South Cisco IQ Office Hours - October

So thank you everyone for joining today's Cisco IT office hour session. My name is.00:10And I am here with I know Fernando colleagues from the professional services organization. In the next 30 to 45 min, we are going to walk you through the new Cisco IQ features and then we will leave a space for questions and answer.00:17This is.00:37So yes, quick welcome message discussing about what is Cisco Q We'll talk about what is new, what was released this summer. In this session, we are going to do demos, so you're going to see live demos and as I mentioned, we will end up.00:40With questions and answers. Now, in order to calibrate the presentation, who would like to know how many of you have created already a Cisco IQ account? You should see a Slido.01:00On the right side of your Webex and if you do not see it, you can open it directly on the mobile phone. So I see the questions. If you can answer.01:14So you know, maybe you can comment on the results that you see? And I see 5050. Half of the people have already set the account half still not.01:31Okay, so thank you for your answers, so this help us a bit calibrate the session. Now, during this session, if you have questions, you can use the chat window within Webex.01:49We are going to have also this Q and A slot at the end of the presentation and any time after this meeting, if you have other questions, you can use the email, ask me about the Cisco queue which you can see there on the bottom of the screen, address your questions and we have a team of people that are going to.02:10Be answering them. Now, without the further delay, let's talk about Cisco EQ. If I need to define Cisco EQ in a single sentence, I will say that it is the AI power.02:31Digital experience for the Cisco support and Cisco professional services, it is spanning the entire life cycle, including assets, assessments, troubleshooting, insights, and guidance all aggregated in a single platform. How does Cisco.02:43Work and Cisco EQ, we have consolidating the knowledge, the documentation that Cisco has been publishing in the last years. It includes P certs, troubleshooting guide optimization guides, best practices guides, security.03:03Advisory so all the information that we have about our Cisco products we have consolidated it in the Cisco EQ platform and at the same time, we are going to be collecting telemetry from your network devices, and this is about configurations, show commands, show versions.03:23As well as we have details about the support contract. Cisco is going to be correlating all this data. It will correlate and it's going to generate insights about the assets in your infrastructure. It's going to deliver infrastructure assessments and we are going to see the.03:43Demos during this session is going to help you on troubleshooting as well as the learning. The benefits benefits are clear. You get a very broad view of your IT landscape. It's going to help prevent the outages and disruptions and.04:03In the case that this occurred is going to help you re resolve them faster and with less effort than than before. So if we look now into details of what are the specific capabilities when we are doing all these data correlation, what.04:21Can it provide to you? In July this summer we launched a few new capabilities on Cisco IQ. We have the resilient infrastructure playbook, ok? Cisco AQ is mapping.04:40The attack surface and that means that it's going to tell you which security advisories are affecting the devices in your infrastructure. It is also providing remediation guidance and that means that.04:56When we are disclosing the details on a security vulnerability, Cisco is going to tell you what are the commands you need to enter in the CLI of the devices to resolve this issue. It's going to identify legacy assets. Those ones which have already passed.05:12The last day of support.05:32Meaning that the Cisco is not releasing new software versions for them. It is also going to help you prioritize actions based on the criticality of that device within your network infrastructure. We are going to see some of these features in the demo. I know I will be presenting this.05:34Very soon. Next one it is the quantum readiness assessment and it is about providing this automated compressive analysis of your environment and determine how ready it is for the quantum era.05:54Getting safe for this harvest to now decrypt the later type of threats risks that Quantum will bring, we're going to discuss how Cisco is helping us on that. We are going to talk about the certificate expiration. It is also a new of the feature.06:11That was released in July.06:31Many of us have experienced a certificate going expiring in a device and and has not been able to to renew it anticipating to this exploration and and creating an outage. So we are going to see how Cisco security is helping on on previous.06:34Thinking the, these outages.06:53We will talk about software conformance answering the question of are the software versions running on my network aligned to the recommendations of the Cisco business entity or business unit? So that is also one of the new capabilities and PR benchmarking. Sometimes it's good to know, ok.06:55So