was created. Let's go back to the FMC. As you can see 1st at the top, we can see that a message here saying that the API user is currently making changes to the policy and well as we know, the API user is the one that we're.01:45:57Using for all the API requests. So I'm gonna refresh the FMC so that we can see this changes. And at the bottom of our policy, if we scroll down, we can see the API new rule that's that was created.01:46:16Okay, so let's take a look at the logging and see if it actually worked. And yeah, we do have logging enabled at the beginning and at the end of the connection. Again, this is not a best practice. Actually, you just have to enable one of those checkbox.01:46:34But yeah, let's cancel this. This configuration is already saved and well actually I don't need that rule being part of my policy, so let's go back to the FMC so that we can delete.01:46:50That a specific rule. Remember that I mentioned that every object has a unique ID. What happens if I use an ID that I shouldn't be using? In this case, as you can see, I didn't copy the ID of the access rule, but instead I copied again the ID of.01:47:08My access control policy, right? Which is.01:47:28It's gonna be wrong. So I'm gonna hit send to delete that one. And in this case, we're going to see that we got an error in the response, right? In this case remember as it is a delete option, we don't need to provide anybody.01:47:31But as if you have any questions on the ID or the unique ID to double check, you can always go back, change the method to get and consult the access control rules that are configured in your policy. So again, we can see that here is the API new rule, and now I can.01:47:49Copy the right IP.01:48:09Paste it in my URL and again change the method to delete. So now that I hit send, the request is gonna be successful. Okay, it will provide well information of the policy, the access control rule that was deleted.01:48:13And well, if we go back to the FMC and refresh the page again, that is specific action control access control rule should be done.01:48:29Okay, so it's not there, meaning that it was successful and well that pretty much concludes our second demo on how to use our, client API in order to make some changes to our FMC.01:48:48And with that, I'm passing the ball back to Ike. Fantastic. It's always fun to see, the API in action. Okay, well unfortunately, this marks the end of our content for today for.01:49:05For managing secure firewall with APIs. As we wrap up, we would like to leave you with a few key points to remember today.01:49:25One that Cisco secure Firewall leverages REST API using the JSON format to represent and update objects. The four verbs post get put and delete are the HD methods which we use to interact with the REST API. A reminder to keep GUI and API users separate in our permissions.01:49:33Not use the admin account default admin account as an API user and to visit developer.cisco.com/secure firewall for all of our Cisco related programming needs.01:49:53Thank you for your time today. If we still have any questions about today's topic, be sure to ask in the Slido Q and A We also have the AMA thread that will be open for two weeks, so if you have questions about that later, go ahead and post there. Back to you, Anya.01:50:05Thank you had great presentation. So we have shared some links that we consider helpful in the Webex chat, so please take advantage of those resources.01:50:21So now we will take a break if this will be a 20 min break, approximately, so we will be back at 1215 central time that will be 01:15 eastern time.01:50:36And we will cover troubleshooting techniques and best practices. So stay tuned for that interesting session and yeah, we will be back enjoying your break.01:50:54Hello team. Welcome back. Hope you enjoyed your break.01:51:19Now we will have the last session of the day, which will be troubleshooting techniques, and we will also cover some best practices and for this session we have either Pacheco. He's a security escalation engineer from.01:51:23Cisco tech, so with that said, Heather, take it away. Sure, thank you so much for the introduction. Hello team, as our colleague said, I'm Header Pacheco security escalation engineer from security tech backbone team.01:51:39And this this presentation is gonna be about the best practice on how to use a snort, how to troubleshoot that apath, right? So, 1st of all, let's see who I am. Well, as I told you.01:51:56I'm a tax solution engineer, Toastmaster member. I'm a huge star warson, sports lover, and I'm a security passion, right? So for the agenda today, we are going to check an overview of the technology that we are gonna focus.01:52:15The secure firewall portfolio, the architecture and how does it work, troubleshooting example, packet flow processing flow, how to detect issues, how to enhance your snore IPS rule performance rules.01:52:33ACL best practice and a conclusion. So for all of the audience, 1st that I want to ask, does everyone knows exactly what a firewall is and how to, how do it works or do we have a doubted here?01:52:52All right. Perfect. So, what are the 1st step to identify the network impacting issue on a secure firewall? This is how we are going to start, right? The best practice applicable to any secure firewall platform, best practice for snort configurations.01:53:11Identify the best way to communicate with TAC, and well, as always know, we have our branch office, we have our campus, we have our, our enterprise and all of the devices that are connected try to go into internet some cases, and it's very.01:53:32Basically right? We have our network that goes to to a cloud.01:53:51A Public cloud internet and we have this flow, right? But we have to cover our internal network from external network. And what do we do for that? Well, we put on a firewall, right? And the flow is very similar.01:53:56We send or let our network traffic to the firewall and the firewall sends to the to the network, but sometimes there is a problem there, right? And what is the 1st thing that everyone says when we have a problem, it's a firewall. Unfortunately in some cases.01:54:14It's true. So let's see how we are going to handle this kind of situations. So we have our secure firewall portfolio from Cisco. We have from the small one to the, to the service provider, the the biggest ones and the flagships, right? The small one we use it for.01:54:32IoT on an OT like a branches office or sensors or over.01:54:52Over the place, right? Then we have the branch or sassy that is secure firewall, 1200. We have the the the 3100 that are medium sized and works as well for hybrid.01:54:59Hybrid networks or data center or campus that is the 4200 series and at the last we have the 61 series or flagship and the ones that uses for service provider. Also, we have private cloud, right? As being worked KBM Nutanix hyperflex, and.01:55:14Recently we added hyper B as well.01:55:34We have it for pub public cloud, the the Google, the Amazon Web Services and Azure, but we added recently as well Oracle and Alibaba. So, what is our today's presentation objective?01:55:39The 1st thing, the spot when the firewall is the corporate. Second, simple step to pinpoint hardware or software issues. Sharper is not optimization, best practice for opening cases, and we're going to start with the.01:55:56The foundation of all of this, the secure firewall architecture, right? So, a while ago we have another kind of architecture with the 2100 that are out of sale and of life at the moment. We have some