Umbrella DNS: Evolution to Secure Access

Oh. Team, thank you very much for tuning in today. We we hope that you will enjoy this session and without further ado, let's kick into it. We have allowed our.00:00Attendees a few minutes to move between meetings.00:20Even though we're not physically moving these days, but the agenda that we've got for you today is, is predominantly for our, our traditional Cisco umbrella customers are we muted now. In particular, our DNS.00:24Customers, we invited to this session today and.00:44What we're going to be discussing is how Umbrella has evolved to a new product called secure access because all of our customers, it doesn't matter whether you're using umbrella or DNS whether you're using umbrella or secure access, we're gonna share with you some of the.00:48The latest innovations that we've brought to market inside of both products because behind both of these is the same DNS and Danny's got some important updates to share with us.01:08Neeraj will speak to us about the DNS two secure access migration. So what does that look like commercially? What are some of the packaging that, that is available? What are some of the features? Why would you wanna do this? And then we'll, we'll run through a quick demo of what that experience looks like for you guys. And then from there I'll share.01:23There's some post sale updates post sales.01:42Support and onboarding updates. And if you stick it out to the end and you fill out our survey, we do have some swag that we'd love to send your way. We're not promising everyone will get a swag package. It just really depends on on how many people and, and, and who fills out the survey, so we encourage you.01:46Stay till the end. If you've got any questions for us, if you could hit us up in the Q and A panel, if you look inside of Webex, it'll be like a spot at the bottom of your control panel where you can hit on the three dots and you'll see the Q and A panel. Use that panel for us. It just helps us.02:06Keep track of what it is and who's answering those questions for you and respond to you if we don't nail it. But without further ado I'll I'll kick off the 1st part of, well the 1st slide that I'm gonna hand to Neeraj, but basically I've, you know, I've covered that off. We had it today to speak about our Cisco.02:24Our Cisco umbrella product and how that's evolving to this new product that we call secure access. The the customers or all of our umbrella customers and sec and secure access customers make use of DNS, and we're the number one when it comes to DNS. So we want to share some of those.02:43Innovations that make us the 1st in the market, and.03:03And share with you some optional upgrades. You know, we've commercially put some things together on how you can migrate from not only not only not only commercially, but also the the supporting tools so we can streamline that experience so that you're not paying for two at the same time, that you can take the work.03:09That you've put into the one system and easily ported into the new system.03:28And another thing that's worthwhile mentioning is umbrella's not going away, like there's NO end of life, there's NO forced, this is something that you are going to want to choose to do on your own. But with that said, what I'll do is hand over to Neeraj.03:34That can speak about a little bit about the history of, of how we got to this point. So Neeraj, over to you. Yeah. Thank you Jay. Alright, so what we are seeing here is you know cisco's evolution.03:52From a point capability into a true cloud security platform. And that evolution has not happened by chance. It was driven through acquisition, innovation, and deep integration. So this timeline shows the journey very clearly. We started with the DNS resolution and over the time.04:10We have expanded into a much broader vision which is secure access service edge or sassy where you know security and networking functions come together in the cloud. So speaking of the timelines.04:30We have open DNS that began in 2006 as a recursive DNS service. In 2009 it moved into the enterprise space and then in 2012 umbrella was introduced, you know, bringing in the DNS layer security into the cloud and giving customers a simple.04:43Scalable way to stop threats very early stage. So with the acquisition of open DNS in 2015, Cisco has accelerated that momentum by adding even more security capabilities into an already high performance cloud native foundation technology.05:03So then in 2017, Cisco introduced secure internet gateway or SIG, bringing in multiple cloud delivered security services together into a single integrated platform. And as the customer needs have evolved with the direct internet access or SAS adoption or hybrid work and as.05:22The WAN, Cisco has expanded far beyond, you know, the DNS capabilities and evolved into a secure web gateway, CASB, firewall as a service, zero trust access, and much more functionalities. And that brings us to secure access that we see today, right? That we experience today. So which is kind of a modern ss.05:42The platform that unifies production, that simplifies policies and moves customers closer to a true sassy by combining the strength of secure Cisco security with the power of Cisco networking.06:02Next one please. Alright, so at a high level, secure access is about delivering consistent secure connectivity from anything to anywhere, right? And that matters because the environment that we are securing today is NO longer fixed. Simple.06:15Or even office bound. So on the left hand side of this slide, you can see the reality of most organizations that we are dealing with. Users are everywhere. You know, we have devices that are mixed of managed and unmanaged devices, and we are also seeing a lot more IoT and non traditional endpoints devices that are connecting to the environment.06:35Then on the right hand side, the destination landscape also has changed.06:55It is NO longer just the internet access, you know, you have users that are