how many devices are elders or not, but comparing with other customers in the industry is going to to help me understand if I am doing well enough or not. So peer benchmarking it is also one of the new features you are going to see that life.07:15I want to talk about the telemetry before going further. Earlier, I was talking about how Cisco, it is correlating the data collected from your network with all the knowledge we have about Cisco products. Now, that's where the telemetry.07:34Conversation becomes relevant. Cisco AQ without the telemetry will know.07:54About your services contracts and it will give you details about the device inventory for those devices which are under contract. The hardware last day of support which is associated to the support contracts. It will also help you use Cisco EQ to manage cases. Now.08:00So in order to start getting the real benefits from IQ, we need telemetry. Once we have telemetry.08:20Then we can look into the software last day of support. We are going to look into the security vulnerability mapping to your infrastructure. We need to compare your config, your software version with the details of that advisory. We are going to look into security hardening recommendation field notice.08:27This is software conformance, so the capability that I have been introducing that have been announced in July.08:47If they rely on the telemetry, and the question is how do I enable telemetry? So telemetry today when you are in the mode of Cisco AQ so you are using the the cloud version.08:56You're going to be installing Cisco IQ link on prem is going to be collecting the data and sending this data to the, to, to, to the cloud and all the processing of the data, all the analysis, all the insights they are processed in the cloud itself. In the very.09:11Right side we have an air gap most so there are.09:31Domains, there are customers where, and maybe it is your case where you cannot connect this collector to the cloud. You need to run everything on prem. And in that case there is the Cisco IQ virtual appliance.09:36Where you can run it on an air gap environment without connecting to the cloud. And in the roadmap, we have the which is going to be released soon where all the processing of the data will be done on prem, but all the, the, the details about the vulnerability.09:51And so on, they are going to be downloaded in a unidirectional way from the cloud to your local appliance. In all the cases, either the Cisco IQ link or the Cisco IQ virtual appliance is the one that will be.10:11Collecting this telemetry from your network controllers or your standalone devices in the network. Now, following this introduction, let's start to look into the specific use cases and and capabilities and the 1st one it is about advisories.10:27We know about the frontier AI models, the fact that the time for attackers to weaponize new security vulnerabilities, it is dropping from months to hours and the fact that.10:46Many of these attacks, they are landing on end of support equipment. If we look into the disclosure model that Cisco started or implementing back in July.11:00Yes since July, we have been releasing 67 security advisories. There are 14 hardening releases and there are five actively exploited vulnerabilities and the heaviest of this since July was on 16 September, so the 1st question that most.11:15Most of you are going to ask yourself is.11:35Are these security vulnerabilities affecting my infrastructure? To which extent I am exposed to them, do I need to, to upgrade to these hardening releases? So as part of the resilient infrastructure playbook capabilities, Cisco.11:38Thank you.11:58It's going to collect through the telemetry, your software versions, your configurations is going to do the analysis comparing them against all these hardening releases LDOS security advisories that we have been releasing in the last two, three months as well as the previous one and it will give you.11:59So a clear idea of what your LDOS devices are, what are your devices affected by security vulnerabilities and is going to also give you the view of LDOS devices with security vulnerabilities which are the highest risk, and they are the highest risk because we are not.12:19Releasing fixes for them. It's also going to help you compare with your peers and this will trigger questions such as I have elder devices with non vulnerability, so which devices should I prioritize?12:40In the refresh plan. In the security insights case and that goes beyond LDOS, so security vulnerabilities will affect LDOS devices but also devices which are not LDOS. You're going to be able to get these insights and and and also.12:56To compare against your peers and this will trigger questions like why are my peers?13:16Let's expose than I am and what roadmap do I need to take to my leadership to be safe, to step away from this danger zone that I might have when my devices are exposed to, to vulnerabilities. So I know maybe you can run.13:23Demo of of how do we see these vulnerabilities in Cisco IQ itself. Okay, so you should be able to see my screen now. This is the main IQ page, so from here as Asia was commenting we are going just to firstly check.13:44The end of life part. So