someone there, but the only difference.01:56:13Besides on hardware implementations that is almost the same that we have for both for other, the virtual, the ones on the cloud, the ones on the new hardware, this is our way to handle the traffic, right? We have this schema, so we have at the bottom or interfaces that are physical in.01:56:33Interfaces that are are layer one and then from there we send the traffic to the firewall features, right? Not US VPN, we're going to see it later how how it is be handled. And then we have the 1st way that we can handle the traffic with trust in inspect or block on or pre filter rules that.01:56:53Can be determinated by L one to.01:57:13Layer four, right? Acls. And after that, we have our breach we can say between the inspection that is our classic firewall software to the new generation firewall that is gonna be the snort engine, right? With the with the data acquisition, right? We have a.01:57:18Trust allow and block as well instead of inspect, we have the the allow, and from there we are going to use the firewall engine to determine what is does the snort do with those packets, this this traffic is gonna be a trust allowed or it's gonna be blocked, right?01:57:38So this is basically how we, we handle the traffic, the foundation of the FTD. So for data path troubleshooting, 1st of all, we can check hardware issues, right? We have or we have just to connect to your IP management address and we can check it the chassis.01:57:57The the the the FXOS, that is the software that handles all the the hardware situations, right?01:58:17So, the 1st thing that we can do is just connect it or login to our prompt and we can check basic error message. How with a simple just show fault command. That is gonna display all of the errors or all of the.01:58:23Alerts that we have on our, on our box, on our FTD, on our appliance, and we have these columns that is gonna set things like a measure or or or a warning, right? In this case we have on this example that the internet port one/four is is linked down.01:58:41We can check if the link is already there. Maybe the cable is not good or something is blocking the light if it's an SFP for a fabric for a optical cable, right? So we can check this kind of message here directly and it's gonna display.01:59:00And how to how to check what is the next steps on our troubleshooting path, right? Then we can check the module, that is where the the application is gonna be itself, right? It's gonna be running.01:59:20That could be ASA if you are using just a regular common firewall, but if you are using FTD it's gonna be the FTD there. So if you scope SSA, then you can check the app instance, in this case it's an FTD, you can see there, what is the running version, the startup version.01:59:39And if it's native or if it's container, right? So you can check it through here.01:59:58Then we can check the blade. In the late, in the largest firewalls we have, we can have up to three. In this case we are just using one so it's gonna be a scope chassis one, the scope server one/one. If we have three or two more, we can say scope change.02:00:04And the scope of the server one/one, right? And we could check the FS FSM status and it's gonna tell us things like if there is an error with the inside of the pro of the of the blade, in this case is the remote code error.02:00:26If we have problems with the post completion in this case, these kind of messages, if you can extract them and send it over attack, we are gonna be ultra good because we are gonna start looking further on what we can do to solve this issue faster.02:00:44And it's like just three commands and that's it. So it and it give us a lot of information. So, to check the app instance at this state, e.g., if we have problems with the hard drive.02:01:02We can check the model the same scope SSA scope is log one or two or three, and then show detail. With this kind of command we're gonna see if the status of the SSD is correct, if it's healthy, if what it happens when we just do a ray image and never came up and.02:01:18And it's like just loading with this kind of messages we can know what exactly needs happening.02:01:37So for software issues, we can go directly 1st to our Lena engine and check the basic stuff to check problems on the hardware through the software, right? E.g., just show CPU.02:01:48Directly on Lena and it's gonna show us what is the resources that we are using the memory state as well. Show memory is gonna show us the, the RAM, the disk to check if we are full of the on the disk on this partition. Sometimes there are problems that the disk is.02:02:01It's full and new sessions cannot be created it is when everyone said that internet is not working, well it could be because this is full.02:02:21And the snort side, we can check directly on root, the, with the top command, what is the CPU utilization? If it's too high, maybe there is a problem with snort. Maybe there is users that cannot be reaching internet because of this.02:02:30That we can check it out here. For the RAM we can do exactly the same free space.G and we are going to see it on gigabytes amount, right? So or total or user or free, how is the memory? And for the this state, we can use this another this command the F space.02:02:45Slash TH on capitals and we can see the partitions on that is not on linux side and see if.02:03:06Something is full and that could be causing issues, right? So let's see an example. E.g., what about if Edather wants to check the real madridge score or want to check directly the, the his favorite team, right? The 1st thing that we do is open a browser.02:03:13Through edge.02:03:34And what happens? We have something like this and everyone gets mad, everyone gets like crazy and is reporting to IT that there is NO internet connections and ok, let's see. But for working to to do their daily job work, they can.02:03:36E.g., retrieve info, retrieve files, documents from servers that are inside of the network. So, not to go internet is not showing that the the all the network is down. Maybe some services are falling but not everything is down.02:03:56So if we try to compare there is a problem, there is not, ok, let's see why it's happening. So the 1st thing that everyone do is the the most easy way, right? To see if we can reach sites. So, the trusted think.02:04:15We're gonna ping to our server where are the things that we have on our our daily work and the pink is working. But if we try to ping, e.g., this, this host that is internet is not is not reaching out, right?02:04:33So let's see what could be happen. 