connecting to SaaS applications, EI enabled apps, you know, traditional private applications, modern private applications, all with different risk profiles, you know, different access methods and different security expectations. So the challenge for IT and security.06:59The Teams is very clear. How do you create one security experience that is better for users, easier for IT folks, and safer for everyone, right? That is where the secure access comes in. Cisco secure access provides a cloud delivered security architecture which is grounded on zero trust, you know, designed to prod.07:19Check your users, devices as they are securely connect to the network, regardless of their location.07:39Regardless of the device type or app application destination, right? And that is why the phrase in the middle of the slide is so much important from anything to anywhere. And that is not just about, you know, remote access giving you remote access functionality. This is not just about any kind of VPN replacement, and it's not.07:45About, you know, web security.08:05It is about converting security controls into a more unified access approach so that organizations can support the way people actually work today, right? Wherever they are on remote, on campus, you know, mobile traveling in the field, operating across the regions, you know? So when we talk about modernization.08:07Here we are really talking about three outcomes, a better user experience, a simpler ID operations and stronger, more consistent protection across the access journey.08:27Next one please, right? So let's take a look at our secure access offerings, you know? So Cisco DNS defense is a strong starting point and that is our starting package for the customers who want better security.08:40Without adding unnecessary complexity. And the reason is simple. DNS is one of the earliest points where traffic can be inspected, which means threats can be identified and stopped early. But that is not just the basic DNS protection. Cisco extends that value with additional capabilities such as a DLP cloud.08:59Good malware scanning.09:19And also on top of that, customers are going to receive a hundred seat, you know, secure private access trial, giving them an easier way to begin exploring the additional functionalities that we provide in our added packages. Now, when the customers are ready to do more, when they think that you, they want to take a step further, Cisco gives them a clear.09:21Your path forward, you can expand into secure internet access SIA.09:41Which adds broader production mechanisms like secure web gateway, CASB, DLP, firewall as a service, you know, remote browser isolation et cetera. And if secure access to private applications is also a priority for the customers, then you can go for secure private access, which brings in ZDNA zero trust network access.09:46VPN as a service, application connectors, and many more functionalities. So.10:06It is important to note here is that SIA and SPA can also be purchased together allowing customers to unlock even greater value from the platform and building a more complete access strategy from day one, right? So the message here is very clear. You can start with the DNS defense, which is a quick value today and.10:12Into a full secure access portfolio as your need grows. So ultimately this is about moving from a point production to a unified access strategy, delivering stronger security, simpler operations, and a better user experience.10:32Thank you. Thanks Neeraj. I know we're gonna come back to you later in the in the discussion today, but that was an excellent update. At this point. Andy, I'm gonna hand it to you.10:48And take it away. Thanks Jay. Thanks Neeraj. Hey, guys, my name is Handy. I'm the technical customer success specialist in APJC. So I'm I'm gonna dial it back a little bit and focus on more on the DNS side because basically it's the the.11:02For of of umbrella and even in secure access as well for SIA, right? So all those feature of services.11:22They have underlying DNS protections as a, as a DNS layers. So let's let's go back to that a little bit and talked about more TNS innovations and and what and a few bit of updates on DNS where we at right now in terms of protecting Umbrella and secure access. Now.11:32On my, today I want to talk about about four points basically in terms of DNS protections. The 1st one is more on DNS timeline threat and domain generation algorithm. We combine those two with the AI driven capabilities that we're gonna have, and we're gonna talk about enhanced authentication method.11:52Thought about DNS forwarding that we have for Umbrella and secure access and also futual appliances for KVM. The 1st two points that I'm gonna talk about is actually it's not a new innovations. This innovations has actually already been exists about a year ago, but it's still relevant.12:12For us to showcase this innovations today because essentially that's the, the, the growing threats that we are experiencing in terms of in the in the DNS layer protections. Next slide please Jay.12:32Right, so let's talk about the 1st point. Talk about DNS tunneling. What, what is DNS tunneling basically? DNS tunning is basically a technique that views DNS protocols by breaking the data apart and coding it into DNS queries so that the.12:48It can be reassembled on the receiving end for command and control, data exfiltrations and covered communications. So in simple terms DNS tunneling basically is a threat that has been encoded to the DNS queries. Now, why is it a problem?13:06It's a problem because it's very difficult to detect because it can mimic legitimate traffic in DNS queries with encoded queries such as using APIs, UIDs, hashes, and it's also using a short lived domains which is making.13:23More difficult to detect and this also carries a high risk in enforcement. Why we say it's a high risk enforcement because if we set the enforcement to be aggressive, it can cause a false positive, meaning it can block legitimate use