as Asir was commenting there are several information that can be checked only with adding service contract, which is the end of life. Eh, and here what we can see is which is the status of the devices we have in portal. So how can we select how to.14:03Prioritize which devices to refresh 1st. Here directly in insight we can find a full analysis where, where the portal is going to generate a full report explaining eh which is the status of the assets you have.14:23Eh under contracts on the portal. So here we will be able to see which milestone eh, is the one that is meeting each one of the devices. So here we will see that there's a seven and seven.three percent in enough service.14:39Eh how many are at the last day of support, how many do we have the telemetry and which is the overall status regarding last day of support. So here we will be able to see that there's a 1396 devices out of support, which should be the ones we should prioritize on the refresh.14:56So in order to go deeper, we will be also able to filter.15:16Regarding the last day of support milestone, e.g., which devices will be coming on last day of support eh which are already, which is a past milestone or which which ones will come in the next twelve months in the next 24 or in the next 36? So if we are checking for the past ones.15:20We will have here with the filter the full devices we already have in last day of support. And from here, as I see here was commenting, we can also check the full report as we were doing on the previous one, but we are also able to see which one of them are having this one, e.g., doesn't, but we.15:40Which one of them are having advisories also?16:00In place. So those one would be regarding only the last day of support part, which for this one we do not need telemetry, but then if we want to check the security advisory part in these ones, we need to have telemetry. So how does the security advisory part work?16:04Having the notification work we are doing, we will be able to see here before the advanced notifications of those advisories that are going to be published. So here e.g. we can see that tomorrow 21st we will find a new publication and if we click here, we will be able to see the notice.16:23Announcement.16:44Where we are going to be able to determine which are the, which are the the products that are going to appear on those on on that publication that will come tomorrow. So eh for those that we already have published, if we check here, we can find here the ones that have been that has been published.16:44In the last days. So if we put if we e.g. check in this one, this one is a vulnerability, an advisory checking.17:04The IOSXC software with SNMP denial of of service vulnerability. So saying here, here we are able to check which is the security advisory that was published and which are the affected products and which is the configuration we need to determine to check whether the device is affected or not. So how does Cisco IQ trust.17:14Like this. What is checking is regarding the telemetry via SSH and SNMP, we are able to take the configuration and the releases that is on each of the devices and we are able to determine.17:34If that device is affected is potentially affected of E or or if the device is clear. So, eh, in this case, e.g., we are checking a vulnerability in the SNMP protocol. So here we should have a concrete version, a concrete software, and also a concrete configuration as we will.17:48By checking in the in the other tab. So e.g., if we are if we are selecting one of the devices which is affective, we are able to see that this device is matching off somewhere on software type.18:08Also in software released and also we can see that it is having the the selected line on place. So we can directly determine that this device is affective. Checking this if we go to the advisory, we can see which is the version that is solving the issue.18:19And we can establish our strategy to to parts or to or to secure the device. As we were doing in the other ones, if we check e.g. for a potentially affected one, the point here is that we don't have enough enough information to determine.18:38Maybe if it is affected or not, we only see the software type. This is because full telemetry is not enabled. So it's quite important to have a telemetry enabled to have a faster.18:58A faster report and a, and a faster view of how is our our asset. So here if we are checking the full advisory, we are able to export all the, all the devices affected and we are able to know how many of the devices we do have.19:12Eh we need to work on. So here we are, we can see which is the idea of the product and we we are able to check and and determine how to upgrade them so that we are ok. Eh, apart from, from, from this if.19:30To Continue with the what's saying, eh, we are also able.19:50To check if we if our infrastructure is ready for the quantum meter. So here the question would be eh, which platforms do I need to refresh in order to be quantum safe? So we can also check this using.19:58The portal.20:17So, if we select the quantum readiness part here we are able to to see which are the quantum rules that are being checked. So if we go directly to the full analysis part, we