1st, let's see the network diagnostic. We are going to see go to system support diagnostics CLI on on and then we are going to check what are the interface that are involved to our direct host, right? In this case, the computer that I am using.02:04:50Seen for, the test.02:05:10And the the servers and the internet, right? So if we do this show IP, this is a very, very small network, a very basic one we have inside outside and DMC, right? The same outside is connecting to internet, inside to our guests are our our hosts involved here and the DMC is where the servers with everything.02:05:14Is is there.02:05:34So we're going to check those routes. How to do it really easy. We are going to use show route, the IP address, right? For the, in this case the PC host that is connected. And we are seeing that the inside is this host is connected via inside. The interface is inside red.02:05:36Then we have the show route for the server. It's on the DMC zone, so we know that the server is reaching because it's on the DMC zone. And we have the show route a.eight.8.eight and it's gonna be internet, right? So the network is not in the table, so it's gonna go to the default gateway that most.02:05:55Based on, on on the internet outside, right? So we're going to use a very powerful tool that we have on the firewalls that is the capture. For capture, we are going to use a syntax, a very easy syntax.02:06:15The 1st thing is the the name capture that is gonna be all command. After that we are going to name the capture. In this case as I'm gonna put the the capture on the interface inside, we are going to use capin the the the word interface to to know what is the interface where the.02:06:34Capture is gonna be reside, the inside because that is the name trace to trace all of the packets match, we are going to use this to match all the traffic that we are that interested to us. In this case we are going to use ICMP because it's the ping.02:06:54The host, we can use the host, but we can use network or we can use any, right? In this case when are we our computer host because we know that we are going to to the server, but we can change it through network or to any to catch traffic for all of the very.02:07:10Intercept plus.02:07:30So we're gonna use the show capture cappine once we do the test, some seconds or minutes have passed, show capture campaign, we are gonna see something like this, right? The capture is saying that the 1st packet was an echo request that was from our host.02:07:33To the server and the reply comes from the server to the host. So there is a full communication between it. So what about if we do the same syntaxes but instead of inside we're going to use the MC. We're gonna be the vice versa traffic, right?02:07:53Coming from exactly the same post our server, but the server answer back, that's it. We know that the are the same amount of packets because this is the full communication level. Let's do the showcap recappine.02:08:12If we do the same for A.eight.eight and there is a problem, we are sending the echo request but we never get the the echo reply, right? Let's see why. We can use another powerful tool traces.02:08:30So when we get this capture, we know that we have it and the error is there, we can do a capture trace using this kind of command and we are going to check exactly what packet is interesting to us using the packet number one or packet number 20 or packet number 50.02:08:45Not more than 80 packets more than 80 is gonna be it's not gonna be show you anything, but the 1st 8060 packets are gonna be with this trace. We're going to use the detail at the end and what it will be displaying is the firewall is gonna display what does the firewall is doing exactly.02:09:05Exactly with this packet from all of the faces that we have on the firewall for the configuration on this rule.02:09:25E.g., we saw before the schema where all of the firewall is with the layer one, layer two, layer out to layer four, we are going to see this on these traces and what does the firewall does with that?02:09:32Packet. E.g., the packet, the phase number one is that we captured the packet, right? And we allow it. We didn't reject it because at least at layer one level is allowed. Then it's gonna go to the access list it's about and there is gonna be the phase three phase four and depending on how they're.02:09:48Configuration of your firewall is or your rules.02:10:08You have is gonna show all of the faces that this packet pass through. And at the end we're going to see something like this, the result. The result shows the the input interface that is inside this app, but we haven't an action as a drop. And why is that drop? Because the drop reason shows NO route, NO route.02:10:11Up to the host. All right, so we don't have a route to go to internet. Let's check it out directly on our FMC. So let's check the routes on our FMC. We have to go to devices, device management, select the device that we are interested, then the routing and the static route. We are gonna show to display something like that.02:10:31And as we can see here, we have the, the route. Actually, there is there is an existing route. Any IP before is gonna go to the outside and and there is two gateways, right? So why it's not working? Let's check the status of the hardware itself.02:10:51So we can go to system, health monitor home and we are going to select the device of our interest. In this case, we have this, right? We have our firepower 3110 is not working. This is a legacy one. But what is showing us that the interface status is not linked?02:11:09And we go to the site and see that the link is up. Something is happening, right? On these kind of legacy devices we have the, the FXOS in another console. On the new verse version, we have it inside of the device. It's the same?02:11:28We are going to have the chassis management, but inside of the FMC, we don't need to have another another console. In this case we have to do it because it's a 4110 and there is the problem, right? The status is down. Let's see physically what is happening.02:11:46So login interface stuff and we are going to see something like this. This kind of prompt is inside of the the FNC on the newest versions, so you don't need to have two kinds of console. But in this case we have it that the internet one/one is admin down actually is turning down, the interface is not up.02:12:03So let's turn it on. And after turn it on here on the on the FXOS, on the FMC seems like everything is good. Everything is on green state, we don't have issues with the interface. So I think I can see my, my football the soccer match or the real module match.02:12:21Let's do see it. Another thing that we can do is just now check again, do the same test, show capture, and we are going to do the same to check the 1st packet that comes to our firewall and what is this doing?02:12:43And you can see, we have the phase two access lists there is an existing access list to allow this traffic. Now we can see that the input interface is up and the output interface is up as well. Perfect.02:12:59So now we can do our work, but I still cannot see a real maldread match. Something is happening here. Okay, let's see. Let's using the capture traces, the same capture cappane, you know how to do it. We are going to match in this case instead of.02:13:14Of Using the host.02:13:34We're going to use any because it's going to internet. We don't know exactly the IP address for the internet. And with any we know that we are coming from the host and going to internet. We're using DNR requests obviously because we have to go to an FQDN.02:13:36So there is or a DNS request. And if you do the show capture cappine trace packet number one detail again, we're going to see something like this. As you can see there is a new phase phase seven, type snort.02:13:54Allow. So it's gonna be allowed the the traffic is gonna be allowed. So let's use the packet tracer, another tool that we are going to see how it works, but for that, we are gonna need the destination IP address.02:14:11As we don't know the the the IP address from Google that the DNS is according this to us, we are going to ping Google and there it is. We know now that that IP address is responding from Google. We can use that IP address.02:14:27To, to use the packet tracer, right? How we are gonna use the packet tracer. Packet tracer is a tool inside of the firewall that is gonna simulate traffic passing to the firewall.02:14:44With the ports that you need and the IP