traffic, which we don't really want that.13:41If we set the enforcement to be not aggressive enough, it can cause a false negative, which is allowing the bad actors basically to succeed, right? And we also don't want that. Can you next slide please Jay. Yeah. Right, in these slides I'm trying to illustrate how the DNS tunneling thread.14:00Flow and how Cisco Umbrella and Cisco secure access can play a part in this and pro and provide the protections.14:20So let's start with the, the client. So we in in this example, we have a compromised client. The the client that's been compromised for some reason got a hold on under password, and it will hash the password, then the when you hash the password and encode it to a DNS query.14:29Which in this case we're gonna use evil.com at example. Now, when this compromise client make a DNS request to go back to evil.com, it will goes to the DNS and it goes to the DNS resolver.14:49The DNS is always trying to resolve and doing the DNS recursive, going to that, to that domain basically it will try to contact the root level, it gets try to contact the top level domain and then eventually it will goes to the delegated name server which is@evil.com.15:03Now, in these scenarios, if we don't have umbrella or secure access DNS protections, evil.com can receive this particular request, which is the malicious request. Then the the bad actors that in evil.15:19Dot com, you can reassemble the encoder DNS request and will get that information in this case is password. Now this is where Cisco Umbrella and Cisco securex DNS protection comes in.15:40If in this scenarios the DNS resolver is using our resolvers, this is where we can stop this to be happening. This is where we can detect the threat and we can stop stop the the request going to the, the designated evil.com and then we can we can we can basically just stop it from, from its happening.15:51Next slide. Here we go. Sorry, that doesn't work. Alright, so yep, let's go to the next slide again. Okay, so, but the question is, did an umbrella and DNS protection already has DNS tunneling protections?16:11Against DNS tunneling. The question, the answer is yes. Umbrella and protection actually already has this kind of protection against DNS tunneling. But we are using an old algorithm which is relies on hand curated heuristic and caching.16:29But the old algorithm now is becoming very outdated because the the threat landscape is evolving, means our security detections also need to evolve. So what we are doing now to, to, to, to keep up with, with the trend of the, the threat if you so about one year.16:48We have a joint project between Cisco Talos threat research team and also our DNS security product team that we are developing a new algorithm to and in leveraging AI to do this to to to detect and enforce the threat in real time.17:08So the new algorithm significantly at hands with AI, it will increase the accuracy in detection rates and it will not impact the performance of the the recursive DNS as well. The AI model that we are using, we're using AI convolutional neural network architectures.17:25What we call CNN architectures that being trained to identify.17:45String encoding associated with the data exfilitations techniques in DNS, e.g., like character embedding table, bottleneck functional architectures that can achieve an efficient and accurate technique to distinguish the the exhibitations.17:51And domain name labels to profile in DNS basically. And because of we are using this AI driven capabilities, now we the our DNS, we can detect the DNS tunneling in real time and still maintaining the performance which is less than 20 milliseconds which as a response time.18:07While also reducing false positives. Now, is it really a big deal on that? Is it competitively differentiated? Hell, yeah, I mean yes, absolutely, forget my excuse my language, because some of the competitors today, even today, some of them are still relying.18:25And very old technique like using log analysis to detect DNS timely. This old technique will still introduce a very at like times basically and it will, it will still impact the efficacy of the the detections.18:45So yeah, so by using AI driven, basically, put our DNS resolvers to be on the top of the list and then while maintaining the, the performance. Next slide, please. All right. So the the 3rd top or 2nd topic that I want to talk about is, domain generation algorithm.19:02Detections or or known as DGA. So again, what is, what is DGAI? DGA is basically the algorithms that used by malware to generate numerous and many new domains for command and control communication and for attack resili re resiliency.19:23Making them a critical threat factor in in DNS basically. So what are the challenges in in detecting DGA? Because it's generate numerous and new many new domains, it's the traditional report reputation, based systems today is struggling with the high volume.19:43Of the new domains that are evolving in the DGA.20:03And also DGA is using fast flux and relating IPs making this more harder to detect, and they also looks like a legitimate domains as well that that that masking and then also making hard to detect as well. This kind of method is used more and more commonly by the attackers.20:07As a technique in in the DNS threat.20:26So what are we doing to prevent this? Keep evolving threats in in DNS using the DTA algorithm? We, from one year ago, similarly like DNS tunneling threat, we are leveraging leveraging the same AI different driven.20:29Algorithms, which is again joint ventures with the, with Cisco Talos as well with our DNS team as well. We're using the same AI model the neural network architectures, and we enhance that model. We enhance that architectures to be also trained to identify.20:50Unique lexical characterisk characteristics that the DGA algorithm is using. Because of this enhancement in in AI driven and algorithm, it's resulting to 30 % increase in real detection for DGAI.21:09And also 50 % improvement in