will also have a full analysis on the rules that appear below that we can export to get the full information on how.20:18Our, our platform is, but if we go checking e.g. one of the rules, the SSH one, we are, we can see how are our assets regarding that one. So e.g. in this one we can see that this device cannot pass the quantum safe status and this is because the hardware needs to be referred.20:38So if we check internally, we can find the details on the evidences. So we see that it is matching the following, eh, the following points like software product ID, proof family and so on. And then we are able to see why that rule is not is not working.20:58So as I said before, this is having the telemetry on point is a key, a key part. So continue with the capabilities Asira was saying, we also have the certificate expiration. As he was commenting before, eh there.21:15Sometimes a network falls because a certificate has expired and then troubleshooting has to be done afterwards. So here the point is eh, how can do a renew, how can we do a renewal of the certificate?21:36Before having a production issue due to the expiration. So same happens here. If we go checking in the portal we have in the certificate part eh a check on how are our certificates. As in the previous one we can directly from the insights in full analysis.21:52Eh the data report where we can export which is our regular status.22:12But then we can go deeply on each of them. So here we have the the certificate expiration times. So e.g., if we go for the expired ones, we are able to see which devices have already the certificate expired.22:17And when was this expiration date? So we can here create a strategy on checking certificates that will expire in the next month and go doing this cleaning job, eh, on previous basis so that there's NO affectance on on the network.22:34Okay.22:54And then last but not least is the software conformance part. So ok we've been checking which is the pre the hardware last day of support we are doing on prioritizing, but regarding the software health, how should I prioritize.22:56The upgrades. So here the the working way is pretty similar. In this case, instead of having.23:16Eh, the hardware part we are finding a software life cycle. So we can check it in in two parts. 1st parts would be how healthy our software is. So here we can find the full software life cycle. This is working same way as hardware.23:24Where life cycle does. We see here which are the milestones we are covering on each of the devices.23:43So we will see how many of our software have already last day of support announcement. This means that the software is NO longer going to be supported but here there are also some critical points to check before. Here we will find the, the end of patching on those software versions.23:50And also the last day of new releases. So here, apart from the vulnerability part which is.24:10Eh the software we are going to set as compliance, let's say, we need to check also that we are covered regarding software. So, if we, if we check here, e.g., there are 3000 devices that are already on last day of support. So these ones.24:19Eh, don't have coverage itself, but if we go to the assessment part to the software conformance one, we can check which is the recommended one, but also regarding vulnerability. So e.g..24:39We can find here these devices in this version which is not in end of life, but the version is not conformant because we already have new software versions that are fixing vulnerabilities. So the point here is to have both merged. So versions should be in out of.24:54Eh last day of support milestones.25:14But also in a, in a suggested version where those versions that are in in place are also vulnerability free. So as we were checking in the previous ones, we can create reports regarding each one of the families. E.g., this one is for the catalyst digital.25:16Building 30 years switches.25:36So here the suggested release would be this one and we can check how many of our devices are compliant, so once we go upgrading those devices, we will find with the telemetry that those versions are merged, so here will appear the new version and devices will result conformant.25:38And now we can go check in also those report and create an upgraded strategy using those those insights that we can see here where we will find which are the families that need to be prioritized because we have them on last day of support or because they.25:58The versions we already have are not conformant ones, so should be those ones to prioritize like e.g. ones that are having critical gaps and we will be able to determine which ones are those ones in a fast mode.26:17So I think regarding demos, this should be everything if you wanna go with the question and answers, maybe, yeah, let let's see from the people in the audience. If you have any questions, maybe you can raise your hand and we will unmute.26:39You or you write it in the chat and we will answer. So we give you time to think about questions.26:59So NO questions live. We have included a list of what are the typical questions that we have been receiving from from other customers, so maybe we can go one more slide. I know.27:18Yeah. Yes. There