addresses that you need. So you don't need to test every time. You can do it with this packet tracer. Packet tracer is gonna simulate the the flow on the firewall and it's gonna give us what does the.02:15:00Packet those the engines are doing with the packet. E.g., let's use packet tracer. We are gonna input the packet on the inside interface, it's gonna be TCP because it's HTTPS traffic.02:15:17From our computer that we are using for testing, we are going to use an ephemeral port. We don't know what is the port that is gonna use our our browser. So in this case I use this one. We are going to use the IP address that we, that we get from the pink before.02:15:33That is, we know that is google. And where use this 443, right? Because we know that it's HTTPS traffic. All right, we got a new phase in this case phase 15th as well.02:15:51And as you can see, we have our inside app, outside up, there is NO problem with hardware, but you can see there that is firewall preposessor doing this block. Let's see what is happening.02:16:07Let's see deeply. Another tool that we have in the system support trace, we are going to see the flow, but it's gonna be, it's gonna be in just a snort site, right? A Snort is gonna tell us what is here.02:16:22So on Glish, we're going to use system support Trace we are going to enable the engine debug, and then we are gonna specify the IP protocol. In this case it's gonna be TCP because we know this is HTTPS.02:16:44We're gonna use our client IP address. We are not specified the port because it's an ephemeral one, we are not know what is the browser using it for this new connection. We don't know the IP address of the server because remember that those are IP addresses that are changing. They are dynamics.02:16:59So in this case we are not going to use server address.02:17:19But we know the port, right? We know that the, the server port is gonna be 443 and start to to debug the messages. You do, your test and it's gonna show us what is the snort session doing with this. In this case, we have that there is.02:17:23New firewall session, there is another event, we can check all of this. It's very deep if you don't need to check everything as deep as I need. You just need to check what is the rule that is matching with this kind of traffic, in this case, not match rule five. So we know that on our configuration on the ACL, the rule five is the one that is rule.02:17:43Rejecting this kind of traffic the name of that rule it calls HTTPS and it has a time range.02:18:03All right. All of that is gonna be, the, the, the information that we are gonna use to check this. And then it shows deny action. Okay, let's see why it's denying. On the FMC we can check on the ACP.02:18:11Dashboard, we have those rules that we have configured, the ICMP, the insight to the MC traffic is gonna work ok, the DNS is working ok as well as we are solving, and there is HTTPS the one that we saw before on the lock.02:18:26It says that the ports is HTTP HTTPS that are allowed, but for some reason it's is blocking it, right? So let's see what is inside of that rule. So it shows a time range on the on the on the right on top.02:18:42It says NO internet. That means that maybe the IT guy says, ok, either cannot see his match, cannot see real Adrid at his lunchtime. So we are going to cancel internet to HTTPS, but he doesn't know that I know.02:19:00How does this firewall works? We're gonna read out that the the rule and after that, we can see that internet is working. So we go through a lot of the steps just to to check that the rule was not working good, but why?02:19:17Because we take those baby steps in every phase to check what is the problem. 1st was the the interface, then we check that the roads are ok. But if we do this kind of steps, we can know.02:19:35What the, what the problem is. So packet processing flow, before of that to continue, is there any.02:19:52Question or comment that you want to add here? No, we don't have, we don't have questions at this at this moment. All right, ok, let's continue.02:20:07Okay, so this is our packet processing flow, right? This is the way does the, how does the firewall see every packet. So this is too deep to check it at the moment every phase.02:20:28But the thing that is interested to us are two things. How does the fast path works and how does the instant works? So on the ring, on the, on the bottom, on the RX, we have our ingress interface, and we're going to check if there is an existing connection with that packet.02:20:45We are going to fast path and we are going to proxy that packet and then we are going to the duck. The duck is gonna know if it has to go to a snort, or it can, going to the flow. The if if it's a new packet and there is NO existing connection.02:21:04It's gonna do the ingress interface and it's gonna check if there is a pre filter rule.02:21:24It's gonna the same. Transport to the proxy and the flow is gonna be ok. If not, if there is NO profiltering for this kind of packet, we are going to use the L three and the L four ACLs to note what is the next step.02:21:30The same transport the proxy. We're going to use our data that is a rich between Lina and all of those process that you are seeing there is gonna go to the security intelligence, this is some decryption, reassembly, if there is some DNS for if you have.02:21:47Have rules for DNS and all of that identity policy, things like that.02:22:07If if it's allowed it's gonna be allowed, if it's not, it's gonna be dropped. So, what happened when we do all of those things? As you can see is very, very sorry sir. It's very long that way. And there's our 1st slider question.02:22:13Which access control rule action should be used if an institution policy is needed?02:22:35And let me check if I'm doing that correct.02:23:00Yeah, so, yeah, we do see some people that are have already questions, so yeah, so you can go to the next slide and it will show the result. Perfect. Let's see how many.02:23:11Of the attendees. Got it, correct. Allow. Okay perfect. Perfect perfect. Let's see. So as you saw it, there are a lot of faces that come from a packet to a snock.02:23:27And what does that happen? It's gonna elevate the resource that we have to inspect deeply those packets. And that is gonna cause something like a slowness or network, things like that because the amount of traffic is gonna be there. But something that we can do is.02:23:44Detect how to does not can work better for or requirements on our network. So how we can detect issues? A while ago we have to do a lot of very difficult set of commands to detect this kind of issue.02:24:04On the newest versions we is just like gonna check our symptoms.02:24:23What could be those symptoms, right? E.g., we are gonna have latency. The user are saying our internet is very slow. I cannot see videos on YouTube to work better, right?02:24:29I have internet connection losses, I don't know something worse, sometime it doesn't, high CPU on the IT side and what could be the causes of these issues? 