accuracy while maintaining the false positive and false negatives as well. Now, this enhanced detections basically is already available a year ago and it's.21:25Is built into our DNS protections for Umbrella and secure access as long as the category is enabled or or active basically. So there isn't any add on or any, any, any extra that you, the users need to to perform is actually already built into in our L.21:41To read them in our protection.22:01Next slide please Jay. Great. So the 3rd topic that I wanna talk about is well it's about enhanced authentication method that we are using for Umbrella and secure access virtual appliances and AD connector. Just to put more a bit of more.22:04Context to it to to to advise what is actually a future appliances.22:23And what is actually an AD connector. Virtual appliances basically is our lightweight agent that acting as a DNS profile folder. So user can install this virtual appliances in their environment and these agents will act as a DNS folder, so the user can just point to this.22:28Virtual appliances and the virtual appliances will intercept all the DNS requests from the user go back to to our cloud to perform productions.22:48Well, AD connector is our light based agents that fetching the the the user authentication or user or groups informations from the domain controller and send it to, to the cloud, to Umbrella and cloud so we can pro.22:58Perform a policy based on the user and and groups asset authentications. So those those are the what VA and anyconnector is. Now, starting I mean, by the end of May 29 to 2026, we are moving away from using our legacy old like.23:16The authentication method when doing registration of the VA and any connector, we're migrating to use enhanced authentication method. So the, the cutoff date is 29 May 2026. The failure failure to do so.23:36It will cost the future appliances and any connectors to stop syncing back to our cloud. When they stop syncing to our cloud, then it will impact basically the the way the VA and any connector behaves and it might stop the services.23:53Now what is legacy authentication method and enhanced authentication method that we are using? The legacy authentication method is that when user registered virtual appliances and ID connector to umbrella or secure access.24:10At the back end by default, we are, we're we're generating a static authentication token that based on the organization ID of that tenancy. And then we use that token as authentications when we are using device registration and also sync traffic back to the cloud.24:25The problem with this, the token is static and the token never changed. Now, because it's never changed, it's it basically is acceptable to a, to a threat, right? If there's a bad actors that get a hold of this token, then it can manipulate these particular communications.24:44Therefore is becoming a security concern. We're trying to get away from, from, from that. That's why we are migrating to our enhanced authentication method in terms of registering the the agents and also the regular sync back to the cloud.25:03The new enhanced authentication method we are using a double layers based on API. The API is gonna be a an API pairs between key admin API and also client API. The key admin API will be.25:19Enable or generate it by the users on their tenancy itself. And then once they already enabled that or generate that, it will automatically generate a client API key and secret from our end. And then we're gonna use that for device registration and also a traffic sync, basically.25:36And again, this client key and secret will be rotated by default every 90 days because of the security measure, but user can also initiate that rotations at their own convenience. They don't need to wait until for 90 days to rotated automatically.25:55Therefore we are more security focused that the key and secret will keep changing basically. Next slide please Jay. Now, how do we configure configure that? To configure that basically is just a two step process. The 1st step is.26:14The user will need to create a key admin API. I've already put the, the location on irrespective product with securex and umbrella. So basically the user need to create API keys on umbrella. That would be as a key admin.26:30And then it will generate a key admin APIs and key admin API keys and secret. The user will need to save that information, the keys and the secret because they need to use those information on 2nd step.26:49Yeah. Yep. So this second step is basically once you've got the information for the key admin key and also secret, the user will need to go to user and groups configurations and under API authentication for secure access.27:05Well umbrella, they need to go to sites and Active directory managed credentials page. So they need to put those key and also secret in in those respective configuration. When they hit submit, the system automatically will create a new client API key and.27:25Also client secret key.27:45The client API key and secret key basically automatically being used by the virtual appliances and any connector that is registered in that tenant. So it will automatically fetch that informations and then use that for device registration, sync traffic, regular sync traffic.27:48Get back to the cloud as well. But we always recommend to also save your client API key and secret in case you need it in the future. So basically that's, that's pretty much it in terms of configuring the enhanced authentication method. It's pretty simple process or steps.28:07But again, I just want to reiterate again for as awareness, user that's already registered or configuring their VA and any connector in their umbrella of secure access, they will need to move this, to migrate this to the new enhanced authentication method before May 29.28:25Because if after May 29, if they're still using the old legacy authentications, their traffic will get impacted basically and we don't want and we want to avoid any future unforeseen issues