is a document with all the Cisco IQ frequently asked the questions and what you're going to see on the next slide.27:35It is just a summary of them. We thought about, hey, we can put the URL in the chat. Maybe that was the the fastest way but we said go to Google and search for Cisco IQ frequently ask the questions and also within Cisco queue we can check those ones or it's.27:511st. Yes, so if you have already used Cisco IQ account, go from the portal.28:11And you will open the IQ as well as the links to to documentation. Now, what are these typical questions? If we move one slide forward, they're asking us about what is Cisco EQ link, which I think it should be.28:18Already clear to everyone in this meeting. So this is our on prem collector which is doing device inventory but also collecting telemetry. And when we say collecting telemetry.28:37We are referring to collecting configurations to collecting show running, show interface other show commands which are relevant to the different assessments, right? So if you think about the quantum readiness assessment versus.28:52The security advisory exposure or mapping assessment we need different type of information so we are going to be collecting all of that. It collects information directly from network devices using the CLI or through.29:10Catalyst the center and it also integrates with functionality for troubleshooting. And the next question that customer have been asking is hey how many devices can I connect?29:30To, to a single IQ link and how many AQ links I, I can have per account and it is very scalable. So one single IQ link virtual machine.29:47Can collect telemetry from up to 50000 devices and a Cisco IQ instance, it can aggregate multiple Cisco IQ links. So that is.30:02Going to be, you know, enough for, for most organizations. We have cases that customers implementing multiple IQ links and it is often because they have different environments and which are isolated and they they need one collector per environment.30:20Does AQ link require a GPU?30:40No, the Cisco IQ link, when we are in SAS modes so we use the cloud flavor for, for processing data is only going to do data collection. There is the Cisco IQ virtual appliance for the air gap mode.30:44That I mentioned before and in that case.31:04You can choose to have the IQ virtual appliance with a GPU and then you are going to have the AA capabilities running on prem, air gap, isolated from the internet or you can also choose.31:07To run it with CPUs only and in that case, you are going to have limited capabilities. E.g., all the document report generation feature which are LLM based that I know I was presenting, those ones run.31:24On LLM, so either you run the version and you run this in the cloud or if you are undergap mode you you want to have GPUs. Now, if you just need the basic reports, those ones will run with a CPU on air gap mode.31:41Can I use CX Cloud legacy collector like CSPC CX agent? Yes. Temporarily. The recommendation is to go to the Cisco IQ link. That is the future all the the new capabilities eh.32:02And the roadmap are pointing to IQ Link as the collector. So the moment you have the opportunity to move from a legacy collector to Cisco IQ link recommendation is to do it.32:21About data, where does the data reside? If you are using air gap, it resides at your premises. If you are using the cloud version, you can choose between letting your, your data storage in US, in Frankfurt or in Sydney.32:35So for the people in this audience, it's going to be mainly Frankfurt, I believe.32:54I have to say and I think that is the the next question. So does using AI assistant move my data out of the region? For the EMEA Frankfurt data center, there is a subset of the data which are specifically CLI data.33:03That the LLM needs and these llmiss at the moment they are running on the US region for inferencing, so when, when we have llmiss and and and and you know we we want to use AS capabilities.33:22Some data anonymized is going to go to that US data center. And the last question on this typical Q and A, it is about cadence. So do I collect data every minute, every hour, every day? So the answer is that you can configure this from the IQ link.33:37UI and is going to be set to daily, so every 24 h weekly or monthly. I will recommend daily with the pace of vulnerabilities that we are announcing, it is good.33:58To stay up to date and to run that correlation of the very last configuration with our security advisory details on a daily basis, maybe weekly, I would not recommend mostly unless you have a very static network.34:16So with this we are covering this typical Q and A So again, we ask you if you have any further questions, you can use the chat. You can raise your hand now.34:35If there are NO further questions, we are going to close the webinar and, you know, wait for you on the next one we run in a few weeks so I don't see anyone.34:50I'm raising their hands. I don't see questions in the chat.35:10In this case, yes, thank you everyone for your assistance, for your time. I hope you you you enjoy learning about these new Cisco EQ capabilities and again thanks again and looking forward to seeing you on, on the next session.35:14