1st of all.02:24:46Rule performance, the rules are not good configured. Application identification performance could be or own applications or 3rd party applications. We can see it. Maybe it's not is doing something with that. Flow performance.02:25:00Over subscription. Maybe we need a bigger box, a snort misconfiguration is doing something bad with your packets or a poorly designed on the network, right? So let's see how to avoid this performance. As I told you before, we asked a lot of commands that we have to do.02:25:16Do on the boxes and now we can just use the CPU profiling.02:25:36Just select the device that we need on devices tab, then we are going to select it on the dropdown menu that is there and then we are going to run it with the start button on the right, and we are going to do it while the.02:25:41People is working while the, the network traffic is in ISO issues. We're going to start it and then the CPU profile is gonna give us a results, right? Of what are.02:25:59The processes that are using this CPU the most, right? You can run it by 30 min 1 h 3 h, that depends on you. You can configure that. And it's gonna show us the profiling metrics, right? And for that we are going to.02:26:14To see the meaning of that. 1st of all, the model, what is the model or the inspector on the snort that is causing this or is using these resources? The percentage and the total of time of that module using the CPU time.02:26:34And this case is gonna be on microseconds, the average that the ticket involved to invoke this and the percentage of color, right? So, what are those? The, the, the dark, as I told you is the bridge between Lina and.02:26:53The 3rd stream that is gonna the TCP stream GDP stream, and it's if it's, you are doing streaming, right? The rule evaluation, the app ID we're gonna see it later in NPSE, the multi partner search engine, right? Is.02:27:13Always most of the time on top of this module because he's gonna use multi packer.02:27:33To check your packets and see that everything is secure. So how we are gonna perform this rule? Well, sometimes we can go and directly we're gonna see an alert that Snort is using 99 % of one of the CPUs or.02:27:38You can check it over the over the health monitor, right? And if you go to the health monitor you're gonna see something like this. What other things that you can see it? Well, there is a a lot of graphs that you can check that is gonna be dynamic, it's gonna be changed over the time.02:27:56You can check CPU.02:28:16What is using the CPU, right? The the data path in this case could be Lina or Snort directly or the system software using itself by managing the memory, connection statics, the throughput on the interface, you can check over all the interfaces or see every interface by itself.02:28:18Of the processes, how they are going on the on the bottom, you can see there.02:28:38The green are good, the the gray is not using red or or orange have problems the usage, but you can go more beyond. If you click on the little.02:28:44Plus bottom, you can add more statics statistics to this dashboard. And you can create a report on the, on the right there is a download bottom, you can create a report with all of this information if you need it.02:29:00So for the IPS rules, we are gonna create a new IPS rules. We are gonna name it as whatever you want, put a description and we are going to decide if we are using this new rule for detection, we mean in IDS just detect.02:29:15Or prevention, IPS, right? And we are going to select one of these dropdown menu base policy. What are gonna be those base policy? It's gonna be balanced secure and connectivity, connectivity or security, maximum detection.02:29:32And security over connectivity, right? And what does that mean? Exactly what you are reading. Exactly what you are reading. For complete this kind of IPS protection, we have the street of customization that needs all CVE reference, right?02:29:49The taxonomy, the taxonomy is through the attached framework.02:30:09And this is gonna be updating almost once a week, two, two times a week with the LSP releases, right? With the LSP releases, we just operate that release, that upgrade doesn't require.02:30:13A reboot on your device or you just need to install it and that's it, deploy it. So for the IPS rules, as I told you, balanced security and connectivity, network analysis and this is the description. We can share this.02:30:33This slide with you so you can check it deeper, but but basically what you are reading is what the the policy is gonna do. So what are the IPS rules? This is we create already our default rule. In this case you can see Snort two and snort three.02:30:49North two is about to get end of life, so I highly recommend to use always snort three. And in this case we use balanced security and connectivity. If we click on a snort three version button, we are gonna set set up and we are gonna customize.02:31:09How this is gonna work. So let's tune in the IPS rules. This is our foundation of the secure and Cisco secure firewall and not just but not just that the secure is we're based on Talos and that provides the security for all of the Cisco devices.02:31:29In this case, we are talking about Cisco firewall, but for all of the devices that we have on Cisco for security as the true protection on all the portfolio.02:31:48So we have something like this and you can see it more granular as we select balanced security and connectivity and mode prevention, as you can see on the right, we have, more than 90000.02:32:00Rules that are active at the moment. We have over 50000. In this case we're just gonna use just 90 almost 10000 and we are gonna alert on 4477.02:32:16Alerts. And for the others more than 9000, the the default action is gonna be blocked. What could be that? Well, we can check everything. If you want to do it by yourself.02:32:32It's better actually, and you are gonna be all of the rules that are involved on this policy and use it for block or alert, right? And in this case we have more than 41000 disabled, we are not gonna use those, but you can check the, the, the policy in.02:32:48Generate reports, explore your policy, things like that. What is interest to us if you check the base policy, as you can see here, we have the rule categories. We have browser e.g.. We are going to do that.02:33:08Everyone that uses four, e.g., Tour browser is gonna be disabled on our network. I don't know, if you don't want to users use brave, ok, you can select it and NO one is gonna use brave. For files, e.g. NO one can download.02:33:26EXE files from internet, ok? You can put it there on the on the on the rule, right? So operating system, ok? No ones that have Linux on on their devices is gonna go internet, you can do it from here as well.02:33:44So let's do the rule profiling on the web UI that we saw before. So, we have here rule profiling, we select all device we are gonna give us, I don't know, in this case, I give it like.02:34:032 h, right? And after 2 h we get this. You see on the left, in the rear left, the GID S ID, and we are gonna see it later in the next slide. But as you can see here, there is a rule description.02:34:19What the rule prevent or do that? In this case malware server, the percentage that is not used to check this specific rule, if it matches, if it there is alert or in the time that it it takes.02:34:36The average to check it and you can export this this snapshot. So explanations for that. Well, there is the GID SID is the generator. What generate this.02:34:53This event and the rule that matches with that and the rule that is being provided, right? This is for three, so you can check what I said before. You can check every one of the app or yeah, applications that are using this. You can enable disable.02:35:14Maybe you don't want to check this kind of traffic, you just need to disable and there is not gonna be a generator because the rule ID is all already disabled, right? The rule description, the percentage of a snort time.02:35:34The revision number rule checks matches or at the same