in their, in that services basically.28:43So just just for awareness, right. Thank you J next slide please. Now, this is my last topic for today because we are still talking about future appliances. I think it's a good segue to move to this to this slide. It's still under virtual appliances topic.29:00Now starting from February this year, 2026, we have a new KVM image for feature appliances that, that user can download from dashboard or that image file is a direct download for KVM environment.29:21The reason I said that because before February 2026, we only have a VMware ESXi and hyper V environment that that can install the VA, but user can, customer can still install the VA in their KVM environment as well before.29:40February 2026. However, to do that, the user will need to manually convert.30:00The OVA file to extensions that is KVM friendly. E.g., on the OVA file that you downloaded from VMware sxi, e.g., you need to to extract it and then get the, the virtual this file, the VM DK file.30:06And then convert it to Q cal two extension which is the KVM that's using using QM QM image e.g.. So now after February 2026 user.30:26You don't have to do that anymore. When you, when you download the VA for KVM, now you'll get an installation file which is straight away KVM friendly. Basically it's it's using qcal two format now that you can, a user can use to install the VA to the KVM environment.30:41When the user install it, the SSH access will be enabled automatically on this environment. So I've already put, few links as well in terms of how to configure virtual appliances in KVM respectively in the secure access and, and also umbrella.31:01That's pretty much it from my side, all. Thank you again for listening to me and yeah, let's move on to the next topic. I'm gonna move it to Neeraj again to talk about our.31:22DNS umbrella DNS to secure access migration tool. Thank you guys. Thank you, handy. Hi everyone, let's have a look into how do you, you know, migrate from Umbrella to the secure access, but before that we have a look into why into the real real.31:37Reason why you want to upgrade to secure access, right? So here's the real real reason to upgrade to secure access, you know? Customers get more security value without adding any kind of complexity or increasing cost.31:56Cisco positions, you know, secure access as the evolution of the umbrella DNS solution, you know, taking the strong foundation that we already had, you know, which the customers already trust and, you know, we are extending it with added capabilities like this has API DLP, cloud malware scanning and more unified policy frame.32:09Framework. Now, let's make that real. The 1st major value add is the SAS API DLP. The simplest way to explain this is that Cisco can protect the data that is already sitting inside the sanctioned cloud applications, and it does that through a cloud to cloud API.32:29Model, which means it can inspect and control data at rest without needing that traffic to pass through a secure web gateway 1st. That's powerful because it allows Cisco to continuously monitor connected cloud services for newly entered sensitive data and apply a policy in near to real time because.32:49Say.33:102nd major value add is the cloud malware scanning. So here Cisco, you know, scans the connected cloud cloud repositories for malicious files before those files can even spread to the users and points or other parts of the network environment. Once enabled.33:10But the files in the supported cloud services are automatically hashed and inspected and malicious files can be identified for different kinds of actions that you are provided like remediation, quarantine or even deletion, right? And this is not.33:30Only forward looking production. Cisco also supports retroactive scanning of existing files in the supported tenants so that customers can look back and identify threats that may already be sitting in the, in their cloud storage, right? So we support you know major sanctioned platforms including Microsoft three.33:472605, google Drive, Dropbox, Webex, Azure, AWS, you know, and more.34:06The 3rd value is operational simplicity that you are going to get with secure access. So secure access brings these capabilities together through a single cloud managed console with centralized policy creation and aggregated reporting. So instead of managing multiple point features separately and separate dashboards.34:14Customers get a far more unified experience. And finally, DNS defense also includes as I mentioned earlier, on NO cost trial for up to hundred seats of the secure private access giving our customers a practical path into a ZDNA and VPN as a service whenever they need to.34:34Next slide please. Alright, let's have a look into the secure access upgrade manager. Now while the customers plan for the upgrade, one of the biggest customers concerns is the complexity of the upgrade, right? And this is exactly where Cisco makes the upgrade really very simple.34:54I give you an upgrade manager that is directly available inside the umbrella dashboard so that the experience is going to feel familiar from day one. It is guided, you know, it's a structured approach and it clearly shows you what needs to, you know, what step you need to take next. The migration to secure access.35:13Is entirely optional and and it can happen based upon the customer's timeline whenever the customer wishes to, you know, migrate it. What makes this especially powerful is that the tool helps to carry forward any kind of policies that you have in the umbrella dashboard. It also converts your configurations into new rule based model.35:33And also allows the customers to modernize without unnecessary disruption.35:53So this is to me, this is not just a product enhancement. I would say it's a simplified upgrade experience that helps our customers unlock stronger protection, giving them better visibility and a smoother path into the broader secure access architecture. Now let's get into the details of the upgrade manager.35:58Next slide. Thank you. So 1st you will need to complete the prerequisites. This includes enabling your Cisco security cloud control signing, which means you will need to create an account on it. You know, 2nd prerequisite is that you need to upgrade your virtual appliances, and active directory connectors to the.36:19Latest versions and also you need to ensure that your Chromebooks or if you have any kind of mobile devices, Android, iOS are up to date when they are in use, you know? So.36:39If you do not have the mobile devices in scope, you can simply move on to the next step. Then, the next step is going to be, you know, starting the upgrade. So Cisco while you click on the upgrade, Cisco creates a new secure access defense org you know for you while the upgrade umbrella continues to operate in parallel.36:52This means the production stays in place throughout the process or throughout the upgrade process, I would say. So your umbrella DNS policies and components are copied into secure access as soon as the, you know, migration starts and the policy replication is typically completed in just a few minutes.37:11So the total upgrade time may depend upon how many policies are being migrated and how many policies have you set up on your umbrella dashboard?37:31And this is where the flexibility really kicks in or really matters, right? Your umbrella DNS and secure access DNS defense can run simultaneously so that customers can move on based on their own timeline. They can validate as they go and upgrade with confidence. The main best practice I would.37:41So here is very simple. Once the upgrade begins, avoid making any kind of changes until it is complete.38:01And after the move, make any kind of future policy upgrades only in the new secure access dashboard. So with that, I believe we can start with the demo for the migration. Excellent. Thanks, Neeraj.38:08I want to bring this up very quickly and what we've got guys is that it's a 6 min and 58 s demonstration from taking a look at the upgrade process from Cisco Umbrella DNS to Cisco Secure Access. There's three main steps that we're gonna be taking.38:23Number one, we're gonna create security cloud control and security sign on accounts. Number two, we're going to activate the upgrade manager in umbrella. And then finally, number three, we're gonna migrate our traffic from Umbrella to secure access.38:41And then we're gonna close the umbrella account. The only thing that you need other than admin access to your umbrella account is a claim code. This claim code will be emailed to you on the start date chosen for the subscription. And with that, let's jump in.38:57Here we are in the umbrella dashboard and we have an account with some identities configured and traffic going out from those identities to the internet. We can also see that we have some policies configured. These are kind of using AD groups as the identity source, so we'll be able to see not only how the AD information is migrated, but also how the policies are migrated.39:13As well. Now if we go under licensing, we can see that this account has a DNS advantage license for a hundred and five users. And at the top we have an option to request an invitation to start the upgrade process. And when we request it, we can see the invitation has been sent to our email.39:33Checking our inbox, there's a message with the info that we need to attach our secure access account to security cloud control. So let's go ahead and do that. I don't already have a security cloud tenant, so I'm going to speed things up while I create a new one. In addition to creating a security sign on account, security cloud control provides us.39:52Centralized control and AI driven insights across the Cisco security cloud. It gives us a central interface to manage and integrate all of our Cisco security products while Cisco security sign on provides seamless authentication across those products.40:11Now that we've created our account and activated MFA with Duo, we can access security cloud control and create our new organization. It's important to note that the name selected here will also be used for the secure access account, so choose a name appropriately.40:25Since secure access is a global platform, the region deployment won't be used for this migration, but it's still a good idea to select an appropriate region since this account can be used to deploy other Cisco security products as well. If we look under product subscriptions, we see our invitation to attach secure access. The instance ID will be a.40:42The same as our existing umbrella organization ID.41:02And once we finish, we can see there's a card for secure access in our product list. With the product attached, we can claim the subscription using our claim code. As a reminder, this claim code will be emailed to you on the start date chosen for the subscription. During this process, it's important to select attach existing instance. Choosing create new.41:05Instance will create a new secure access account that will need to be deactivated from the subscriptions page before you can apply the license to the correct account.41:25Once we claim the subscription, it can take a few minutes to fully activate, so now is a good time to grab a cup of coffee. After claiming the subscription, we can apply it to the secure access product instance, and now we're all set to migrate our umbrella configuration.41:34Back on the umbrella dashboard, I'm going to refresh the page and a pop up will appear with the option to take us to the upgrade manager in addition to a new link being available in the menu bar. We have three steps we need to take care of before starting the upgrade. The 1st one is to configure Umbrella to use security sign on for authentication.41:50Since this is what security cloud control and secure access use, we need to have Umbrella use it as well. If you already use a SAML IDP for umbrella dashboard authentication, you can configure security sign on to use that same IDP