time, right? This is really deep, you don't need to do it to check every column, but you can know what is heating this kind of rules or if it's using a lot of your CPU.02:35:49So Cisco recommended rules, something that you can do is just select, e.g., prevention and use balancy and connectivity and click here on the start. What is gonna do this? Your firewall is gonna check rules and target vulnerabilities associated to your network.02:36:07That are detecting on your network and based on that, it's gonna give you the rules that must act as alert or as a detection or as a as a prevention, right? You are gonna check it out like this and it's gonna be automatically, you don't have to tune anything. You just need to click and start.02:36:27So you don't know, you don't have to go to every one of the rules. You just need to start, it's gonna do this detection and it's gonna evaluate this and after evaluating this, it's gonna give you what are the best practice for your network. So.02:36:46As you can see, what are, what are the rules that we are going to enable when that depends? There are the recommendations. You can add it or disable it. That is your choice, the discovered CVEs that were on that were on your on network.02:37:06And for this, something that is very good is we are gonna update our fmcs and ftds with the BDB vulnerability database that are almost the same as the LSP and it's gonna update your devices to work with the newest.02:37:24Applications that are coming to the market, right? And with the discovery policy, we are going to check this kind of situation that we saw it before. The vulnerability database is the same. You don't need to reboot your devices. You just need to install it and deploy it, and that's it.02:37:44So, highly reliable traffic. We know that on our network we can have video cameras, we can have printers, we can have managed devices as the FTD. So.02:38:02All of that traffic most of them, if it's not interested to us to expect it, shouldn't go to a snort. We shouldn't be a part of that traffic from a snort because Snort is gonna use resource to inspect those kind of packets that are not needed to be inspected.02:38:19Right? So, to elevate this is not exclusion to pre establish the, to establish these pre filter rules on your policies. That is gonna be excluded the reliable traffic, right? SNMP, if you have SNMP for, I don't know, maybe alerting.02:38:35And you know those devices are trusted or you can do it like that. The syslog shouldn't be passing through because it's syslog, and maybe they are going to your collector or your splunk. I don't know.02:38:52Boy, because voice over IP is really, really heavy and you cannot see every packet on that maybe VPN because it's encrypted traffic, you don't need to check encrypted traffic as not is not gonna do anything with that traffic because it's encrypted.02:39:09And generated by network devices, right? Firewalls, routers, things like that. That shouldn't go to snort. So your devices to your management devices shouldn't be pre filtered.02:39:27So what how we are gonna create these kind of prefilter rules? Well, we're going to policies, access control and select the the ACP that we want to the ACL sorry that we are going to use. E.g., this ACP test.02:39:44Let's click on the little pencil, and we are going to on the top there is the way that the firewall detects and handles the traffic and pre filter for the decryption security intelligence, we are going to interested right now on the pre filter, we are gonna click on the pre filter or you have to create a prefilter.02:40:03You can do it right there, and in this case we are gonna add it and what we can do. Remember that this is just for layer one to layer four, right? We are not going to involve anything else but that.02:40:23In this case, we are going to use fast path to to alleviate the snort. This kind of traffic must be inside outside always, and we can add networks.02:40:39Right, there is networks, interface objects, VLAN tags if you are using VLAN and ports. As you can see on the, on the left side, we have the the available ports that are for presenting as a, with the name SMTP SMTPS SSH, SMP.02:40:56But if you want to add a port that maybe your application, your own application uses, you can add that application that application port here. You just click on the, on the plus button there.02:41:17Add your port, put the label that you wanted and that's it. You can add it as a destination port, right? And in this case we are gonna alleviate DNS because DNS not isn't not gonna go to this north LDAP SIP, that is for VoIP, SNMP and syslog.02:41:29All of the traffic that touches the interfaces on the firewall that has this kind of destination port is gonna be pre filtered and it's not is never gonna check it out. So it's not it's gonna alleviate those resources for this kind of traffic.02:41:45So once we got the rule, as you can see, that is the way it's gonna work from inside to outside, any source, any destination, any port, but source port, but for destination ports always gonna be this fast padded. We save it and we deploy.02:42:02So, this practice for fast part import filtering, what are the ideal traffic for this? Well VPN, as I told you, VPN is gonna be actually coming from your trusted device or a trusted network from another place. You already.02:42:19Inspect that traffic and passes through the VPN encrypted.02:42:40As Nori is gonna do anything with encrypted traffic because it's encrypted already. So VPN is gonna be a well fast parting kind of traffic. SQL traffic, interested endpoints or your internet SQL maybe is used a lot.02:42:44And if you know that your internal network use endpoints that are trusted between it, two or three or four servers users, you should SQL traffic, you should be prefer pre filtering.02:43:03Scanners. Scanners add a lot of false positive on our our devices on our ftds. It's gonna response from the inclusion, the IPS that we saw before, because they are gonna detect that someone is doing a scanning on our network. But if we rely on.02:43:20Those IP address on the per filter rule.02:43:41The profilter rule knows that that kind of scanner, it's ok, it's well trusted and don't worry, we can use so scanner traffic is gonna be a profilter is a whole practice. Voice and video. If you have video security cameras or you have a stream.02:43:43Network devices like video conference calls, things like that, that voice and video could be fulfilled. Backups, backups, e.g., for your FMC or your ftds that are maybe weekly sync or monthly or I don't know, and you will know that maybe once.02:44:04And of the week or at the moment, you have to pass a lot of backups through your network. You don't need to do to to expect that kind of traffic because you already know what that traffic is. And the backups are really high on.02:44:24Use a lot of network resource because could be an amount of gigabytes, right? Or terabytes if it's alone or I don't know, and management traffic, e.g. or Cisco devices, right? Like the FMC, like the FTD, we already know that uses TCP 803O.02:44:41Five and actually we know that this kind of traffic is already on a VPN, it's already encrypted, it's already ciphered, so you don't need to inspect it, right?02:45:00So next question, what type of traffic should not be considering for fast parting in a profilter room? Let's give it a few minutes.02:45:13One, 1 min four we got few responses.02:45:54Got it correct. Exactly. Traffic required deep inspection, that is not gonna be Scarnish traffic. Scarnish