before completing this step.42:09For our account here, we're going to go ahead and choose configure SAML, and when the test configuration comes up, we can see that we're already logged into security cloud control and so we don't have to log in again. If we weren't already authenticated, we would just log in using our security cloud control credentials.42:26Back at the upgrade manager, the other two prerequisites are to upgrade some of our connectors and devices. Clicking start will walk you through that process, but since I know all of mine are already on the latest versions, I'm gonna mark them as done and click next. Now we're ready to start the upgrade process that will migrate our configuration to secure access.42:50Once clicking upgrade, it's important to stay on this page until the process has completed. Closing the page means the process will have to start again from the beginning. This step also applies the new license and needs to be completed before the existing umbrella subscription expires to prevent a service interruption.43:10With the upgrade complete, we can now open secure access and view our policy. Since secure access has a different policy structure than umbrella, there might be multiple rules per migrated policy, but the outcome of the policy engine will be the same. Here we can see that our AD group has been migrated and is listed as the source for the rule.43:26Digging in, we can see all of our users are visible in the secure access dashboard as well as our DNS forwarders, which is what secure access calls the virtual appliances. The important thing to note is that we've only migrated our configuration. All of our traffic is still being routed through umbrella.43:46We can verify this by opening activity search and selecting Cisco Secure Access as the point of enforcement. No traffic is found, but if we select umbrella, we can see all of our traffic. To migrate traffic, we'll return to the upgrade manager and click start on the redirect traffic step.44:04For now we'll redirect our HQ site to secure access. From here we can freely move individual identities to and from secure access so that we can migrate and test at whatever pace we need to. Now, let's generate some traffic. We're back in activity search and in addition.44:24To the HQ site, I also migrated our branch one router and then generated some traffic from both.44:44If we select secure access as our point of enforcement, we can see traffic using secure access in addition to our other identities that are still using umbrella. Once we've migrated all our traffic to secure access and our content, everything is working as expected. The last step is to close the umbrella.44:50Now on the upgrade manager, we have the option to complete upgrade and close umbrella. This is a one way action. Make sure you're comfortable with the upgrade, click close umbrella, and that's it. A start to finish look at upgrading from umbrella DNS to secure access.45:10That's pretty cool. Let me just stop that so we don't get this thing playing in the background and go back to our presentation. So, so as you can see, there's been a lot of innovation inside of, inside of Cisco when it relates to our cloud security platforms.45:29It's not only, you know, not only are we doing stuff with inside of DNS, but we also doing and that applies to both umbrella as well as secure access. With secure access there definitely is a value proposition in there. There's a whole bunch of additional features or a bunch of additional.45:49Capabilities rather that we've embedded inside of the base products and we've wrapped that in a commercial package, but also a bunch of.46:09Operational tools to be able to support our customers in migrating from one platform to the next. And beyond that, there is also a bunch of artifacts and support that we can provide our customers. As far as our.46:20Our customer success team goes, and that's the people that you see here on this call. We're a global org, so there's little people like us all around the globe, and what we've developed is a whole bunch of artifacts to help you along the way. Because often people don't, you know, hey J I can't.46:37Meet with you in a Sydney time zone, sitting in.46:57India and I needed I've got some time at 03:00 in the afternoon. So what we've got inside of this presentation is a hyperlink to a pre activation checklist, and what that helps us do is is get things done 1st time round, so NO delays, NO real.47:02Work from there there's instructions on how to create your security cloud accounts, how to claim your subscription, and then how to navigate.47:21The upgrade manager, also embedded inside of secure access itself is a walk me, tab and inside of that list you'll be able to see what that looks like, but that contains a bunch of really steps or guided resources, separate.47:31Which brings me to the next point we've not only got walk me inside of the product there to help you along if you're setting secure access up from scratch. We've also developed that into well we've taken that and put that in into our Cisco community into.47:51The guided resources and inside there, we've got a number of different guided resources for each of the use cases and really what they are are steps. They th that built into the product with that contains.48:10A bunch of links to program programming information. We've got links to videos in there so you can understand what that is frequently asked questions. So we equip you to be able to serve yourself as you go through this process.48:26And and beyond that, we also have the Cisco community. Here's a link to the Cisco community where we've got a whole bunch of other things like the upcoming live webinars. We've got a full schedule in there and with this particular presentation, what I've done is I've gone and extracted just the secure access.48:42User protection suite and umbrella webinars, so you can go and.49:02Click on that link and we'll show you everything that we've got out there. We've also got a