traffic e.g. could be.02:46:16The ones that we because I saw the question, e.g., the scanners that goes.02:46:31To the network and do scans on the all the the all the IP address and check for ports that are open on devices or if SNMP is open and some kind of devices, that kind of scanners on traffic, right?02:46:38Alright, for applications, what are applications? Well, an application is a collection of protocols and patterns that can be identified as a common group of Facebook, e.g., LinkedIn.02:46:56WhatsApp, all of those are applications because we know that always the the the kind of traffic that is gonna be sended over the network is gonna be with a pattern very defined, right? We have a per application protocol, it can be HTTP, imap SM SMTP SSL.02:47:11Client, what could be Firefox, skype, Brave, all of those, and the web application.02:47:31The, the, the, the destination, right? I loud, Amazon office, all of those almost work every time with the same port in the same way, right? So application visibility description.02:47:40We have this. It's a very, very powerful tool that is gonna show us this kind of, what does the users network are doing with the network, right? E.g., you have we have here what protocols you are using on this application? Well HTTPS.02:47:55HTTPS, or quick, right?02:48:15To send information for the connection and what application was running on the client's computer to generate this traffic, where on the web is this application gets the content, right? And you can see here the application is HTPS, what kind of application, we have a lot, we have over up 5000 or more.02:48:19Applications on our bdbs, right?02:48:39And then you can see it here on the top applications in what applications were was using were using by your users, Netflix, Webex, Twitter, Facebook, Amazon items, it's gonna be detected because all of these patterns and not all these protocols are already bundled on our in.02:48:43And the engine can detect exactly what is working on that computer and what is using the what what is the host that is using this kind of resource, right?02:49:02So that you can you can check it out on your overview dashboard and the summary is gonna show us all that. You just need to add it if you don't have it by default is always enabled. And then we have the app ID portal. This is very important. Why?02:49:13Provides details about each application that is on the firewall. This gonna be this application are summarizing all that we have and they can be added more how with the BDB operates, right?02:49:32The release note for each of the its own app ID Cisco.com and supported for the detectors. You can have e.g. an application internal application on your network and maybe the the firewall is detecting as a suspicious or malicious.02:49:48And you said NO it's well trusted traffic. Well, if you need, you can request a new detector, send the information over the app iD.cisco.com. They're gonna request info.02:50:06So they can add your application to the database, right? So it's looking like this, e.g., if we check the app detectors, and as you can see here, e.g., Facebook I I select Facebook. What is the detection type on this? Well, it's gonna work with TCP.02:50:22Right? The detail is Facebook and as you can see, you can check it out with the little icon there with the eye information. In this case is Instagram mobile photo sharing, the risk is medium, the type, well, on the, on the business is low or is not relevant.02:50:40And what are the tags that are associated to this application? Well, file sharing transfer media, Facebook encrypted visibility, all of that. As you can see there are buttons that you can investigate further for that kind of application. In this case it's Facebook, we don't need to search.02:50:58Deeper because all all of know what what it is. But something that you can do is just check that application deeper and see if it's an application that you don't know but your user are.02:51:14You to check it out, you can click there and see what is that kind of application, right? Okay, so, for snort, the access control rule best practice. We, we know how to pre filter.02:51:30Before to get there, now we are going to check the the core of, of the rules, the access control. 1st, we have which, which of these options are best practice for ordering rules?02:51:48Oh, guess here, and we are gonna see later how it's gonna be this.02:52:04Okay, we're almost done alright. Oops, sorry. Let's see.02:52:22Let's top priority rules. Yeah exactly. Exactly. All right. Perfect. Let's see why. Application inspection traffic flowing snork. This is gonna it's gonna work, right? FTD passing through filter, we saw it before PBR well.02:52:42That is for policy based route and letter then allow.02:53:01All of this that we know what it is at a an application now and that is how it's gonna be the flow. How it's gonna be is not using this well 1st with the five top of rules rules can be determined with the 1st packet.02:53:05You know the five double are your rules exactly the same with the 1st packet IPS most is gonna be covered with one packet, but sometimes we have to let it pass like two or three, and the application this could take longer to inspect.02:53:21For better IPS evaluation, combined rule two and three in the same order, same with the applications and four as you can see and combine it with an IPS rule. Inspection will be dig deeper dig deeper, sorry.02:53:40So, what are we gonna do well go to your rule, select applications and then you can add every application that you need to allow it or deny it. As you can see here is Facebook and there is the app ID button that we saw before. If you click there.02:53:57You are gonna display everything that is gonna be used by that kind of traffic on the firewall. As you can see the default port that is gonna be used are AD and 443 that are HTTP and HTTPS GDP as well, and you can check that all the tags that are involved on this.02:54:17The risk that application ID gave it, in this case is high, and all of the category that it has gaming, social networking some messaging, multimedia, you can check it out here. Every application that passes to the firewall can be inspected like this. Latency improvements, what is latency? What are the potential issues?02:54:33Well latency is everyone though, right? It's very slow on their network. Everything is slow on the web pages, Nothing is loading as normal, but that could be latency. Potential issues. Well, there are traffic drops on the external underperforming traffic to the elephant flows, elephant flows are when.02:54:53Are an amount of traffic that this it's a connection that has a lot of traffic.02:55:13A large traffic passing to the firewall, issues with windows size and qms and let's see how to better identify those issues, right? How to detect latency? Well, isolate flows with latency.02:55:19What is the issue? In this computer we have latency and and another computer doesn't or maybe the financial network is good but the human resources is low. Let's isolate the flows.02:55:37Right, review connections, events from the source IP, what is the IP source that is having this latency? Let's identify maybe the the problem is just with one application, not with all the network and tracing the common traffic, right? Find the common patterns.02:55:52For this we can do the packet capture, you know how to do it now on the, on the side on the commands, but if you don't want to do it like that, you can use the the graphical interface using the same parameters and that's it. We are gonna save it, test and it's gonna give us the results.02:56:11The same as we saw before. Phase 5678. And as you can see, this is a nanoseconds. How how how long took this phase to to on the last time to get this phase? Nanoseconds, really quick.02:56:28How to detect latency. This is really easy, do you know detect the detect the, the interfaces involved, you know how to do it now? In this case, the 1st thing that we can check is here.02:56:47Device generated and on the inside coming traffic and the outside coming traffic you can see are the same. So we are ok there. We are not dropping packets, we are not black holding nothing. It seems to be ok. And this is the way that I do.02:57:05And the engineers and that is gonna do it to apply this. Look, we have here our 1st packet, as you can see this is an echo request and on the on the right and the left side, we have this number, this large number 656 numbers on that.02:57:24What is gonna do this? Those are this time the time stamps. As you can see, the 1st three numbers are not interested to us, but the three at the at the last are white. This is microseconds.02:57:43And if we change the 1st three numbers, that is for sure that there is latency, for sure. But if the only numbers that groups are the last three, the latency is not a problem.02:58:00In this case, you can see it there is a problem because we have 243 and then 244. That is a lot of time wasted on the firewall. So something is happening because it takes a lot of time. As you can see, if we put the the same capture but on the other interface.02:58:15In this case cap out, you can see there, 243761. And on the top we have 243258. So the time that passes through from the one interface to another.02:58:35Was really quick, not even a micro second because it didn't change on on the on the numbers, right? So then we got the the next packet and you can see it there, 244.02:58:53And there on the on the bottom 244 but the only numbers that it changed are the last three on the firewall. So the firewall is not doing latency at all. The the the firewall is doing the the well job because the time that passes through one interface to another, it doesn't take.02:59:07Not even a microsecond.02:59:27It's really quick. It's handled this kind of traffic on nanoseconds. So maybe the latency is in somewhere else and somewhere somewhere else but not up here elephant flow detection and remediation. Well, this is really quick if AFDR.02:59:30It's gonna bypass proto elephant pros.02:59:50Traffic. What is gonna do? The firewall is gonna detect, ok, this traffic is a backup, e.g., and you want to be inspected. All right. If the, if the if this is if the pre filter rule doesn't work with that elephant flow.02:59:54What we are gonna do is once we got it and we check that this is gonna be an elephant flow, it's just gonna take some packets for detection, but for all of all of the traffic is gonna be throttled and it's gonna be exempt on the firewall. So we are going to just take samples of the traffic, but we are not going to inspect it.03:00:12The packet.03:00:32And that is gonna work for these kind of flows. You just need to enable it directly on your on your rule and that's it on your, on your firewall. Applications, we suggest not to decrypt the the ones that we already know, right? Though the one that you.03:00:32Has NO risk. Those are the ones that we are not going to decrypt, right? What are the best practice to face an interferent outage? Well, do you just know that check hardware issues, test connections, take captures, take packet tracer.03:00:53Have syslogs and error and do not reboot the device if you don't didn't extract all the troubleshooting files, right? Everybody's needed, take it before. Okay wrapping up for the best practice.03:01:10You know how to do rule performance, the full performance over the packets with the elephant flow, the app ID performance, you can know what are the application that you must evaluate or the ones that you can prefilter or you sorry pre filter just.03:01:26Do it and allow.03:01:46I stop inspect traffic you can trust. The rule order, as you know, the general ones must be on the bottom, the more specific ones must be on the top, always. That is the way to do it. If you have more blocks than allows, then those blocks must be on the top, but.03:01:49Remember always that if you're gonna block like here is a block, but then we have three allows and then we have a block that is not a way that we shouldn't do it.03:02:09Okay, and well that's it for for today's session. I hope you enjoyed this and I think the recording is gonna be available and I think we can send this presentation to all of you. Thank you so much for your time.03:02:19Thank you, Heather for a great presentation. Yes, the recording will be posted in the Cisco community. We have been sharing the link in the, in the chat, so it will be available in a couple of days, but.03:02:36Yeah, definitely we can you will be able to revisit all the great information that has been shared today. So, we will, just to wrap up this event.03:02:51Just wanted to share some information so just a couple of things. 1st off.03:03:07If you have additional questions and you would like to submit them, we will have an ask me anything event that will be running from today until March 18 in the Cisco community site. So the same site where you can access the recording.03:03:22In that side you will be able to participate in this discussion. If you can also scan the QR code that we are showing here, so in that way you can access the recording and join the ask me anything session. Also, if you would like to enhance your knowledge in.03:03:40Security topics. We are also sharing few QR codes, one in Spanish and one in English related to cyber capsules. Cyber capsules are bite sized videos with different topics of.03:04:00Best practices how to configure certain features in secure firewall, so feel free to scan these QR codes depending on the preferred language so you can get additional insight. And finally, you will be receiving a short survey after the session closes.03:04:16We value your feedback and comments, it will not take more than 2 min, so we appreciate your feedback. And with that, we would like to thank our presenters panelists for a great session, and we would like to thank all of you for attending today's experts and series. Have a great day.03:04:35
About this Video
Author : Cisco Customer Success
Uploaded : March 09, 2026
AI summary
Explore how Cisco Secure Firewall evolves to a Cisco Hybrid Mesh Firewall and see what is new in release 10.0. The recording demonstrates simple, guided ways to manage at scale with Cisco Security Cloud Control, or on-premises Cisco Firewall Management Center, and shows how to increase efficacy with Encrypted Visibility Engine and Snort Machine Learning. It also walks through REST API fundamentals, API Explorer, and Postman examples to create and deploy Access Control Policies, plus proven troubleshooting and performance tuning techniques, including policy optimization, prefilter fastpath, captures, and CPU profiling.
- Enable and tune Encrypted Visibility Engine and Snort Machine Learning to block zero day threats without full decryption.
- Deploy cloud or hybrid management, onboard devices, and adopt Policy Analyzer, AI guidance, and fallback CLI for operations.
- Use REST APIs to automate objects and policies, then troubleshoot with captures, packet tracer, and rule ordering best practices.
Internal error
No related resources available.