full repository of previously recorded video content that includes some of the webinars that we've delivered. So if you wanna hear somebody from America talking in their accent, you can go to that one, which is which.49:09This is amazing. We also have this the the secure access resource repository which contains all of these the different use cases as well as a step through of each of the, the logical components, be that integrations, be that specific features. It.49:29We'll speak you through how to approach that and then take you to the appropriate links inside of the documentation. So as you can see we we are trying as best as we can not only support you live and in person in those one to one sessions that we support you with.49:49As our team, also inside of the webinars, but you know you can you can self serve if you like using some of these links and we'll share this presentation out with you. I think last but not least, just some notable online tools.50:07That that you should bookmark if you have umbrella or secure access. What I highlighted here is the secure access documentation because that's recently changed too, we're, we're basically.50:24Pulling all of our security products into a single repository called security docs. And what I've done is I've highlighted I've taken I've got security access in there. There's a separate one for umbrella, and it's embedded in there as well. You can take a look at the the service status, so see when if there is any planned.50:39Maintenance taking place or whether there's an an outage before you log those tech cases, it's it's worthwhile taking a look to see whether there might be an impact to something. Something else worth noting?50:59Is using the Cisco community once again because secure access is such a new product for us and there's such a such great emphasis from our business on this. We're seeing heaps of new capabilities being introduced all of the time.51:13And if you want to keep abreast of some of these things, like it's it's it's hard for us to communicate those out and I'm sure you don't want another email in your inbox. This is a great link to go and take a look at at at what comes out.51:32Because there's something in there every week. There's a link to the the web community, our Cisco community. If you need to open up a tech case, there's a link to do that. I'm sure you guys have have all experienced our world class tech organization before. We know the guys that support us in the region and that a great bunch of lads.51:47The escalations manager lives in this office, so we know these guys personally and we work with them too, and we're keen to support you to make sure that your problems are quickly dealt with. But last last but not least on this, I would encourage you to join our Webex community. We've got an umbrella and secure access web.52:07Webex community, even if you aren't a Webex customer, you can download the Webex app.52:27You can install the Webex app. If you click on that e URL, what that will do is add you to our Webex community and there inside of the community, we've got a whole bunch of Cisco folks, a whole bunch of partners, a whole bunch of customers. What's nice about that is you've got a community of literally thousand.52:32Of people to support you and you can then start subscribing to some of the other.52:52Communities out there, things like the secure clients, which undoubtedly if you've got secure access, you'll probably land up using that community too. The last thing that I'd like to share with you, as you can see, our.52:58Our team here is growing. We initially started rather slim on the ground and you know, this is, you know, this is what we've got planned coming up. We aim to deliver these webinars at a regular frequency. We wanna.53:14We wanna have you guys to keep you guys engaged. What we would like to do is, is maybe for the next one dump into jump into a session about what secure access is, what those components are, and then we'll do a deep dive into internet access.53:32Private access, the, the migration for our secure internet gateway umbrella customers is something that we have. So it's not only for DNS, that upgrade manager, we've got a similar one available for our SIG customers and we'll take you through what that looks like as well. And then from there we we.53:49We're spitballing a little bit earlier, absolutely zero trust network access. ZTNA is a hot topic for all of our customers along with a real focus from our BU, and we'd love to give you a deep dive into what that looks like along with remote access VPN. We'll jump into that. And you know what?54:09At the end of this, we'd we'd love to collect your feedback. If there are things that you would like to hear from us, if there's topics that you would like to discuss with us, we would, we, we want to bring you that information. We've heard you loud and clear. Jay bring us more demos.54:29We don't want to see we don't want to see presentations. We wanna see how to. We want to come off mute. We wanna talk to you, we want to engage. So we're hoping that in future sessions depending on how things go, we'll see whether we can maybe make these things a little bit longer.54:46But give you an opportunity to speak to us. I've seen what's going on inside of this webinar today. There's been heaps of interactions. We're grateful for you guys as, as our customers, as our partners. We want to work with you more closely. And that brings me to my final.55:01My final slide which is listen, if you stay to the end and fill out our survey, depending on, you know, how many people respond and and and take it up, there's a very good chance that if you fill out our survey.55:22We'll contact you with a bit of a swag package. But with that said, I want to thank our speakers, you bring with them many years of experience. You can hear how solid these guys are technically and to our customers and our partners. Thank you. We look forward to seeing you next month. With that said.55:41Have a nice day.56:01